52 files changed, 1495 insertions, 1126 deletions
diff --git a/net/appletalk/atalk_proc.c b/net/appletalk/atalk_proc.c
index 80caad1a31a5..6ef0e761e5de 100644
--- a/net/appletalk/atalk_proc.c
+++ b/net/appletalk/atalk_proc.c
@@ -144,40 +144,16 @@ out:
        return 0;
 }
-static __inline__ struct sock *atalk_get_socket_idx(loff_t pos)
-{
-        struct sock *s;
-        struct hlist_node *node;
-        sk_for_each(s, node, &atalk_sockets)
-                if (!pos--)
-                        goto found;
-        s = NULL;
-found:
-        return s;
-}
 static void *atalk_seq_socket_start(struct seq_file *seq, loff_t *pos)
        __acquires(atalk_sockets_lock)
 {
-        loff_t l = *pos;
        read_lock_bh(&atalk_sockets_lock);
-        return l ? atalk_get_socket_idx(--l) : SEQ_START_TOKEN;
+        return seq_hlist_start_head(&atalk_sockets, *pos);
 }
 static void *atalk_seq_socket_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct sock *i;
+        return seq_hlist_next(v, &atalk_sockets, pos);
-        ++*pos;
-        if (v == SEQ_START_TOKEN) {
-                i = sk_head(&atalk_sockets);
-                goto out;
-        }
-        i = sk_next(v);
-out:
-        return i;
 }
 static void atalk_seq_socket_stop(struct seq_file *seq, void *v)
@@ -197,7 +173,7 @@ static int atalk_seq_socket_show(struct seq_file *seq, void *v)
                goto out;
        }
-        s = v;
+        s = sk_entry(v);
        at = at_sk(s);
        seq_printf(seq, "%02X   %04X:%02X:%02X  %04X:%02X:%02X  %08X:%08X "
diff --git a/net/atm/proc.c b/net/atm/proc.c
index 476779d845eb..7a96b2376bd7 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -238,7 +238,7 @@ static int atm_dev_seq_show(struct seq_file *seq, void *v)
                "Itf Type    ESI/\"MAC\"addr "
                "AAL(TX,err,RX,err,drop) ...               [refcnt]\n";
-        if (v == SEQ_START_TOKEN)
+        if (v == &atm_devs)
                seq_puts(seq, atm_dev_banner);
        else {
                struct atm_dev *dev = list_entry(v, struct atm_dev, dev_list);
diff --git a/net/atm/resources.c b/net/atm/resources.c
index 447ed89205d8..90082904f20d 100644
--- a/net/atm/resources.c
+++ b/net/atm/resources.c
@@ -444,21 +444,10 @@ done:
        return error;
 }
-static inline void *dev_get_idx(loff_t left)
-{
-        struct list_head *p;
-        list_for_each(p, &atm_devs) {
-                if (!--left)
-                        break;
-        }
-        return (p != &atm_devs) ? p : NULL;
-}
 void *atm_dev_seq_start(struct seq_file *seq, loff_t *pos)
 {
        mutex_lock(&atm_dev_mutex);
-        return *pos ? dev_get_idx(*pos) : SEQ_START_TOKEN;
+        return seq_list_start_head(&atm_devs, *pos);
 }
 void atm_dev_seq_stop(struct seq_file *seq, void *v)
@@ -468,8 +457,5 @@ void atm_dev_seq_stop(struct seq_file *seq, void *v)
 void *atm_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        ++*pos;
+        return seq_list_next(v, &atm_devs, pos);
-        v = (v == SEQ_START_TOKEN)
-                ? atm_devs.next : ((struct list_head *)v)->next;
-        return (v == &atm_devs) ? NULL : v;
 }
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 5588ba69c468..a5beedf43e2d 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1863,25 +1863,13 @@ static int ax25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 static void *ax25_info_start(struct seq_file *seq, loff_t *pos)
        __acquires(ax25_list_lock)
 {
-        struct ax25_cb *ax25;
-        struct hlist_node *node;
-        int i = 0;
        spin_lock_bh(&ax25_list_lock);
-        ax25_for_each(ax25, node, &ax25_list) {
+        return seq_hlist_start(&ax25_list, *pos);
-                if (i == *pos)
-                        return ax25;
-                ++i;
-        }
-        return NULL;
 }
 static void *ax25_info_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        ++*pos;
+        return seq_hlist_next(v, &ax25_list, pos);
-        return hlist_entry( ((struct ax25_cb *)v)->ax25_node.next,
-                            struct ax25_cb, ax25_node);
 }
 static void ax25_info_stop(struct seq_file *seq, void *v)
@@ -1892,7 +1880,7 @@ static void ax25_info_stop(struct seq_file *seq, void *v)
 static int ax25_info_show(struct seq_file *seq, void *v)
 {
-        ax25_cb *ax25 = v;
+        ax25_cb *ax25 = hlist_entry(v, struct ax25_cb, ax25_node);
        char buf[11];
        int k;
diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
index 832bcf092a01..9f13f6eefcba 100644
--- a/net/ax25/ax25_uid.c
+++ b/net/ax25/ax25_uid.c
@@ -146,31 +146,13 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
 static void *ax25_uid_seq_start(struct seq_file *seq, loff_t *pos)
        __acquires(ax25_uid_lock)
 {
-        struct ax25_uid_assoc *pt;
-        struct hlist_node *node;
-        int i = 1;
        read_lock(&ax25_uid_lock);
+        return seq_hlist_start_head(&ax25_uid_list, *pos);
-        if (*pos == 0)
-                return SEQ_START_TOKEN;
-        ax25_uid_for_each(pt, node, &ax25_uid_list) {
-                if (i == *pos)
-                        return pt;
-                ++i;
-        }
-        return NULL;
 }
 static void *ax25_uid_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        ++*pos;
+        return seq_hlist_next(v, &ax25_uid_list, pos);
-        if (v == SEQ_START_TOKEN)
-                return ax25_uid_list.first;
-        else
-                return hlist_entry(((ax25_uid_assoc *)v)->uid_node.next,
-                           ax25_uid_assoc, uid_node);
 }
 static void ax25_uid_seq_stop(struct seq_file *seq, void *v)
@@ -186,8 +168,9 @@ static int ax25_uid_seq_show(struct seq_file *seq, void *v)
        if (v == SEQ_START_TOKEN)
                seq_printf(seq, "Policy: %d\n", ax25_uid_policy);
        else {
-                struct ax25_uid_assoc *pt = v;
+                struct ax25_uid_assoc *pt;
+                pt = hlist_entry(v, struct ax25_uid_assoc, uid_node);
                seq_printf(seq, "%6d %s\n", pt->uid, ax2asc(buf, &pt->call));
        }
        return 0;
diff --git a/net/bluetooth/bnep/netdev.c b/net/bluetooth/bnep/netdev.c
index 26fb831ef7e0..b6234b73c4cf 100644
--- a/net/bluetooth/bnep/netdev.c
+++ b/net/bluetooth/bnep/netdev.c
@@ -64,7 +64,7 @@ static void bnep_net_set_mc_list(struct net_device *dev)
        struct sk_buff *skb;
        int size;
-        BT_DBG("%s mc_count %d", dev->name, dev->mc_count);
+        BT_DBG("%s mc_count %d", dev->name, netdev_mc_count(dev));
        size = sizeof(*r) + (BNEP_MAX_MULTICAST_FILTERS + 1) * ETH_ALEN * 2;
        skb  = alloc_skb(size, GFP_ATOMIC);
@@ -97,7 +97,9 @@ static void bnep_net_set_mc_list(struct net_device *dev)
                /* FIXME: We should group addresses here. */
-                for (i = 0; i < dev->mc_count && i < BNEP_MAX_MULTICAST_FILTERS; i++) {
+                for (i = 0;
+                     i < netdev_mc_count(dev) && i < BNEP_MAX_MULTICAST_FILTERS;
+                     i++) {
                        memcpy(__skb_put(skb, ETH_ALEN), dmi->dmi_addr, ETH_ALEN);
                        memcpy(__skb_put(skb, ETH_ALEN), dmi->dmi_addr, ETH_ALEN);
                        dmi = dmi->next;
diff --git a/net/core/dev.c b/net/core/dev.c
index 94c1eeed25e5..d1cf53d0d597 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4263,7 +4263,7 @@ static void dev_addr_discard(struct net_device *dev)
        netif_addr_lock_bh(dev);
        __dev_addr_discard(&dev->mc_list);
-        dev->mc_count = 0;
+        netdev_mc_count(dev) = 0;
        netif_addr_unlock_bh(dev);
 }
@@ -5419,6 +5419,8 @@ struct net_device *alloc_netdev_mq(int sizeof_priv, const char *name,
        netdev_init_queues(dev);
+        INIT_LIST_HEAD(&dev->ethtool_ntuple_list.list);
+        dev->ethtool_ntuple_list.count = 0;
        INIT_LIST_HEAD(&dev->napi_list);
        INIT_LIST_HEAD(&dev->unreg_list);
        INIT_LIST_HEAD(&dev->link_watch_list);
@@ -5455,6 +5457,9 @@ void free_netdev(struct net_device *dev)
        /* Flush device addresses */
        dev_addr_flush(dev);
+        /* Clear ethtool n-tuple list */
+        ethtool_ntuple_flush(dev);
        list_for_each_entry_safe(p, n, &dev->napi_list, dev_list)
                netif_napi_del(p);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index d8aee584e8d1..82cae3bca78d 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -120,7 +120,7 @@ int ethtool_op_set_ufo(struct net_device *dev, u32 data)
 * NETIF_F_xxx values in include/linux/netdevice.h
 */
 static const u32 flags_dup_features =
-        ETH_FLAG_LRO;
+        (ETH_FLAG_LRO | ETH_FLAG_NTUPLE);
 u32 ethtool_op_get_flags(struct net_device *dev)
 {
@@ -134,19 +134,42 @@ u32 ethtool_op_get_flags(struct net_device *dev)
 int ethtool_op_set_flags(struct net_device *dev, u32 data)
 {
+        const struct ethtool_ops *ops = dev->ethtool_ops;
        if (data & ETH_FLAG_LRO)
                dev->features |= NETIF_F_LRO;
        else
                dev->features &= ~NETIF_F_LRO;
+        if (data & ETH_FLAG_NTUPLE) {
+                if (!ops->set_rx_ntuple)
+                        return -EOPNOTSUPP;
+                dev->features |= NETIF_F_NTUPLE;
+        } else {
+                /* safe to clear regardless */
+                dev->features &= ~NETIF_F_NTUPLE;
+        }
        return 0;
 }
+void ethtool_ntuple_flush(struct net_device *dev)
+{
+        struct ethtool_rx_ntuple_flow_spec_container *fsc, *f;
+        list_for_each_entry_safe(fsc, f, &dev->ethtool_ntuple_list.list, list) {
+                list_del(&fsc->list);
+                kfree(fsc);
+        }
+        dev->ethtool_ntuple_list.count = 0;
+}
+EXPORT_SYMBOL(ethtool_ntuple_flush);
 /* Handlers for each ethtool command */
 static int ethtool_get_settings(struct net_device *dev, void __user *useraddr)
 {
-        struct ethtool_cmd cmd = { ETHTOOL_GSET };
+        struct ethtool_cmd cmd = { .cmd = ETHTOOL_GSET };
        int err;
        if (!dev->ethtool_ops->get_settings)
@@ -174,7 +197,10 @@ static int ethtool_set_settings(struct net_device *dev, void __user *useraddr)
        return dev->ethtool_ops->set_settings(dev, &cmd);
 }
-static int ethtool_get_drvinfo(struct net_device *dev, void __user *useraddr)
+/*
+ * noinline attribute so that gcc doesnt use too much stack in dev_ethtool()
+ */
+static noinline int ethtool_get_drvinfo(struct net_device *dev, void __user *useraddr)
 {
        struct ethtool_drvinfo info;
        const struct ethtool_ops *ops = dev->ethtool_ops;
@@ -209,7 +235,10 @@ static int ethtool_get_drvinfo(struct net_device *dev, void __user *useraddr)
        return 0;
 }
-static int ethtool_set_rxnfc(struct net_device *dev, void __user *useraddr)
+/*
+ * noinline attribute so that gcc doesnt use too much stack in dev_ethtool()
+ */
+static noinline int ethtool_set_rxnfc(struct net_device *dev, void __user *useraddr)
 {
        struct ethtool_rxnfc cmd;
@@ -222,7 +251,10 @@ static int ethtool_set_rxnfc(struct net_device *dev, void __user *useraddr)
        return dev->ethtool_ops->set_rxnfc(dev, &cmd);
 }
-static int ethtool_get_rxnfc(struct net_device *dev, void __user *useraddr)
+/*
+ * noinline attribute so that gcc doesnt use too much stack in dev_ethtool()
+ */
+static noinline int ethtool_get_rxnfc(struct net_device *dev, void __user *useraddr)
 {
        struct ethtool_rxnfc info;
        const struct ethtool_ops *ops = dev->ethtool_ops;
@@ -266,6 +298,315 @@ err_out:
        return ret;
 }
+static void __rx_ntuple_filter_add(struct ethtool_rx_ntuple_list *list,
+                              struct ethtool_rx_ntuple_flow_spec *spec,
+                              struct ethtool_rx_ntuple_flow_spec_container *fsc)
+{
+        /* don't add filters forever */
+        if (list->count >= ETHTOOL_MAX_NTUPLE_LIST_ENTRY) {
+                /* free the container */
+                kfree(fsc);
+                return;
+        }
+        /* Copy the whole filter over */
+        fsc->fs.flow_type = spec->flow_type;
+        memcpy(&fsc->fs.h_u, &spec->h_u, sizeof(spec->h_u));
+        memcpy(&fsc->fs.m_u, &spec->m_u, sizeof(spec->m_u));
+        fsc->fs.vlan_tag = spec->vlan_tag;
+        fsc->fs.vlan_tag_mask = spec->vlan_tag_mask;
+        fsc->fs.data = spec->data;
+        fsc->fs.data_mask = spec->data_mask;
+        fsc->fs.action = spec->action;
+        /* add to the list */
+        list_add_tail_rcu(&fsc->list, &list->list);
+        list->count++;
+}
+/*
+ * noinline attribute so that gcc doesnt use too much stack in dev_ethtool()
+ */
+static noinline int ethtool_set_rx_ntuple(struct net_device *dev, void __user *useraddr)
+{
+        struct ethtool_rx_ntuple cmd;
+        const struct ethtool_ops *ops = dev->ethtool_ops;
+        struct ethtool_rx_ntuple_flow_spec_container *fsc = NULL;
+        int ret;
+        if (!(dev->features & NETIF_F_NTUPLE))
+                return -EINVAL;
+        if (copy_from_user(&cmd, useraddr, sizeof(cmd)))
+                return -EFAULT;
+        /*
+         * Cache filter in dev struct for GET operation only if
+         * the underlying driver doesn't have its own GET operation, and
+         * only if the filter was added successfully.  First make sure we
+         * can allocate the filter, then continue if successful.
+         */
+        if (!ops->get_rx_ntuple) {
+                fsc = kmalloc(sizeof(*fsc), GFP_ATOMIC);
+                if (!fsc)
+                        return -ENOMEM;
+        }
+        ret = ops->set_rx_ntuple(dev, &cmd);
+        if (ret) {
+                kfree(fsc);
+                return ret;
+        }
+        if (!ops->get_rx_ntuple)
+                __rx_ntuple_filter_add(&dev->ethtool_ntuple_list, &cmd.fs, fsc);
+        return ret;
+}
+static int ethtool_get_rx_ntuple(struct net_device *dev, void __user *useraddr)
+{
+        struct ethtool_gstrings gstrings;
+        const struct ethtool_ops *ops = dev->ethtool_ops;
+        struct ethtool_rx_ntuple_flow_spec_container *fsc;
+        u8 *data;
+        char *p;
+        int ret, i, num_strings = 0;
+        if (!ops->get_sset_count)
+                return -EOPNOTSUPP;
+        if (copy_from_user(&gstrings, useraddr, sizeof(gstrings)))
+                return -EFAULT;
+        ret = ops->get_sset_count(dev, gstrings.string_set);
+        if (ret < 0)
+                return ret;
+        gstrings.len = ret;
+        data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER);
+        if (!data)
+                return -ENOMEM;
+        if (ops->get_rx_ntuple) {
+                /* driver-specific filter grab */
+                ret = ops->get_rx_ntuple(dev, gstrings.string_set, data);
+                goto copy;
+        }
+        /* default ethtool filter grab */
+        i = 0;
+        p = (char *)data;
+        list_for_each_entry(fsc, &dev->ethtool_ntuple_list.list, list) {
+                sprintf(p, "Filter %d:\n", i);
+                p += ETH_GSTRING_LEN;
+                num_strings++;
+                switch (fsc->fs.flow_type) {
+                case TCP_V4_FLOW:
+                        sprintf(p, "\tFlow Type: TCP\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case UDP_V4_FLOW:
+                        sprintf(p, "\tFlow Type: UDP\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case SCTP_V4_FLOW:
+                        sprintf(p, "\tFlow Type: SCTP\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case AH_ESP_V4_FLOW:
+                        sprintf(p, "\tFlow Type: AH ESP\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case ESP_V4_FLOW:
+                        sprintf(p, "\tFlow Type: ESP\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case IP_USER_FLOW:
+                        sprintf(p, "\tFlow Type: Raw IP\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case IPV4_FLOW:
+                        sprintf(p, "\tFlow Type: IPv4\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                default:
+                        sprintf(p, "\tFlow Type: Unknown\n");
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        goto unknown_filter;
+                };
+                /* now the rest of the filters */
+                switch (fsc->fs.flow_type) {
+                case TCP_V4_FLOW:
+                case UDP_V4_FLOW:
+                case SCTP_V4_FLOW:
+                        sprintf(p, "\tSrc IP addr: 0x%x\n",
+                                fsc->fs.h_u.tcp_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tSrc IP mask: 0x%x\n",
+                                fsc->fs.m_u.tcp_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP addr: 0x%x\n",
+                                fsc->fs.h_u.tcp_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP mask: 0x%x\n",
+                                fsc->fs.m_u.tcp_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tSrc Port: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.tcp_ip4_spec.psrc,
+                                fsc->fs.m_u.tcp_ip4_spec.psrc);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest Port: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.tcp_ip4_spec.pdst,
+                                fsc->fs.m_u.tcp_ip4_spec.pdst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tTOS: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.tcp_ip4_spec.tos,
+                                fsc->fs.m_u.tcp_ip4_spec.tos);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case AH_ESP_V4_FLOW:
+                case ESP_V4_FLOW:
+                        sprintf(p, "\tSrc IP addr: 0x%x\n",
+                                fsc->fs.h_u.ah_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tSrc IP mask: 0x%x\n",
+                                fsc->fs.m_u.ah_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP addr: 0x%x\n",
+                                fsc->fs.h_u.ah_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP mask: 0x%x\n",
+                                fsc->fs.m_u.ah_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tSPI: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.ah_ip4_spec.spi,
+                                fsc->fs.m_u.ah_ip4_spec.spi);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tTOS: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.ah_ip4_spec.tos,
+                                fsc->fs.m_u.ah_ip4_spec.tos);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case IP_USER_FLOW:
+                        sprintf(p, "\tSrc IP addr: 0x%x\n",
+                                fsc->fs.h_u.raw_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tSrc IP mask: 0x%x\n",
+                                fsc->fs.m_u.raw_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP addr: 0x%x\n",
+                                fsc->fs.h_u.raw_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP mask: 0x%x\n",
+                                fsc->fs.m_u.raw_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                case IPV4_FLOW:
+                        sprintf(p, "\tSrc IP addr: 0x%x\n",
+                                fsc->fs.h_u.usr_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tSrc IP mask: 0x%x\n",
+                                fsc->fs.m_u.usr_ip4_spec.ip4src);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP addr: 0x%x\n",
+                                fsc->fs.h_u.usr_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tDest IP mask: 0x%x\n",
+                                fsc->fs.m_u.usr_ip4_spec.ip4dst);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tL4 bytes: 0x%x, mask: 0x%x\n",
+                                fsc->fs.h_u.usr_ip4_spec.l4_4_bytes,
+                                fsc->fs.m_u.usr_ip4_spec.l4_4_bytes);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tTOS: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.usr_ip4_spec.tos,
+                                fsc->fs.m_u.usr_ip4_spec.tos);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tIP Version: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.usr_ip4_spec.ip_ver,
+                                fsc->fs.m_u.usr_ip4_spec.ip_ver);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        sprintf(p, "\tProtocol: %d, mask: 0x%x\n",
+                                fsc->fs.h_u.usr_ip4_spec.proto,
+                                fsc->fs.m_u.usr_ip4_spec.proto);
+                        p += ETH_GSTRING_LEN;
+                        num_strings++;
+                        break;
+                };
+                sprintf(p, "\tVLAN: %d, mask: 0x%x\n",
+                        fsc->fs.vlan_tag, fsc->fs.vlan_tag_mask);
+                p += ETH_GSTRING_LEN;
+                num_strings++;
+                sprintf(p, "\tUser-defined: 0x%Lx\n", fsc->fs.data);
+                p += ETH_GSTRING_LEN;
+                num_strings++;
+                sprintf(p, "\tUser-defined mask: 0x%Lx\n", fsc->fs.data_mask);
+                p += ETH_GSTRING_LEN;
+                num_strings++;
+                if (fsc->fs.action == ETHTOOL_RXNTUPLE_ACTION_DROP)
+                        sprintf(p, "\tAction: Drop\n");
+                else
+                        sprintf(p, "\tAction: Direct to queue %d\n",
+                                fsc->fs.action);
+                p += ETH_GSTRING_LEN;
+                num_strings++;
+unknown_filter:
+                i++;
+        }
+copy:
+        /* indicate to userspace how many strings we actually have */
+        gstrings.len = num_strings;
+        ret = -EFAULT;
+        if (copy_to_user(useraddr, &gstrings, sizeof(gstrings)))
+                goto out;
+        useraddr += sizeof(gstrings);
+        if (copy_to_user(useraddr, data, gstrings.len * ETH_GSTRING_LEN))
+                goto out;
+        ret = 0;
+out:
+        kfree(data);
+        return ret;
+}
 static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
 {
        struct ethtool_regs regs;
@@ -313,6 +654,9 @@ static int ethtool_reset(struct net_device *dev, char __user *useraddr)
        if (copy_from_user(&reset, useraddr, sizeof(reset)))
                return -EFAULT;
+        /* Clear ethtool n-tuple list */
+        ethtool_ntuple_flush(dev);
        ret = dev->ethtool_ops->reset(dev, &reset.data);
        if (ret)
                return ret;
@@ -324,7 +668,7 @@ static int ethtool_reset(struct net_device *dev, char __user *useraddr)
 static int ethtool_get_wol(struct net_device *dev, char __user *useraddr)
 {
-        struct ethtool_wolinfo wol = { ETHTOOL_GWOL };
+        struct ethtool_wolinfo wol = { .cmd = ETHTOOL_GWOL };
        if (!dev->ethtool_ops->get_wol)
                return -EOPNOTSUPP;
@@ -456,9 +800,12 @@ static int ethtool_set_eeprom(struct net_device *dev, void __user *useraddr)
        return ret;
 }
-static int ethtool_get_coalesce(struct net_device *dev, void __user *useraddr)
+/*
+ * noinline attribute so that gcc doesnt use too much stack in dev_ethtool()
+ */
+static noinline int ethtool_get_coalesce(struct net_device *dev, void __user *useraddr)
 {
-        struct ethtool_coalesce coalesce = { ETHTOOL_GCOALESCE };
+        struct ethtool_coalesce coalesce = { .cmd = ETHTOOL_GCOALESCE };
        if (!dev->ethtool_ops->get_coalesce)
                return -EOPNOTSUPP;
@@ -470,7 +817,10 @@ static int ethtool_get_coalesce(struct net_device *dev, void __user *useraddr)
        return 0;
 }
-static int ethtool_set_coalesce(struct net_device *dev, void __user *useraddr)
+/*
+ * noinline attribute so that gcc doesnt use too much stack in dev_ethtool()
+ */
+static noinline int ethtool_set_coalesce(struct net_device *dev, void __user *useraddr)
 {
        struct ethtool_coalesce coalesce;
@@ -485,7 +835,7 @@ static int ethtool_set_coalesce(struct net_device *dev, void __user *useraddr)
 static int ethtool_get_ringparam(struct net_device *dev, void __user *useraddr)
 {
-        struct ethtool_ringparam ringparam = { ETHTOOL_GRINGPARAM };
+        struct ethtool_ringparam ringparam = { .cmd = ETHTOOL_GRINGPARAM };
        if (!dev->ethtool_ops->get_ringparam)
                return -EOPNOTSUPP;
@@ -839,7 +1189,7 @@ static int ethtool_get_perm_addr(struct net_device *dev, void __user *useraddr)
 static int ethtool_get_value(struct net_device *dev, char __user *useraddr,
                             u32 cmd, u32 (*actor)(struct net_device *))
 {
-        struct ethtool_value edata = { cmd };
+        struct ethtool_value edata = { .cmd = cmd };
        if (!actor)
                return -EOPNOTSUPP;
@@ -880,7 +1230,10 @@ static int ethtool_set_value(struct net_device *dev, char __user *useraddr,
        return actor(dev, edata.data);
 }
-static int ethtool_flash_device(struct net_device *dev, char __user *useraddr)
+/*
+ * noinline attribute so that gcc doesnt use too much stack in dev_ethtool()
+ */
+static noinline int ethtool_flash_device(struct net_device *dev, char __user *useraddr)
 {
        struct ethtool_flash efl;
@@ -1112,6 +1465,12 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
        case ETHTOOL_RESET:
                rc = ethtool_reset(dev, useraddr);
                break;
+        case ETHTOOL_SRXNTUPLE:
+                rc = ethtool_set_rx_ntuple(dev, useraddr);
+                break;
+        case ETHTOOL_GRXNTUPLE:
+                rc = ethtool_get_rx_ntuple(dev, useraddr);
+                break;
        default:
                rc = -EOPNOTSUPP;
        }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 62f3878a6010..42da96a4eeee 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -35,6 +35,7 @@
 #include <linux/security.h>
 #include <linux/mutex.h>
 #include <linux/if_addr.h>
+#include <linux/pci.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -580,6 +581,15 @@ static void copy_rtnl_link_stats(struct rtnl_link_stats *a,
        a->tx_compressed = b->tx_compressed;
 };
+static inline int rtnl_vfinfo_size(const struct net_device *dev)
+{
+        if (dev->dev.parent && dev_is_pci(dev->dev.parent))
+                return dev_num_vf(dev->dev.parent) *
+                        sizeof(struct ifla_vf_info);
+        else
+                return 0;
+}
 static inline size_t if_nlmsg_size(const struct net_device *dev)
 {
        return NLMSG_ALIGN(sizeof(struct ifinfomsg))
@@ -597,6 +607,8 @@ static inline size_t if_nlmsg_size(const struct net_device *dev)
               + nla_total_size(4) /* IFLA_MASTER */
               + nla_total_size(1) /* IFLA_OPERSTATE */
               + nla_total_size(1) /* IFLA_LINKMODE */
+               + nla_total_size(4) /* IFLA_NUM_VF */
+               + nla_total_size(rtnl_vfinfo_size(dev)) /* IFLA_VFINFO */
               + rtnl_link_get_size(dev); /* IFLA_LINKINFO */
 }
@@ -665,6 +677,17 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
        stats = dev_get_stats(dev);
        copy_rtnl_link_stats(nla_data(attr), stats);
+        if (dev->netdev_ops->ndo_get_vf_config && dev->dev.parent) {
+                int i;
+                struct ifla_vf_info ivi;
+                NLA_PUT_U32(skb, IFLA_NUM_VF, dev_num_vf(dev->dev.parent));
+                for (i = 0; i < dev_num_vf(dev->dev.parent); i++) {
+                        if (dev->netdev_ops->ndo_get_vf_config(dev, i, &ivi))
+                                break;
+                        NLA_PUT(skb, IFLA_VFINFO, sizeof(ivi), &ivi);
+                }
+        }
        if (dev->rtnl_link_ops) {
                if (rtnl_link_fill(skb, dev) < 0)
                        goto nla_put_failure;
@@ -725,6 +748,12 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
        [IFLA_LINKINFO]         = { .type = NLA_NESTED },
        [IFLA_NET_NS_PID]       = { .type = NLA_U32 },
        [IFLA_IFALIAS]          = { .type = NLA_STRING, .len = IFALIASZ-1 },
+        [IFLA_VF_MAC]           = { .type = NLA_BINARY,
+                                    .len = sizeof(struct ifla_vf_mac) },
+        [IFLA_VF_VLAN]          = { .type = NLA_BINARY,
+                                    .len = sizeof(struct ifla_vf_vlan) },
+        [IFLA_VF_TX_RATE]       = { .type = NLA_BINARY,
+                                    .len = sizeof(struct ifla_vf_tx_rate) },
 };
 EXPORT_SYMBOL(ifla_policy);
@@ -898,6 +927,44 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
                write_unlock_bh(&dev_base_lock);
        }
+        if (tb[IFLA_VF_MAC]) {
+                struct ifla_vf_mac *ivm;
+                ivm = nla_data(tb[IFLA_VF_MAC]);
+                write_lock_bh(&dev_base_lock);
+                if (ops->ndo_set_vf_mac)
+                        err = ops->ndo_set_vf_mac(dev, ivm->vf, ivm->mac);
+                write_unlock_bh(&dev_base_lock);
+                if (err < 0)
+                        goto errout;
+                modified = 1;
+        }
+        if (tb[IFLA_VF_VLAN]) {
+                struct ifla_vf_vlan *ivv;
+                ivv = nla_data(tb[IFLA_VF_VLAN]);
+                write_lock_bh(&dev_base_lock);
+                if (ops->ndo_set_vf_vlan)
+                        err = ops->ndo_set_vf_vlan(dev, ivv->vf,
+                                                   (u16)ivv->vlan,
+                                                   (u8)ivv->qos);
+                write_unlock_bh(&dev_base_lock);
+                if (err < 0)
+                        goto errout;
+                modified = 1;
+        }
+        err = 0;
+        if (tb[IFLA_VF_TX_RATE]) {
+                struct ifla_vf_tx_rate *ivt;
+                ivt = nla_data(tb[IFLA_VF_TX_RATE]);
+                write_lock_bh(&dev_base_lock);
+                if (ops->ndo_set_vf_tx_rate)
+                        err = ops->ndo_set_vf_tx_rate(dev, ivt->vf, ivt->rate);
+                write_unlock_bh(&dev_base_lock);
+                if (err < 0)
+                        goto errout;
+                modified = 1;
+        }
        err = 0;
 errout:
diff --git a/net/dccp/ccid.c b/net/dccp/ccid.c
index ff16e9df1969..49d27c556bec 100644
--- a/net/dccp/ccid.c
+++ b/net/dccp/ccid.c
@@ -63,14 +63,13 @@ int ccid_getsockopt_builtin_ccids(struct sock *sk, int len,
        u8 *ccid_array, array_len;
        int err = 0;
-        if (len < ARRAY_SIZE(ccids))
-                return -EINVAL;
        if (ccid_get_builtin_ccids(&ccid_array, &array_len))
                return -ENOBUFS;
-        if (put_user(array_len, optlen) ||
+        if (put_user(array_len, optlen))
-            copy_to_user(optval, ccid_array, array_len))
+                err = -EFAULT;
+        else if (len > 0 && copy_to_user(optval, ccid_array,
+                                         len > array_len ? array_len : len))
                err = -EFAULT;
        kfree(ccid_array);
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 671cd1413d59..85ec1cb7fd41 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -835,6 +835,8 @@ verify_sock_status:
                        len = -EFAULT;
                        break;
                }
+                if (flags & MSG_TRUNC)
+                        len = skb->len;
        found_fin_ok:
                if (!(flags & MSG_PEEK))
                        sk_eat_skb(sk, skb, 0);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index d28363998743..63bf298ca109 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -946,7 +946,6 @@ int igmp_rcv(struct sk_buff *skb)
                break;
        case IGMP_HOST_MEMBERSHIP_REPORT:
        case IGMPV2_HOST_MEMBERSHIP_REPORT:
-        case IGMPV3_HOST_MEMBERSHIP_REPORT:
                /* Is it our report looped back? */
                if (skb_rtable(skb)->fl.iif == 0)
                        break;
@@ -960,6 +959,7 @@ int igmp_rcv(struct sk_buff *skb)
                in_dev_put(in_dev);
                return pim_rcv_v1(skb);
 #endif
+        case IGMPV3_HOST_MEMBERSHIP_REPORT:
        case IGMP_DVMRP:
        case IGMP_TRACE:
        case IGMP_HOST_LEAVE_MESSAGE:
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 28e029632493..3fddc69ccccc 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5783,11 +5783,9 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                                /* tcp_ack considers this ACK as duplicate
                                 * and does not calculate rtt.
-                                 * Fix it at least with timestamps.
+                                 * Force it here.
                                 */
-                                if (tp->rx_opt.saw_tstamp &&
+                                tcp_ack_update_rtt(sk, 0, 0);
-                                    tp->rx_opt.rcv_tsecr && !tp->srtt)
-                                        tcp_ack_saw_tstamp(sk, 0);
                                if (tp->rx_opt.tstamp_ok)
                                        tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 4f7d2122d818..608a5446d05b 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1117,7 +1117,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        struct inet_sock *inet = inet_sk(sk);
        struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
        struct sk_buff *skb;
-        unsigned int ulen, copied;
+        unsigned int ulen;
        int peeked;
        int err;
        int is_udplite = IS_UDPLITE(sk);
@@ -1138,10 +1138,9 @@ try_again:
                goto out;
        ulen = skb->len - sizeof(struct udphdr);
-        copied = len;
+        if (len > ulen)
-        if (copied > ulen)
+                len = ulen;
-                copied = ulen;
+        else if (len < ulen)
-        else if (copied < ulen)
                msg->msg_flags |= MSG_TRUNC;
        /*
@@ -1150,14 +1149,14 @@ try_again:
         * coverage checksum (UDP-Lite), do it before the copy.
         */
-        if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+        if (len < ulen || UDP_SKB_CB(skb)->partial_cov) {
                if (udp_lib_checksum_complete(skb))
                        goto csum_copy_err;
        }
        if (skb_csum_unnecessary(skb))
                err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
-                                              msg->msg_iov, copied);
+                                              msg->msg_iov, len);
        else {
                err = skb_copy_and_csum_datagram_iovec(skb,
                                                       sizeof(struct udphdr),
@@ -1186,7 +1185,7 @@ try_again:
        if (inet->cmsg_flags)
                ip_cmsg_recv(msg, skb);
-        err = copied;
+        err = len;
        if (flags & MSG_TRUNC)
                err = ulen;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 1593289155ff..764ad37ca070 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2646,7 +2646,8 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                write_lock_bh(&addrconf_hash_lock);
                while ((ifa = *bifa) != NULL) {
-                        if (ifa->idev == idev) {
+                        if (ifa->idev == idev &&
+                            (how || !(ifa->flags&IFA_F_PERMANENT))) {
                                *bifa = ifa->lst_next;
                                ifa->lst_next = NULL;
                                addrconf_del_timer(ifa);
@@ -2686,18 +2687,30 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                write_lock_bh(&idev->lock);
        }
 #endif
-        while ((ifa = idev->addr_list) != NULL) {
+        bifa = &idev->addr_list;
-                idev->addr_list = ifa->if_next;
+        while ((ifa = *bifa) != NULL) {
-                ifa->if_next = NULL;
+                if (how == 0 && (ifa->flags&IFA_F_PERMANENT)) {
-                ifa->dead = 1;
+                        /* Retain permanent address on admin down */
-                addrconf_del_timer(ifa);
+                        bifa = &ifa->if_next;
-                write_unlock_bh(&idev->lock);
+                        /* Restart DAD if needed when link comes back up */
+                        if ( !((dev->flags&(IFF_NOARP|IFF_LOOPBACK)) ||
+                               idev->cnf.accept_dad <= 0 ||
+                               (ifa->flags & IFA_F_NODAD)))
+                                ifa->flags |= IFA_F_TENTATIVE;
+                } else {
+                        *bifa = ifa->if_next;
+                        ifa->if_next = NULL;
-                __ipv6_ifa_notify(RTM_DELADDR, ifa);
+                        ifa->dead = 1;
-                atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifa);
+                        write_unlock_bh(&idev->lock);
-                in6_ifa_put(ifa);
-                write_lock_bh(&idev->lock);
+                        __ipv6_ifa_notify(RTM_DELADDR, ifa);
+                        atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifa);
+                        in6_ifa_put(ifa);
+                        write_lock_bh(&idev->lock);
+                }
        }
        write_unlock_bh(&idev->lock);
@@ -2789,14 +2802,14 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
        read_lock_bh(&idev->lock);
        if (ifp->dead)
                goto out;
-        spin_lock_bh(&ifp->lock);
+        spin_lock(&ifp->lock);
        if (dev->flags&(IFF_NOARP|IFF_LOOPBACK) ||
            idev->cnf.accept_dad < 1 ||
            !(ifp->flags&IFA_F_TENTATIVE) ||
            ifp->flags & IFA_F_NODAD) {
                ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
-                spin_unlock_bh(&ifp->lock);
+                spin_unlock(&ifp->lock);
                read_unlock_bh(&idev->lock);
                addrconf_dad_completed(ifp);
@@ -2804,7 +2817,7 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
        }
        if (!(idev->if_flags & IF_READY)) {
-                spin_unlock_bh(&ifp->lock);
+                spin_unlock(&ifp->lock);
                read_unlock_bh(&idev->lock);
                /*
                 * If the device is not ready:
@@ -2824,7 +2837,7 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
                ip6_ins_rt(ifp->rt);
        addrconf_dad_kick(ifp);
-        spin_unlock_bh(&ifp->lock);
+        spin_unlock(&ifp->lock);
 out:
        read_unlock_bh(&idev->lock);
 }
@@ -2840,14 +2853,15 @@ static void addrconf_dad_timer(unsigned long data)
                read_unlock_bh(&idev->lock);
                goto out;
        }
-        spin_lock_bh(&ifp->lock);
+        spin_lock(&ifp->lock);
        if (ifp->probes == 0) {
                /*
                 * DAD was successful
                 */
                ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
-                spin_unlock_bh(&ifp->lock);
+                spin_unlock(&ifp->lock);
                read_unlock_bh(&idev->lock);
                addrconf_dad_completed(ifp);
@@ -2857,7 +2871,7 @@ static void addrconf_dad_timer(unsigned long data)
        ifp->probes--;
        addrconf_mod_timer(ifp, AC_DAD, ifp->idev->nd_parms->retrans_time);
-        spin_unlock_bh(&ifp->lock);
+        spin_unlock(&ifp->lock);
        read_unlock_bh(&idev->lock);
        /* send a neighbour solicitation for our addr */
@@ -2905,12 +2919,12 @@ static void addrconf_dad_run(struct inet6_dev *idev) {
        read_lock_bh(&idev->lock);
        for (ifp = idev->addr_list; ifp; ifp = ifp->if_next) {
-                spin_lock_bh(&ifp->lock);
+                spin_lock(&ifp->lock);
                if (!(ifp->flags & IFA_F_TENTATIVE)) {
-                        spin_unlock_bh(&ifp->lock);
+                        spin_unlock(&ifp->lock);
                        continue;
                }
-                spin_unlock_bh(&ifp->lock);
+                spin_unlock(&ifp->lock);
                addrconf_dad_kick(ifp);
        }
        read_unlock_bh(&idev->lock);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index f626ea2b304f..77e122f53ea6 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -319,12 +319,26 @@ static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb,
        w->root = &table->tb6_root;
        if (cb->args[4] == 0) {
+                w->count = 0;
+                w->skip = 0;
                read_lock_bh(&table->tb6_lock);
                res = fib6_walk(w);
                read_unlock_bh(&table->tb6_lock);
-                if (res > 0)
+                if (res > 0) {
                        cb->args[4] = 1;
+                        cb->args[5] = w->root->fn_sernum;
+                }
        } else {
+                if (cb->args[5] != w->root->fn_sernum) {
+                        /* Begin at the root if the tree changed */
+                        cb->args[5] = w->root->fn_sernum;
+                        w->state = FWS_INIT;
+                        w->node = w->root;
+                        w->skip = w->count;
+                } else
+                        w->skip = 0;
                read_lock_bh(&table->tb6_lock);
                res = fib6_walk_continue(w);
                read_unlock_bh(&table->tb6_lock);
@@ -1250,9 +1264,18 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                        w->leaf = fn->leaf;
                case FWS_C:
                        if (w->leaf && fn->fn_flags&RTN_RTINFO) {
-                                int err = w->func(w);
+                                int err;
+                                if (w->count < w->skip) {
+                                        w->count++;
+                                        continue;
+                                }
+                                err = w->func(w);
                                if (err)
                                        return err;
+                                w->count++;
                                continue;
                        }
                        w->state = FWS_U;
@@ -1346,6 +1369,8 @@ static void fib6_clean_tree(struct net *net, struct fib6_node *root,
        c.w.root = root;
        c.w.func = fib6_clean_node;
        c.w.prune = prune;
+        c.w.count = 0;
+        c.w.skip = 0;
        c.func = func;
        c.arg = arg;
        c.net = net;
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index d93812d09c13..b2847ed6a7d9 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -237,8 +237,7 @@ out:
 }
 static __inline__ struct frag_queue *
-fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst,
+fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst)
-        struct inet6_dev *idev)
 {
        struct inet_frag_queue *q;
        struct ip6_create_arg arg;
@@ -254,13 +253,9 @@ fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst,
        q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash);
        if (q == NULL)
-                goto oom;
+                return NULL;
        return container_of(q, struct frag_queue, q);
-oom:
-        IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_REASMFAILS);
-        return NULL;
 }
 static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
@@ -606,8 +601,8 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
        if (atomic_read(&net->ipv6.frags.mem) > net->ipv6.frags.high_thresh)
                ip6_evictor(net, ip6_dst_idev(skb_dst(skb)));
-        if ((fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr,
+        fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr);
-                          ip6_dst_idev(skb_dst(skb)))) != NULL) {
+        if (fq != NULL) {
                int ret;
                spin_lock(&fq->q.lock);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 34efb3589ffa..a7af9d68cd6c 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -322,7 +322,7 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct inet_sock *inet = inet_sk(sk);
        struct sk_buff *skb;
-        unsigned int ulen, copied;
+        unsigned int ulen;
        int peeked;
        int err;
        int is_udplite = IS_UDPLITE(sk);
@@ -341,10 +341,9 @@ try_again:
                goto out;
        ulen = skb->len - sizeof(struct udphdr);
-        copied = len;
+        if (len > ulen)
-        if (copied > ulen)
+                len = ulen;
-                copied = ulen;
+        else if (len < ulen)
-        else if (copied < ulen)
                msg->msg_flags |= MSG_TRUNC;
        is_udp4 = (skb->protocol == htons(ETH_P_IP));
@@ -355,14 +354,14 @@ try_again:
         * coverage checksum (UDP-Lite), do it before the copy.
         */
-        if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+        if (len < ulen || UDP_SKB_CB(skb)->partial_cov) {
                if (udp_lib_checksum_complete(skb))
                        goto csum_copy_err;
        }
        if (skb_csum_unnecessary(skb))
                err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
-                                              msg->msg_iov, copied       );
+                                              msg->msg_iov,len);
        else {
                err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
                if (err == -EINVAL)
@@ -411,7 +410,7 @@ try_again:
                        datagram_recv_ctl(sk, msg, skb);
        }
-        err = copied;
+        err = len;
        if (flags & MSG_TRUNC)
                err = ulen;
diff --git a/net/ipx/ipx_proc.c b/net/ipx/ipx_proc.c
index 576178482f89..26b5bfcf1d03 100644
--- a/net/ipx/ipx_proc.c
+++ b/net/ipx/ipx_proc.c
@@ -13,45 +13,15 @@
 #include <net/tcp_states.h>
 #include <net/ipx.h>
-static __inline__ struct ipx_interface *ipx_get_interface_idx(loff_t pos)
-{
-        struct ipx_interface *i;
-        list_for_each_entry(i, &ipx_interfaces, node)
-                if (!pos--)
-                        goto out;
-        i = NULL;
-out:
-        return i;
-}
-static struct ipx_interface *ipx_interfaces_next(struct ipx_interface *i)
-{
-        struct ipx_interface *rc = NULL;
-        if (i->node.next != &ipx_interfaces)
-                rc = list_entry(i->node.next, struct ipx_interface, node);
-        return rc;
-}
 static void *ipx_seq_interface_start(struct seq_file *seq, loff_t *pos)
 {
-        loff_t l = *pos;
        spin_lock_bh(&ipx_interfaces_lock);
-        return l ? ipx_get_interface_idx(--l) : SEQ_START_TOKEN;
+        return seq_list_start_head(&ipx_interfaces, *pos);
 }
 static void *ipx_seq_interface_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct ipx_interface *i;
+        return seq_list_next(v, &ipx_interfaces, pos);
-        ++*pos;
-        if (v == SEQ_START_TOKEN)
-                i = ipx_interfaces_head();
-        else
-                i = ipx_interfaces_next(v);
-        return i;
 }
 static void ipx_seq_interface_stop(struct seq_file *seq, void *v)
@@ -63,7 +33,7 @@ static int ipx_seq_interface_show(struct seq_file *seq, void *v)
 {
        struct ipx_interface *i;
-        if (v == SEQ_START_TOKEN) {
+        if (v == &ipx_interfaces) {
                seq_puts(seq, "Network    Node_Address   Primary  Device     "
                              "Frame_Type");
 #ifdef IPX_REFCNT_DEBUG
@@ -73,7 +43,7 @@ static int ipx_seq_interface_show(struct seq_file *seq, void *v)
                goto out;
        }
-        i = v;
+        i = list_entry(v, struct ipx_interface, node);
        seq_printf(seq, "%08lX   ", (unsigned long int)ntohl(i->if_netnum));
        seq_printf(seq, "%02X%02X%02X%02X%02X%02X   ",
                        i->if_node[0], i->if_node[1], i->if_node[2],
@@ -89,53 +59,15 @@ out:
        return 0;
 }
-static struct ipx_route *ipx_routes_head(void)
-{
-        struct ipx_route *rc = NULL;
-        if (!list_empty(&ipx_routes))
-                rc = list_entry(ipx_routes.next, struct ipx_route, node);
-        return rc;
-}
-static struct ipx_route *ipx_routes_next(struct ipx_route *r)
-{
-        struct ipx_route *rc = NULL;
-        if (r->node.next != &ipx_routes)
-                rc = list_entry(r->node.next, struct ipx_route, node);
-        return rc;
-}
-static __inline__ struct ipx_route *ipx_get_route_idx(loff_t pos)
-{
-        struct ipx_route *r;
-        list_for_each_entry(r, &ipx_routes, node)
-                if (!pos--)
-                        goto out;
-        r = NULL;
-out:
-        return r;
-}
 static void *ipx_seq_route_start(struct seq_file *seq, loff_t *pos)
 {
-        loff_t l = *pos;
        read_lock_bh(&ipx_routes_lock);
-        return l ? ipx_get_route_idx(--l) : SEQ_START_TOKEN;
+        return seq_list_start_head(&ipx_routes, *pos);
 }
 static void *ipx_seq_route_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct ipx_route *r;
+        return seq_list_next(v, &ipx_routes, pos);
-        ++*pos;
-        if (v == SEQ_START_TOKEN)
-                r = ipx_routes_head();
-        else
-                r = ipx_routes_next(v);
-        return r;
 }
 static void ipx_seq_route_stop(struct seq_file *seq, void *v)
@@ -147,11 +79,13 @@ static int ipx_seq_route_show(struct seq_file *seq, void *v)
 {
        struct ipx_route *rt;
-        if (v == SEQ_START_TOKEN) {
+        if (v == &ipx_routes) {
                seq_puts(seq, "Network    Router_Net   Router_Node\n");
                goto out;
        }
-        rt = v;
+        rt = list_entry(v, struct ipx_route, node);
        seq_printf(seq, "%08lX   ", (unsigned long int)ntohl(rt->ir_net));
        if (rt->ir_routed)
                seq_printf(seq, "%08lX     %02X%02X%02X%02X%02X%02X\n",
@@ -226,9 +160,9 @@ static void *ipx_seq_socket_next(struct seq_file *seq, void *v, loff_t *pos)
        spin_unlock_bh(&i->if_sklist_lock);
        sk = NULL;
        for (;;) {
-                i = ipx_interfaces_next(i);
+                if (i->node.next == &ipx_interfaces)
-                if (!i)
                        break;
+                i = list_entry(i->node.next, struct ipx_interface, node);
                spin_lock_bh(&i->if_sklist_lock);
                if (!hlist_empty(&i->if_sklist)) {
                        sk = sk_head(&i->if_sklist);
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index 315ead3cb926..e486dc89ea59 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -1128,34 +1128,14 @@ int irlan_extract_param(__u8 *buf, char *name, char *value, __u16 *len)
 */
 static void *irlan_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        int i = 1;
-        struct irlan_cb *self;
        rcu_read_lock();
-        if (*pos == 0)
+        return seq_list_start_head(&irlans, *pos);
-                return SEQ_START_TOKEN;
-        list_for_each_entry(self, &irlans, dev_list) {
-                if (*pos == i)
-                        return self;
-                ++i;
-        }
-        return NULL;
 }
 /* Return entry after v, and increment pos */
 static void *irlan_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct list_head *nxt;
+        return seq_list_next(v, &irlans, pos);
-        ++*pos;
-        if (v == SEQ_START_TOKEN)
-                nxt = irlans.next;
-        else
-                nxt = ((struct irlan_cb *)v)->dev_list.next;
-        return (nxt == &irlans) ? NULL
-                : list_entry(nxt, struct irlan_cb, dev_list);
 }
 /* End of reading /proc file */
@@ -1170,10 +1150,10 @@ static void irlan_seq_stop(struct seq_file *seq, void *v)
 */
 static int irlan_seq_show(struct seq_file *seq, void *v)
 {
-        if (v == SEQ_START_TOKEN)
+        if (v == &irlans)
                seq_puts(seq, "IrLAN instances:\n");
        else {
-                struct irlan_cb *self = v;
+                struct irlan_cb *self = list_entry(v, struct irlan_cb, dev_list);
                IRDA_ASSERT(self != NULL, return -1;);
                IRDA_ASSERT(self->magic == IRLAN_MAGIC, return -1;);
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index d340110f5c0c..9616c32d1076 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -321,14 +321,15 @@ static void irlan_eth_set_multicast_list(struct net_device *dev)
                /* Enable promiscuous mode */
                IRDA_WARNING("Promiscuous mode not implemented by IrLAN!\n");
        }
-        else if ((dev->flags & IFF_ALLMULTI) || dev->mc_count > HW_MAX_ADDRS) {
+        else if ((dev->flags & IFF_ALLMULTI) ||
+                 netdev_mc_count(dev) > HW_MAX_ADDRS) {
                /* Disable promiscuous mode, use normal mode. */
                IRDA_DEBUG(4, "%s(), Setting multicast filter\n", __func__ );
                /* hardware_set_filter(NULL); */
                irlan_set_multicast_filter(self, TRUE);
        }
-        else if (dev->mc_count) {
+        else if (!netdev_mc_empty(dev)) {
                IRDA_DEBUG(4, "%s(), Setting multicast filter\n", __func__ );
                /* Walk the address list, and load the filter */
                /* hardware_set_filter(dev->mc_list); */
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 41dd2cb07ef3..8b8e26a9e401 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1751,7 +1751,7 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hd
        audit_info.secid = 0;
        err = xfrm_state_flush(net, proto, &audit_info);
        if (err)
-                return err;
+                return 0;
        c.data.proto = proto;
        c.seq = hdr->sadb_msg_seq;
        c.pid = hdr->sadb_msg_pid;
@@ -2713,7 +2713,7 @@ static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, struct sadb_msg
        audit_info.secid = 0;
        err = xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info);
        if (err)
-                return err;
+                return 0;
        c.data.type = XFRM_POLICY_TYPE_MAIN;
        c.event = XFRM_MSG_FLUSHPOLICY;
        c.pid = hdr->sadb_msg_pid;
@@ -3654,9 +3654,8 @@ static const struct net_proto_family pfkey_family_ops = {
 #ifdef CONFIG_PROC_FS
 static int pfkey_seq_show(struct seq_file *f, void *v)
 {
-        struct sock *s;
+        struct sock *s = sk_entry(v);
-        s = (struct sock *)v;
        if (v == SEQ_START_TOKEN)
                seq_printf(f ,"sk       RefCnt Rmem   Wmem   User   Inode\n");
        else
@@ -3675,19 +3674,9 @@ static void *pfkey_seq_start(struct seq_file *f, loff_t *ppos)
 {
        struct net *net = seq_file_net(f);
        struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
-        struct sock *s;
-        struct hlist_node *node;
-        loff_t pos = *ppos;
        read_lock(&pfkey_table_lock);
-        if (pos == 0)
+        return seq_hlist_start_head(&net_pfkey->table, *ppos);
-                return SEQ_START_TOKEN;
-        sk_for_each(s, node, &net_pfkey->table)
-                if (pos-- == 1)
-                        return s;
-        return NULL;
 }
 static void *pfkey_seq_next(struct seq_file *f, void *v, loff_t *ppos)
@@ -3695,10 +3684,7 @@ static void *pfkey_seq_next(struct seq_file *f, void *v, loff_t *ppos)
        struct net *net = seq_file_net(f);
        struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
-        ++*ppos;
+        return seq_hlist_next(v, &net_pfkey->table, ppos);
-        return (v == SEQ_START_TOKEN) ?
-                sk_head(&net_pfkey->table) :
-                        sk_next((struct sock *)v);
 }
 static void pfkey_seq_stop(struct seq_file *f, void *v)
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 718fbcff84d2..5538e1b4a697 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -237,6 +237,14 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
            sdata->vif.type != NL80211_IFTYPE_AP)
                return -EINVAL;
+        if (test_sta_flags(sta, WLAN_STA_DISASSOC)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Disassociation is in progress. "
+                       "Denying BA session request\n");
+#endif
+                return -EINVAL;
+        }
        if (test_sta_flags(sta, WLAN_STA_SUSPEND)) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                printk(KERN_DEBUG "Suspend in progress. "
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index facf233843e0..e1731b7c2523 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -515,6 +515,8 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
                if (old)
                        memcpy(new->tail, old->tail, new_tail_len);
+        sdata->vif.bss_conf.dtim_period = new->dtim_period;
        rcu_assign_pointer(sdata->u.ap.beacon, new);
        synchronize_rcu();
@@ -747,9 +749,7 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
        layer2_update = sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
                sdata->vif.type == NL80211_IFTYPE_AP;
-        rcu_read_lock();
+        err = sta_info_insert_rcu(sta);
-        err = sta_info_insert(sta);
        if (err) {
                rcu_read_unlock();
                return err;
@@ -768,26 +768,13 @@ static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
 {
        struct ieee80211_local *local = wiphy_priv(wiphy);
        struct ieee80211_sub_if_data *sdata;
-        struct sta_info *sta;
        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        if (mac) {
+        if (mac)
-                rcu_read_lock();
+                return sta_info_destroy_addr_bss(sdata, mac);
-                sta = sta_info_get_bss(sdata, mac);
-                if (!sta) {
-                        rcu_read_unlock();
-                        return -ENOENT;
-                }
-                sta_info_unlink(&sta);
-                rcu_read_unlock();
-                sta_info_destroy(sta);
-        } else
-                sta_info_flush(local, sdata);
+        sta_info_flush(local, sdata);
        return 0;
 }
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index b3bc32b62a5a..637929b65ccc 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -250,6 +250,38 @@ static const struct file_operations uapsd_max_sp_len_ops = {
        .open = mac80211_open_file_generic
 };
+static ssize_t channel_type_read(struct file *file, char __user *user_buf,
+                       size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        const char *buf;
+        switch (local->hw.conf.channel_type) {
+        case NL80211_CHAN_NO_HT:
+                buf = "no ht\n";
+                break;
+        case NL80211_CHAN_HT20:
+                buf = "ht20\n";
+                break;
+        case NL80211_CHAN_HT40MINUS:
+                buf = "ht40-\n";
+                break;
+        case NL80211_CHAN_HT40PLUS:
+                buf = "ht40+\n";
+                break;
+        default:
+                buf = "???";
+                break;
+        }
+        return simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf));
+}
+static const struct file_operations channel_type_ops = {
+        .read = channel_type_read,
+        .open = mac80211_open_file_generic
+};
 static ssize_t queues_read(struct file *file, char __user *user_buf,
                           size_t count, loff_t *ppos)
 {
@@ -408,6 +440,7 @@ void debugfs_hw_add(struct ieee80211_local *local)
        DEBUGFS_ADD(noack);
        DEBUGFS_ADD(uapsd_queues);
        DEBUGFS_ADD(uapsd_max_sp_len);
+        DEBUGFS_ADD(channel_type);
        statsd = debugfs_create_dir("statistics", phyd);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 6c31f38ac7f5..c3d844093a2f 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -243,6 +243,40 @@ static inline void drv_sta_notify(struct ieee80211_local *local,
        trace_drv_sta_notify(local, sdata, cmd, sta);
 }
+static inline int drv_sta_add(struct ieee80211_local *local,
+                              struct ieee80211_sub_if_data *sdata,
+                              struct ieee80211_sta *sta)
+{
+        int ret = 0;
+        might_sleep();
+        if (local->ops->sta_add)
+                ret = local->ops->sta_add(&local->hw, &sdata->vif, sta);
+        else if (local->ops->sta_notify)
+                local->ops->sta_notify(&local->hw, &sdata->vif,
+                                        STA_NOTIFY_ADD, sta);
+        trace_drv_sta_add(local, sdata, sta, ret);
+        return ret;
+}
+static inline void drv_sta_remove(struct ieee80211_local *local,
+                                  struct ieee80211_sub_if_data *sdata,
+                                  struct ieee80211_sta *sta)
+{
+        might_sleep();
+        if (local->ops->sta_remove)
+                local->ops->sta_remove(&local->hw, &sdata->vif, sta);
+        else if (local->ops->sta_notify)
+                local->ops->sta_notify(&local->hw, &sdata->vif,
+                                        STA_NOTIFY_REMOVE, sta);
+        trace_drv_sta_remove(local, sdata, sta);
+}
 static inline int drv_conf_tx(struct ieee80211_local *local, u16 queue,
                              const struct ieee80211_tx_queue_params *params)
 {
@@ -256,14 +290,6 @@ static inline int drv_conf_tx(struct ieee80211_local *local, u16 queue,
        return ret;
 }
-static inline int drv_get_tx_stats(struct ieee80211_local *local,
-                                   struct ieee80211_tx_queue_stats *stats)
-{
-        int ret = local->ops->get_tx_stats(&local->hw, stats);
-        trace_drv_get_tx_stats(local, stats, ret);
-        return ret;
-}
 static inline u64 drv_get_tsf(struct ieee80211_local *local)
 {
        u64 ret = -1ULL;
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 502424b2538a..41baf730a5c7 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -545,59 +545,88 @@ TRACE_EVENT(drv_sta_notify,
        )
 );
-TRACE_EVENT(drv_conf_tx,
+TRACE_EVENT(drv_sta_add,
-        TP_PROTO(struct ieee80211_local *local, u16 queue,
+        TP_PROTO(struct ieee80211_local *local,
-                 const struct ieee80211_tx_queue_params *params,
+                 struct ieee80211_sub_if_data *sdata,
-                 int ret),
+                 struct ieee80211_sta *sta, int ret),
-        TP_ARGS(local, queue, params, ret),
+        TP_ARGS(local, sdata, sta, ret),
        TP_STRUCT__entry(
                LOCAL_ENTRY
-                __field(u16, queue)
+                VIF_ENTRY
-                __field(u16, txop)
+                STA_ENTRY
-                __field(u16, cw_min)
-                __field(u16, cw_max)
-                __field(u8, aifs)
                __field(int, ret)
        ),
        TP_fast_assign(
                LOCAL_ASSIGN;
-                __entry->queue = queue;
+                VIF_ASSIGN;
+                STA_ASSIGN;
                __entry->ret = ret;
-                __entry->txop = params->txop;
-                __entry->cw_max = params->cw_max;
-                __entry->cw_min = params->cw_min;
-                __entry->aifs = params->aifs;
        ),
        TP_printk(
-                LOCAL_PR_FMT " queue:%d ret:%d",
+                LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT " ret:%d",
-                LOCAL_PR_ARG, __entry->queue, __entry->ret
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->ret
        )
 );
-TRACE_EVENT(drv_get_tx_stats,
+TRACE_EVENT(drv_sta_remove,
        TP_PROTO(struct ieee80211_local *local,
-                 struct ieee80211_tx_queue_stats *stats,
+                 struct ieee80211_sub_if_data *sdata,
+                 struct ieee80211_sta *sta),
+        TP_ARGS(local, sdata, sta),
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                STA_ENTRY
+        ),
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                STA_ASSIGN;
+        ),
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT  STA_PR_FMT,
+                LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG
+        )
+);
+TRACE_EVENT(drv_conf_tx,
+        TP_PROTO(struct ieee80211_local *local, u16 queue,
+                 const struct ieee80211_tx_queue_params *params,
                 int ret),
-        TP_ARGS(local, stats, ret),
+        TP_ARGS(local, queue, params, ret),
        TP_STRUCT__entry(
                LOCAL_ENTRY
+                __field(u16, queue)
+                __field(u16, txop)
+                __field(u16, cw_min)
+                __field(u16, cw_max)
+                __field(u8, aifs)
                __field(int, ret)
        ),
        TP_fast_assign(
                LOCAL_ASSIGN;
+                __entry->queue = queue;
                __entry->ret = ret;
+                __entry->txop = params->txop;
+                __entry->cw_max = params->cw_max;
+                __entry->cw_min = params->cw_min;
+                __entry->aifs = params->aifs;
        ),
        TP_printk(
-                LOCAL_PR_FMT " ret:%d",
+                LOCAL_PR_FMT " queue:%d ret:%d",
-                LOCAL_PR_ARG, __entry->ret
+                LOCAL_PR_ARG, __entry->queue, __entry->ret
        )
 );
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index f95750b423e3..f3e942486749 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -275,10 +275,12 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                    (unsigned long long) supp_rates,
                                    (unsigned long long) sta->sta.supp_rates[band]);
 #endif
-                } else
+                        rcu_read_unlock();
-                        ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
+                } else {
+                        rcu_read_unlock();
-                rcu_read_unlock();
+                        ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
+                                               supp_rates, GFP_KERNEL);
+                }
        }
        bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
@@ -368,7 +370,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                       sdata->name, mgmt->bssid);
 #endif
                ieee80211_sta_join_ibss(sdata, bss);
-                ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
+                ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
+                                       supp_rates, GFP_KERNEL);
        }
 put_bss:
@@ -381,7 +384,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 * must be callable in atomic context.
 */
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                                        u8 *bssid,u8 *addr, u32 supp_rates)
+                                        u8 *bssid,u8 *addr, u32 supp_rates,
+                                        gfp_t gfp)
 {
        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
        struct ieee80211_local *local = sdata->local;
@@ -410,7 +414,7 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
               wiphy_name(local->hw.wiphy), addr, sdata->name);
 #endif
-        sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
+        sta = sta_info_alloc(sdata, addr, gfp);
        if (!sta)
                return NULL;
@@ -422,9 +426,9 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
        rate_control_rate_init(sta);
+        /* If it fails, maybe we raced another insertion? */
        if (sta_info_insert(sta))
-                return NULL;
+                return sta_info_get(sdata, addr);
        return sta;
 }
@@ -652,7 +656,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
        }
        if (pos[1] != 0 &&
            (pos[1] != ifibss->ssid_len ||
-             !memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
+             memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
                /* Ignore ProbeReq for foreign SSID */
                return;
        }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 3067fbd69d63..9dd98b674cbc 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -316,6 +316,7 @@ enum ieee80211_sta_flags {
        IEEE80211_STA_CSA_RECEIVED      = BIT(5),
        IEEE80211_STA_MFP_ENABLED       = BIT(6),
        IEEE80211_STA_UAPSD_ENABLED     = BIT(7),
+        IEEE80211_STA_NULLFUNC_ACKED    = BIT(8),
 };
 struct ieee80211_if_managed {
@@ -688,15 +689,18 @@ struct ieee80211_local {
        /* Station data */
        /*
-         * The lock only protects the list, hash, timer and counter
+         * The mutex only protects the list and counter,
-         * against manipulation, reads are done in RCU. Additionally,
+         * reads are done in RCU.
-         * the lock protects each BSS's TIM bitmap.
+         * Additionally, the lock protects the hash table,
+         * the pending list and each BSS's TIM bitmap.
         */
+        struct mutex sta_mtx;
        spinlock_t sta_lock;
        unsigned long num_sta;
-        struct list_head sta_list;
+        struct list_head sta_list, sta_pending_list;
        struct sta_info *sta_hash[STA_HASH_SIZE];
        struct timer_list sta_cleanup;
+        struct work_struct sta_finish_work;
        int sta_generation;
        struct sk_buff_head pending[IEEE80211_MAX_QUEUES];
@@ -770,10 +774,6 @@ struct ieee80211_local {
             assoc_led_name[32], radio_led_name[32];
 #endif
-#ifdef CONFIG_MAC80211_DEBUGFS
-        struct work_struct sta_debugfs_add;
-#endif
 #ifdef CONFIG_MAC80211_DEBUG_COUNTERS
        /* TX/RX handler statistics */
        unsigned int tx_handlers_drop;
@@ -985,7 +985,8 @@ void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata);
 ieee80211_rx_result
 ieee80211_ibss_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
 struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
-                                        u8 *bssid, u8 *addr, u32 supp_rates);
+                                        u8 *bssid, u8 *addr, u32 supp_rates,
+                                        gfp_t gfp);
 int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
                        struct cfg80211_ibss_params *params);
 int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata);
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 7985e5150898..bc4e20e57ff5 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -102,7 +102,7 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
        if (local->num_sta >= MESH_MAX_PLINKS)
                return NULL;
-        sta = sta_info_alloc(sdata, hw_addr, GFP_ATOMIC);
+        sta = sta_info_alloc(sdata, hw_addr, GFP_KERNEL);
        if (!sta)
                return NULL;
@@ -236,12 +236,12 @@ void mesh_neighbour_update(u8 *hw_addr, u32 rates, struct ieee80211_sub_if_data
        sta = sta_info_get(sdata, hw_addr);
        if (!sta) {
+                rcu_read_unlock();
                sta = mesh_plink_alloc(sdata, hw_addr, rates);
-                if (!sta) {
+                if (!sta)
-                        rcu_read_unlock();
                        return;
-                }
+                if (sta_info_insert_rcu(sta)) {
-                if (sta_info_insert(sta)) {
                        rcu_read_unlock();
                        return;
                }
@@ -485,9 +485,11 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
        } else if (!sta) {
                /* ftype == PLINK_OPEN */
                u32 rates;
+                rcu_read_unlock();
                if (!mesh_plink_free_count(sdata)) {
                        mpl_dbg("Mesh plink error: no more free plinks\n");
-                        rcu_read_unlock();
                        return;
                }
@@ -495,10 +497,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                sta = mesh_plink_alloc(sdata, mgmt->sa, rates);
                if (!sta) {
                        mpl_dbg("Mesh plink error: plink table full\n");
-                        rcu_read_unlock();
                        return;
                }
-                if (sta_info_insert(sta)) {
+                if (sta_info_insert_rcu(sta)) {
                        rcu_read_unlock();
                        return;
                }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 86c6ad1b058d..bfc4a5070013 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -27,10 +27,6 @@
 #include "rate.h"
 #include "led.h"
-#define IEEE80211_AUTH_TIMEOUT (HZ / 5)
-#define IEEE80211_AUTH_MAX_TRIES 3
-#define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
-#define IEEE80211_ASSOC_MAX_TRIES 3
 #define IEEE80211_MAX_PROBE_TRIES 5
 /*
@@ -438,8 +434,11 @@ static void ieee80211_enable_ps(struct ieee80211_local *local,
        } else {
                if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
                        ieee80211_send_nullfunc(local, sdata, 1);
-                conf->flags |= IEEE80211_CONF_PS;
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+                if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
+                        conf->flags |= IEEE80211_CONF_PS;
+                        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+                }
        }
 }
@@ -545,6 +544,7 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
                container_of(work, struct ieee80211_local,
                             dynamic_ps_enable_work);
        struct ieee80211_sub_if_data *sdata = local->ps_sdata;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
        /* can only happen when PS was just disabled anyway */
        if (!sdata)
@@ -553,11 +553,16 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
        if (local->hw.conf.flags & IEEE80211_CONF_PS)
                return;
-        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+        if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
+            (!(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)))
                ieee80211_send_nullfunc(local, sdata, 1);
-        local->hw.conf.flags |= IEEE80211_CONF_PS;
+        if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) ||
-        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+            (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
+                ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
+                local->hw.conf.flags |= IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        }
 }
 void ieee80211_dynamic_ps_timer(unsigned long data)
@@ -792,8 +797,10 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata)
        rcu_read_lock();
        sta = sta_info_get(sdata, bssid);
-        if (sta)
+        if (sta) {
+                set_sta_flags(sta, WLAN_STA_DISASSOC);
                ieee80211_sta_tear_down_BA_sessions(sta);
+        }
        rcu_read_unlock();
        changed |= ieee80211_reset_erp_info(sdata);
@@ -826,19 +833,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata)
        changed |= BSS_CHANGED_BSSID;
        ieee80211_bss_info_change_notify(sdata, changed);
-        rcu_read_lock();
+        sta_info_destroy_addr(sdata, bssid);
-        sta = sta_info_get(sdata, bssid);
-        if (!sta) {
-                rcu_read_unlock();
-                return;
-        }
-        sta_info_unlink(&sta);
-        rcu_read_unlock();
-        sta_info_destroy(sta);
 }
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
@@ -1844,7 +1839,11 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
        wk->probe_auth.algorithm = auth_alg;
        wk->probe_auth.privacy = req->bss->capability & WLAN_CAPABILITY_PRIVACY;
-        wk->type = IEEE80211_WORK_DIRECT_PROBE;
+        /* if we already have a probe, don't probe again */
+        if (req->bss->proberesp_ies)
+                wk->type = IEEE80211_WORK_AUTH;
+        else
+                wk->type = IEEE80211_WORK_DIRECT_PROBE;
        wk->chan = req->bss->channel;
        wk->sdata = sdata;
        wk->done = ieee80211_probe_auth_done;
@@ -1904,6 +1903,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                return -ENOMEM;
        ifmgd->flags &= ~IEEE80211_STA_DISABLE_11N;
+        ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
        for (i = 0; i < req->crypto.n_ciphers_pairwise; i++)
                if (req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP40 ||
@@ -2007,12 +2007,18 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                mutex_lock(&local->work_mtx);
                list_for_each_entry(wk, &local->work_list, list) {
-                        if (wk->type != IEEE80211_WORK_DIRECT_PROBE)
+                        if (wk->sdata != sdata)
+                                continue;
+                        if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
+                            wk->type != IEEE80211_WORK_AUTH)
                                continue;
                        if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
                                continue;
-                        not_auth_yet = true;
-                        list_del(&wk->list);
+                        not_auth_yet = wk->type == IEEE80211_WORK_DIRECT_PROBE;
+                        list_del_rcu(&wk->list);
                        free_work(wk);
                        break;
                }
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 47f818959ad7..0e64484e861c 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -11,7 +11,6 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
        struct ieee80211_local *local = hw_to_local(hw);
        struct ieee80211_sub_if_data *sdata;
        struct sta_info *sta;
-        unsigned long flags;
        ieee80211_scan_cancel(local);
@@ -55,22 +54,21 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
        rcu_read_unlock();
        /* remove STAs */
-        spin_lock_irqsave(&local->sta_lock, flags);
+        mutex_lock(&local->sta_mtx);
        list_for_each_entry(sta, &local->sta_list, list) {
-                if (local->ops->sta_notify) {
+                if (sta->uploaded) {
                        sdata = sta->sdata;
                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                                sdata = container_of(sdata->bss,
                                             struct ieee80211_sub_if_data,
                                             u.ap);
-                        drv_sta_notify(local, sdata, STA_NOTIFY_REMOVE,
+                        drv_sta_remove(local, sdata, &sta->sta);
-                                       &sta->sta);
                }
                mesh_plink_quiesce(sta);
        }
-        spin_unlock_irqrestore(&local->sta_lock, flags);
+        mutex_unlock(&local->sta_mtx);
        /* remove all interfaces */
        list_for_each_entry(sdata, &local->interfaces, list) {
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index c74b7c85403c..0b299d236fa1 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -145,7 +145,7 @@ static const struct file_operations rcname_ops = {
 };
 #endif
-struct rate_control_ref *rate_control_alloc(const char *name,
+static struct rate_control_ref *rate_control_alloc(const char *name,
                                            struct ieee80211_local *local)
 {
        struct dentry *debugfsdir = NULL;
@@ -303,6 +303,9 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                info->control.rates[i].count = 1;
        }
+        if (sdata->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
+                return;
        ref->ops->get_rate(ref->priv, ista, priv_sta, txrc);
        /*
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index 998cf7a935b6..b6108bca96d4 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -26,10 +26,6 @@ struct rate_control_ref {
        struct kref kref;
 };
-/* Get a reference to the rate control algorithm. If `name' is NULL, get the
- * first available algorithm. */
-struct rate_control_ref *rate_control_alloc(const char *name,
-                                            struct ieee80211_local *local);
 void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                           struct sta_info *sta,
                           struct ieee80211_tx_rate_control *txrc);
@@ -116,7 +112,8 @@ static inline void rate_control_remove_sta_debugfs(struct sta_info *sta)
 #endif
 }
-/* functions for rate control related to a device */
+/* Get a reference to the rate control algorithm. If `name' is NULL, get the
+ * first available algorithm. */
 int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
                                 const char *name);
 void rate_control_deinitialize(struct ieee80211_local *local);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 5709307fcb9b..c9755f3d986c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1719,6 +1719,7 @@ static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
 {
        struct ieee80211_sub_if_data *sdata = rx->sdata;
+        struct ieee80211_local *local = rx->local;
        struct net_device *dev = sdata->dev;
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
        __le16 fc = hdr->frame_control;
@@ -1750,6 +1751,13 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
        dev->stats.rx_packets++;
        dev->stats.rx_bytes += rx->skb->len;
+        if (ieee80211_is_data(hdr->frame_control) &&
+            !is_multicast_ether_addr(hdr->addr1) &&
+            local->hw.conf.dynamic_ps_timeout > 0 && local->ps_sdata) {
+                        mod_timer(&local->dynamic_ps_timer, jiffies +
+                         msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
+        }
        ieee80211_deliver_skb(rx);
        return RX_QUEUED;
@@ -2244,8 +2252,8 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                                rate_idx = 0; /* TODO: HT rates */
                        else
                                rate_idx = status->rate_idx;
-                        rx->sta = ieee80211_ibss_add_sta(sdata, bssid, hdr->addr2,
+                        rx->sta = ieee80211_ibss_add_sta(sdata, bssid,
-                                BIT(rate_idx));
+                                        hdr->addr2, BIT(rate_idx), GFP_ATOMIC);
                }
                break;
        case NL80211_IFTYPE_MESH_POINT:
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index bc061f629674..b822dce97867 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -345,6 +345,13 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
        if (local->scan_req)
                return -EBUSY;
+        if (!list_empty(&local->work_list)) {
+                /* wait for the work to finish/time out */
+                local->scan_req = req;
+                local->scan_sdata = sdata;
+                return 0;
+        }
        if (local->ops->hw_scan) {
                u8 *ies;
@@ -364,29 +371,33 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
                local->hw_scan_req->ie = ies;
                local->hw_scan_band = 0;
+                /*
+                 * After allocating local->hw_scan_req, we must
+                 * go through until ieee80211_prep_hw_scan(), so
+                 * anything that might be changed here and leave
+                 * this function early must not go after this
+                 * allocation.
+                 */
        }
        local->scan_req = req;
        local->scan_sdata = sdata;
-        if (!list_empty(&local->work_list)) {
-                /* wait for the work to finish/time out */
-                return 0;
-        }
        if (local->ops->hw_scan)
                __set_bit(SCAN_HW_SCANNING, &local->scanning);
        else
                __set_bit(SCAN_SW_SCANNING, &local->scanning);
        /*
         * Kicking off the scan need not be protected,
         * only the scan variable stuff, since now
         * local->scan_req is assigned and other callers
         * will abort their scan attempts.
         *
-         * This avoids getting a scan_mtx -> iflist_mtx
+         * This avoids too many locking dependencies
-         * dependency, so that the scan completed calls
+         * so that the scan completed calls have more
-         * have more locking freedom.
+         * locking freedom.
         */
        ieee80211_recalc_idle(local);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index f735826f055c..211c475f73c6 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -32,49 +32,33 @@
 * for faster lookup and a list for iteration. They are managed using
 * RCU, i.e. access to the list and hash table is protected by RCU.
 *
- * Upon allocating a STA info structure with sta_info_alloc(), the caller owns
+ * Upon allocating a STA info structure with sta_info_alloc(), the caller
- * that structure. It must then either destroy it using sta_info_destroy()
+ * owns that structure. It must then insert it into the hash table using
- * (which is pretty useless) or insert it into the hash table using
+ * either sta_info_insert() or sta_info_insert_rcu(); only in the latter
- * sta_info_insert() which demotes the reference from ownership to a regular
+ * case (which acquires an rcu read section but must not be called from
- * RCU-protected reference; if the function is called without protection by an
+ * within one) will the pointer still be valid after the call. Note that
- * RCU critical section the reference is instantly invalidated. Note that the
+ * the caller may not do much with the STA info before inserting it, in
- * caller may not do much with the STA info before inserting it, in particular,
+ * particular, it may not start any mesh peer link management or add
- * it may not start any mesh peer link management or add encryption keys.
+ * encryption keys.
 *
 * When the insertion fails (sta_info_insert()) returns non-zero), the
 * structure will have been freed by sta_info_insert()!
 *
- * sta entries are added by mac80211 when you establish a link with a
+ * Station entries are added by mac80211 when you establish a link with a
 * peer. This means different things for the different type of interfaces
 * we support. For a regular station this mean we add the AP sta when we
 * receive an assocation response from the AP. For IBSS this occurs when
- * we receive a probe response or a beacon from target IBSS network. For
+ * get to know about a peer on the same IBSS. For WDS we add the sta for
- * WDS we add the sta for the peer imediately upon device open. When using
+ * the peer imediately upon device open. When using AP mode we add stations
- * AP mode we add stations for each respective station upon request from
+ * for each respective station upon request from userspace through nl80211.
- * userspace through nl80211.
 *
- * Because there are debugfs entries for each station, and adding those
+ * In order to remove a STA info structure, various sta_info_destroy_*()
- * must be able to sleep, it is also possible to "pin" a station entry,
+ * calls are available.
- * that means it can be removed from the hash table but not be freed.
- * See the comment in __sta_info_unlink() for more information, this is
- * an internal capability only.
 *
- * In order to remove a STA info structure, the caller needs to first
+ * There is no concept of ownership on a STA entry, each structure is
- * unlink it (sta_info_unlink()) from the list and hash tables and
+ * owned by the global hash table/list until it is removed. All users of
- * then destroy it; sta_info_destroy() will wait for an RCU grace period
+ * the structure need to be RCU protected so that the structure won't be
- * to elapse before actually freeing it. Due to the pinning and the
+ * freed before they are done using it.
- * possibility of multiple callers trying to remove the same STA info at
- * the same time, sta_info_unlink() can clear the STA info pointer it is
- * passed to indicate that the STA info is owned by somebody else now.
- *
- * If sta_info_unlink() did not clear the pointer then the caller owns
- * the STA info structure now and is responsible of destroying it with
- * a call to sta_info_destroy().
- *
- * In all other cases, there is no concept of ownership on a STA entry,
- * each structure is owned by the global hash table/list until it is
- * removed. All users of the structure need to be RCU protected so that
- * the structure won't be freed before they are done using it.
 */
 /* Caller must hold local->sta_lock */
@@ -185,101 +169,6 @@ static void __sta_info_free(struct ieee80211_local *local,
        kfree(sta);
 }
-void sta_info_destroy(struct sta_info *sta)
-{
-        struct ieee80211_local *local;
-        struct sk_buff *skb;
-        int i;
-        might_sleep();
-        if (!sta)
-                return;
-        local = sta->local;
-        cancel_work_sync(&sta->drv_unblock_wk);
-        rate_control_remove_sta_debugfs(sta);
-        ieee80211_sta_debugfs_remove(sta);
-#ifdef CONFIG_MAC80211_MESH
-        if (ieee80211_vif_is_mesh(&sta->sdata->vif))
-                mesh_plink_deactivate(sta);
-#endif
-        /*
-         * We have only unlinked the key, and actually destroying it
-         * may mean it is removed from hardware which requires that
-         * the key->sta pointer is still valid, so flush the key todo
-         * list here.
-         *
-         * ieee80211_key_todo() will synchronize_rcu() so after this
-         * nothing can reference this sta struct any more.
-         */
-        ieee80211_key_todo();
-#ifdef CONFIG_MAC80211_MESH
-        if (ieee80211_vif_is_mesh(&sta->sdata->vif))
-                del_timer_sync(&sta->plink_timer);
-#endif
-        while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
-                local->total_ps_buffered--;
-                dev_kfree_skb_any(skb);
-        }
-        while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL)
-                dev_kfree_skb_any(skb);
-        for (i = 0; i <  STA_TID_NUM; i++) {
-                struct tid_ampdu_rx *tid_rx;
-                struct tid_ampdu_tx *tid_tx;
-                spin_lock_bh(&sta->lock);
-                tid_rx = sta->ampdu_mlme.tid_rx[i];
-                /* Make sure timer won't free the tid_rx struct, see below */
-                if (tid_rx)
-                        tid_rx->shutdown = true;
-                spin_unlock_bh(&sta->lock);
-                /*
-                 * Outside spinlock - shutdown is true now so that the timer
-                 * won't free tid_rx, we have to do that now. Can't let the
-                 * timer do it because we have to sync the timer outside the
-                 * lock that it takes itself.
-                 */
-                if (tid_rx) {
-                        del_timer_sync(&tid_rx->session_timer);
-                        kfree(tid_rx);
-                }
-                /*
-                 * No need to do such complications for TX agg sessions, the
-                 * path leading to freeing the tid_tx struct goes via a call
-                 * from the driver, and thus needs to look up the sta struct
-                 * again, which cannot be found when we get here. Hence, we
-                 * just need to delete the timer and free the aggregation
-                 * info; we won't be telling the peer about it then but that
-                 * doesn't matter if we're not talking to it again anyway.
-                 */
-                tid_tx = sta->ampdu_mlme.tid_tx[i];
-                if (tid_tx) {
-                        del_timer_sync(&tid_tx->addba_resp_timer);
-                        /*
-                         * STA removed while aggregation session being
-                         * started? Bit odd, but purge frames anyway.
-                         */
-                        skb_queue_purge(&tid_tx->pending);
-                        kfree(tid_tx);
-                }
-        }
-        __sta_info_free(local, sta);
-}
 /* Caller must hold local->sta_lock */
 static void sta_info_hash_add(struct ieee80211_local *local,
                              struct sta_info *sta)
@@ -376,7 +265,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
        return sta;
 }
-int sta_info_insert(struct sta_info *sta)
+static int sta_info_finish_insert(struct sta_info *sta, bool async)
 {
        struct ieee80211_local *local = sta->local;
        struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -384,6 +273,91 @@ int sta_info_insert(struct sta_info *sta)
        unsigned long flags;
        int err = 0;
+        WARN_ON(!mutex_is_locked(&local->sta_mtx));
+        /* notify driver */
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                sdata = container_of(sdata->bss,
+                                     struct ieee80211_sub_if_data,
+                                     u.ap);
+        err = drv_sta_add(local, sdata, &sta->sta);
+        if (err) {
+                if (!async)
+                        return err;
+                printk(KERN_DEBUG "%s: failed to add IBSS STA %pM to driver (%d)"
+                                  " - keeping it anyway.\n",
+                       sdata->name, sta->sta.addr, err);
+        } else {
+                sta->uploaded = true;
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+                if (async)
+                        printk(KERN_DEBUG "%s: Finished adding IBSS STA %pM\n",
+                               wiphy_name(local->hw.wiphy), sta->sta.addr);
+#endif
+        }
+        sdata = sta->sdata;
+        if (!async) {
+                local->num_sta++;
+                local->sta_generation++;
+                smp_mb();
+                /* make the station visible */
+                spin_lock_irqsave(&local->sta_lock, flags);
+                sta_info_hash_add(local, sta);
+                spin_unlock_irqrestore(&local->sta_lock, flags);
+        }
+        list_add(&sta->list, &local->sta_list);
+        ieee80211_sta_debugfs_add(sta);
+        rate_control_add_sta_debugfs(sta);
+        sinfo.filled = 0;
+        sinfo.generation = local->sta_generation;
+        cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
+        return 0;
+}
+static void sta_info_finish_pending(struct ieee80211_local *local)
+{
+        struct sta_info *sta;
+        unsigned long flags;
+        spin_lock_irqsave(&local->sta_lock, flags);
+        while (!list_empty(&local->sta_pending_list)) {
+                sta = list_first_entry(&local->sta_pending_list,
+                                       struct sta_info, list);
+                list_del(&sta->list);
+                spin_unlock_irqrestore(&local->sta_lock, flags);
+                sta_info_finish_insert(sta, true);
+                spin_lock_irqsave(&local->sta_lock, flags);
+        }
+        spin_unlock_irqrestore(&local->sta_lock, flags);
+}
+static void sta_info_finish_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local, sta_finish_work);
+        mutex_lock(&local->sta_mtx);
+        sta_info_finish_pending(local);
+        mutex_unlock(&local->sta_mtx);
+}
+int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
+{
+        struct ieee80211_local *local = sta->local;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        unsigned long flags;
+        int err = 0;
        /*
         * Can't be a WARN_ON because it can be triggered through a race:
         * something inserts a STA (on one CPU) without holding the RTNL
@@ -391,36 +365,87 @@ int sta_info_insert(struct sta_info *sta)
         */
        if (unlikely(!ieee80211_sdata_running(sdata))) {
                err = -ENETDOWN;
+                rcu_read_lock();
                goto out_free;
        }
        if (WARN_ON(compare_ether_addr(sta->sta.addr, sdata->vif.addr) == 0 ||
                    is_multicast_ether_addr(sta->sta.addr))) {
                err = -EINVAL;
+                rcu_read_lock();
                goto out_free;
        }
+        /*
+         * In ad-hoc mode, we sometimes need to insert stations
+         * from tasklet context from the RX path. To avoid races,
+         * always do so in that case -- see the comment below.
+         */
+        if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
+                spin_lock_irqsave(&local->sta_lock, flags);
+                /* check if STA exists already */
+                if (sta_info_get_bss(sdata, sta->sta.addr)) {
+                        spin_unlock_irqrestore(&local->sta_lock, flags);
+                        rcu_read_lock();
+                        err = -EEXIST;
+                        goto out_free;
+                }
+                local->num_sta++;
+                local->sta_generation++;
+                smp_mb();
+                sta_info_hash_add(local, sta);
+                list_add_tail(&sta->list, &local->sta_pending_list);
+                rcu_read_lock();
+                spin_unlock_irqrestore(&local->sta_lock, flags);
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+                printk(KERN_DEBUG "%s: Added IBSS STA %pM\n",
+                       wiphy_name(local->hw.wiphy), sta->sta.addr);
+#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
+                ieee80211_queue_work(&local->hw, &local->sta_finish_work);
+                return 0;
+        }
+        /*
+         * On first glance, this will look racy, because the code
+         * below this point, which inserts a station with sleeping,
+         * unlocks the sta_lock between checking existence in the
+         * hash table and inserting into it.
+         *
+         * However, it is not racy against itself because it keeps
+         * the mutex locked. It still seems to race against the
+         * above code that atomically inserts the station... That,
+         * however, is not true because the above code can only
+         * be invoked for IBSS interfaces, and the below code will
+         * not be -- and the two do not race against each other as
+         * the hash table also keys off the interface.
+         */
+        might_sleep();
+        mutex_lock(&local->sta_mtx);
        spin_lock_irqsave(&local->sta_lock, flags);
        /* check if STA exists already */
-        if (sta_info_get(sdata, sta->sta.addr)) {
+        if (sta_info_get_bss(sdata, sta->sta.addr)) {
                spin_unlock_irqrestore(&local->sta_lock, flags);
+                rcu_read_lock();
                err = -EEXIST;
                goto out_free;
        }
-        list_add(&sta->list, &local->sta_list);
-        local->sta_generation++;
-        local->num_sta++;
-        sta_info_hash_add(local, sta);
-        /* notify driver */
+        spin_unlock_irqrestore(&local->sta_lock, flags);
-        if (local->ops->sta_notify) {
-                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                        sdata = container_of(sdata->bss,
-                                             struct ieee80211_sub_if_data,
-                                             u.ap);
-                drv_sta_notify(local, sdata, STA_NOTIFY_ADD, &sta->sta);
+        err = sta_info_finish_insert(sta, false);
-                sdata = sta->sdata;
+        if (err) {
+                mutex_unlock(&local->sta_mtx);
+                rcu_read_lock();
+                goto out_free;
        }
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -428,22 +453,9 @@ int sta_info_insert(struct sta_info *sta)
               wiphy_name(local->hw.wiphy), sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
-        spin_unlock_irqrestore(&local->sta_lock, flags);
+        /* move reference to rcu-protected */
+        rcu_read_lock();
-        sinfo.filled = 0;
+        mutex_unlock(&local->sta_mtx);
-        sinfo.generation = local->sta_generation;
-        cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_ATOMIC);
-#ifdef CONFIG_MAC80211_DEBUGFS
-        /*
-         * Debugfs entry adding might sleep, so schedule process
-         * context task for adding entry for STAs that do not yet
-         * have one.
-         * NOTE: due to auto-freeing semantics this may only be done
-         *       if the insertion is successful!
-         */
-        schedule_work(&local->sta_debugfs_add);
-#endif
        if (ieee80211_vif_is_mesh(&sdata->vif))
                mesh_accept_plinks_update(sdata);
@@ -455,6 +467,15 @@ int sta_info_insert(struct sta_info *sta)
        return err;
 }
+int sta_info_insert(struct sta_info *sta)
+{
+        int err = sta_info_insert_rcu(sta);
+        rcu_read_unlock();
+        return err;
+}
 static inline void __bss_tim_set(struct ieee80211_if_ap *bss, u16 aid)
 {
        /*
@@ -523,108 +544,6 @@ void sta_info_clear_tim_bit(struct sta_info *sta)
        spin_unlock_irqrestore(&sta->local->sta_lock, flags);
 }
-static void __sta_info_unlink(struct sta_info **sta)
-{
-        struct ieee80211_local *local = (*sta)->local;
-        struct ieee80211_sub_if_data *sdata = (*sta)->sdata;
-        /*
-         * pull caller's reference if we're already gone.
-         */
-        if (sta_info_hash_del(local, *sta)) {
-                *sta = NULL;
-                return;
-        }
-        if ((*sta)->key) {
-                ieee80211_key_free((*sta)->key);
-                WARN_ON((*sta)->key);
-        }
-        list_del(&(*sta)->list);
-        (*sta)->dead = true;
-        if (test_and_clear_sta_flags(*sta,
-                                WLAN_STA_PS_STA | WLAN_STA_PS_DRIVER)) {
-                BUG_ON(!sdata->bss);
-                atomic_dec(&sdata->bss->num_sta_ps);
-                __sta_info_clear_tim_bit(sdata->bss, *sta);
-        }
-        local->num_sta--;
-        local->sta_generation++;
-        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                rcu_assign_pointer(sdata->u.vlan.sta, NULL);
-        if (local->ops->sta_notify) {
-                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                        sdata = container_of(sdata->bss,
-                                             struct ieee80211_sub_if_data,
-                                             u.ap);
-                drv_sta_notify(local, sdata, STA_NOTIFY_REMOVE,
-                               &(*sta)->sta);
-                sdata = (*sta)->sdata;
-        }
-        if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                mesh_accept_plinks_update(sdata);
-#ifdef CONFIG_MAC80211_MESH
-                del_timer(&(*sta)->plink_timer);
-#endif
-        }
-#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
-        printk(KERN_DEBUG "%s: Removed STA %pM\n",
-               wiphy_name(local->hw.wiphy), (*sta)->sta.addr);
-#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
-        /*
-         * Finally, pull caller's reference if the STA is pinned by the
-         * task that is adding the debugfs entries. In that case, we
-         * leave the STA "to be freed".
-         *
-         * The rules are not trivial, but not too complex either:
-         *  (1) pin_status is only modified under the sta_lock
-         *  (2) STAs may only be pinned under the RTNL so that
-         *      sta_info_flush() is guaranteed to actually destroy
-         *      all STAs that are active for a given interface, this
-         *      is required for correctness because otherwise we
-         *      could notify a driver that an interface is going
-         *      away and only after that (!) notify it about a STA
-         *      on that interface going away.
-         *  (3) sta_info_debugfs_add_work() will set the status
-         *      to PINNED when it found an item that needs a new
-         *      debugfs directory created. In that case, that item
-         *      must not be freed although all *RCU* users are done
-         *      with it. Hence, we tell the caller of _unlink()
-         *      that the item is already gone (as can happen when
-         *      two tasks try to unlink/destroy at the same time)
-         *  (4) We set the pin_status to DESTROY here when we
-         *      find such an item.
-         *  (5) sta_info_debugfs_add_work() will reset the pin_status
-         *      from PINNED to NORMAL when it is done with the item,
-         *      but will check for DESTROY before resetting it in
-         *      which case it will free the item.
-         */
-        if ((*sta)->pin_status == STA_INFO_PIN_STAT_PINNED) {
-                (*sta)->pin_status = STA_INFO_PIN_STAT_DESTROY;
-                *sta = NULL;
-                return;
-        }
-}
-void sta_info_unlink(struct sta_info **sta)
-{
-        struct ieee80211_local *local = (*sta)->local;
-        unsigned long flags;
-        spin_lock_irqsave(&local->sta_lock, flags);
-        __sta_info_unlink(sta);
-        spin_unlock_irqrestore(&local->sta_lock, flags);
-}
 static int sta_info_buffer_expired(struct sta_info *sta,
                                   struct sk_buff *skb)
 {
@@ -681,109 +600,209 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
        }
 }
+static int __must_check __sta_info_destroy(struct sta_info *sta)
-static void sta_info_cleanup(unsigned long data)
 {
-        struct ieee80211_local *local = (struct ieee80211_local *) data;
+        struct ieee80211_local *local;
-        struct sta_info *sta;
+        struct ieee80211_sub_if_data *sdata;
+        struct sk_buff *skb;
+        unsigned long flags;
+        int ret, i;
-        rcu_read_lock();
+        might_sleep();
-        list_for_each_entry_rcu(sta, &local->sta_list, list)
-                sta_info_cleanup_expire_buffered(local, sta);
-        rcu_read_unlock();
-        if (local->quiescing)
+        if (!sta)
-                return;
+                return -ENOENT;
-        local->sta_cleanup.expires =
+        local = sta->local;
-                round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL);
+        sdata = sta->sdata;
-        add_timer(&local->sta_cleanup);
-}
-#ifdef CONFIG_MAC80211_DEBUGFS
+        spin_lock_irqsave(&local->sta_lock, flags);
-/*
+        ret = sta_info_hash_del(local, sta);
- * See comment in __sta_info_unlink,
+        /* this might still be the pending list ... which is fine */
- * caller must hold local->sta_lock.
+        if (!ret)
- */
+                list_del(&sta->list);
-static void __sta_info_pin(struct sta_info *sta)
+        spin_unlock_irqrestore(&local->sta_lock, flags);
-{
+        if (ret)
-        WARN_ON(sta->pin_status != STA_INFO_PIN_STAT_NORMAL);
+                return ret;
-        sta->pin_status = STA_INFO_PIN_STAT_PINNED;
+        if (sta->key) {
+                ieee80211_key_free(sta->key);
+                /*
+                 * We have only unlinked the key, and actually destroying it
+                 * may mean it is removed from hardware which requires that
+                 * the key->sta pointer is still valid, so flush the key todo
+                 * list here.
+                 *
+                 * ieee80211_key_todo() will synchronize_rcu() so after this
+                 * nothing can reference this sta struct any more.
+                 */
+                ieee80211_key_todo();
+                WARN_ON(sta->key);
+        }
+        sta->dead = true;
+        if (test_and_clear_sta_flags(sta,
+                                WLAN_STA_PS_STA | WLAN_STA_PS_DRIVER)) {
+                BUG_ON(!sdata->bss);
+                atomic_dec(&sdata->bss->num_sta_ps);
+                __sta_info_clear_tim_bit(sdata->bss, sta);
+        }
+        local->num_sta--;
+        local->sta_generation++;
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                rcu_assign_pointer(sdata->u.vlan.sta, NULL);
+        if (sta->uploaded) {
+                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                        sdata = container_of(sdata->bss,
+                                             struct ieee80211_sub_if_data,
+                                             u.ap);
+                drv_sta_remove(local, sdata, &sta->sta);
+                sdata = sta->sdata;
+        }
+#ifdef CONFIG_MAC80211_MESH
+        if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                mesh_accept_plinks_update(sdata);
+                del_timer(&sta->plink_timer);
+        }
+#endif
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        printk(KERN_DEBUG "%s: Removed STA %pM\n",
+               wiphy_name(local->hw.wiphy), sta->sta.addr);
+#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
+        cancel_work_sync(&sta->drv_unblock_wk);
+        rate_control_remove_sta_debugfs(sta);
+        ieee80211_sta_debugfs_remove(sta);
+#ifdef CONFIG_MAC80211_MESH
+        if (ieee80211_vif_is_mesh(&sta->sdata->vif)) {
+                mesh_plink_deactivate(sta);
+                del_timer_sync(&sta->plink_timer);
+        }
+#endif
+        while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
+                local->total_ps_buffered--;
+                dev_kfree_skb_any(skb);
+        }
+        while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL)
+                dev_kfree_skb_any(skb);
+        for (i = 0; i <  STA_TID_NUM; i++) {
+                struct tid_ampdu_rx *tid_rx;
+                struct tid_ampdu_tx *tid_tx;
+                spin_lock_bh(&sta->lock);
+                tid_rx = sta->ampdu_mlme.tid_rx[i];
+                /* Make sure timer won't free the tid_rx struct, see below */
+                if (tid_rx)
+                        tid_rx->shutdown = true;
+                spin_unlock_bh(&sta->lock);
+                /*
+                 * Outside spinlock - shutdown is true now so that the timer
+                 * won't free tid_rx, we have to do that now. Can't let the
+                 * timer do it because we have to sync the timer outside the
+                 * lock that it takes itself.
+                 */
+                if (tid_rx) {
+                        del_timer_sync(&tid_rx->session_timer);
+                        kfree(tid_rx);
+                }
+                /*
+                 * No need to do such complications for TX agg sessions, the
+                 * path leading to freeing the tid_tx struct goes via a call
+                 * from the driver, and thus needs to look up the sta struct
+                 * again, which cannot be found when we get here. Hence, we
+                 * just need to delete the timer and free the aggregation
+                 * info; we won't be telling the peer about it then but that
+                 * doesn't matter if we're not talking to it again anyway.
+                 */
+                tid_tx = sta->ampdu_mlme.tid_tx[i];
+                if (tid_tx) {
+                        del_timer_sync(&tid_tx->addba_resp_timer);
+                        /*
+                         * STA removed while aggregation session being
+                         * started? Bit odd, but purge frames anyway.
+                         */
+                        skb_queue_purge(&tid_tx->pending);
+                        kfree(tid_tx);
+                }
+        }
+        __sta_info_free(local, sta);
+        return 0;
 }
-/*
+int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata, const u8 *addr)
- * See comment in __sta_info_unlink, returns sta if it
- * needs to be destroyed.
- */
-static struct sta_info *__sta_info_unpin(struct sta_info *sta)
 {
-        struct sta_info *ret = NULL;
+        struct sta_info *sta;
-        unsigned long flags;
+        int ret;
-        spin_lock_irqsave(&sta->local->sta_lock, flags);
+        mutex_lock(&sdata->local->sta_mtx);
-        WARN_ON(sta->pin_status != STA_INFO_PIN_STAT_DESTROY &&
+        sta = sta_info_get(sdata, addr);
-                sta->pin_status != STA_INFO_PIN_STAT_PINNED);
+        ret = __sta_info_destroy(sta);
-        if (sta->pin_status == STA_INFO_PIN_STAT_DESTROY)
+        mutex_unlock(&sdata->local->sta_mtx);
-                ret = sta;
-        sta->pin_status = STA_INFO_PIN_STAT_NORMAL;
-        spin_unlock_irqrestore(&sta->local->sta_lock, flags);
        return ret;
 }
-static void sta_info_debugfs_add_work(struct work_struct *work)
+int sta_info_destroy_addr_bss(struct ieee80211_sub_if_data *sdata,
+                              const u8 *addr)
 {
-        struct ieee80211_local *local =
+        struct sta_info *sta;
-                container_of(work, struct ieee80211_local, sta_debugfs_add);
+        int ret;
-        struct sta_info *sta, *tmp;
-        unsigned long flags;
-        /* We need to keep the RTNL across the whole pinned status. */
+        mutex_lock(&sdata->local->sta_mtx);
-        rtnl_lock();
+        sta = sta_info_get_bss(sdata, addr);
-        while (1) {
+        ret = __sta_info_destroy(sta);
-                sta = NULL;
+        mutex_unlock(&sdata->local->sta_mtx);
-                spin_lock_irqsave(&local->sta_lock, flags);
+        return ret;
-                list_for_each_entry(tmp, &local->sta_list, list) {
+}
-                        /*
-                         * debugfs.add_has_run will be set by
-                         * ieee80211_sta_debugfs_add regardless
-                         * of what else it does.
-                         */
-                        if (!tmp->debugfs.add_has_run) {
-                                sta = tmp;
-                                __sta_info_pin(sta);
-                                break;
-                        }
-                }
-                spin_unlock_irqrestore(&local->sta_lock, flags);
-                if (!sta)
+static void sta_info_cleanup(unsigned long data)
-                        break;
+{
+        struct ieee80211_local *local = (struct ieee80211_local *) data;
+        struct sta_info *sta;
+        rcu_read_lock();
+        list_for_each_entry_rcu(sta, &local->sta_list, list)
+                sta_info_cleanup_expire_buffered(local, sta);
+        rcu_read_unlock();
-                ieee80211_sta_debugfs_add(sta);
+        if (local->quiescing)
-                rate_control_add_sta_debugfs(sta);
+                return;
-                sta = __sta_info_unpin(sta);
+        local->sta_cleanup.expires =
-                sta_info_destroy(sta);
+                round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL);
-        }
+        add_timer(&local->sta_cleanup);
-        rtnl_unlock();
 }
-#endif
 void sta_info_init(struct ieee80211_local *local)
 {
        spin_lock_init(&local->sta_lock);
+        mutex_init(&local->sta_mtx);
        INIT_LIST_HEAD(&local->sta_list);
+        INIT_LIST_HEAD(&local->sta_pending_list);
+        INIT_WORK(&local->sta_finish_work, sta_info_finish_work);
        setup_timer(&local->sta_cleanup, sta_info_cleanup,
                    (unsigned long)local);
        local->sta_cleanup.expires =
                round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL);
-#ifdef CONFIG_MAC80211_DEBUGFS
-        INIT_WORK(&local->sta_debugfs_add, sta_info_debugfs_add_work);
-#endif
 }
 int sta_info_start(struct ieee80211_local *local)
@@ -795,16 +814,6 @@ int sta_info_start(struct ieee80211_local *local)
 void sta_info_stop(struct ieee80211_local *local)
 {
        del_timer(&local->sta_cleanup);
-#ifdef CONFIG_MAC80211_DEBUGFS
-        /*
-         * Make sure the debugfs adding work isn't pending after this
-         * because we're about to be destroyed. It doesn't matter
-         * whether it ran or not since we're going to flush all STAs
-         * anyway.
-         */
-        cancel_work_sync(&local->sta_debugfs_add);
-#endif
        sta_info_flush(local, NULL);
 }
@@ -820,26 +829,19 @@ int sta_info_flush(struct ieee80211_local *local,
                   struct ieee80211_sub_if_data *sdata)
 {
        struct sta_info *sta, *tmp;
-        LIST_HEAD(tmp_list);
        int ret = 0;
-        unsigned long flags;
        might_sleep();
-        spin_lock_irqsave(&local->sta_lock, flags);
+        mutex_lock(&local->sta_mtx);
+        sta_info_finish_pending(local);
        list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
-                if (!sdata || sdata == sta->sdata) {
+                if (!sdata || sdata == sta->sdata)
-                        __sta_info_unlink(&sta);
+                        WARN_ON(__sta_info_destroy(sta));
-                        if (sta) {
-                                list_add_tail(&sta->list, &tmp_list);
-                                ret++;
-                        }
-                }
        }
-        spin_unlock_irqrestore(&local->sta_lock, flags);
+        mutex_unlock(&local->sta_mtx);
-        list_for_each_entry_safe(sta, tmp, &tmp_list, list)
-                sta_info_destroy(sta);
        return ret;
 }
@@ -849,24 +851,17 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
 {
        struct ieee80211_local *local = sdata->local;
        struct sta_info *sta, *tmp;
-        LIST_HEAD(tmp_list);
-        unsigned long flags;
-        spin_lock_irqsave(&local->sta_lock, flags);
+        mutex_lock(&local->sta_mtx);
        list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
                if (time_after(jiffies, sta->last_rx + exp_time)) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                        printk(KERN_DEBUG "%s: expiring inactive STA %pM\n",
                               sdata->name, sta->sta.addr);
 #endif
-                        __sta_info_unlink(&sta);
+                        WARN_ON(__sta_info_destroy(sta));
-                        if (sta)
-                                list_add(&sta->list, &tmp_list);
                }
-        spin_unlock_irqrestore(&local->sta_lock, flags);
+        mutex_unlock(&local->sta_mtx);
-        list_for_each_entry_safe(sta, tmp, &tmp_list, list)
-                sta_info_destroy(sta);
 }
 struct ieee80211_sta *ieee80211_find_sta_by_hw(struct ieee80211_hw *hw,
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 6f79bba5706e..822d84522937 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -42,6 +42,9 @@
 *      be in the queues
 * @WLAN_STA_PSPOLL: Station sent PS-poll while driver was keeping
 *      station in power-save mode, reply when the driver unblocks.
+ * @WLAN_STA_DISASSOC: Disassociation in progress.
+ *      This is used to reject TX BA session requests when disassociation
+ *      is in progress.
 */
 enum ieee80211_sta_info_flags {
        WLAN_STA_AUTH           = 1<<0,
@@ -57,6 +60,7 @@ enum ieee80211_sta_info_flags {
        WLAN_STA_SUSPEND        = 1<<11,
        WLAN_STA_PS_DRIVER      = 1<<12,
        WLAN_STA_PSPOLL         = 1<<13,
+        WLAN_STA_DISASSOC       = 1<<14,
 };
 #define STA_TID_NUM 16
@@ -162,11 +166,6 @@ struct sta_ampdu_mlme {
 };
-/* see __sta_info_unlink */
-#define STA_INFO_PIN_STAT_NORMAL        0
-#define STA_INFO_PIN_STAT_PINNED        1
-#define STA_INFO_PIN_STAT_DESTROY       2
 /**
 * struct sta_info - STA information
 *
@@ -187,7 +186,6 @@ struct sta_ampdu_mlme {
 * @flaglock: spinlock for flags accesses
 * @drv_unblock_wk: used for driver PS unblocking
 * @listen_interval: listen interval of this station, when we're acting as AP
- * @pin_status: used internally for pinning a STA struct into memory
 * @flags: STA flags, see &enum ieee80211_sta_info_flags
 * @ps_tx_buf: buffer of frames to transmit to this station
 *      when it leaves power saving state
@@ -226,6 +224,7 @@ struct sta_ampdu_mlme {
 * @debugfs: debug filesystem info
 * @sta: station information we share with the driver
 * @dead: set to true when sta is unlinked
+ * @uploaded: set to true when sta is uploaded to the driver
 */
 struct sta_info {
        /* General information, mostly static */
@@ -245,11 +244,7 @@ struct sta_info {
        bool dead;
-        /*
+        bool uploaded;
-         * for use by the internal lifetime management,
-         * see __sta_info_unlink
-         */
-        u8 pin_status;
        /*
         * frequently updated, locked with own spinlock (flaglock),
@@ -449,18 +444,19 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 * Insert STA info into hash table/list, returns zero or a
 * -EEXIST if (if the same MAC address is already present).
 *
- * Calling this without RCU protection makes the caller
+ * Calling the non-rcu version makes the caller relinquish,
- * relinquish its reference to @sta.
+ * the _rcu version calls read_lock_rcu() and must be called
+ * without it held.
 */
 int sta_info_insert(struct sta_info *sta);
-/*
+int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU);
- * Unlink a STA info from the hash table/list.
+int sta_info_insert_atomic(struct sta_info *sta);
- * This can NULL the STA pointer if somebody else
- * has already unlinked it.
+int sta_info_destroy_addr(struct ieee80211_sub_if_data *sdata,
- */
+                          const u8 *addr);
-void sta_info_unlink(struct sta_info **sta);
+int sta_info_destroy_addr_bss(struct ieee80211_sub_if_data *sdata,
+                              const u8 *addr);
-void sta_info_destroy(struct sta_info *sta);
 void sta_info_set_tim_bit(struct sta_info *sta);
 void sta_info_clear_tim_bit(struct sta_info *sta);
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index e57ad6b1d7ea..ded98730c111 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -188,6 +188,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
        rcu_read_lock();
        sband = local->hw.wiphy->bands[info->band];
+        fc = hdr->frame_control;
        for_each_sta_info(local, hdr->addr1, sta, tmp) {
                /* skip wrong virtual interface */
@@ -205,8 +206,6 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                        return;
                }
-                fc = hdr->frame_control;
                if ((info->flags & IEEE80211_TX_STAT_AMPDU_NO_BACK) &&
                    (ieee80211_is_data_qos(fc))) {
                        u16 tid, ssn;
@@ -275,6 +274,20 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                        local->dot11FailedCount++;
        }
+        if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc) &&
+            (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
+            !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
+            local->ps_sdata && !(local->scanning)) {
+                if (info->flags & IEEE80211_TX_STAT_ACK) {
+                        local->ps_sdata->u.mgd.flags |=
+                                        IEEE80211_STA_NULLFUNC_ACKED;
+                        ieee80211_queue_work(&local->hw,
+                                        &local->dynamic_ps_enable_work);
+                } else
+                        mod_timer(&local->dynamic_ps_timer, jiffies +
+                                        msecs_to_jiffies(10));
+        }
        /* this was a transmitted frame, but now we want to reuse it */
        skb_orphan(skb);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 85e382aa894e..cbe53ed4fb0b 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -571,7 +571,7 @@ ieee80211_tx_h_sta(struct ieee80211_tx_data *tx)
 {
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-        if (tx->sta)
+        if (tx->sta && tx->sta->uploaded)
                info->control.sta = &tx->sta->sta;
        return TX_CONTINUE;
@@ -1010,7 +1010,8 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                (struct ieee80211_radiotap_header *) skb->data;
        struct ieee80211_supported_band *sband;
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len);
+        int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
+                                                   NULL);
        sband = tx->local->hw.wiphy->bands[tx->channel->band];
@@ -1046,7 +1047,7 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
                                 * because it will be recomputed and added
                                 * on transmission
                                 */
-                                if (skb->len < (iterator.max_length + FCS_LEN))
+                                if (skb->len < (iterator._max_length + FCS_LEN))
                                        return false;
                                skb_trim(skb, skb->len - FCS_LEN);
@@ -1073,10 +1074,10 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
        /*
         * remove the radiotap header
-         * iterator->max_length was sanity-checked against
+         * iterator->_max_length was sanity-checked against
         * skb->len by iterator init
         */
-        skb_pull(skb, iterator.max_length);
+        skb_pull(skb, iterator._max_length);
        return true;
 }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index ca170b417da6..c453226f06b2 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1082,7 +1082,6 @@ int ieee80211_reconfig(struct ieee80211_local *local)
        struct ieee80211_hw *hw = &local->hw;
        struct ieee80211_sub_if_data *sdata;
        struct sta_info *sta;
-        unsigned long flags;
        int res;
        if (local->suspended)
@@ -1116,20 +1115,19 @@ int ieee80211_reconfig(struct ieee80211_local *local)
        }
        /* add STAs back */
-        if (local->ops->sta_notify) {
+        mutex_lock(&local->sta_mtx);
-                spin_lock_irqsave(&local->sta_lock, flags);
+        list_for_each_entry(sta, &local->sta_list, list) {
-                list_for_each_entry(sta, &local->sta_list, list) {
+                if (sta->uploaded) {
                        sdata = sta->sdata;
                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                                sdata = container_of(sdata->bss,
                                             struct ieee80211_sub_if_data,
                                             u.ap);
-                        drv_sta_notify(local, sdata, STA_NOTIFY_ADD,
+                        WARN_ON(drv_sta_add(local, sdata, &sta->sta));
-                                       &sta->sta);
                }
-                spin_unlock_irqrestore(&local->sta_lock, flags);
        }
+        mutex_unlock(&local->sta_mtx);
        /* Clear Suspend state so that ADDBA requests can be processed */
@@ -1180,6 +1178,14 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                }
        }
+        rcu_read_lock();
+        if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
+                list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                        ieee80211_sta_tear_down_BA_sessions(sta);
+                }
+        }
+        rcu_read_unlock();
        /* add back keys */
        list_for_each_entry(sdata, &local->interfaces, list)
                if (ieee80211_sdata_running(sdata))
@@ -1219,10 +1225,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
        add_timer(&local->sta_cleanup);
-        spin_lock_irqsave(&local->sta_lock, flags);
+        mutex_lock(&local->sta_mtx);
        list_for_each_entry(sta, &local->sta_list, list)
                mesh_plink_restart(sta);
-        spin_unlock_irqrestore(&local->sta_lock, flags);
+        mutex_unlock(&local->sta_mtx);
 #else
        WARN_ON(1);
 #endif
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 71604c6613b5..a249127020a5 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1267,28 +1267,13 @@ static int nr_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 static void *nr_info_start(struct seq_file *seq, loff_t *pos)
 {
-        struct sock *s;
-        struct hlist_node *node;
-        int i = 1;
        spin_lock_bh(&nr_list_lock);
-        if (*pos == 0)
+        return seq_hlist_start_head(&nr_list, *pos);
-                return SEQ_START_TOKEN;
-        sk_for_each(s, node, &nr_list) {
-                if (i == *pos)
-                        return s;
-                ++i;
-        }
-        return NULL;
 }
 static void *nr_info_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        ++*pos;
+        return seq_hlist_next(v, &nr_list, pos);
-        return (v == SEQ_START_TOKEN) ? sk_head(&nr_list)
-                : sk_next((struct sock *)v);
 }
 static void nr_info_stop(struct seq_file *seq, void *v)
@@ -1298,7 +1283,7 @@ static void nr_info_stop(struct seq_file *seq, void *v)
 static int nr_info_show(struct seq_file *seq, void *v)
 {
-        struct sock *s = v;
+        struct sock *s = sk_entry(v);
        struct net_device *dev;
        struct nr_sock *nr;
        const char *devname;
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index e2e2d33cafdf..5cc648012f50 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -863,33 +863,13 @@ int nr_route_frame(struct sk_buff *skb, ax25_cb *ax25)
 static void *nr_node_start(struct seq_file *seq, loff_t *pos)
 {
-        struct nr_node *nr_node;
-        struct hlist_node *node;
-        int i = 1;
        spin_lock_bh(&nr_node_list_lock);
-        if (*pos == 0)
+        return seq_hlist_start_head(&nr_node_list, *pos);
-                return SEQ_START_TOKEN;
-        nr_node_for_each(nr_node, node, &nr_node_list) {
-                if (i == *pos)
-                        return nr_node;
-                ++i;
-        }
-        return NULL;
 }
 static void *nr_node_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct hlist_node *node;
+        return seq_hlist_next(v, &nr_node_list, pos);
-        ++*pos;
-        node = (v == SEQ_START_TOKEN)
-                ? nr_node_list.first
-                : ((struct nr_node *)v)->node_node.next;
-        return hlist_entry(node, struct nr_node, node_node);
 }
 static void nr_node_stop(struct seq_file *seq, void *v)
@@ -906,7 +886,9 @@ static int nr_node_show(struct seq_file *seq, void *v)
                seq_puts(seq,
                         "callsign  mnemonic w n qual obs neigh qual obs neigh qual obs neigh\n");
        else {
-                struct nr_node *nr_node = v;
+                struct nr_node *nr_node = hlist_entry(v, struct nr_node,
+                                                      node_node);
                nr_node_lock(nr_node);
                seq_printf(seq, "%-9s %-7s  %d %d",
                        ax2asc(buf, &nr_node->callsign),
@@ -949,31 +931,13 @@ const struct file_operations nr_nodes_fops = {
 static void *nr_neigh_start(struct seq_file *seq, loff_t *pos)
 {
-        struct nr_neigh *nr_neigh;
-        struct hlist_node *node;
-        int i = 1;
        spin_lock_bh(&nr_neigh_list_lock);
-        if (*pos == 0)
+        return seq_hlist_start_head(&nr_neigh_list, *pos);
-                return SEQ_START_TOKEN;
-        nr_neigh_for_each(nr_neigh, node, &nr_neigh_list) {
-                if (i == *pos)
-                        return nr_neigh;
-        }
-        return NULL;
 }
 static void *nr_neigh_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct hlist_node *node;
+        return seq_hlist_next(v, &nr_neigh_list, pos);
-        ++*pos;
-        node = (v == SEQ_START_TOKEN)
-                ? nr_neigh_list.first
-                : ((struct nr_neigh *)v)->neigh_node.next;
-        return hlist_entry(node, struct nr_neigh, neigh_node);
 }
 static void nr_neigh_stop(struct seq_file *seq, void *v)
@@ -989,8 +953,9 @@ static int nr_neigh_show(struct seq_file *seq, void *v)
        if (v == SEQ_START_TOKEN)
                seq_puts(seq, "addr  callsign  dev  qual lock count failed digipeaters\n");
        else {
-                struct nr_neigh *nr_neigh = v;
+                struct nr_neigh *nr_neigh;
+                nr_neigh = hlist_entry(v, struct nr_neigh, neigh_node);
                seq_printf(seq, "%05d %-9s %-4s  %3d    %d   %3d    %3d",
                        nr_neigh->number,
                        ax2asc(buf, &nr_neigh->callsign),
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 6ecb426bc0cf..10f7295bcefb 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2510,33 +2510,19 @@ static struct notifier_block packet_netdev_notifier = {
 };
 #ifdef CONFIG_PROC_FS
-static inline struct sock *packet_seq_idx(struct net *net, loff_t off)
-{
-        struct sock *s;
-        struct hlist_node *node;
-        sk_for_each(s, node, &net->packet.sklist) {
-                if (!off--)
-                        return s;
-        }
-        return NULL;
-}
 static void *packet_seq_start(struct seq_file *seq, loff_t *pos)
        __acquires(seq_file_net(seq)->packet.sklist_lock)
 {
        struct net *net = seq_file_net(seq);
        read_lock(&net->packet.sklist_lock);
-        return *pos ? packet_seq_idx(net, *pos - 1) : SEQ_START_TOKEN;
+        return seq_hlist_start_head(&net->packet.sklist, *pos);
 }
 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
        struct net *net = seq_file_net(seq);
-        ++*pos;
+        return seq_hlist_next(v, &net->packet.sklist, pos);
-        return  (v == SEQ_START_TOKEN)
-                ? sk_head(&net->packet.sklist)
-                : sk_next((struct sock *)v) ;
 }
 static void packet_seq_stop(struct seq_file *seq, void *v)
@@ -2551,7 +2537,7 @@ static int packet_seq_show(struct seq_file *seq, void *v)
        if (v == SEQ_START_TOKEN)
                seq_puts(seq, "sk       RefCnt Type Proto  Iface R Rmem   User   Inode\n");
        else {
-                struct sock *s = v;
+                struct sock *s = sk_entry(v);
                const struct packet_sock *po = pkt_sk(s);
                seq_printf(seq,
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 8feb9e5d6623..e90b9b6c16ae 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1404,29 +1404,13 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 static void *rose_info_start(struct seq_file *seq, loff_t *pos)
        __acquires(rose_list_lock)
 {
-        int i;
-        struct sock *s;
-        struct hlist_node *node;
        spin_lock_bh(&rose_list_lock);
-        if (*pos == 0)
+        return seq_hlist_start_head(&rose_list, *pos);
-                return SEQ_START_TOKEN;
-        i = 1;
-        sk_for_each(s, node, &rose_list) {
-                if (i == *pos)
-                        return s;
-                ++i;
-        }
-        return NULL;
 }
 static void *rose_info_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        ++*pos;
+        return seq_hlist_next(v, &rose_list, pos);
-        return (v == SEQ_START_TOKEN) ? sk_head(&rose_list)
-                : sk_next((struct sock *)v);
 }
 static void rose_info_stop(struct seq_file *seq, void *v)
@@ -1444,7 +1428,7 @@ static int rose_info_show(struct seq_file *seq, void *v)
                         "dest_addr  dest_call src_addr   src_call  dev   lci neigh st vs vr va   t  t1  t2  t3  hb    idle Snd-Q Rcv-Q inode\n");
        else {
-                struct sock *s = v;
+                struct sock *s = sk_entry(v);
                struct rose_sock *rose = rose_sk(s);
                const char *devname, *callsign;
                const struct net_device *dev = rose->device;
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 49278f830367..9ea45383480e 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -78,7 +78,7 @@ rpc_timeout_upcall_queue(struct work_struct *work)
 }
 /**
- * rpc_queue_upcall
+ * rpc_queue_upcall - queue an upcall message to userspace
 * @inode: inode of upcall pipe on which to queue given message
 * @msg: message to queue
 *
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
index f591871a7b4f..1332c445d1c7 100644
--- a/net/wireless/radiotap.c
+++ b/net/wireless/radiotap.c
@@ -2,6 +2,16 @@
 * Radiotap parser
 *
 * Copyright 2007               Andy Green <andy@warmcat.com>
+ * Copyright 2009               Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of BSD
+ * license.
+ *
+ * See COPYING for more details.
 */
 #include <net/cfg80211.h>
@@ -10,6 +20,35 @@
 /* function prototypes and related defs are in include/net/cfg80211.h */
+static const struct radiotap_align_size rtap_namespace_sizes[] = {
+        [IEEE80211_RADIOTAP_TSFT] = { .align = 8, .size = 8, },
+        [IEEE80211_RADIOTAP_FLAGS] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_RATE] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_CHANNEL] = { .align = 2, .size = 4, },
+        [IEEE80211_RADIOTAP_FHSS] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_DBM_ANTSIGNAL] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_DBM_ANTNOISE] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_LOCK_QUALITY] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_TX_ATTENUATION] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_DB_TX_ATTENUATION] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_DBM_TX_POWER] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_ANTENNA] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_DB_ANTSIGNAL] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_DB_ANTNOISE] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_RX_FLAGS] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_TX_FLAGS] = { .align = 2, .size = 2, },
+        [IEEE80211_RADIOTAP_RTS_RETRIES] = { .align = 1, .size = 1, },
+        [IEEE80211_RADIOTAP_DATA_RETRIES] = { .align = 1, .size = 1, },
+        /*
+         * add more here as they are defined in radiotap.h
+         */
+};
+static const struct ieee80211_radiotap_namespace radiotap_ns = {
+        .n_bits = sizeof(rtap_namespace_sizes) / sizeof(rtap_namespace_sizes[0]),
+        .align_size = rtap_namespace_sizes,
+};
 /**
 * ieee80211_radiotap_iterator_init - radiotap parser iterator initialization
 * @iterator: radiotap_iterator to initialize
@@ -50,9 +89,9 @@
 */
 int ieee80211_radiotap_iterator_init(
-    struct ieee80211_radiotap_iterator *iterator,
+        struct ieee80211_radiotap_iterator *iterator,
-    struct ieee80211_radiotap_header *radiotap_header,
+        struct ieee80211_radiotap_header *radiotap_header,
-    int max_length)
+        int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
 {
        /* Linux only supports version 0 radiotap format */
        if (radiotap_header->it_version)
@@ -62,19 +101,24 @@ int ieee80211_radiotap_iterator_init(
        if (max_length < get_unaligned_le16(&radiotap_header->it_len))
                return -EINVAL;
-        iterator->rtheader = radiotap_header;
+        iterator->_rtheader = radiotap_header;
-        iterator->max_length = get_unaligned_le16(&radiotap_header->it_len);
+        iterator->_max_length = get_unaligned_le16(&radiotap_header->it_len);
-        iterator->arg_index = 0;
+        iterator->_arg_index = 0;
-        iterator->bitmap_shifter = get_unaligned_le32(&radiotap_header->it_present);
+        iterator->_bitmap_shifter = get_unaligned_le32(&radiotap_header->it_present);
-        iterator->arg = (u8 *)radiotap_header + sizeof(*radiotap_header);
+        iterator->_arg = (uint8_t *)radiotap_header + sizeof(*radiotap_header);
-        iterator->this_arg = NULL;
+        iterator->_reset_on_ext = 0;
+        iterator->_next_bitmap = &radiotap_header->it_present;
+        iterator->_next_bitmap++;
+        iterator->_vns = vns;
+        iterator->current_namespace = &radiotap_ns;
+        iterator->is_radiotap_ns = 1;
        /* find payload start allowing for extended bitmap(s) */
-        if (unlikely(iterator->bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT))) {
+        if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) {
-                while (get_unaligned_le32(iterator->arg) &
+                while (get_unaligned_le32(iterator->_arg) &
-                       (1 << IEEE80211_RADIOTAP_EXT)) {
+                                        (1 << IEEE80211_RADIOTAP_EXT)) {
-                        iterator->arg += sizeof(u32);
+                        iterator->_arg += sizeof(uint32_t);
                        /*
                         * check for insanity where the present bitmaps
@@ -82,12 +126,13 @@ int ieee80211_radiotap_iterator_init(
                         * stated radiotap header length
                         */
-                        if (((ulong)iterator->arg -
+                        if ((unsigned long)iterator->_arg -
-                             (ulong)iterator->rtheader) > iterator->max_length)
+                            (unsigned long)iterator->_rtheader >
+                            (unsigned long)iterator->_max_length)
                                return -EINVAL;
                }
-                iterator->arg += sizeof(u32);
+                iterator->_arg += sizeof(uint32_t);
                /*
                 * no need to check again for blowing past stated radiotap
@@ -96,12 +141,36 @@ int ieee80211_radiotap_iterator_init(
                 */
        }
+        iterator->this_arg = iterator->_arg;
        /* we are all initialized happily */
        return 0;
 }
 EXPORT_SYMBOL(ieee80211_radiotap_iterator_init);
+static void find_ns(struct ieee80211_radiotap_iterator *iterator,
+                    uint32_t oui, uint8_t subns)
+{
+        int i;
+        iterator->current_namespace = NULL;
+        if (!iterator->_vns)
+                return;
+        for (i = 0; i < iterator->_vns->n_ns; i++) {
+                if (iterator->_vns->ns[i].oui != oui)
+                        continue;
+                if (iterator->_vns->ns[i].subns != subns)
+                        continue;
+                iterator->current_namespace = &iterator->_vns->ns[i];
+                break;
+        }
+}
 /**
 * ieee80211_radiotap_iterator_next - return next radiotap parser iterator arg
@@ -127,99 +196,80 @@ EXPORT_SYMBOL(ieee80211_radiotap_iterator_init);
 */
 int ieee80211_radiotap_iterator_next(
-    struct ieee80211_radiotap_iterator *iterator)
+        struct ieee80211_radiotap_iterator *iterator)
 {
+        while (1) {
-        /*
-         * small length lookup table for all radiotap types we heard of
-         * starting from b0 in the bitmap, so we can walk the payload
-         * area of the radiotap header
-         *
-         * There is a requirement to pad args, so that args
-         * of a given length must begin at a boundary of that length
-         * -- but note that compound args are allowed (eg, 2 x u16
-         * for IEEE80211_RADIOTAP_CHANNEL) so total arg length is not
-         * a reliable indicator of alignment requirement.
-         *
-         * upper nybble: content alignment for arg
-         * lower nybble: content length for arg
-         */
-        static const u8 rt_sizes[] = {
-                [IEEE80211_RADIOTAP_TSFT] = 0x88,
-                [IEEE80211_RADIOTAP_FLAGS] = 0x11,
-                [IEEE80211_RADIOTAP_RATE] = 0x11,
-                [IEEE80211_RADIOTAP_CHANNEL] = 0x24,
-                [IEEE80211_RADIOTAP_FHSS] = 0x22,
-                [IEEE80211_RADIOTAP_DBM_ANTSIGNAL] = 0x11,
-                [IEEE80211_RADIOTAP_DBM_ANTNOISE] = 0x11,
-                [IEEE80211_RADIOTAP_LOCK_QUALITY] = 0x22,
-                [IEEE80211_RADIOTAP_TX_ATTENUATION] = 0x22,
-                [IEEE80211_RADIOTAP_DB_TX_ATTENUATION] = 0x22,
-                [IEEE80211_RADIOTAP_DBM_TX_POWER] = 0x11,
-                [IEEE80211_RADIOTAP_ANTENNA] = 0x11,
-                [IEEE80211_RADIOTAP_DB_ANTSIGNAL] = 0x11,
-                [IEEE80211_RADIOTAP_DB_ANTNOISE] = 0x11,
-                [IEEE80211_RADIOTAP_RX_FLAGS] = 0x22,
-                [IEEE80211_RADIOTAP_TX_FLAGS] = 0x22,
-                [IEEE80211_RADIOTAP_RTS_RETRIES] = 0x11,
-                [IEEE80211_RADIOTAP_DATA_RETRIES] = 0x11,
-                /*
-                 * add more here as they are defined in
-                 * include/net/ieee80211_radiotap.h
-                 */
-        };
-        /*
-         * for every radiotap entry we can at
-         * least skip (by knowing the length)...
-         */
-        while (iterator->arg_index < sizeof(rt_sizes)) {
                int hit = 0;
-                int pad;
+                int pad, align, size, subns, vnslen;
+                uint32_t oui;
-                if (!(iterator->bitmap_shifter & 1))
+                /* if no more EXT bits, that's it */
+                if ((iterator->_arg_index % 32) == IEEE80211_RADIOTAP_EXT &&
+                    !(iterator->_bitmap_shifter & 1))
+                        return -ENOENT;
+                if (!(iterator->_bitmap_shifter & 1))
                        goto next_entry; /* arg not present */
+                /* get alignment/size of data */
+                switch (iterator->_arg_index % 32) {
+                case IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE:
+                case IEEE80211_RADIOTAP_EXT:
+                        align = 1;
+                        size = 0;
+                        break;
+                case IEEE80211_RADIOTAP_VENDOR_NAMESPACE:
+                        align = 2;
+                        size = 6;
+                        break;
+                default:
+                        if (!iterator->current_namespace ||
+                            iterator->_arg_index >= iterator->current_namespace->n_bits) {
+                                if (iterator->current_namespace == &radiotap_ns)
+                                        return -ENOENT;
+                                align = 0;
+                        } else {
+                                align = iterator->current_namespace->align_size[iterator->_arg_index].align;
+                                size = iterator->current_namespace->align_size[iterator->_arg_index].size;
+                        }
+                        if (!align) {
+                                /* skip all subsequent data */
+                                iterator->_arg = iterator->_next_ns_data;
+                                /* give up on this namespace */
+                                iterator->current_namespace = NULL;
+                                goto next_entry;
+                        }
+                        break;
+                }
                /*
                 * arg is present, account for alignment padding
-                 *  8-bit args can be at any alignment
-                 * 16-bit args must start on 16-bit boundary
-                 * 32-bit args must start on 32-bit boundary
-                 * 64-bit args must start on 64-bit boundary
                 *
-                 * note that total arg size can differ from alignment of
+                 * Note that these alignments are relative to the start
-                 * elements inside arg, so we use upper nybble of length
+                 * of the radiotap header.  There is no guarantee
-                 * table to base alignment on
-                 *
-                 * also note: these alignments are ** relative to the
-                 * start of the radiotap header **.  There is no guarantee
                 * that the radiotap header itself is aligned on any
                 * kind of boundary.
                 *
-                 * the above is why get_unaligned() is used to dereference
+                 * The above is why get_unaligned() is used to dereference
-                 * multibyte elements from the radiotap area
+                 * multibyte elements from the radiotap area.
                 */
-                pad = (((ulong)iterator->arg) -
+                pad = ((unsigned long)iterator->_arg -
-                        ((ulong)iterator->rtheader)) &
+                       (unsigned long)iterator->_rtheader) & (align - 1);
-                        ((rt_sizes[iterator->arg_index] >> 4) - 1);
                if (pad)
-                        iterator->arg +=
+                        iterator->_arg += align - pad;
-                                (rt_sizes[iterator->arg_index] >> 4) - pad;
                /*
                 * this is what we will return to user, but we need to
                 * move on first so next call has something fresh to test
                 */
-                iterator->this_arg_index = iterator->arg_index;
+                iterator->this_arg_index = iterator->_arg_index;
-                iterator->this_arg = iterator->arg;
+                iterator->this_arg = iterator->_arg;
-                hit = 1;
+                iterator->this_arg_size = size;
                /* internally move on the size of this arg */
-                iterator->arg += rt_sizes[iterator->arg_index] & 0x0f;
+                iterator->_arg += size;
                /*
                 * check for insanity where we are given a bitmap that
@@ -228,32 +278,73 @@ int ieee80211_radiotap_iterator_next(
                 * max_length on the last arg, never exceeding it.
                 */
-                if (((ulong)iterator->arg - (ulong)iterator->rtheader) >
+                if ((unsigned long)iterator->_arg -
-                    iterator->max_length)
+                    (unsigned long)iterator->_rtheader >
+                    (unsigned long)iterator->_max_length)
                        return -EINVAL;
-        next_entry:
+                /* these special ones are valid in each bitmap word */
-                iterator->arg_index++;
+                switch (iterator->_arg_index % 32) {
-                if (unlikely((iterator->arg_index & 31) == 0)) {
+                case IEEE80211_RADIOTAP_VENDOR_NAMESPACE:
-                        /* completed current u32 bitmap */
+                        iterator->_bitmap_shifter >>= 1;
-                        if (iterator->bitmap_shifter & 1) {
+                        iterator->_arg_index++;
-                                /* b31 was set, there is more */
-                                /* move to next u32 bitmap */
+                        iterator->_reset_on_ext = 1;
-                                iterator->bitmap_shifter =
-                                    get_unaligned_le32(iterator->next_bitmap);
+                        vnslen = get_unaligned_le16(iterator->this_arg + 4);
-                                iterator->next_bitmap++;
+                        iterator->_next_ns_data = iterator->_arg + vnslen;
-                        } else
+                        oui = (*iterator->this_arg << 16) |
-                                /* no more bitmaps: end */
+                                (*(iterator->this_arg + 1) << 8) |
-                                iterator->arg_index = sizeof(rt_sizes);
+                                *(iterator->this_arg + 2);
-                } else /* just try the next bit */
+                        subns = *(iterator->this_arg + 3);
-                        iterator->bitmap_shifter >>= 1;
+                        find_ns(iterator, oui, subns);
+                        iterator->is_radiotap_ns = 0;
+                        /* allow parsers to show this information */
+                        iterator->this_arg_index =
+                                IEEE80211_RADIOTAP_VENDOR_NAMESPACE;
+                        iterator->this_arg_size += vnslen;
+                        if ((unsigned long)iterator->this_arg +
+                            iterator->this_arg_size -
+                            (unsigned long)iterator->_rtheader >
+                            (unsigned long)(unsigned long)iterator->_max_length)
+                                return -EINVAL;
+                        hit = 1;
+                        break;
+                case IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE:
+                        iterator->_bitmap_shifter >>= 1;
+                        iterator->_arg_index++;
+                        iterator->_reset_on_ext = 1;
+                        iterator->current_namespace = &radiotap_ns;
+                        iterator->is_radiotap_ns = 1;
+                        break;
+                case IEEE80211_RADIOTAP_EXT:
+                        /*
+                         * bit 31 was set, there is more
+                         * -- move to next u32 bitmap
+                         */
+                        iterator->_bitmap_shifter =
+                                get_unaligned_le32(iterator->_next_bitmap);
+                        iterator->_next_bitmap++;
+                        if (iterator->_reset_on_ext)
+                                iterator->_arg_index = 0;
+                        else
+                                iterator->_arg_index++;
+                        iterator->_reset_on_ext = 0;
+                        break;
+                default:
+                        /* we've got a hit! */
+                        hit = 1;
+ next_entry:
+                        iterator->_bitmap_shifter >>= 1;
+                        iterator->_arg_index++;
+                }
                /* if we found a valid arg earlier, return it now */
                if (hit)
                        return 0;
        }
-        /* we don't know how to handle any more args, we're done */
-        return -ENOENT;
 }
 EXPORT_SYMBOL(ieee80211_radiotap_iterator_next);
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index e3219e4cd044..9796f3ed1edb 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -55,6 +55,7 @@
 #include <linux/notifier.h>
 #include <linux/init.h>
 #include <linux/compat.h>
+#include <linux/ctype.h>
 #include <net/x25.h>
 #include <net/compat.h>
@@ -512,15 +513,20 @@ static int x25_create(struct net *net, struct socket *sock, int protocol,
 {
        struct sock *sk;
        struct x25_sock *x25;
-        int rc = -ESOCKTNOSUPPORT;
+        int rc = -EAFNOSUPPORT;
        if (!net_eq(net, &init_net))
-                return -EAFNOSUPPORT;
+                goto out;
-        if (sock->type != SOCK_SEQPACKET || protocol)
+        rc = -ESOCKTNOSUPPORT;
+        if (sock->type != SOCK_SEQPACKET)
                goto out;
-        rc = -ENOMEM;
+        rc = -EINVAL;
+        if (protocol)
+                goto out;
+        rc = -ENOBUFS;
        if ((sk = x25_alloc_socket(net)) == NULL)
                goto out;
@@ -643,7 +649,7 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
        struct sock *sk = sock->sk;
        struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
-        int rc = 0;
+        int len, i, rc = 0;
        lock_kernel();
        if (!sock_flag(sk, SOCK_ZAPPED) ||
@@ -653,6 +659,14 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                goto out;
        }
+        len = strlen(addr->sx25_addr.x25_addr);
+        for (i = 0; i < len; i++) {
+                if (!isdigit(addr->sx25_addr.x25_addr[i])) {
+                        rc = -EINVAL;
+                        goto out;
+                }
+        }
        x25_sk(sk)->source_addr = addr->sx25_addr;
        x25_insert_socket(sk);
        sock_reset_flag(sk, SOCK_ZAPPED);
diff --git a/net/x25/x25_proc.c b/net/x25/x25_proc.c
index 0a04e62e0e18..7ff373792324 100644
--- a/net/x25/x25_proc.c
+++ b/net/x25/x25_proc.c
@@ -25,49 +25,17 @@
 #include <net/x25.h>
 #ifdef CONFIG_PROC_FS
-static __inline__ struct x25_route *x25_get_route_idx(loff_t pos)
-{
-        struct list_head *route_entry;
-        struct x25_route *rt = NULL;
-        list_for_each(route_entry, &x25_route_list) {
-                rt = list_entry(route_entry, struct x25_route, node);
-                if (!pos--)
-                        goto found;
-        }
-        rt = NULL;
-found:
-        return rt;
-}
 static void *x25_seq_route_start(struct seq_file *seq, loff_t *pos)
        __acquires(x25_route_list_lock)
 {
-        loff_t l = *pos;
        read_lock_bh(&x25_route_list_lock);
-        return l ? x25_get_route_idx(--l) : SEQ_START_TOKEN;
+        return seq_list_start_head(&x25_route_list, *pos);
 }
 static void *x25_seq_route_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct x25_route *rt;
+        return seq_list_next(v, &x25_route_list, pos);
-        ++*pos;
-        if (v == SEQ_START_TOKEN) {
-                rt = NULL;
-                if (!list_empty(&x25_route_list))
-                        rt = list_entry(x25_route_list.next,
-                                        struct x25_route, node);
-                goto out;
-        }
-        rt = v;
-        if (rt->node.next != &x25_route_list)
-                rt = list_entry(rt->node.next, struct x25_route, node);
-        else
-                rt = NULL;
-out:
-        return rt;
 }
 static void x25_seq_route_stop(struct seq_file *seq, void *v)
@@ -78,9 +46,9 @@ static void x25_seq_route_stop(struct seq_file *seq, void *v)
 static int x25_seq_route_show(struct seq_file *seq, void *v)
 {
-        struct x25_route *rt;
+        struct x25_route *rt = list_entry(v, struct x25_route, node);
-        if (v == SEQ_START_TOKEN) {
+        if (v == &x25_route_list) {
                seq_puts(seq, "Address          Digits  Device\n");
                goto out;
        }
@@ -93,40 +61,16 @@ out:
        return 0;
 }
-static __inline__ struct sock *x25_get_socket_idx(loff_t pos)
-{
-        struct sock *s;
-        struct hlist_node *node;
-        sk_for_each(s, node, &x25_list)
-                if (!pos--)
-                        goto found;
-        s = NULL;
-found:
-        return s;
-}
 static void *x25_seq_socket_start(struct seq_file *seq, loff_t *pos)
        __acquires(x25_list_lock)
 {
-        loff_t l = *pos;
        read_lock_bh(&x25_list_lock);
-        return l ? x25_get_socket_idx(--l) : SEQ_START_TOKEN;
+        return seq_hlist_start_head(&x25_list, *pos);
 }
 static void *x25_seq_socket_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct sock *s;
+        return seq_hlist_next(v, &x25_list, pos);
-        ++*pos;
-        if (v == SEQ_START_TOKEN) {
-                s = sk_head(&x25_list);
-                goto out;
-        }
-        s = sk_next(v);
-out:
-        return s;
 }
 static void x25_seq_socket_stop(struct seq_file *seq, void *v)
@@ -148,7 +92,7 @@ static int x25_seq_socket_show(struct seq_file *seq, void *v)
                goto out;
        }
-        s = v;
+        s = sk_entry(v);
        x25 = x25_sk(s);
        if (!x25->neighbour || (dev = x25->neighbour->dev) == NULL)
@@ -170,51 +114,16 @@ out:
        return 0;
 }
-static __inline__ struct x25_forward *x25_get_forward_idx(loff_t pos)
-{
-        struct x25_forward *f;
-        struct list_head *entry;
-        list_for_each(entry, &x25_forward_list) {
-                f = list_entry(entry, struct x25_forward, node);
-                if (!pos--)
-                        goto found;
-        }
-        f = NULL;
-found:
-        return f;
-}
 static void *x25_seq_forward_start(struct seq_file *seq, loff_t *pos)
        __acquires(x25_forward_list_lock)
 {
-        loff_t l = *pos;
        read_lock_bh(&x25_forward_list_lock);
-        return l ? x25_get_forward_idx(--l) : SEQ_START_TOKEN;
+        return seq_list_start_head(&x25_forward_list, *pos);
 }
 static void *x25_seq_forward_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct x25_forward *f;
+        return seq_list_next(v, &x25_forward_list, pos);
-        ++*pos;
-        if (v == SEQ_START_TOKEN) {
-                f = NULL;
-                if (!list_empty(&x25_forward_list))
-                        f = list_entry(x25_forward_list.next,
-                                        struct x25_forward, node);
-                goto out;
-        }
-        f = v;
-        if (f->node.next != &x25_forward_list)
-                f = list_entry(f->node.next, struct x25_forward, node);
-        else
-                f = NULL;
-out:
-        return f;
 }
 static void x25_seq_forward_stop(struct seq_file *seq, void *v)
@@ -225,9 +134,9 @@ static void x25_seq_forward_stop(struct seq_file *seq, void *v)
 static int x25_seq_forward_show(struct seq_file *seq, void *v)
 {
-        struct x25_forward *f;
+        struct x25_forward *f = list_entry(v, struct x25_forward, node);
-        if (v == SEQ_START_TOKEN) {
+        if (v == &x25_forward_list) {
                seq_printf(seq, "lci dev1       dev2\n");
                goto out;
        }
@@ -236,7 +145,6 @@ static int x25_seq_forward_show(struct seq_file *seq, void *v)
        seq_printf(seq, "%d %-10s %-10s\n",
                        f->lci, f->dev1->name, f->dev2->name);
 out:
        return 0;
 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 0ecb16a9a883..eb870fcc29cc 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -771,7 +771,8 @@ xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audi
 int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
 {
-        int dir, err = 0;
+        int dir, err = 0, cnt = 0;
+        struct xfrm_policy *dp;
        write_lock_bh(&xfrm_policy_lock);
@@ -789,8 +790,10 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
                                     &net->xfrm.policy_inexact[dir], bydst) {
                        if (pol->type != type)
                                continue;
-                        __xfrm_policy_unlink(pol, dir);
+                        dp = __xfrm_policy_unlink(pol, dir);
                        write_unlock_bh(&xfrm_policy_lock);
+                        if (dp)
+                                cnt++;
                        xfrm_audit_policy_delete(pol, 1, audit_info->loginuid,
                                                 audit_info->sessionid,
@@ -809,8 +812,10 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
                                             bydst) {
                                if (pol->type != type)
                                        continue;
-                                __xfrm_policy_unlink(pol, dir);
+                                dp = __xfrm_policy_unlink(pol, dir);
                                write_unlock_bh(&xfrm_policy_lock);
+                                if (dp)
+                                        cnt++;
                                xfrm_audit_policy_delete(pol, 1,
                                                         audit_info->loginuid,
@@ -824,6 +829,8 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
                }
        }
+        if (!cnt)
+                err = -ESRCH;
        atomic_inc(&flow_cache_genid);
 out:
        write_unlock_bh(&xfrm_policy_lock);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index b36cc344474b..f50ee9badf47 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -603,13 +603,14 @@ xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audi
 int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info)
 {
-        int i, err = 0;
+        int i, err = 0, cnt = 0;
        spin_lock_bh(&xfrm_state_lock);
        err = xfrm_state_flush_secctx_check(net, proto, audit_info);
        if (err)
                goto out;
+        err = -ESRCH;
        for (i = 0; i <= net->xfrm.state_hmask; i++) {
                struct hlist_node *entry;
                struct xfrm_state *x;
@@ -626,13 +627,16 @@ restart:
                                                        audit_info->sessionid,
                                                        audit_info->secid);
                                xfrm_state_put(x);
+                                if (!err)
+                                        cnt++;
                                spin_lock_bh(&xfrm_state_lock);
                                goto restart;
                        }
                }
        }
-        err = 0;
+        if (cnt)
+                err = 0;
 out:
        spin_unlock_bh(&xfrm_state_lock);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d5a712976004..b0fb7d3bc15e 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1525,7 +1525,7 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
        audit_info.secid = NETLINK_CB(skb).sid;
        err = xfrm_state_flush(net, p->proto, &audit_info);
        if (err)
-                return err;
+                return 0;
        c.data.proto = p->proto;
        c.event = nlh->nlmsg_type;
        c.seq = nlh->nlmsg_seq;
@@ -1677,7 +1677,7 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
        audit_info.secid = NETLINK_CB(skb).sid;
        err = xfrm_policy_flush(net, type, &audit_info);
        if (err)
-                return err;
+                return 0;
        c.data.type = type;
        c.event = nlh->nlmsg_type;
        c.seq = nlh->nlmsg_seq;
@@ -2054,6 +2054,10 @@ static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
 #undef XMSGSIZE
 static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
+        [XFRMA_SA]              = { .len = sizeof(struct xfrm_usersa_info)},
+        [XFRMA_POLICY]          = { .len = sizeof(struct xfrm_userpolicy_info)},
+        [XFRMA_LASTUSED]        = { .type = NLA_U64},
+        [XFRMA_ALG_AUTH_TRUNC]  = { .len = sizeof(struct xfrm_algo_auth)},
        [XFRMA_ALG_AEAD]        = { .len = sizeof(struct xfrm_algo_aead) },
        [XFRMA_ALG_AUTH]        = { .len = sizeof(struct xfrm_algo) },
        [XFRMA_ALG_CRYPT]       = { .len = sizeof(struct xfrm_algo) },