154 files changed, 4229 insertions, 2960 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 8836575f9d79..511afe72af31 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -140,7 +140,7 @@ static void vlan_rcu_free(struct rcu_head *rcu)
         vlan_group_free(container_of(rcu, struct vlan_group, rcu));
 }
 
-void unregister_vlan_dev(struct net_device *dev)
+void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
 {
         struct vlan_dev_info *vlan = vlan_dev_info(dev);
         struct net_device *real_dev = vlan->real_dev;
@@ -159,12 +159,13 @@ void unregister_vlan_dev(struct net_device *dev)
         if (real_dev->features & NETIF_F_HW_VLAN_FILTER)
                 ops->ndo_vlan_rx_kill_vid(real_dev, vlan_id);
 
-        vlan_group_set_device(grp, vlan_id, NULL);
         grp->nr_vlans--;
 
-        synchronize_net();
-
-        unregister_netdevice(dev);
+        if (!grp->killall) {
+                vlan_group_set_device(grp, vlan_id, NULL);
+                synchronize_net();
+        }
+        unregister_netdevice_queue(dev, head);
 
         /* If the group is now empty, kill off the group. */
         if (grp->nr_vlans == 0) {
@@ -183,6 +184,34 @@ void unregister_vlan_dev(struct net_device *dev)
         dev_put(real_dev);
 }
 
+void unregister_vlan_dev_alls(struct vlan_group *grp)
+{
+        LIST_HEAD(list);
+        int i;
+        struct net_device *vlandev;
+        struct vlan_group save;
+
+        memcpy(&save, grp, sizeof(save));
+        memset(&grp->vlan_devices_arrays, 0, sizeof(grp->vlan_devices_arrays));
+        grp->killall = 1;
+
+        synchronize_net();
+
+        /* Delete all VLANs for this dev. */
+        for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
+                vlandev = vlan_group_get_device(&save, i);
+                if (!vlandev)
+                        continue;
+
+                unregister_vlan_dev(vlandev, &list);
+                if (grp->nr_vlans == 0)
+                        break;
+        }
+        unregister_netdevice_many(&list);
+        for (i = 0; i < VLAN_GROUP_ARRAY_SPLIT_PARTS; i++)
+                kfree(save.vlan_devices_arrays[i]);
+}
+
 static void vlan_transfer_operstate(const struct net_device *dev,
                                     struct net_device *vlandev)
 {
@@ -524,19 +553,7 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                 break;
 
         case NETDEV_UNREGISTER:
-                /* Delete all VLANs for this dev. */
-                for (i = 0; i < VLAN_GROUP_ARRAY_LEN; i++) {
-                        vlandev = vlan_group_get_device(grp, i);
-                        if (!vlandev)
-                                continue;
-
-                        /* unregistration of last vlan destroys group, abort
-                         * afterwards */
-                        if (grp->nr_vlans == 1)
-                                i = VLAN_GROUP_ARRAY_LEN;
-
-                        unregister_vlan_dev(vlandev);
-                }
+                unregister_vlan_dev_alls(grp);
                 break;
         }
 
@@ -642,7 +659,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg)
                 err = -EPERM;
                 if (!capable(CAP_NET_ADMIN))
                         break;
-                unregister_vlan_dev(dev);
+                unregister_vlan_dev(dev, NULL);
                 err = 0;
                 break;
 
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index 82570bc2a180..68f9290e6837 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -82,14 +82,14 @@ void vlan_dev_get_realdev_name(const struct net_device *dev, char *result);
 int vlan_check_real_dev(struct net_device *real_dev, u16 vlan_id);
 void vlan_setup(struct net_device *dev);
 int register_vlan_dev(struct net_device *dev);
-void unregister_vlan_dev(struct net_device *dev);
+void unregister_vlan_dev(struct net_device *dev, struct list_head *head);
 
 static inline u32 vlan_get_ingress_priority(struct net_device *dev,
                                             u16 vlan_tci)
 {
         struct vlan_dev_info *vip = vlan_dev_info(dev);
 
-        return vip->ingress_priority_map[(vlan_tci >> 13) & 0x7];
+        return vip->ingress_priority_map[(vlan_tci >> VLAN_PRIO_SHIFT) & 0x7];
 }
 
 #ifdef CONFIG_VLAN_8021Q_GVRP
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 4198ec5c8abc..790fd55ec318 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -393,7 +393,7 @@ int vlan_dev_set_egress_priority(const struct net_device *dev,
         struct vlan_dev_info *vlan = vlan_dev_info(dev);
         struct vlan_priority_tci_mapping *mp = NULL;
         struct vlan_priority_tci_mapping *np;
-        u32 vlan_qos = (vlan_prio << 13) & 0xE000;
+        u32 vlan_qos = (vlan_prio << VLAN_PRIO_SHIFT) & VLAN_PRIO_MASK;
 
         /* See if a priority mapping exists.. */
         mp = vlan->egress_priority_map[skb_prio & 0xF];
@@ -626,6 +626,17 @@ static int vlan_dev_fcoe_disable(struct net_device *dev)
                 rc = ops->ndo_fcoe_disable(real_dev);
         return rc;
 }
+
+static int vlan_dev_fcoe_get_wwn(struct net_device *dev, u64 *wwn, int type)
+{
+        struct net_device *real_dev = vlan_dev_info(dev)->real_dev;
+        const struct net_device_ops *ops = real_dev->netdev_ops;
+        int rc = -EINVAL;
+
+        if (ops->ndo_fcoe_get_wwn)
+                rc = ops->ndo_fcoe_get_wwn(real_dev, wwn, type);
+        return rc;
+}
 #endif
 
 static void vlan_dev_change_rx_flags(struct net_device *dev, int change)
@@ -791,6 +802,7 @@ static const struct net_device_ops vlan_netdev_ops = {
         .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
         .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
         .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
+        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
 #endif
 };
 
@@ -813,6 +825,7 @@ static const struct net_device_ops vlan_netdev_accel_ops = {
         .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
         .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
         .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
+        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
 #endif
 };
 
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index b1a4290996b5..abe38014b7fd 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1821,7 +1821,7 @@ static int atalk_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned lo
 #endif
 
 
-static struct net_proto_family atalk_family_ops = {
+static const struct net_proto_family atalk_family_ops = {
         .family         = PF_APPLETALK,
         .create         = atalk_create,
         .owner          = THIS_MODULE,
diff --git a/net/atm/common.c b/net/atm/common.c
index 950bd16d2383..d61e051e0a3f 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -496,7 +496,7 @@ int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         error = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
         if (error)
                 return error;
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
         pr_debug("RcvM %d -= %d\n", atomic_read(&sk->sk_rmem_alloc), skb->truesize);
         atm_return(vcc, skb->truesize);
         skb_free_datagram(sk, skb);
diff --git a/net/atm/pvc.c b/net/atm/pvc.c
index d4c024504f99..a6e1fdbae87f 100644
--- a/net/atm/pvc.c
+++ b/net/atm/pvc.c
@@ -137,7 +137,7 @@ static int pvc_create(struct net *net, struct socket *sock,int protocol)
 }
 
 
-static struct net_proto_family pvc_family_ops = {
+static const struct net_proto_family pvc_family_ops = {
         .family = PF_ATMPVC,
         .create = pvc_create,
         .owner = THIS_MODULE,
diff --git a/net/atm/svc.c b/net/atm/svc.c
index f90d143c4b25..819354233318 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -666,7 +666,7 @@ static int svc_create(struct net *net, struct socket *sock,int protocol)
 }
 
 
-static struct net_proto_family svc_family_ops = {
+static const struct net_proto_family svc_family_ops = {
         .family = PF_ATMSVC,
         .create = svc_create,
         .owner = THIS_MODULE,
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index f45460730371..f05306f168fa 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1961,7 +1961,7 @@ static const struct file_operations ax25_info_fops = {
 
 #endif
 
-static struct net_proto_family ax25_family_ops = {
+static const struct net_proto_family ax25_family_ops = {
         .family =       PF_AX25,
         .create =       ax25_create,
         .owner  =       THIS_MODULE,
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 8cfb5a849841..399e59c9c6cb 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -45,7 +45,7 @@
 
 /* Bluetooth sockets */
 #define BT_MAX_PROTO    8
-static struct net_proto_family *bt_proto[BT_MAX_PROTO];
+static const struct net_proto_family *bt_proto[BT_MAX_PROTO];
 static DEFINE_RWLOCK(bt_proto_lock);
 
 static struct lock_class_key bt_lock_key[BT_MAX_PROTO];
@@ -86,7 +86,7 @@ static inline void bt_sock_reclassify_lock(struct socket *sock, int proto)
                                 bt_key_strings[proto], &bt_lock_key[proto]);
 }
 
-int bt_sock_register(int proto, struct net_proto_family *ops)
+int bt_sock_register(int proto, const struct net_proto_family *ops)
 {
         int err = 0;
 
@@ -257,7 +257,7 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         skb_reset_transport_header(skb);
         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
         if (err == 0)
-                sock_recv_timestamp(msg, sk, skb);
+                sock_recv_ts_and_drops(msg, sk, skb);
 
         skb_free_datagram(sk, skb);
 
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
index e857628b0b27..0a2c5460bb48 100644
--- a/net/bluetooth/bnep/sock.c
+++ b/net/bluetooth/bnep/sock.c
@@ -222,7 +222,7 @@ static int bnep_sock_create(struct net *net, struct socket *sock, int protocol)
         return 0;
 }
 
-static struct net_proto_family bnep_sock_family_ops = {
+static const struct net_proto_family bnep_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = bnep_sock_create
diff --git a/net/bluetooth/cmtp/sock.c b/net/bluetooth/cmtp/sock.c
index 16b0fad74f6e..de7c8040bc56 100644
--- a/net/bluetooth/cmtp/sock.c
+++ b/net/bluetooth/cmtp/sock.c
@@ -217,7 +217,7 @@ static int cmtp_sock_create(struct net *net, struct socket *sock, int protocol)
         return 0;
 }
 
-static struct net_proto_family cmtp_sock_family_ops = {
+static const struct net_proto_family cmtp_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = cmtp_sock_create
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 75302a986067..e7395f231989 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -687,7 +687,7 @@ static int hci_sock_dev_event(struct notifier_block *this, unsigned long event,
         return NOTIFY_DONE;
 }
 
-static struct net_proto_family hci_sock_family_ops = {
+static const struct net_proto_family hci_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = hci_sock_create,
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 37c9d7d2e688..4beb6a7a2953 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -268,7 +268,7 @@ static int hidp_sock_create(struct net *net, struct socket *sock, int protocol)
         return 0;
 }
 
-static struct net_proto_family hidp_sock_family_ops = {
+static const struct net_proto_family hidp_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = hidp_sock_create
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 77e9fb130adb..d65101d92ee5 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -3919,7 +3919,7 @@ static const struct proto_ops l2cap_sock_ops = {
         .getsockopt     = l2cap_sock_getsockopt
 };
 
-static struct net_proto_family l2cap_sock_family_ops = {
+static const struct net_proto_family l2cap_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = l2cap_sock_create,
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 8a20aaf1f231..d3bfc1b0afb1 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -703,7 +703,7 @@ static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                 copied += chunk;
                 size   -= chunk;
 
-                sock_recv_timestamp(msg, sk, skb);
+                sock_recv_ts_and_drops(msg, sk, skb);
 
                 if (!(flags & MSG_PEEK)) {
                         atomic_sub(chunk, &sk->sk_rmem_alloc);
@@ -1101,7 +1101,7 @@ static const struct proto_ops rfcomm_sock_ops = {
         .mmap           = sock_no_mmap
 };
 
-static struct net_proto_family rfcomm_sock_family_ops = {
+static const struct net_proto_family rfcomm_sock_family_ops = {
         .family         = PF_BLUETOOTH,
         .owner          = THIS_MODULE,
         .create         = rfcomm_sock_create
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 77f4153bdb5e..694a65541b73 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -993,7 +993,7 @@ static const struct proto_ops sco_sock_ops = {
         .getsockopt     = sco_sock_getsockopt
 };
 
-static struct net_proto_family sco_sock_family_ops = {
+static const struct net_proto_family sco_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = sco_sock_create,
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 07a07770c8b6..1a99c4e04e85 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -157,6 +157,7 @@ static const struct ethtool_ops br_ethtool_ops = {
         .get_tso        = ethtool_op_get_tso,
         .set_tso        = br_set_tso,
         .get_ufo        = ethtool_op_get_ufo,
+        .set_ufo        = ethtool_op_set_ufo,
         .get_flags      = ethtool_op_get_flags,
 };
 
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index b1b3b0fbf41c..2117e5ba24c8 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -154,7 +154,7 @@ static void del_nbp(struct net_bridge_port *p)
 }
 
 /* called with RTNL */
-static void del_br(struct net_bridge *br)
+static void del_br(struct net_bridge *br, struct list_head *head)
 {
         struct net_bridge_port *p, *n;
 
@@ -165,7 +165,7 @@ static void del_br(struct net_bridge *br)
         del_timer_sync(&br->gc_timer);
 
         br_sysfs_delbr(br->dev);
-        unregister_netdevice(br->dev);
+        unregister_netdevice_queue(br->dev, head);
 }
 
 static struct net_device *new_bridge_dev(struct net *net, const char *name)
@@ -323,7 +323,7 @@ int br_del_bridge(struct net *net, const char *name)
         }
 
         else
-                del_br(netdev_priv(dev));
+                del_br(netdev_priv(dev), NULL);
 
         rtnl_unlock();
         return ret;
@@ -462,15 +462,14 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
 void br_net_exit(struct net *net)
 {
         struct net_device *dev;
+        LIST_HEAD(list);
 
         rtnl_lock();
-restart:
-        for_each_netdev(net, dev) {
-                if (dev->priv_flags & IFF_EBRIDGE) {
-                        del_br(netdev_priv(dev));
-                        goto restart;
-                }
-        }
+        for_each_netdev(net, dev)
+                if (dev->priv_flags & IFF_EBRIDGE)
+                        del_br(netdev_priv(dev), &list);
+
+        unregister_netdevice_many(&list);
         rtnl_unlock();
 
 }
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 606832115674..3f2eb27e1ffb 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -842,7 +842,7 @@ static struct packet_type can_packet __read_mostly = {
         .func = can_rcv,
 };
 
-static struct net_proto_family can_family_ops __read_mostly = {
+static const struct net_proto_family can_family_ops = {
         .family = PF_CAN,
         .create = can_create,
         .owner  = THIS_MODULE,
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 597da4f8f888..2f47039c79dd 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1534,7 +1534,7 @@ static int bcm_recvmsg(struct kiocb *iocb, struct socket *sock,
                 return err;
         }
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         if (msg->msg_name) {
                 msg->msg_namelen = sizeof(struct sockaddr_can);
diff --git a/net/can/raw.c b/net/can/raw.c
index b5e897922d32..6e77db58b9e6 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -424,8 +424,6 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
 
         if (level != SOL_CAN_RAW)
                 return -EINVAL;
-        if (optlen < 0)
-                return -EINVAL;
 
         switch (optname) {
 
@@ -702,7 +700,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct socket *sock,
                 return err;
         }
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         if (msg->msg_name) {
                 msg->msg_namelen = sizeof(struct sockaddr_can);
diff --git a/net/compat.c b/net/compat.c
index a407c3addbae..6a2f75fb3f45 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -390,9 +390,6 @@ asmlinkage long compat_sys_setsockopt(int fd, int level, int optname,
         int err;
         struct socket *sock;
 
-        if (optlen < 0)
-                return -EINVAL;
-
         if ((sock = sockfd_lookup(fd, &err))!=NULL)
         {
                 err = security_socket_setsockopt(sock,level,optname);
@@ -727,10 +724,10 @@ EXPORT_SYMBOL(compat_mc_getsockopt);
 
 /* Argument list sizes for compat_sys_socketcall */
 #define AL(x) ((x) * sizeof(u32))
-static unsigned char nas[19]={AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
+static unsigned char nas[20]={AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
                                 AL(3),AL(3),AL(4),AL(4),AL(4),AL(6),
                                 AL(6),AL(2),AL(5),AL(5),AL(3),AL(3),
-                                AL(4)};
+                                AL(4),AL(5)};
 #undef AL
 
 asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned flags)
@@ -755,13 +752,36 @@ asmlinkage long compat_sys_recvfrom(int fd, void __user *buf, size_t len,
         return sys_recvfrom(fd, buf, len, flags | MSG_CMSG_COMPAT, addr, addrlen);
 }
 
+asmlinkage long compat_sys_recvmmsg(int fd, struct compat_mmsghdr __user *mmsg,
+                                    unsigned vlen, unsigned int flags,
+                                    struct timespec __user *timeout)
+{
+        int datagrams;
+        struct timespec ktspec;
+        struct compat_timespec __user *utspec =
+                        (struct compat_timespec __user *)timeout;
+
+        if (get_user(ktspec.tv_sec, &utspec->tv_sec) ||
+            get_user(ktspec.tv_nsec, &utspec->tv_nsec))
+                return -EFAULT;
+
+        datagrams = __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+                                   flags | MSG_CMSG_COMPAT, &ktspec);
+        if (datagrams > 0 &&
+            (put_user(ktspec.tv_sec, &utspec->tv_sec) ||
+             put_user(ktspec.tv_nsec, &utspec->tv_nsec)))
+                datagrams = -EFAULT;
+
+        return datagrams;
+}
+
 asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
 {
         int ret;
         u32 a[6];
         u32 a0, a1;
 
-        if (call < SYS_SOCKET || call > SYS_ACCEPT4)
+        if (call < SYS_SOCKET || call > SYS_RECVMMSG)
                 return -EINVAL;
         if (copy_from_user(a, args, nas[call]))
                 return -EFAULT;
@@ -823,6 +843,10 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
         case SYS_RECVMSG:
                 ret = compat_sys_recvmsg(a0, compat_ptr(a1), a[2]);
                 break;
+        case SYS_RECVMMSG:
+                ret = compat_sys_recvmmsg(a0, compat_ptr(a1), a[2], a[3],
+                                          compat_ptr(a[4]));
+                break;
         case SYS_ACCEPT4:
                 ret = sys_accept4(a0, compat_ptr(a1), compat_ptr(a[2]), a[3]);
                 break;
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 1c6cf3a1a4f6..4d57f5e12b05 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -262,6 +262,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
         }
 
         kfree_skb(skb);
+        atomic_inc(&sk->sk_drops);
         sk_mem_reclaim_partial(sk);
 
         return err;
diff --git a/net/core/dev.c b/net/core/dev.c
index b8f74cfb1bfd..68a1bb68b5a8 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -193,18 +193,15 @@ static struct list_head ptype_all __read_mostly;	/* Taps */
 DEFINE_RWLOCK(dev_base_lock);
 EXPORT_SYMBOL(dev_base_lock);
 
-#define NETDEV_HASHBITS 8
-#define NETDEV_HASHENTRIES (1 << NETDEV_HASHBITS)
-
 static inline struct hlist_head *dev_name_hash(struct net *net, const char *name)
 {
         unsigned hash = full_name_hash(name, strnlen(name, IFNAMSIZ));
-        return &net->dev_name_head[hash & ((1 << NETDEV_HASHBITS) - 1)];
+        return &net->dev_name_head[hash & (NETDEV_HASHENTRIES - 1)];
 }
 
 static inline struct hlist_head *dev_index_hash(struct net *net, int ifindex)
 {
-        return &net->dev_index_head[ifindex & ((1 << NETDEV_HASHBITS) - 1)];
+        return &net->dev_index_head[ifindex & (NETDEV_HASHENTRIES - 1)];
 }
 
 /* Device list insertion */
@@ -217,12 +214,15 @@ static int list_netdevice(struct net_device *dev)
         write_lock_bh(&dev_base_lock);
         list_add_tail(&dev->dev_list, &net->dev_base_head);
         hlist_add_head(&dev->name_hlist, dev_name_hash(net, dev->name));
-        hlist_add_head(&dev->index_hlist, dev_index_hash(net, dev->ifindex));
+        hlist_add_head_rcu(&dev->index_hlist,
+                           dev_index_hash(net, dev->ifindex));
         write_unlock_bh(&dev_base_lock);
         return 0;
 }
 
-/* Device list removal */
+/* Device list removal
+ * caller must respect a RCU grace period before freeing/reusing dev
+ */
 static void unlist_netdevice(struct net_device *dev)
 {
         ASSERT_RTNL();
@@ -231,7 +231,7 @@ static void unlist_netdevice(struct net_device *dev)
         write_lock_bh(&dev_base_lock);
         list_del(&dev->dev_list);
         hlist_del(&dev->name_hlist);
-        hlist_del(&dev->index_hlist);
+        hlist_del_rcu(&dev->index_hlist);
         write_unlock_bh(&dev_base_lock);
 }
 
@@ -649,6 +649,31 @@ struct net_device *__dev_get_by_index(struct net *net, int ifindex)
 }
 EXPORT_SYMBOL(__dev_get_by_index);
 
+/**
+ *      dev_get_by_index_rcu - find a device by its ifindex
+ *      @net: the applicable net namespace
+ *      @ifindex: index of device
+ *
+ *      Search for an interface by index. Returns %NULL if the device
+ *      is not found or a pointer to the device. The device has not
+ *      had its reference counter increased so the caller must be careful
+ *      about locking. The caller must hold RCU lock.
+ */
+
+struct net_device *dev_get_by_index_rcu(struct net *net, int ifindex)
+{
+        struct hlist_node *p;
+        struct net_device *dev;
+        struct hlist_head *head = dev_index_hash(net, ifindex);
+
+        hlist_for_each_entry_rcu(dev, p, head, index_hlist)
+                if (dev->ifindex == ifindex)
+                        return dev;
+
+        return NULL;
+}
+EXPORT_SYMBOL(dev_get_by_index_rcu);
+
 
 /**
  *      dev_get_by_index - find a device by its ifindex
@@ -665,11 +690,11 @@ struct net_device *dev_get_by_index(struct net *net, int ifindex)
 {
         struct net_device *dev;
 
-        read_lock(&dev_base_lock);
-        dev = __dev_get_by_index(net, ifindex);
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(net, ifindex);
         if (dev)
                 dev_hold(dev);
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
         return dev;
 }
 EXPORT_SYMBOL(dev_get_by_index);
@@ -1791,13 +1816,25 @@ EXPORT_SYMBOL(skb_tx_hash);
 static struct netdev_queue *dev_pick_tx(struct net_device *dev,
                                         struct sk_buff *skb)
 {
-        const struct net_device_ops *ops = dev->netdev_ops;
-        u16 queue_index = 0;
+        u16 queue_index;
+        struct sock *sk = skb->sk;
+
+        if (sk_tx_queue_recorded(sk)) {
+                queue_index = sk_tx_queue_get(sk);
+        } else {
+                const struct net_device_ops *ops = dev->netdev_ops;
+
+                if (ops->ndo_select_queue) {
+                        queue_index = ops->ndo_select_queue(dev, skb);
+                } else {
+                        queue_index = 0;
+                        if (dev->real_num_tx_queues > 1)
+                                queue_index = skb_tx_hash(dev, skb);
 
-        if (ops->ndo_select_queue)
-                queue_index = ops->ndo_select_queue(dev, skb);
-        else if (dev->real_num_tx_queues > 1)
-                queue_index = skb_tx_hash(dev, skb);
+                        if (sk && sk->sk_dst_cache)
+                                sk_tx_queue_set(sk, queue_index);
+                }
+        }
 
         skb_set_queue_mapping(skb, queue_index);
         return netdev_get_tx_queue(dev, queue_index);
@@ -2291,7 +2328,7 @@ int netif_receive_skb(struct sk_buff *skb)
         if (!skb->tstamp.tv64)
                 net_timestamp(skb);
 
-        if (skb->vlan_tci && vlan_hwaccel_do_receive(skb))
+        if (vlan_tx_tag_present(skb) && vlan_hwaccel_do_receive(skb))
                 return NET_RX_SUCCESS;
 
         /* if we've gotten here through NAPI, check netpoll */
@@ -2604,20 +2641,13 @@ EXPORT_SYMBOL(napi_reuse_skb);
 
 struct sk_buff *napi_get_frags(struct napi_struct *napi)
 {
-        struct net_device *dev = napi->dev;
         struct sk_buff *skb = napi->skb;
 
         if (!skb) {
-                skb = netdev_alloc_skb(dev, GRO_MAX_HEAD + NET_IP_ALIGN);
-                if (!skb)
-                        goto out;
-
-                skb_reserve(skb, NET_IP_ALIGN);
-
-                napi->skb = skb;
+                skb = netdev_alloc_skb_ip_align(napi->dev, GRO_MAX_HEAD);
+                if (skb)
+                        napi->skb = skb;
         }
-
-out:
         return skb;
 }
 EXPORT_SYMBOL(napi_get_frags);
@@ -2937,15 +2967,15 @@ static int dev_ifname(struct net *net, struct ifreq __user *arg)
         if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
                 return -EFAULT;
 
-        read_lock(&dev_base_lock);
-        dev = __dev_get_by_index(net, ifr.ifr_ifindex);
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(net, ifr.ifr_ifindex);
         if (!dev) {
-                read_unlock(&dev_base_lock);
+                rcu_read_unlock();
                 return -ENODEV;
         }
 
         strcpy(ifr.ifr_name, dev->name);
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 
         if (copy_to_user(arg, &ifr, sizeof(struct ifreq)))
                 return -EFAULT;
@@ -4635,59 +4665,76 @@ static void net_set_todo(struct net_device *dev)
         list_add_tail(&dev->todo_list, &net_todo_list);
 }
 
-static void rollback_registered(struct net_device *dev)
+static void rollback_registered_many(struct list_head *head)
 {
+        struct net_device *dev;
+
         BUG_ON(dev_boot_phase);
         ASSERT_RTNL();
 
-        /* Some devices call without registering for initialization unwind. */
-        if (dev->reg_state == NETREG_UNINITIALIZED) {
-                printk(KERN_DEBUG "unregister_netdevice: device %s/%p never "
-                                  "was registered\n", dev->name, dev);
+        list_for_each_entry(dev, head, unreg_list) {
+                /* Some devices call without registering
+                 * for initialization unwind.
+                 */
+                if (dev->reg_state == NETREG_UNINITIALIZED) {
+                        pr_debug("unregister_netdevice: device %s/%p never "
+                                 "was registered\n", dev->name, dev);
 
-                WARN_ON(1);
-                return;
-        }
+                        WARN_ON(1);
+                        return;
+                }
 
-        BUG_ON(dev->reg_state != NETREG_REGISTERED);
+                BUG_ON(dev->reg_state != NETREG_REGISTERED);
 
-        /* If device is running, close it first. */
-        dev_close(dev);
+                /* If device is running, close it first. */
+                dev_close(dev);
 
-        /* And unlink it from device chain. */
-        unlist_netdevice(dev);
+                /* And unlink it from device chain. */
+                unlist_netdevice(dev);
 
-        dev->reg_state = NETREG_UNREGISTERING;
+                dev->reg_state = NETREG_UNREGISTERING;
+        }
 
         synchronize_net();
 
-        /* Shutdown queueing discipline. */
-        dev_shutdown(dev);
+        list_for_each_entry(dev, head, unreg_list) {
+                /* Shutdown queueing discipline. */
+                dev_shutdown(dev);
 
 
-        /* Notify protocols, that we are about to destroy
-           this device. They should clean all the things.
-        */
-        call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
+                /* Notify protocols, that we are about to destroy
+                   this device. They should clean all the things.
+                */
+                call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
 
-        /*
-         *      Flush the unicast and multicast chains
-         */
-        dev_unicast_flush(dev);
-        dev_addr_discard(dev);
+                /*
+                 *      Flush the unicast and multicast chains
+                 */
+                dev_unicast_flush(dev);
+                dev_addr_discard(dev);
 
-        if (dev->netdev_ops->ndo_uninit)
-                dev->netdev_ops->ndo_uninit(dev);
+                if (dev->netdev_ops->ndo_uninit)
+                        dev->netdev_ops->ndo_uninit(dev);
 
-        /* Notifier chain MUST detach us from master device. */
-        WARN_ON(dev->master);
+                /* Notifier chain MUST detach us from master device. */
+                WARN_ON(dev->master);
 
-        /* Remove entries from kobject tree */
-        netdev_unregister_kobject(dev);
+                /* Remove entries from kobject tree */
+                netdev_unregister_kobject(dev);
+        }
 
         synchronize_net();
 
-        dev_put(dev);
+        list_for_each_entry(dev, head, unreg_list)
+                dev_put(dev);
+}
+
+static void rollback_registered(struct net_device *dev)
+{
+        LIST_HEAD(single);
+
+        list_add(&dev->unreg_list, &single);
+        rollback_registered_many(&single);
 }
 
 static void __netdev_init_queue_locks_one(struct net_device *dev,
@@ -4836,6 +4883,12 @@ int register_netdevice(struct net_device *dev)
                 dev->features |= NETIF_F_GSO;
 
         netdev_initialize_kobject(dev);
+
+        ret = call_netdevice_notifiers(NETDEV_POST_INIT, dev);
+        ret = notifier_to_errno(ret);
+        if (ret)
+                goto err_uninit;
+
         ret = netdev_register_kobject(dev);
         if (ret)
                 goto err_uninit;
@@ -5237,25 +5290,48 @@ void synchronize_net(void)
 EXPORT_SYMBOL(synchronize_net);
 
 /**
- *      unregister_netdevice - remove device from the kernel
+ *      unregister_netdevice_queue - remove device from the kernel
  *      @dev: device
- *
+ *      @head: list
+
  *      This function shuts down a device interface and removes it
  *      from the kernel tables.
+ *      If head not NULL, device is queued to be unregistered later.
  *
  *      Callers must hold the rtnl semaphore.  You may want
  *      unregister_netdev() instead of this.
  */
 
-void unregister_netdevice(struct net_device *dev)
+void unregister_netdevice_queue(struct net_device *dev, struct list_head *head)
 {
         ASSERT_RTNL();
 
-        rollback_registered(dev);
-        /* Finish processing unregister after unlock */
-        net_set_todo(dev);
+        if (head) {
+                list_add_tail(&dev->unreg_list, head);
+        } else {
+                rollback_registered(dev);
+                /* Finish processing unregister after unlock */
+                net_set_todo(dev);
+        }
+}
+EXPORT_SYMBOL(unregister_netdevice_queue);
+
+/**
+ *      unregister_netdevice_many - unregister many devices
+ *      @head: list of devices
+ *
+ */
+void unregister_netdevice_many(struct list_head *head)
+{
+        struct net_device *dev;
+
+        if (!list_empty(head)) {
+                rollback_registered_many(head);
+                list_for_each_entry(dev, head, unreg_list)
+                        net_set_todo(dev);
+        }
 }
-EXPORT_SYMBOL(unregister_netdevice);
+EXPORT_SYMBOL(unregister_netdevice_many);
 
 /**
  *      unregister_netdev - remove device from the kernel
@@ -5483,7 +5559,7 @@ unsigned long netdev_increment_features(unsigned long all, unsigned long one,
         one |= NETIF_F_ALL_CSUM;
 
         one |= all & NETIF_F_ONE_FOR_ALL;
-        all &= one | NETIF_F_LLTX | NETIF_F_GSO;
+        all &= one | NETIF_F_LLTX | NETIF_F_GSO | NETIF_F_UFO;
         all |= one & mask & NETIF_F_ONE_FOR_ALL;
 
         return all;
@@ -5582,7 +5658,7 @@ restart:
 
                 /* Delete virtual devices */
                 if (dev->rtnl_link_ops && dev->rtnl_link_ops->dellink) {
-                        dev->rtnl_link_ops->dellink(dev);
+                        dev->rtnl_link_ops->dellink(dev, NULL);
                         goto restart;
                 }
 
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 4c12ddb5f5ee..d8aee584e8d1 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -198,13 +198,6 @@ static int ethtool_get_drvinfo(struct net_device *dev, void __user *useraddr)
                 rc = ops->get_sset_count(dev, ETH_SS_PRIV_FLAGS);
                 if (rc >= 0)
                         info.n_priv_flags = rc;
-        } else {
-                /* code path for obsolete hooks */
-
-                if (ops->self_test_count)
-                        info.testinfo_len = ops->self_test_count(dev);
-                if (ops->get_stats_count)
-                        info.n_stats = ops->get_stats_count(dev);
         }
         if (ops->get_regs_len)
                 info.regdump_len = ops->get_regs_len(dev);
@@ -309,6 +302,26 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
         return ret;
 }
 
+static int ethtool_reset(struct net_device *dev, char __user *useraddr)
+{
+        struct ethtool_value reset;
+        int ret;
+
+        if (!dev->ethtool_ops->reset)
+                return -EOPNOTSUPP;
+
+        if (copy_from_user(&reset, useraddr, sizeof(reset)))
+                return -EFAULT;
+
+        ret = dev->ethtool_ops->reset(dev, &reset.data);
+        if (ret)
+                return ret;
+
+        if (copy_to_user(useraddr, &reset, sizeof(reset)))
+                return -EFAULT;
+        return 0;
+}
+
 static int ethtool_get_wol(struct net_device *dev, char __user *useraddr)
 {
         struct ethtool_wolinfo wol = { ETHTOOL_GWOL };
@@ -684,16 +697,10 @@ static int ethtool_self_test(struct net_device *dev, char __user *useraddr)
         u64 *data;
         int ret, test_len;
 
-        if (!ops->self_test)
-                return -EOPNOTSUPP;
-        if (!ops->get_sset_count && !ops->self_test_count)
+        if (!ops->self_test || !ops->get_sset_count)
                 return -EOPNOTSUPP;
 
-        if (ops->get_sset_count)
-                test_len = ops->get_sset_count(dev, ETH_SS_TEST);
-        else
-                /* code path for obsolete hook */
-                test_len = ops->self_test_count(dev);
+        test_len = ops->get_sset_count(dev, ETH_SS_TEST);
         if (test_len < 0)
                 return test_len;
         WARN_ON(test_len == 0);
@@ -728,36 +735,17 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr)
         u8 *data;
         int ret;
 
-        if (!ops->get_strings)
+        if (!ops->get_strings || !ops->get_sset_count)
                 return -EOPNOTSUPP;
 
         if (copy_from_user(&gstrings, useraddr, sizeof(gstrings)))
                 return -EFAULT;
 
-        if (ops->get_sset_count) {
-                ret = ops->get_sset_count(dev, gstrings.string_set);
-                if (ret < 0)
-                        return ret;
-
-                gstrings.len = ret;
-        } else {
-                /* code path for obsolete hooks */
-
-                switch (gstrings.string_set) {
-                case ETH_SS_TEST:
-                        if (!ops->self_test_count)
-                                return -EOPNOTSUPP;
-                        gstrings.len = ops->self_test_count(dev);
-                        break;
-                case ETH_SS_STATS:
-                        if (!ops->get_stats_count)
-                                return -EOPNOTSUPP;
-                        gstrings.len = ops->get_stats_count(dev);
-                        break;
-                default:
-                        return -EINVAL;
-                }
-        }
+        ret = ops->get_sset_count(dev, gstrings.string_set);
+        if (ret < 0)
+                return ret;
+
+        gstrings.len = ret;
 
         data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER);
         if (!data)
@@ -798,16 +786,10 @@ static int ethtool_get_stats(struct net_device *dev, void __user *useraddr)
         u64 *data;
         int ret, n_stats;
 
-        if (!ops->get_ethtool_stats)
-                return -EOPNOTSUPP;
-        if (!ops->get_sset_count && !ops->get_stats_count)
+        if (!ops->get_ethtool_stats || !ops->get_sset_count)
                 return -EOPNOTSUPP;
 
-        if (ops->get_sset_count)
-                n_stats = ops->get_sset_count(dev, ETH_SS_STATS);
-        else
-                /* code path for obsolete hook */
-                n_stats = ops->get_stats_count(dev);
+        n_stats = ops->get_sset_count(dev, ETH_SS_STATS);
         if (n_stats < 0)
                 return n_stats;
         WARN_ON(n_stats == 0);
@@ -1127,6 +1109,9 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_FLASHDEV:
                 rc = ethtool_flash_device(dev, useraddr);
                 break;
+        case ETHTOOL_RESET:
+                rc = ethtool_reset(dev, useraddr);
+                break;
         default:
                 rc = -EOPNOTSUPP;
         }
diff --git a/net/core/filter.c b/net/core/filter.c
index d1d779ca096d..08db7b9143a3 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -303,6 +303,12 @@ load_b:
                 case SKF_AD_IFINDEX:
                         A = skb->dev->ifindex;
                         continue;
+                case SKF_AD_MARK:
+                        A = skb->mark;
+                        continue;
+                case SKF_AD_QUEUE:
+                        A = skb->queue_mapping;
+                        continue;
                 case SKF_AD_NLATTR: {
                         struct nlattr *nla;
 
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index 8569310268ab..393b1d8618e2 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -127,6 +127,7 @@ gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic_packed *b)
 /**
  * gnet_stats_copy_rate_est - copy rate estimator statistics into statistics TLV
  * @d: dumping handle
+ * @b: basic statistics
  * @r: rate estimator statistics
  *
  * Appends the rate estimator statistics to the top level TLV created by
@@ -136,8 +137,13 @@ gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic_packed *b)
  * if the room in the socket buffer was not sufficient.
  */
 int
-gnet_stats_copy_rate_est(struct gnet_dump *d, struct gnet_stats_rate_est *r)
+gnet_stats_copy_rate_est(struct gnet_dump *d,
+                         const struct gnet_stats_basic_packed *b,
+                         struct gnet_stats_rate_est *r)
 {
+        if (b && !gen_estimator_active(b, r))
+                return 0;
+
         if (d->compat_tc_stats) {
                 d->tc_stats.bps = r->bps;
                 d->tc_stats.pps = r->pps;
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 427ded841224..89de182353b0 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -130,6 +130,48 @@ static ssize_t show_carrier(struct device *dev,
         return -EINVAL;
 }
 
+static ssize_t show_speed(struct device *dev,
+                          struct device_attribute *attr, char *buf)
+{
+        struct net_device *netdev = to_net_dev(dev);
+        int ret = -EINVAL;
+
+        if (!rtnl_trylock())
+                return restart_syscall();
+
+        if (netif_running(netdev) &&
+            netdev->ethtool_ops &&
+            netdev->ethtool_ops->get_settings) {
+                struct ethtool_cmd cmd = { ETHTOOL_GSET };
+
+                if (!netdev->ethtool_ops->get_settings(netdev, &cmd))
+                        ret = sprintf(buf, fmt_dec, ethtool_cmd_speed(&cmd));
+        }
+        rtnl_unlock();
+        return ret;
+}
+
+static ssize_t show_duplex(struct device *dev,
+                           struct device_attribute *attr, char *buf)
+{
+        struct net_device *netdev = to_net_dev(dev);
+        int ret = -EINVAL;
+
+        if (!rtnl_trylock())
+                return restart_syscall();
+
+        if (netif_running(netdev) &&
+            netdev->ethtool_ops &&
+            netdev->ethtool_ops->get_settings) {
+                struct ethtool_cmd cmd = { ETHTOOL_GSET };
+
+                if (!netdev->ethtool_ops->get_settings(netdev, &cmd))
+                        ret = sprintf(buf, "%s\n", cmd.duplex ? "full" : "half");
+        }
+        rtnl_unlock();
+        return ret;
+}
+
 static ssize_t show_dormant(struct device *dev,
                             struct device_attribute *attr, char *buf)
 {
@@ -259,6 +301,8 @@ static struct device_attribute net_class_attributes[] = {
         __ATTR(address, S_IRUGO, show_address, NULL),
         __ATTR(broadcast, S_IRUGO, show_broadcast, NULL),
         __ATTR(carrier, S_IRUGO, show_carrier, NULL),
+        __ATTR(speed, S_IRUGO, show_speed, NULL),
+        __ATTR(duplex, S_IRUGO, show_duplex, NULL),
         __ATTR(dormant, S_IRUGO, show_dormant, NULL),
         __ATTR(operstate, S_IRUGO, show_operstate, NULL),
         __ATTR(mtu, S_IRUGO | S_IWUSR, show_mtu, store_mtu),
@@ -503,9 +547,13 @@ int netdev_register_kobject(struct net_device *net)
         *groups++ = &netstat_group;
 
 #ifdef CONFIG_WIRELESS_EXT_SYSFS
-        if (net->wireless_handlers || net->ieee80211_ptr)
+        if (net->ieee80211_ptr)
+                *groups++ = &wireless_group;
+#ifdef CONFIG_WIRELESS_EXT
+        else if (net->wireless_handlers)
                 *groups++ = &wireless_group;
 #endif
+#endif
 #endif /* CONFIG_SYSFS */
 
         if (dev_net(net) != &init_net)
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 6eb8d47cbf3a..5ce017bf4afa 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3446,12 +3446,14 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
         txq = netdev_get_tx_queue(odev, queue_map);
 
         __netif_tx_lock_bh(txq);
-        atomic_inc(&(pkt_dev->skb->users));
 
-        if (unlikely(netif_tx_queue_stopped(txq) || netif_tx_queue_frozen(txq)))
+        if (unlikely(netif_tx_queue_stopped(txq) || netif_tx_queue_frozen(txq))) {
                 ret = NETDEV_TX_BUSY;
-        else
-                ret = (*xmit)(pkt_dev->skb, odev);
+                pkt_dev->last_ok = 0;
+                goto unlock;
+        }
+        atomic_inc(&(pkt_dev->skb->users));
+        ret = (*xmit)(pkt_dev->skb, odev);
 
         switch (ret) {
         case NETDEV_TX_OK:
@@ -3473,6 +3475,7 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
                 atomic_dec(&(pkt_dev->skb->users));
                 pkt_dev->last_ok = 0;
         }
+unlock:
         __netif_tx_unlock_bh(txq);
 
         /* If pkt_dev->count is zero, then run forever */
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index eb42873f2a3a..391a62cd9df6 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -248,7 +248,7 @@ static LIST_HEAD(link_ops);
 int __rtnl_link_register(struct rtnl_link_ops *ops)
 {
         if (!ops->dellink)
-                ops->dellink = unregister_netdevice;
+                ops->dellink = unregister_netdevice_queue;
 
         list_add_tail(&ops->list, &link_ops);
         return 0;
@@ -277,13 +277,13 @@ EXPORT_SYMBOL_GPL(rtnl_link_register);
 static void __rtnl_kill_links(struct net *net, struct rtnl_link_ops *ops)
 {
         struct net_device *dev;
-restart:
+        LIST_HEAD(list_kill);
+
         for_each_netdev(net, dev) {
-                if (dev->rtnl_link_ops == ops) {
-                        ops->dellink(dev);
-                        goto restart;
-                }
+                if (dev->rtnl_link_ops == ops)
+                        ops->dellink(dev, &list_kill);
         }
+        unregister_netdevice_many(&list_kill);
 }
 
 void rtnl_kill_links(struct net *net, struct rtnl_link_ops *ops)
@@ -682,22 +682,33 @@ nla_put_failure:
 static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
-        int idx;
-        int s_idx = cb->args[0];
+        int h, s_h;
+        int idx = 0, s_idx;
         struct net_device *dev;
-
-        idx = 0;
-        for_each_netdev(net, dev) {
-                if (idx < s_idx)
-                        goto cont;
-                if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
-                                     NETLINK_CB(cb->skb).pid,
-                                     cb->nlh->nlmsg_seq, 0, NLM_F_MULTI) <= 0)
-                        break;
+        struct hlist_head *head;
+        struct hlist_node *node;
+
+        s_h = cb->args[0];
+        s_idx = cb->args[1];
+
+        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
+                idx = 0;
+                head = &net->dev_index_head[h];
+                hlist_for_each_entry(dev, node, head, index_hlist) {
+                        if (idx < s_idx)
+                                goto cont;
+                        if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
+                                             NETLINK_CB(cb->skb).pid,
+                                             cb->nlh->nlmsg_seq, 0,
+                                             NLM_F_MULTI) <= 0)
+                                goto out;
 cont:
-                idx++;
+                        idx++;
+                }
         }
-        cb->args[0] = idx;
+out:
+        cb->args[1] = idx;
+        cb->args[0] = h;
 
         return skb->len;
 }
@@ -910,9 +921,9 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
         err = -EINVAL;
         ifm = nlmsg_data(nlh);
         if (ifm->ifi_index > 0)
-                dev = dev_get_by_index(net, ifm->ifi_index);
+                dev = __dev_get_by_index(net, ifm->ifi_index);
         else if (tb[IFLA_IFNAME])
-                dev = dev_get_by_name(net, ifname);
+                dev = __dev_get_by_name(net, ifname);
         else
                 goto errout;
 
@@ -922,11 +933,9 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
         }
 
         if ((err = validate_linkmsg(dev, tb)) < 0)
-                goto errout_dev;
+                goto errout;
 
         err = do_setlink(dev, ifm, tb, ifname, 0);
-errout_dev:
-        dev_put(dev);
 errout:
         return err;
 }
@@ -963,7 +972,7 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
         if (!ops)
                 return -EOPNOTSUPP;
 
-        ops->dellink(dev);
+        ops->dellink(dev, NULL);
         return 0;
 }
 
@@ -1154,6 +1163,7 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 {
         struct net *net = sock_net(skb->sk);
         struct ifinfomsg *ifm;
+        char ifname[IFNAMSIZ];
         struct nlattr *tb[IFLA_MAX+1];
         struct net_device *dev = NULL;
         struct sk_buff *nskb;
@@ -1163,19 +1173,23 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         if (err < 0)
                 return err;
 
+        if (tb[IFLA_IFNAME])
+                nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
+
         ifm = nlmsg_data(nlh);
-        if (ifm->ifi_index > 0) {
-                dev = dev_get_by_index(net, ifm->ifi_index);
-                if (dev == NULL)
-                        return -ENODEV;
-        } else
+        if (ifm->ifi_index > 0)
+                dev = __dev_get_by_index(net, ifm->ifi_index);
+        else if (tb[IFLA_IFNAME])
+                dev = __dev_get_by_name(net, ifname);
+        else
                 return -EINVAL;
 
+        if (dev == NULL)
+                return -ENODEV;
+
         nskb = nlmsg_new(if_nlmsg_size(dev), GFP_KERNEL);
-        if (nskb == NULL) {
-                err = -ENOBUFS;
-                goto errout;
-        }
+        if (nskb == NULL)
+                return -ENOBUFS;
 
         err = rtnl_fill_ifinfo(nskb, dev, RTM_NEWLINK, NETLINK_CB(skb).pid,
                                nlh->nlmsg_seq, 0, 0);
@@ -1183,11 +1197,8 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
                 /* -EMSGSIZE implies BUG in if_nlmsg_size */
                 WARN_ON(err == -EMSGSIZE);
                 kfree_skb(nskb);
-                goto errout;
-        }
-        err = rtnl_unicast(nskb, net, NETLINK_CB(skb).pid);
-errout:
-        dev_put(dev);
+        } else
+                err = rtnl_unicast(nskb, net, NETLINK_CB(skb).pid);
 
         return err;
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 7626b6aacd68..5a51512f638a 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -274,25 +274,27 @@ static void sock_disable_timestamp(struct sock *sk, int flag)
 
 int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
-        int err = 0;
+        int err;
         int skb_len;
+        unsigned long flags;
+        struct sk_buff_head *list = &sk->sk_receive_queue;
 
         /* Cast sk->rcvbuf to unsigned... It's pointless, but reduces
            number of warnings when compiling with -W --ANK
          */
         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
             (unsigned)sk->sk_rcvbuf) {
-                err = -ENOMEM;
-                goto out;
+                atomic_inc(&sk->sk_drops);
+                return -ENOMEM;
         }
 
         err = sk_filter(sk, skb);
         if (err)
-                goto out;
+                return err;
 
         if (!sk_rmem_schedule(sk, skb->truesize)) {
-                err = -ENOBUFS;
-                goto out;
+                atomic_inc(&sk->sk_drops);
+                return -ENOBUFS;
         }
 
         skb->dev = NULL;
@@ -305,12 +307,14 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
          */
         skb_len = skb->len;
 
-        skb_queue_tail(&sk->sk_receive_queue, skb);
+        spin_lock_irqsave(&list->lock, flags);
+        skb->dropcount = atomic_read(&sk->sk_drops);
+        __skb_queue_tail(list, skb);
+        spin_unlock_irqrestore(&list->lock, flags);
 
         if (!sock_flag(sk, SOCK_DEAD))
                 sk->sk_data_ready(sk, skb_len);
-out:
-        return err;
+        return 0;
 }
 EXPORT_SYMBOL(sock_queue_rcv_skb);
 
@@ -348,11 +352,18 @@ discard_and_relse:
 }
 EXPORT_SYMBOL(sk_receive_skb);
 
+void sk_reset_txq(struct sock *sk)
+{
+        sk_tx_queue_clear(sk);
+}
+EXPORT_SYMBOL(sk_reset_txq);
+
 struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie)
 {
         struct dst_entry *dst = sk->sk_dst_cache;
 
         if (dst && dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
+                sk_tx_queue_clear(sk);
                 sk->sk_dst_cache = NULL;
                 dst_release(dst);
                 return NULL;
@@ -702,6 +713,12 @@ set_rcvbuf:
 
                 /* We implement the SO_SNDLOWAT etc to
                    not be settable (1003.1g 5.3) */
+        case SO_RXQ_OVFL:
+                if (valbool)
+                        sock_set_flag(sk, SOCK_RXQ_OVFL);
+                else
+                        sock_reset_flag(sk, SOCK_RXQ_OVFL);
+                break;
         default:
                 ret = -ENOPROTOOPT;
                 break;
@@ -901,6 +918,10 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 v.val = sk->sk_mark;
                 break;
 
+        case SO_RXQ_OVFL:
+                v.val = !!sock_flag(sk, SOCK_RXQ_OVFL);
+                break;
+
         default:
                 return -ENOPROTOOPT;
         }
@@ -939,7 +960,8 @@ static void sock_copy(struct sock *nsk, const struct sock *osk)
         void *sptr = nsk->sk_security;
 #endif
         BUILD_BUG_ON(offsetof(struct sock, sk_copy_start) !=
-                     sizeof(osk->sk_node) + sizeof(osk->sk_refcnt));
+                     sizeof(osk->sk_node) + sizeof(osk->sk_refcnt) +
+                     sizeof(osk->sk_tx_queue_mapping));
         memcpy(&nsk->sk_copy_start, &osk->sk_copy_start,
                osk->sk_prot->obj_size - offsetof(struct sock, sk_copy_start));
 #ifdef CONFIG_SECURITY_NETWORK
@@ -983,6 +1005,7 @@ static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
 
                 if (!try_module_get(prot->owner))
                         goto out_free_sec;
+                sk_tx_queue_clear(sk);
         }
 
         return sk;
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index e8cf99e880b0..a47a8c918ee8 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -33,20 +33,20 @@
 static int ccid2_debug;
 #define ccid2_pr_debug(format, a...)    DCCP_PR_DEBUG(ccid2_debug, format, ##a)
 
-static void ccid2_hc_tx_check_sanity(const struct ccid2_hc_tx_sock *hctx)
+static void ccid2_hc_tx_check_sanity(const struct ccid2_hc_tx_sock *hc)
 {
         int len = 0;
         int pipe = 0;
-        struct ccid2_seq *seqp = hctx->ccid2hctx_seqh;
+        struct ccid2_seq *seqp = hc->tx_seqh;
 
         /* there is data in the chain */
-        if (seqp != hctx->ccid2hctx_seqt) {
+        if (seqp != hc->tx_seqt) {
                 seqp = seqp->ccid2s_prev;
                 len++;
                 if (!seqp->ccid2s_acked)
                         pipe++;
 
-                while (seqp != hctx->ccid2hctx_seqt) {
+                while (seqp != hc->tx_seqt) {
                         struct ccid2_seq *prev = seqp->ccid2s_prev;
 
                         len++;
@@ -63,30 +63,30 @@ static void ccid2_hc_tx_check_sanity(const struct ccid2_hc_tx_sock *hctx)
                 }
         }
 
-        BUG_ON(pipe != hctx->ccid2hctx_pipe);
+        BUG_ON(pipe != hc->tx_pipe);
         ccid2_pr_debug("len of chain=%d\n", len);
 
         do {
                 seqp = seqp->ccid2s_prev;
                 len++;
-        } while (seqp != hctx->ccid2hctx_seqh);
+        } while (seqp != hc->tx_seqh);
 
         ccid2_pr_debug("total len=%d\n", len);
-        BUG_ON(len != hctx->ccid2hctx_seqbufc * CCID2_SEQBUF_LEN);
+        BUG_ON(len != hc->tx_seqbufc * CCID2_SEQBUF_LEN);
 }
 #else
 #define ccid2_pr_debug(format, a...)
-#define ccid2_hc_tx_check_sanity(hctx)
+#define ccid2_hc_tx_check_sanity(hc)
 #endif
 
-static int ccid2_hc_tx_alloc_seq(struct ccid2_hc_tx_sock *hctx)
+static int ccid2_hc_tx_alloc_seq(struct ccid2_hc_tx_sock *hc)
 {
         struct ccid2_seq *seqp;
         int i;
 
         /* check if we have space to preserve the pointer to the buffer */
-        if (hctx->ccid2hctx_seqbufc >= (sizeof(hctx->ccid2hctx_seqbuf) /
-                                        sizeof(struct ccid2_seq*)))
+        if (hc->tx_seqbufc >= (sizeof(hc->tx_seqbuf) /
+                               sizeof(struct ccid2_seq *)))
                 return -ENOMEM;
 
         /* allocate buffer and initialize linked list */
@@ -102,29 +102,29 @@ static int ccid2_hc_tx_alloc_seq(struct ccid2_hc_tx_sock *hctx)
         seqp->ccid2s_prev = &seqp[CCID2_SEQBUF_LEN - 1];
 
         /* This is the first allocation.  Initiate the head and tail.  */
-        if (hctx->ccid2hctx_seqbufc == 0)
-                hctx->ccid2hctx_seqh = hctx->ccid2hctx_seqt = seqp;
+        if (hc->tx_seqbufc == 0)
+                hc->tx_seqh = hc->tx_seqt = seqp;
         else {
                 /* link the existing list with the one we just created */
-                hctx->ccid2hctx_seqh->ccid2s_next = seqp;
-                seqp->ccid2s_prev = hctx->ccid2hctx_seqh;
+                hc->tx_seqh->ccid2s_next = seqp;
+                seqp->ccid2s_prev = hc->tx_seqh;
 
-                hctx->ccid2hctx_seqt->ccid2s_prev = &seqp[CCID2_SEQBUF_LEN - 1];
-                seqp[CCID2_SEQBUF_LEN - 1].ccid2s_next = hctx->ccid2hctx_seqt;
+                hc->tx_seqt->ccid2s_prev = &seqp[CCID2_SEQBUF_LEN - 1];
+                seqp[CCID2_SEQBUF_LEN - 1].ccid2s_next = hc->tx_seqt;
         }
 
         /* store the original pointer to the buffer so we can free it */
-        hctx->ccid2hctx_seqbuf[hctx->ccid2hctx_seqbufc] = seqp;
-        hctx->ccid2hctx_seqbufc++;
+        hc->tx_seqbuf[hc->tx_seqbufc] = seqp;
+        hc->tx_seqbufc++;
 
         return 0;
 }
 
 static int ccid2_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
 
-        if (hctx->ccid2hctx_pipe < hctx->ccid2hctx_cwnd)
+        if (hc->tx_pipe < hc->tx_cwnd)
                 return 0;
 
         return 1; /* XXX CCID should dequeue when ready instead of polling */
@@ -133,7 +133,7 @@ static int ccid2_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
 static void ccid2_change_l_ack_ratio(struct sock *sk, u32 val)
 {
         struct dccp_sock *dp = dccp_sk(sk);
-        u32 max_ratio = DIV_ROUND_UP(ccid2_hc_tx_sk(sk)->ccid2hctx_cwnd, 2);
+        u32 max_ratio = DIV_ROUND_UP(ccid2_hc_tx_sk(sk)->tx_cwnd, 2);
 
         /*
          * Ensure that Ack Ratio does not exceed ceil(cwnd/2), which is (2) from
@@ -155,10 +155,10 @@ static void ccid2_change_l_ack_ratio(struct sock *sk, u32 val)
         dp->dccps_l_ack_ratio = val;
 }
 
-static void ccid2_change_srtt(struct ccid2_hc_tx_sock *hctx, long val)
+static void ccid2_change_srtt(struct ccid2_hc_tx_sock *hc, long val)
 {
         ccid2_pr_debug("change SRTT to %ld\n", val);
-        hctx->ccid2hctx_srtt = val;
+        hc->tx_srtt = val;
 }
 
 static void ccid2_start_rto_timer(struct sock *sk);
@@ -166,45 +166,44 @@ static void ccid2_start_rto_timer(struct sock *sk);
 static void ccid2_hc_tx_rto_expire(unsigned long data)
 {
         struct sock *sk = (struct sock *)data;
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
         long s;
 
         bh_lock_sock(sk);
         if (sock_owned_by_user(sk)) {
-                sk_reset_timer(sk, &hctx->ccid2hctx_rtotimer,
-                               jiffies + HZ / 5);
+                sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + HZ / 5);
                 goto out;
         }
 
         ccid2_pr_debug("RTO_EXPIRE\n");
 
-        ccid2_hc_tx_check_sanity(hctx);
+        ccid2_hc_tx_check_sanity(hc);
 
         /* back-off timer */
-        hctx->ccid2hctx_rto <<= 1;
+        hc->tx_rto <<= 1;
 
-        s = hctx->ccid2hctx_rto / HZ;
+        s = hc->tx_rto / HZ;
         if (s > 60)
-                hctx->ccid2hctx_rto = 60 * HZ;
+                hc->tx_rto = 60 * HZ;
 
         ccid2_start_rto_timer(sk);
 
         /* adjust pipe, cwnd etc */
-        hctx->ccid2hctx_ssthresh = hctx->ccid2hctx_cwnd / 2;
-        if (hctx->ccid2hctx_ssthresh < 2)
-                hctx->ccid2hctx_ssthresh = 2;
-        hctx->ccid2hctx_cwnd     = 1;
-        hctx->ccid2hctx_pipe     = 0;
+        hc->tx_ssthresh = hc->tx_cwnd / 2;
+        if (hc->tx_ssthresh < 2)
+                hc->tx_ssthresh = 2;
+        hc->tx_cwnd      = 1;
+        hc->tx_pipe      = 0;
 
         /* clear state about stuff we sent */
-        hctx->ccid2hctx_seqt = hctx->ccid2hctx_seqh;
-        hctx->ccid2hctx_packets_acked = 0;
+        hc->tx_seqt = hc->tx_seqh;
+        hc->tx_packets_acked = 0;
 
         /* clear ack ratio state. */
-        hctx->ccid2hctx_rpseq    = 0;
-        hctx->ccid2hctx_rpdupack = -1;
+        hc->tx_rpseq    = 0;
+        hc->tx_rpdupack = -1;
         ccid2_change_l_ack_ratio(sk, 1);
-        ccid2_hc_tx_check_sanity(hctx);
+        ccid2_hc_tx_check_sanity(hc);
 out:
         bh_unlock_sock(sk);
         sock_put(sk);
@@ -212,42 +211,40 @@ out:
 
 static void ccid2_start_rto_timer(struct sock *sk)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
 
-        ccid2_pr_debug("setting RTO timeout=%ld\n", hctx->ccid2hctx_rto);
+        ccid2_pr_debug("setting RTO timeout=%ld\n", hc->tx_rto);
 
-        BUG_ON(timer_pending(&hctx->ccid2hctx_rtotimer));
-        sk_reset_timer(sk, &hctx->ccid2hctx_rtotimer,
-                       jiffies + hctx->ccid2hctx_rto);
+        BUG_ON(timer_pending(&hc->tx_rtotimer));
+        sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
 }
 
 static void ccid2_hc_tx_packet_sent(struct sock *sk, int more, unsigned int len)
 {
         struct dccp_sock *dp = dccp_sk(sk);
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
         struct ccid2_seq *next;
 
-        hctx->ccid2hctx_pipe++;
+        hc->tx_pipe++;
 
-        hctx->ccid2hctx_seqh->ccid2s_seq   = dp->dccps_gss;
-        hctx->ccid2hctx_seqh->ccid2s_acked = 0;
-        hctx->ccid2hctx_seqh->ccid2s_sent  = jiffies;
+        hc->tx_seqh->ccid2s_seq   = dp->dccps_gss;
+        hc->tx_seqh->ccid2s_acked = 0;
+        hc->tx_seqh->ccid2s_sent  = jiffies;
 
-        next = hctx->ccid2hctx_seqh->ccid2s_next;
+        next = hc->tx_seqh->ccid2s_next;
         /* check if we need to alloc more space */
-        if (next == hctx->ccid2hctx_seqt) {
-                if (ccid2_hc_tx_alloc_seq(hctx)) {
+        if (next == hc->tx_seqt) {
+                if (ccid2_hc_tx_alloc_seq(hc)) {
                         DCCP_CRIT("packet history - out of memory!");
                         /* FIXME: find a more graceful way to bail out */
                         return;
                 }
-                next = hctx->ccid2hctx_seqh->ccid2s_next;
-                BUG_ON(next == hctx->ccid2hctx_seqt);
+                next = hc->tx_seqh->ccid2s_next;
+                BUG_ON(next == hc->tx_seqt);
         }
-        hctx->ccid2hctx_seqh = next;
+        hc->tx_seqh = next;
 
-        ccid2_pr_debug("cwnd=%d pipe=%d\n", hctx->ccid2hctx_cwnd,
-                       hctx->ccid2hctx_pipe);
+        ccid2_pr_debug("cwnd=%d pipe=%d\n", hc->tx_cwnd, hc->tx_pipe);
 
         /*
          * FIXME: The code below is broken and the variables have been removed
@@ -270,12 +267,12 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, int more, unsigned int len)
          */
 #if 0
         /* Ack Ratio.  Need to maintain a concept of how many windows we sent */
-        hctx->ccid2hctx_arsent++;
+        hc->tx_arsent++;
         /* We had an ack loss in this window... */
-        if (hctx->ccid2hctx_ackloss) {
-                if (hctx->ccid2hctx_arsent >= hctx->ccid2hctx_cwnd) {
-                        hctx->ccid2hctx_arsent  = 0;
-                        hctx->ccid2hctx_ackloss = 0;
+        if (hc->tx_ackloss) {
+                if (hc->tx_arsent >= hc->tx_cwnd) {
+                        hc->tx_arsent  = 0;
+                        hc->tx_ackloss = 0;
                 }
         } else {
                 /* No acks lost up to now... */
@@ -285,28 +282,28 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, int more, unsigned int len)
                         int denom = dp->dccps_l_ack_ratio * dp->dccps_l_ack_ratio -
                                     dp->dccps_l_ack_ratio;
 
-                        denom = hctx->ccid2hctx_cwnd * hctx->ccid2hctx_cwnd / denom;
+                        denom = hc->tx_cwnd * hc->tx_cwnd / denom;
 
-                        if (hctx->ccid2hctx_arsent >= denom) {
+                        if (hc->tx_arsent >= denom) {
                                 ccid2_change_l_ack_ratio(sk, dp->dccps_l_ack_ratio - 1);
-                                hctx->ccid2hctx_arsent = 0;
+                                hc->tx_arsent = 0;
                         }
                 } else {
                         /* we can't increase ack ratio further [1] */
-                        hctx->ccid2hctx_arsent = 0; /* or maybe set it to cwnd*/
+                        hc->tx_arsent = 0; /* or maybe set it to cwnd*/
                 }
         }
 #endif
 
         /* setup RTO timer */
-        if (!timer_pending(&hctx->ccid2hctx_rtotimer))
+        if (!timer_pending(&hc->tx_rtotimer))
                 ccid2_start_rto_timer(sk);
 
 #ifdef CONFIG_IP_DCCP_CCID2_DEBUG
         do {
-                struct ccid2_seq *seqp = hctx->ccid2hctx_seqt;
+                struct ccid2_seq *seqp = hc->tx_seqt;
 
-                while (seqp != hctx->ccid2hctx_seqh) {
+                while (seqp != hc->tx_seqh) {
                         ccid2_pr_debug("out seq=%llu acked=%d time=%lu\n",
                                        (unsigned long long)seqp->ccid2s_seq,
                                        seqp->ccid2s_acked, seqp->ccid2s_sent);
@@ -314,7 +311,7 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, int more, unsigned int len)
                 }
         } while (0);
         ccid2_pr_debug("=========\n");
-        ccid2_hc_tx_check_sanity(hctx);
+        ccid2_hc_tx_check_sanity(hc);
 #endif
 }
 
@@ -382,9 +379,9 @@ out_invalid_option:
 
 static void ccid2_hc_tx_kill_rto_timer(struct sock *sk)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
 
-        sk_stop_timer(sk, &hctx->ccid2hctx_rtotimer);
+        sk_stop_timer(sk, &hc->tx_rtotimer);
         ccid2_pr_debug("deleted RTO timer\n");
 }
 
@@ -392,75 +389,75 @@ static inline void ccid2_new_ack(struct sock *sk,
                                  struct ccid2_seq *seqp,
                                  unsigned int *maxincr)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
 
-        if (hctx->ccid2hctx_cwnd < hctx->ccid2hctx_ssthresh) {
-                if (*maxincr > 0 && ++hctx->ccid2hctx_packets_acked == 2) {
-                        hctx->ccid2hctx_cwnd += 1;
-                        *maxincr             -= 1;
-                        hctx->ccid2hctx_packets_acked = 0;
+        if (hc->tx_cwnd < hc->tx_ssthresh) {
+                if (*maxincr > 0 && ++hc->tx_packets_acked == 2) {
+                        hc->tx_cwnd += 1;
+                        *maxincr    -= 1;
+                        hc->tx_packets_acked = 0;
                 }
-        } else if (++hctx->ccid2hctx_packets_acked >= hctx->ccid2hctx_cwnd) {
-                        hctx->ccid2hctx_cwnd += 1;
-                        hctx->ccid2hctx_packets_acked = 0;
+        } else if (++hc->tx_packets_acked >= hc->tx_cwnd) {
+                        hc->tx_cwnd += 1;
+                        hc->tx_packets_acked = 0;
         }
 
         /* update RTO */
-        if (hctx->ccid2hctx_srtt == -1 ||
-            time_after(jiffies, hctx->ccid2hctx_lastrtt + hctx->ccid2hctx_srtt)) {
+        if (hc->tx_srtt == -1 ||
+            time_after(jiffies, hc->tx_lastrtt + hc->tx_srtt)) {
                 unsigned long r = (long)jiffies - (long)seqp->ccid2s_sent;
                 int s;
 
                 /* first measurement */
-                if (hctx->ccid2hctx_srtt == -1) {
+                if (hc->tx_srtt == -1) {
                         ccid2_pr_debug("R: %lu Time=%lu seq=%llu\n",
                                        r, jiffies,
                                        (unsigned long long)seqp->ccid2s_seq);
-                        ccid2_change_srtt(hctx, r);
-                        hctx->ccid2hctx_rttvar = r >> 1;
+                        ccid2_change_srtt(hc, r);
+                        hc->tx_rttvar = r >> 1;
                 } else {
                         /* RTTVAR */
-                        long tmp = hctx->ccid2hctx_srtt - r;
+                        long tmp = hc->tx_srtt - r;
                         long srtt;
 
                         if (tmp < 0)
                                 tmp *= -1;
 
                         tmp >>= 2;
-                        hctx->ccid2hctx_rttvar *= 3;
-                        hctx->ccid2hctx_rttvar >>= 2;
-                        hctx->ccid2hctx_rttvar += tmp;
+                        hc->tx_rttvar *= 3;
+                        hc->tx_rttvar >>= 2;
+                        hc->tx_rttvar += tmp;
 
                         /* SRTT */
-                        srtt = hctx->ccid2hctx_srtt;
+                        srtt = hc->tx_srtt;
                         srtt *= 7;
                         srtt >>= 3;
                         tmp = r >> 3;
                         srtt += tmp;
-                        ccid2_change_srtt(hctx, srtt);
+                        ccid2_change_srtt(hc, srtt);
                 }
-                s = hctx->ccid2hctx_rttvar << 2;
+                s = hc->tx_rttvar << 2;
                 /* clock granularity is 1 when based on jiffies */
                 if (!s)
                         s = 1;
-                hctx->ccid2hctx_rto = hctx->ccid2hctx_srtt + s;
+                hc->tx_rto = hc->tx_srtt + s;
 
                 /* must be at least a second */
-                s = hctx->ccid2hctx_rto / HZ;
+                s = hc->tx_rto / HZ;
                 /* DCCP doesn't require this [but I like it cuz my code sux] */
 #if 1
                 if (s < 1)
-                        hctx->ccid2hctx_rto = HZ;
+                        hc->tx_rto = HZ;
 #endif
                 /* max 60 seconds */
                 if (s > 60)
-                        hctx->ccid2hctx_rto = HZ * 60;
+                        hc->tx_rto = HZ * 60;
 
-                hctx->ccid2hctx_lastrtt = jiffies;
+                hc->tx_lastrtt = jiffies;
 
                 ccid2_pr_debug("srtt: %ld rttvar: %ld rto: %ld (HZ=%d) R=%lu\n",
-                               hctx->ccid2hctx_srtt, hctx->ccid2hctx_rttvar,
-                               hctx->ccid2hctx_rto, HZ, r);
+                               hc->tx_srtt, hc->tx_rttvar,
+                               hc->tx_rto, HZ, r);
         }
 
         /* we got a new ack, so re-start RTO timer */
@@ -470,40 +467,40 @@ static inline void ccid2_new_ack(struct sock *sk,
 
 static void ccid2_hc_tx_dec_pipe(struct sock *sk)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
 
-        if (hctx->ccid2hctx_pipe == 0)
+        if (hc->tx_pipe == 0)
                 DCCP_BUG("pipe == 0");
         else
-                hctx->ccid2hctx_pipe--;
+                hc->tx_pipe--;
 
-        if (hctx->ccid2hctx_pipe == 0)
+        if (hc->tx_pipe == 0)
                 ccid2_hc_tx_kill_rto_timer(sk);
 }
 
 static void ccid2_congestion_event(struct sock *sk, struct ccid2_seq *seqp)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
 
-        if (time_before(seqp->ccid2s_sent, hctx->ccid2hctx_last_cong)) {
+        if (time_before(seqp->ccid2s_sent, hc->tx_last_cong)) {
                 ccid2_pr_debug("Multiple losses in an RTT---treating as one\n");
                 return;
         }
 
-        hctx->ccid2hctx_last_cong = jiffies;
+        hc->tx_last_cong = jiffies;
 
-        hctx->ccid2hctx_cwnd     = hctx->ccid2hctx_cwnd / 2 ? : 1U;
-        hctx->ccid2hctx_ssthresh = max(hctx->ccid2hctx_cwnd, 2U);
+        hc->tx_cwnd      = hc->tx_cwnd / 2 ? : 1U;
+        hc->tx_ssthresh  = max(hc->tx_cwnd, 2U);
 
         /* Avoid spurious timeouts resulting from Ack Ratio > cwnd */
-        if (dccp_sk(sk)->dccps_l_ack_ratio > hctx->ccid2hctx_cwnd)
-                ccid2_change_l_ack_ratio(sk, hctx->ccid2hctx_cwnd);
+        if (dccp_sk(sk)->dccps_l_ack_ratio > hc->tx_cwnd)
+                ccid2_change_l_ack_ratio(sk, hc->tx_cwnd);
 }
 
 static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
 {
         struct dccp_sock *dp = dccp_sk(sk);
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
         u64 ackno, seqno;
         struct ccid2_seq *seqp;
         unsigned char *vector;
@@ -512,7 +509,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
         int done = 0;
         unsigned int maxincr = 0;
 
-        ccid2_hc_tx_check_sanity(hctx);
+        ccid2_hc_tx_check_sanity(hc);
         /* check reverse path congestion */
         seqno = DCCP_SKB_CB(skb)->dccpd_seq;
 
@@ -521,21 +518,21 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
          * -sorbo.
          */
         /* need to bootstrap */
-        if (hctx->ccid2hctx_rpdupack == -1) {
-                hctx->ccid2hctx_rpdupack = 0;
-                hctx->ccid2hctx_rpseq = seqno;
+        if (hc->tx_rpdupack == -1) {
+                hc->tx_rpdupack = 0;
+                hc->tx_rpseq    = seqno;
         } else {
                 /* check if packet is consecutive */
-                if (dccp_delta_seqno(hctx->ccid2hctx_rpseq, seqno) == 1)
-                        hctx->ccid2hctx_rpseq = seqno;
+                if (dccp_delta_seqno(hc->tx_rpseq, seqno) == 1)
+                        hc->tx_rpseq = seqno;
                 /* it's a later packet */
-                else if (after48(seqno, hctx->ccid2hctx_rpseq)) {
-                        hctx->ccid2hctx_rpdupack++;
+                else if (after48(seqno, hc->tx_rpseq)) {
+                        hc->tx_rpdupack++;
 
                         /* check if we got enough dupacks */
-                        if (hctx->ccid2hctx_rpdupack >= NUMDUPACK) {
-                                hctx->ccid2hctx_rpdupack = -1; /* XXX lame */
-                                hctx->ccid2hctx_rpseq = 0;
+                        if (hc->tx_rpdupack >= NUMDUPACK) {
+                                hc->tx_rpdupack = -1; /* XXX lame */
+                                hc->tx_rpseq    = 0;
 
                                 ccid2_change_l_ack_ratio(sk, 2 * dp->dccps_l_ack_ratio);
                         }
@@ -544,7 +541,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
 
         /* check forward path congestion */
         /* still didn't send out new data packets */
-        if (hctx->ccid2hctx_seqh == hctx->ccid2hctx_seqt)
+        if (hc->tx_seqh == hc->tx_seqt)
                 return;
 
         switch (DCCP_SKB_CB(skb)->dccpd_type) {
@@ -556,14 +553,14 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
         }
 
         ackno = DCCP_SKB_CB(skb)->dccpd_ack_seq;
-        if (after48(ackno, hctx->ccid2hctx_high_ack))
-                hctx->ccid2hctx_high_ack = ackno;
+        if (after48(ackno, hc->tx_high_ack))
+                hc->tx_high_ack = ackno;
 
-        seqp = hctx->ccid2hctx_seqt;
+        seqp = hc->tx_seqt;
         while (before48(seqp->ccid2s_seq, ackno)) {
                 seqp = seqp->ccid2s_next;
-                if (seqp == hctx->ccid2hctx_seqh) {
-                        seqp = hctx->ccid2hctx_seqh->ccid2s_prev;
+                if (seqp == hc->tx_seqh) {
+                        seqp = hc->tx_seqh->ccid2s_prev;
                         break;
                 }
         }
@@ -573,7 +570,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
          * packets per acknowledgement. Rounding up avoids that cwnd is not
          * advanced when Ack Ratio is 1 and gives a slight edge otherwise.
          */
-        if (hctx->ccid2hctx_cwnd < hctx->ccid2hctx_ssthresh)
+        if (hc->tx_cwnd < hc->tx_ssthresh)
                 maxincr = DIV_ROUND_UP(dp->dccps_l_ack_ratio, 2);
 
         /* go through all ack vectors */
@@ -592,7 +589,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                          * seqnos.
                          */
                         while (after48(seqp->ccid2s_seq, ackno)) {
-                                if (seqp == hctx->ccid2hctx_seqt) {
+                                if (seqp == hc->tx_seqt) {
                                         done = 1;
                                         break;
                                 }
@@ -624,7 +621,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                                                        (unsigned long long)seqp->ccid2s_seq);
                                         ccid2_hc_tx_dec_pipe(sk);
                                 }
-                                if (seqp == hctx->ccid2hctx_seqt) {
+                                if (seqp == hc->tx_seqt) {
                                         done = 1;
                                         break;
                                 }
@@ -643,11 +640,11 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
         /* The state about what is acked should be correct now
          * Check for NUMDUPACK
          */
-        seqp = hctx->ccid2hctx_seqt;
-        while (before48(seqp->ccid2s_seq, hctx->ccid2hctx_high_ack)) {
+        seqp = hc->tx_seqt;
+        while (before48(seqp->ccid2s_seq, hc->tx_high_ack)) {
                 seqp = seqp->ccid2s_next;
-                if (seqp == hctx->ccid2hctx_seqh) {
-                        seqp = hctx->ccid2hctx_seqh->ccid2s_prev;
+                if (seqp == hc->tx_seqh) {
+                        seqp = hc->tx_seqh->ccid2s_prev;
                         break;
                 }
         }
@@ -658,7 +655,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                         if (done == NUMDUPACK)
                                 break;
                 }
-                if (seqp == hctx->ccid2hctx_seqt)
+                if (seqp == hc->tx_seqt)
                         break;
                 seqp = seqp->ccid2s_prev;
         }
@@ -681,86 +678,86 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                                 ccid2_congestion_event(sk, seqp);
                                 ccid2_hc_tx_dec_pipe(sk);
                         }
-                        if (seqp == hctx->ccid2hctx_seqt)
+                        if (seqp == hc->tx_seqt)
                                 break;
                         seqp = seqp->ccid2s_prev;
                 }
 
-                hctx->ccid2hctx_seqt = last_acked;
+                hc->tx_seqt = last_acked;
         }
 
         /* trim acked packets in tail */
-        while (hctx->ccid2hctx_seqt != hctx->ccid2hctx_seqh) {
-                if (!hctx->ccid2hctx_seqt->ccid2s_acked)
+        while (hc->tx_seqt != hc->tx_seqh) {
+                if (!hc->tx_seqt->ccid2s_acked)
                         break;
 
-                hctx->ccid2hctx_seqt = hctx->ccid2hctx_seqt->ccid2s_next;
+                hc->tx_seqt = hc->tx_seqt->ccid2s_next;
         }
 
-        ccid2_hc_tx_check_sanity(hctx);
+        ccid2_hc_tx_check_sanity(hc);
 }
 
 static int ccid2_hc_tx_init(struct ccid *ccid, struct sock *sk)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid_priv(ccid);
+        struct ccid2_hc_tx_sock *hc = ccid_priv(ccid);
         struct dccp_sock *dp = dccp_sk(sk);
         u32 max_ratio;
 
         /* RFC 4341, 5: initialise ssthresh to arbitrarily high (max) value */
-        hctx->ccid2hctx_ssthresh  = ~0U;
+        hc->tx_ssthresh = ~0U;
 
         /*
          * RFC 4341, 5: "The cwnd parameter is initialized to at most four
          * packets for new connections, following the rules from [RFC3390]".
          * We need to convert the bytes of RFC3390 into the packets of RFC 4341.
          */
-        hctx->ccid2hctx_cwnd = clamp(4380U / dp->dccps_mss_cache, 2U, 4U);
+        hc->tx_cwnd = clamp(4380U / dp->dccps_mss_cache, 2U, 4U);
 
         /* Make sure that Ack Ratio is enabled and within bounds. */
-        max_ratio = DIV_ROUND_UP(hctx->ccid2hctx_cwnd, 2);
+        max_ratio = DIV_ROUND_UP(hc->tx_cwnd, 2);
         if (dp->dccps_l_ack_ratio == 0 || dp->dccps_l_ack_ratio > max_ratio)
                 dp->dccps_l_ack_ratio = max_ratio;
 
         /* XXX init ~ to window size... */
-        if (ccid2_hc_tx_alloc_seq(hctx))
+        if (ccid2_hc_tx_alloc_seq(hc))
                 return -ENOMEM;
 
-        hctx->ccid2hctx_rto      = 3 * HZ;
-        ccid2_change_srtt(hctx, -1);
-        hctx->ccid2hctx_rttvar   = -1;
-        hctx->ccid2hctx_rpdupack = -1;
-        hctx->ccid2hctx_last_cong = jiffies;
-        setup_timer(&hctx->ccid2hctx_rtotimer, ccid2_hc_tx_rto_expire,
+        hc->tx_rto       = 3 * HZ;
+        ccid2_change_srtt(hc, -1);
+        hc->tx_rttvar    = -1;
+        hc->tx_rpdupack  = -1;
+        hc->tx_last_cong = jiffies;
+        setup_timer(&hc->tx_rtotimer, ccid2_hc_tx_rto_expire,
                         (unsigned long)sk);
 
-        ccid2_hc_tx_check_sanity(hctx);
+        ccid2_hc_tx_check_sanity(hc);
         return 0;
 }
 
 static void ccid2_hc_tx_exit(struct sock *sk)
 {
-        struct ccid2_hc_tx_sock *hctx = ccid2_hc_tx_sk(sk);
+        struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
         int i;
 
         ccid2_hc_tx_kill_rto_timer(sk);
 
-        for (i = 0; i < hctx->ccid2hctx_seqbufc; i++)
-                kfree(hctx->ccid2hctx_seqbuf[i]);
-        hctx->ccid2hctx_seqbufc = 0;
+        for (i = 0; i < hc->tx_seqbufc; i++)
+                kfree(hc->tx_seqbuf[i]);
+        hc->tx_seqbufc = 0;
 }
 
 static void ccid2_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
 {
         const struct dccp_sock *dp = dccp_sk(sk);
-        struct ccid2_hc_rx_sock *hcrx = ccid2_hc_rx_sk(sk);
+        struct ccid2_hc_rx_sock *hc = ccid2_hc_rx_sk(sk);
 
         switch (DCCP_SKB_CB(skb)->dccpd_type) {
         case DCCP_PKT_DATA:
         case DCCP_PKT_DATAACK:
-                hcrx->ccid2hcrx_data++;
-                if (hcrx->ccid2hcrx_data >= dp->dccps_r_ack_ratio) {
+                hc->rx_data++;
+                if (hc->rx_data >= dp->dccps_r_ack_ratio) {
                         dccp_send_ack(sk);
-                        hcrx->ccid2hcrx_data = 0;
+                        hc->rx_data = 0;
                 }
                 break;
         }
diff --git a/net/dccp/ccids/ccid2.h b/net/dccp/ccids/ccid2.h
index 326ac90fb909..1ec6a30103bb 100644
--- a/net/dccp/ccids/ccid2.h
+++ b/net/dccp/ccids/ccid2.h
@@ -40,34 +40,34 @@ struct ccid2_seq {
 
 /**
  * struct ccid2_hc_tx_sock - CCID2 TX half connection
- * @ccid2hctx_{cwnd,ssthresh,pipe}: as per RFC 4341, section 5
- * @ccid2hctx_packets_acked - Ack counter for deriving cwnd growth (RFC 3465)
- * @ccid2hctx_lastrtt -time RTT was last measured
- * @ccid2hctx_rpseq - last consecutive seqno
- * @ccid2hctx_rpdupack - dupacks since rpseq
+ * @tx_{cwnd,ssthresh,pipe}: as per RFC 4341, section 5
+ * @tx_packets_acked:        Ack counter for deriving cwnd growth (RFC 3465)
+ * @tx_lastrtt:              time RTT was last measured
+ * @tx_rpseq:                last consecutive seqno
+ * @tx_rpdupack:             dupacks since rpseq
  */
 struct ccid2_hc_tx_sock {
-        u32                     ccid2hctx_cwnd;
-        u32                     ccid2hctx_ssthresh;
-        u32                     ccid2hctx_pipe;
-        u32                     ccid2hctx_packets_acked;
-        struct ccid2_seq        *ccid2hctx_seqbuf[CCID2_SEQBUF_MAX];
-        int                     ccid2hctx_seqbufc;
-        struct ccid2_seq        *ccid2hctx_seqh;
-        struct ccid2_seq        *ccid2hctx_seqt;
-        long                    ccid2hctx_rto;
-        long                    ccid2hctx_srtt;
-        long                    ccid2hctx_rttvar;
-        unsigned long           ccid2hctx_lastrtt;
-        struct timer_list       ccid2hctx_rtotimer;
-        u64                     ccid2hctx_rpseq;
-        int                     ccid2hctx_rpdupack;
-        unsigned long           ccid2hctx_last_cong;
-        u64                     ccid2hctx_high_ack;
+        u32                     tx_cwnd;
+        u32                     tx_ssthresh;
+        u32                     tx_pipe;
+        u32                     tx_packets_acked;
+        struct ccid2_seq        *tx_seqbuf[CCID2_SEQBUF_MAX];
+        int                     tx_seqbufc;
+        struct ccid2_seq        *tx_seqh;
+        struct ccid2_seq        *tx_seqt;
+        long                    tx_rto;
+        long                    tx_srtt;
+        long                    tx_rttvar;
+        unsigned long           tx_lastrtt;
+        struct timer_list       tx_rtotimer;
+        u64                     tx_rpseq;
+        int                     tx_rpdupack;
+        unsigned long           tx_last_cong;
+        u64                     tx_high_ack;
 };
 
 struct ccid2_hc_rx_sock {
-        int     ccid2hcrx_data;
+        int     rx_data;
 };
 
 static inline struct ccid2_hc_tx_sock *ccid2_hc_tx_sk(const struct sock *sk)
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 34dcc798c457..bcd7632299f5 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -64,14 +64,14 @@ static const char *ccid3_tx_state_name(enum ccid3_hc_tx_states state)
 static void ccid3_hc_tx_set_state(struct sock *sk,
                                   enum ccid3_hc_tx_states state)
 {
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
-        enum ccid3_hc_tx_states oldstate = hctx->ccid3hctx_state;
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
+        enum ccid3_hc_tx_states oldstate = hc->tx_state;
 
         ccid3_pr_debug("%s(%p) %-8.8s -> %s\n",
                        dccp_role(sk), sk, ccid3_tx_state_name(oldstate),
                        ccid3_tx_state_name(state));
         WARN_ON(state == oldstate);
-        hctx->ccid3hctx_state = state;
+        hc->tx_state = state;
 }
 
 /*
@@ -85,37 +85,32 @@ static void ccid3_hc_tx_set_state(struct sock *sk,
  */
 static inline u64 rfc3390_initial_rate(struct sock *sk)
 {
-        const struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
-        const __u32 w_init = clamp_t(__u32, 4380U,
-                        2 * hctx->ccid3hctx_s, 4 * hctx->ccid3hctx_s);
+        const struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
+        const __u32 w_init = clamp_t(__u32, 4380U, 2 * hc->tx_s, 4 * hc->tx_s);
 
-        return scaled_div(w_init << 6, hctx->ccid3hctx_rtt);
+        return scaled_div(w_init << 6, hc->tx_rtt);
 }
 
 /*
  * Recalculate t_ipi and delta (should be called whenever X changes)
  */
-static void ccid3_update_send_interval(struct ccid3_hc_tx_sock *hctx)
+static void ccid3_update_send_interval(struct ccid3_hc_tx_sock *hc)
 {
         /* Calculate new t_ipi = s / X_inst (X_inst is in 64 * bytes/second) */
-        hctx->ccid3hctx_t_ipi = scaled_div32(((u64)hctx->ccid3hctx_s) << 6,
-                                             hctx->ccid3hctx_x);
+        hc->tx_t_ipi = scaled_div32(((u64)hc->tx_s) << 6, hc->tx_x);
 
         /* Calculate new delta by delta = min(t_ipi / 2, t_gran / 2) */
-        hctx->ccid3hctx_delta = min_t(u32, hctx->ccid3hctx_t_ipi / 2,
-                                           TFRC_OPSYS_HALF_TIME_GRAN);
-
-        ccid3_pr_debug("t_ipi=%u, delta=%u, s=%u, X=%u\n",
-                       hctx->ccid3hctx_t_ipi, hctx->ccid3hctx_delta,
-                       hctx->ccid3hctx_s, (unsigned)(hctx->ccid3hctx_x >> 6));
+        hc->tx_delta = min_t(u32, hc->tx_t_ipi / 2, TFRC_OPSYS_HALF_TIME_GRAN);
 
+        ccid3_pr_debug("t_ipi=%u, delta=%u, s=%u, X=%u\n", hc->tx_t_ipi,
+                       hc->tx_delta, hc->tx_s, (unsigned)(hc->tx_x >> 6));
 }
 
-static u32 ccid3_hc_tx_idle_rtt(struct ccid3_hc_tx_sock *hctx, ktime_t now)
+static u32 ccid3_hc_tx_idle_rtt(struct ccid3_hc_tx_sock *hc, ktime_t now)
 {
-        u32 delta = ktime_us_delta(now, hctx->ccid3hctx_t_last_win_count);
+        u32 delta = ktime_us_delta(now, hc->tx_t_last_win_count);
 
-        return delta / hctx->ccid3hctx_rtt;
+        return delta / hc->tx_rtt;
 }
 
 /**
@@ -130,9 +125,9 @@ static u32 ccid3_hc_tx_idle_rtt(struct ccid3_hc_tx_sock *hctx, ktime_t now)
  */
 static void ccid3_hc_tx_update_x(struct sock *sk, ktime_t *stamp)
 {
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
-        __u64 min_rate = 2 * hctx->ccid3hctx_x_recv;
-        const  __u64 old_x = hctx->ccid3hctx_x;
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
+        __u64 min_rate = 2 * hc->tx_x_recv;
+        const __u64 old_x = hc->tx_x;
         ktime_t now = stamp ? *stamp : ktime_get_real();
 
         /*
@@ -141,37 +136,31 @@ static void ccid3_hc_tx_update_x(struct sock *sk, ktime_t *stamp)
          * a sender is idle if it has not sent anything over a 2-RTT-period.
          * For consistency with X and X_recv, min_rate is also scaled by 2^6.
          */
-        if (ccid3_hc_tx_idle_rtt(hctx, now) >= 2) {
+        if (ccid3_hc_tx_idle_rtt(hc, now) >= 2) {
                 min_rate = rfc3390_initial_rate(sk);
-                min_rate = max(min_rate, 2 * hctx->ccid3hctx_x_recv);
+                min_rate = max(min_rate, 2 * hc->tx_x_recv);
         }
 
-        if (hctx->ccid3hctx_p > 0) {
+        if (hc->tx_p > 0) {
 
-                hctx->ccid3hctx_x = min(((__u64)hctx->ccid3hctx_x_calc) << 6,
-                                        min_rate);
-                hctx->ccid3hctx_x = max(hctx->ccid3hctx_x,
-                                        (((__u64)hctx->ccid3hctx_s) << 6) /
-                                                                TFRC_T_MBI);
+                hc->tx_x = min(((__u64)hc->tx_x_calc) << 6, min_rate);
+                hc->tx_x = max(hc->tx_x, (((__u64)hc->tx_s) << 6) / TFRC_T_MBI);
 
-        } else if (ktime_us_delta(now, hctx->ccid3hctx_t_ld)
-                                - (s64)hctx->ccid3hctx_rtt >= 0) {
+        } else if (ktime_us_delta(now, hc->tx_t_ld) - (s64)hc->tx_rtt >= 0) {
 
-                hctx->ccid3hctx_x = min(2 * hctx->ccid3hctx_x, min_rate);
-                hctx->ccid3hctx_x = max(hctx->ccid3hctx_x,
-                            scaled_div(((__u64)hctx->ccid3hctx_s) << 6,
-                                       hctx->ccid3hctx_rtt));
-                hctx->ccid3hctx_t_ld = now;
+                hc->tx_x = min(2 * hc->tx_x, min_rate);
+                hc->tx_x = max(hc->tx_x,
+                               scaled_div(((__u64)hc->tx_s) << 6, hc->tx_rtt));
+                hc->tx_t_ld = now;
         }
 
-        if (hctx->ccid3hctx_x != old_x) {
+        if (hc->tx_x != old_x) {
                 ccid3_pr_debug("X_prev=%u, X_now=%u, X_calc=%u, "
                                "X_recv=%u\n", (unsigned)(old_x >> 6),
-                               (unsigned)(hctx->ccid3hctx_x >> 6),
-                               hctx->ccid3hctx_x_calc,
-                               (unsigned)(hctx->ccid3hctx_x_recv >> 6));
+                               (unsigned)(hc->tx_x >> 6), hc->tx_x_calc,
+                               (unsigned)(hc->tx_x_recv >> 6));
 
-                ccid3_update_send_interval(hctx);
+                ccid3_update_send_interval(hc);
         }
 }
 
@@ -179,37 +168,37 @@ static void ccid3_hc_tx_update_x(struct sock *sk, ktime_t *stamp)
  *      Track the mean packet size `s' (cf. RFC 4342, 5.3 and  RFC 3448, 4.1)
  *      @len: DCCP packet payload size in bytes
  */
-static inline void ccid3_hc_tx_update_s(struct ccid3_hc_tx_sock *hctx, int len)
+static inline void ccid3_hc_tx_update_s(struct ccid3_hc_tx_sock *hc, int len)
 {
-        const u16 old_s = hctx->ccid3hctx_s;
+        const u16 old_s = hc->tx_s;
 
-        hctx->ccid3hctx_s = tfrc_ewma(hctx->ccid3hctx_s, len, 9);
+        hc->tx_s = tfrc_ewma(hc->tx_s, len, 9);
 
-        if (hctx->ccid3hctx_s != old_s)
-                ccid3_update_send_interval(hctx);
+        if (hc->tx_s != old_s)
+                ccid3_update_send_interval(hc);
 }
 
 /*
  *      Update Window Counter using the algorithm from [RFC 4342, 8.1].
  *      As elsewhere, RTT > 0 is assumed by using dccp_sample_rtt().
  */
-static inline void ccid3_hc_tx_update_win_count(struct ccid3_hc_tx_sock *hctx,
+static inline void ccid3_hc_tx_update_win_count(struct ccid3_hc_tx_sock *hc,
                                                 ktime_t now)
 {
-        u32 delta = ktime_us_delta(now, hctx->ccid3hctx_t_last_win_count),
-            quarter_rtts = (4 * delta) / hctx->ccid3hctx_rtt;
+        u32 delta = ktime_us_delta(now, hc->tx_t_last_win_count),
+            quarter_rtts = (4 * delta) / hc->tx_rtt;
 
         if (quarter_rtts > 0) {
-                hctx->ccid3hctx_t_last_win_count = now;
-                hctx->ccid3hctx_last_win_count  += min(quarter_rtts, 5U);
-                hctx->ccid3hctx_last_win_count  &= 0xF;         /* mod 16 */
+                hc->tx_t_last_win_count = now;
+                hc->tx_last_win_count  += min(quarter_rtts, 5U);
+                hc->tx_last_win_count  &= 0xF;          /* mod 16 */
         }
 }
 
 static void ccid3_hc_tx_no_feedback_timer(unsigned long data)
 {
         struct sock *sk = (struct sock *)data;
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
         unsigned long t_nfb = USEC_PER_SEC / 5;
 
         bh_lock_sock(sk);
@@ -220,24 +209,23 @@ static void ccid3_hc_tx_no_feedback_timer(unsigned long data)
         }
 
         ccid3_pr_debug("%s(%p, state=%s) - entry \n", dccp_role(sk), sk,
-                       ccid3_tx_state_name(hctx->ccid3hctx_state));
+                       ccid3_tx_state_name(hc->tx_state));
 
-        if (hctx->ccid3hctx_state == TFRC_SSTATE_FBACK)
+        if (hc->tx_state == TFRC_SSTATE_FBACK)
                 ccid3_hc_tx_set_state(sk, TFRC_SSTATE_NO_FBACK);
-        else if (hctx->ccid3hctx_state != TFRC_SSTATE_NO_FBACK)
+        else if (hc->tx_state != TFRC_SSTATE_NO_FBACK)
                 goto out;
 
         /*
          * Determine new allowed sending rate X as per draft rfc3448bis-00, 4.4
          */
-        if (hctx->ccid3hctx_t_rto == 0 ||       /* no feedback received yet */
-            hctx->ccid3hctx_p == 0) {
+        if (hc->tx_t_rto == 0 ||        /* no feedback received yet */
+            hc->tx_p == 0) {
 
                 /* halve send rate directly */
-                hctx->ccid3hctx_x = max(hctx->ccid3hctx_x / 2,
-                                        (((__u64)hctx->ccid3hctx_s) << 6) /
-                                                                    TFRC_T_MBI);
-                ccid3_update_send_interval(hctx);
+                hc->tx_x = max(hc->tx_x / 2,
+                               (((__u64)hc->tx_s) << 6) / TFRC_T_MBI);
+                ccid3_update_send_interval(hc);
         } else {
                 /*
                  *  Modify the cached value of X_recv
@@ -249,33 +237,32 @@ static void ccid3_hc_tx_no_feedback_timer(unsigned long data)
                  *
                  *  Note that X_recv is scaled by 2^6 while X_calc is not
                  */
-                BUG_ON(hctx->ccid3hctx_p && !hctx->ccid3hctx_x_calc);
+                BUG_ON(hc->tx_p && !hc->tx_x_calc);
 
-                if (hctx->ccid3hctx_x_calc > (hctx->ccid3hctx_x_recv >> 5))
-                        hctx->ccid3hctx_x_recv =
-                                max(hctx->ccid3hctx_x_recv / 2,
-                                    (((__u64)hctx->ccid3hctx_s) << 6) /
-                                                              (2 * TFRC_T_MBI));
+                if (hc->tx_x_calc > (hc->tx_x_recv >> 5))
+                        hc->tx_x_recv =
+                                max(hc->tx_x_recv / 2,
+                                    (((__u64)hc->tx_s) << 6) / (2*TFRC_T_MBI));
                 else {
-                        hctx->ccid3hctx_x_recv = hctx->ccid3hctx_x_calc;
-                        hctx->ccid3hctx_x_recv <<= 4;
+                        hc->tx_x_recv = hc->tx_x_calc;
+                        hc->tx_x_recv <<= 4;
                 }
                 ccid3_hc_tx_update_x(sk, NULL);
         }
         ccid3_pr_debug("Reduced X to %llu/64 bytes/sec\n",
-                        (unsigned long long)hctx->ccid3hctx_x);
+                        (unsigned long long)hc->tx_x);
 
         /*
          * Set new timeout for the nofeedback timer.
          * See comments in packet_recv() regarding the value of t_RTO.
          */
-        if (unlikely(hctx->ccid3hctx_t_rto == 0))       /* no feedback yet */
+        if (unlikely(hc->tx_t_rto == 0))        /* no feedback yet */
                 t_nfb = TFRC_INITIAL_TIMEOUT;
         else
-                t_nfb = max(hctx->ccid3hctx_t_rto, 2 * hctx->ccid3hctx_t_ipi);
+                t_nfb = max(hc->tx_t_rto, 2 * hc->tx_t_ipi);
 
 restart_timer:
-        sk_reset_timer(sk, &hctx->ccid3hctx_no_feedback_timer,
+        sk_reset_timer(sk, &hc->tx_no_feedback_timer,
                            jiffies + usecs_to_jiffies(t_nfb));
 out:
         bh_unlock_sock(sk);
@@ -291,7 +278,7 @@ out:
 static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
 {
         struct dccp_sock *dp = dccp_sk(sk);
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
         ktime_t now = ktime_get_real();
         s64 delay;
 
@@ -303,18 +290,17 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
         if (unlikely(skb->len == 0))
                 return -EBADMSG;
 
-        switch (hctx->ccid3hctx_state) {
+        switch (hc->tx_state) {
         case TFRC_SSTATE_NO_SENT:
-                sk_reset_timer(sk, &hctx->ccid3hctx_no_feedback_timer,
-                               (jiffies +
-                                usecs_to_jiffies(TFRC_INITIAL_TIMEOUT)));
-                hctx->ccid3hctx_last_win_count   = 0;
-                hctx->ccid3hctx_t_last_win_count = now;
+                sk_reset_timer(sk, &hc->tx_no_feedback_timer, (jiffies +
+                               usecs_to_jiffies(TFRC_INITIAL_TIMEOUT)));
+                hc->tx_last_win_count   = 0;
+                hc->tx_t_last_win_count = now;
 
                 /* Set t_0 for initial packet */
-                hctx->ccid3hctx_t_nom = now;
+                hc->tx_t_nom = now;
 
-                hctx->ccid3hctx_s = skb->len;
+                hc->tx_s = skb->len;
 
                 /*
                  * Use initial RTT sample when available: recommended by erratum
@@ -323,9 +309,9 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
                  */
                 if (dp->dccps_syn_rtt) {
                         ccid3_pr_debug("SYN RTT = %uus\n", dp->dccps_syn_rtt);
-                        hctx->ccid3hctx_rtt  = dp->dccps_syn_rtt;
-                        hctx->ccid3hctx_x    = rfc3390_initial_rate(sk);
-                        hctx->ccid3hctx_t_ld = now;
+                        hc->tx_rtt  = dp->dccps_syn_rtt;
+                        hc->tx_x    = rfc3390_initial_rate(sk);
+                        hc->tx_t_ld = now;
                 } else {
                         /*
                          * Sender does not have RTT sample:
@@ -333,17 +319,17 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
                          *   is needed in several parts (e.g.  window counter);
                          * - set sending rate X_pps = 1pps as per RFC 3448, 4.2.
                          */
-                        hctx->ccid3hctx_rtt = DCCP_FALLBACK_RTT;
-                        hctx->ccid3hctx_x   = hctx->ccid3hctx_s;
-                        hctx->ccid3hctx_x <<= 6;
+                        hc->tx_rtt = DCCP_FALLBACK_RTT;
+                        hc->tx_x   = hc->tx_s;
+                        hc->tx_x <<= 6;
                 }
-                ccid3_update_send_interval(hctx);
+                ccid3_update_send_interval(hc);
 
                 ccid3_hc_tx_set_state(sk, TFRC_SSTATE_NO_FBACK);
                 break;
         case TFRC_SSTATE_NO_FBACK:
         case TFRC_SSTATE_FBACK:
-                delay = ktime_us_delta(hctx->ccid3hctx_t_nom, now);
+                delay = ktime_us_delta(hc->tx_t_nom, now);
                 ccid3_pr_debug("delay=%ld\n", (long)delay);
                 /*
                  *      Scheduling of packet transmissions [RFC 3448, 4.6]
@@ -353,10 +339,10 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
                  * else
                  *       // send the packet in (t_nom - t_now) milliseconds.
                  */
-                if (delay - (s64)hctx->ccid3hctx_delta >= 1000)
+                if (delay - (s64)hc->tx_delta >= 1000)
                         return (u32)delay / 1000L;
 
-                ccid3_hc_tx_update_win_count(hctx, now);
+                ccid3_hc_tx_update_win_count(hc, now);
                 break;
         case TFRC_SSTATE_TERM:
                 DCCP_BUG("%s(%p) - Illegal state TERM", dccp_role(sk), sk);
@@ -365,28 +351,27 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
 
         /* prepare to send now (add options etc.) */
         dp->dccps_hc_tx_insert_options = 1;
-        DCCP_SKB_CB(skb)->dccpd_ccval = hctx->ccid3hctx_last_win_count;
+        DCCP_SKB_CB(skb)->dccpd_ccval  = hc->tx_last_win_count;
 
         /* set the nominal send time for the next following packet */
-        hctx->ccid3hctx_t_nom = ktime_add_us(hctx->ccid3hctx_t_nom,
-                                             hctx->ccid3hctx_t_ipi);
+        hc->tx_t_nom = ktime_add_us(hc->tx_t_nom, hc->tx_t_ipi);
         return 0;
 }
 
 static void ccid3_hc_tx_packet_sent(struct sock *sk, int more,
                                     unsigned int len)
 {
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
 
-        ccid3_hc_tx_update_s(hctx, len);
+        ccid3_hc_tx_update_s(hc, len);
 
-        if (tfrc_tx_hist_add(&hctx->ccid3hctx_hist, dccp_sk(sk)->dccps_gss))
+        if (tfrc_tx_hist_add(&hc->tx_hist, dccp_sk(sk)->dccps_gss))
                 DCCP_CRIT("packet history - out of memory!");
 }
 
 static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
 {
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
         struct ccid3_options_received *opt_recv;
         ktime_t now;
         unsigned long t_nfb;
@@ -397,15 +382,15 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
               DCCP_SKB_CB(skb)->dccpd_type == DCCP_PKT_DATAACK))
                 return;
         /* ... and only in the established state */
-        if (hctx->ccid3hctx_state != TFRC_SSTATE_FBACK &&
-            hctx->ccid3hctx_state != TFRC_SSTATE_NO_FBACK)
+        if (hc->tx_state != TFRC_SSTATE_FBACK &&
+            hc->tx_state != TFRC_SSTATE_NO_FBACK)
                 return;
 
-        opt_recv = &hctx->ccid3hctx_options_received;
+        opt_recv = &hc->tx_options_received;
         now = ktime_get_real();
 
         /* Estimate RTT from history if ACK number is valid */
-        r_sample = tfrc_tx_hist_rtt(hctx->ccid3hctx_hist,
+        r_sample = tfrc_tx_hist_rtt(hc->tx_hist,
                                     DCCP_SKB_CB(skb)->dccpd_ack_seq, now);
         if (r_sample == 0) {
                 DCCP_WARN("%s(%p): %s with bogus ACK-%llu\n", dccp_role(sk), sk,
@@ -415,37 +400,37 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
         }
 
         /* Update receive rate in units of 64 * bytes/second */
-        hctx->ccid3hctx_x_recv = opt_recv->ccid3or_receive_rate;
-        hctx->ccid3hctx_x_recv <<= 6;
+        hc->tx_x_recv = opt_recv->ccid3or_receive_rate;
+        hc->tx_x_recv <<= 6;
 
         /* Update loss event rate (which is scaled by 1e6) */
         pinv = opt_recv->ccid3or_loss_event_rate;
         if (pinv == ~0U || pinv == 0)          /* see RFC 4342, 8.5   */
-                hctx->ccid3hctx_p = 0;
+                hc->tx_p = 0;
         else                                   /* can not exceed 100% */
-                hctx->ccid3hctx_p = scaled_div(1, pinv);
+                hc->tx_p = scaled_div(1, pinv);
         /*
          * Validate new RTT sample and update moving average
          */
         r_sample = dccp_sample_rtt(sk, r_sample);
-        hctx->ccid3hctx_rtt = tfrc_ewma(hctx->ccid3hctx_rtt, r_sample, 9);
+        hc->tx_rtt = tfrc_ewma(hc->tx_rtt, r_sample, 9);
         /*
          * Update allowed sending rate X as per draft rfc3448bis-00, 4.2/3
          */
-        if (hctx->ccid3hctx_state == TFRC_SSTATE_NO_FBACK) {
+        if (hc->tx_state == TFRC_SSTATE_NO_FBACK) {
                 ccid3_hc_tx_set_state(sk, TFRC_SSTATE_FBACK);
 
-                if (hctx->ccid3hctx_t_rto == 0) {
+                if (hc->tx_t_rto == 0) {
                         /*
                          * Initial feedback packet: Larger Initial Windows (4.2)
                          */
-                        hctx->ccid3hctx_x    = rfc3390_initial_rate(sk);
-                        hctx->ccid3hctx_t_ld = now;
+                        hc->tx_x    = rfc3390_initial_rate(sk);
+                        hc->tx_t_ld = now;
 
-                        ccid3_update_send_interval(hctx);
+                        ccid3_update_send_interval(hc);
 
                         goto done_computing_x;
-                } else if (hctx->ccid3hctx_p == 0) {
+                } else if (hc->tx_p == 0) {
                         /*
                          * First feedback after nofeedback timer expiry (4.3)
                          */
@@ -454,25 +439,20 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
         }
 
         /* Update sending rate (step 4 of [RFC 3448, 4.3]) */
-        if (hctx->ccid3hctx_p > 0)
-                hctx->ccid3hctx_x_calc =
-                                tfrc_calc_x(hctx->ccid3hctx_s,
-                                            hctx->ccid3hctx_rtt,
-                                            hctx->ccid3hctx_p);
+        if (hc->tx_p > 0)
+                hc->tx_x_calc = tfrc_calc_x(hc->tx_s, hc->tx_rtt, hc->tx_p);
         ccid3_hc_tx_update_x(sk, &now);
 
 done_computing_x:
         ccid3_pr_debug("%s(%p), RTT=%uus (sample=%uus), s=%u, "
                                "p=%u, X_calc=%u, X_recv=%u, X=%u\n",
-                               dccp_role(sk),
-                               sk, hctx->ccid3hctx_rtt, r_sample,
-                               hctx->ccid3hctx_s, hctx->ccid3hctx_p,
-                               hctx->ccid3hctx_x_calc,
-                               (unsigned)(hctx->ccid3hctx_x_recv >> 6),
-                               (unsigned)(hctx->ccid3hctx_x >> 6));
+                               dccp_role(sk), sk, hc->tx_rtt, r_sample,
+                               hc->tx_s, hc->tx_p, hc->tx_x_calc,
+                               (unsigned)(hc->tx_x_recv >> 6),
+                               (unsigned)(hc->tx_x >> 6));
 
         /* unschedule no feedback timer */
-        sk_stop_timer(sk, &hctx->ccid3hctx_no_feedback_timer);
+        sk_stop_timer(sk, &hc->tx_no_feedback_timer);
 
         /*
          * As we have calculated new ipi, delta, t_nom it is possible
@@ -486,21 +466,19 @@ done_computing_x:
          * This can help avoid triggering the nofeedback timer too
          * often ('spinning') on LANs with small RTTs.
          */
-        hctx->ccid3hctx_t_rto = max_t(u32, 4 * hctx->ccid3hctx_rtt,
-                                           (CONFIG_IP_DCCP_CCID3_RTO *
-                                            (USEC_PER_SEC / 1000)));
+        hc->tx_t_rto = max_t(u32, 4 * hc->tx_rtt, (CONFIG_IP_DCCP_CCID3_RTO *
+                                                       (USEC_PER_SEC / 1000)));
         /*
          * Schedule no feedback timer to expire in
          * max(t_RTO, 2 * s/X)  =  max(t_RTO, 2 * t_ipi)
          */
-        t_nfb = max(hctx->ccid3hctx_t_rto, 2 * hctx->ccid3hctx_t_ipi);
+        t_nfb = max(hc->tx_t_rto, 2 * hc->tx_t_ipi);
 
         ccid3_pr_debug("%s(%p), Scheduled no feedback timer to "
                        "expire in %lu jiffies (%luus)\n",
-                       dccp_role(sk),
-                       sk, usecs_to_jiffies(t_nfb), t_nfb);
+                       dccp_role(sk), sk, usecs_to_jiffies(t_nfb), t_nfb);
 
-        sk_reset_timer(sk, &hctx->ccid3hctx_no_feedback_timer,
+        sk_reset_timer(sk, &hc->tx_no_feedback_timer,
                            jiffies + usecs_to_jiffies(t_nfb));
 }
 
@@ -510,11 +488,11 @@ static int ccid3_hc_tx_parse_options(struct sock *sk, unsigned char option,
 {
         int rc = 0;
         const struct dccp_sock *dp = dccp_sk(sk);
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
         struct ccid3_options_received *opt_recv;
         __be32 opt_val;
 
-        opt_recv = &hctx->ccid3hctx_options_received;
+        opt_recv = &hc->tx_options_received;
 
         if (opt_recv->ccid3or_seqno != dp->dccps_gsr) {
                 opt_recv->ccid3or_seqno              = dp->dccps_gsr;
@@ -568,56 +546,55 @@ static int ccid3_hc_tx_parse_options(struct sock *sk, unsigned char option,
 
 static int ccid3_hc_tx_init(struct ccid *ccid, struct sock *sk)
 {
-        struct ccid3_hc_tx_sock *hctx = ccid_priv(ccid);
+        struct ccid3_hc_tx_sock *hc = ccid_priv(ccid);
 
-        hctx->ccid3hctx_state = TFRC_SSTATE_NO_SENT;
-        hctx->ccid3hctx_hist = NULL;
-        setup_timer(&hctx->ccid3hctx_no_feedback_timer,
+        hc->tx_state = TFRC_SSTATE_NO_SENT;
+        hc->tx_hist  = NULL;
+        setup_timer(&hc->tx_no_feedback_timer,
                         ccid3_hc_tx_no_feedback_timer, (unsigned long)sk);
-
         return 0;
 }
 
 static void ccid3_hc_tx_exit(struct sock *sk)
 {
-        struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
+        struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
 
         ccid3_hc_tx_set_state(sk, TFRC_SSTATE_TERM);
-        sk_stop_timer(sk, &hctx->ccid3hctx_no_feedback_timer);
+        sk_stop_timer(sk, &hc->tx_no_feedback_timer);
 
-        tfrc_tx_hist_purge(&hctx->ccid3hctx_hist);
+        tfrc_tx_hist_purge(&hc->tx_hist);
 }
 
 static void ccid3_hc_tx_get_info(struct sock *sk, struct tcp_info *info)
 {
-        struct ccid3_hc_tx_sock *hctx;
+        struct ccid3_hc_tx_sock *hc;
 
         /* Listen socks doesn't have a private CCID block */
         if (sk->sk_state == DCCP_LISTEN)
                 return;
 
-        hctx = ccid3_hc_tx_sk(sk);
-        info->tcpi_rto = hctx->ccid3hctx_t_rto;
-        info->tcpi_rtt = hctx->ccid3hctx_rtt;
+        hc = ccid3_hc_tx_sk(sk);
+        info->tcpi_rto = hc->tx_t_rto;
+        info->tcpi_rtt = hc->tx_rtt;
 }
 
 static int ccid3_hc_tx_getsockopt(struct sock *sk, const int optname, int len,
                                   u32 __user *optval, int __user *optlen)
 {
-        const struct ccid3_hc_tx_sock *hctx;
+        const struct ccid3_hc_tx_sock *hc;
         const void *val;
 
         /* Listen socks doesn't have a private CCID block */
         if (sk->sk_state == DCCP_LISTEN)
                 return -EINVAL;
 
-        hctx = ccid3_hc_tx_sk(sk);
+        hc = ccid3_hc_tx_sk(sk);
         switch (optname) {
         case DCCP_SOCKOPT_CCID_TX_INFO:
-                if (len < sizeof(hctx->ccid3hctx_tfrc))
+                if (len < sizeof(hc->tx_tfrc))
                         return -EINVAL;
-                len = sizeof(hctx->ccid3hctx_tfrc);
-                val = &hctx->ccid3hctx_tfrc;
+                len = sizeof(hc->tx_tfrc);
+                val = &hc->tx_tfrc;
                 break;
         default:
                 return -ENOPROTOOPT;
@@ -657,34 +634,34 @@ static const char *ccid3_rx_state_name(enum ccid3_hc_rx_states state)
 static void ccid3_hc_rx_set_state(struct sock *sk,
                                   enum ccid3_hc_rx_states state)
 {
-        struct ccid3_hc_rx_sock *hcrx = ccid3_hc_rx_sk(sk);
-        enum ccid3_hc_rx_states oldstate = hcrx->ccid3hcrx_state;
+        struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
+        enum ccid3_hc_rx_states oldstate = hc->rx_state;
 
         ccid3_pr_debug("%s(%p) %-8.8s -> %s\n",
                        dccp_role(sk), sk, ccid3_rx_state_name(oldstate),
                        ccid3_rx_state_name(state));
         WARN_ON(state == oldstate);
-        hcrx->ccid3hcrx_state = state;
+        hc->rx_state = state;
 }
 
 static void ccid3_hc_rx_send_feedback(struct sock *sk,
                                       const struct sk_buff *skb,
                                       enum ccid3_fback_type fbtype)
 {
-        struct ccid3_hc_rx_sock *hcrx = ccid3_hc_rx_sk(sk);
+        struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
         struct dccp_sock *dp = dccp_sk(sk);
         ktime_t now;
         s64 delta = 0;
 
-        if (unlikely(hcrx->ccid3hcrx_state == TFRC_RSTATE_TERM))
+        if (unlikely(hc->rx_state == TFRC_RSTATE_TERM))
                 return;
 
         now = ktime_get_real();
 
         switch (fbtype) {
         case CCID3_FBACK_INITIAL:
-                hcrx->ccid3hcrx_x_recv = 0;
-                hcrx->ccid3hcrx_pinv   = ~0U;   /* see RFC 4342, 8.5 */
+                hc->rx_x_recv = 0;
+                hc->rx_pinv   = ~0U;   /* see RFC 4342, 8.5 */
                 break;
         case CCID3_FBACK_PARAM_CHANGE:
                 /*
@@ -697,27 +674,26 @@ static void ccid3_hc_rx_send_feedback(struct sock *sk,
                  * the number of bytes since last feedback.
                  * This is a safe fallback, since X is bounded above by X_calc.
                  */
-                if (hcrx->ccid3hcrx_x_recv > 0)
+                if (hc->rx_x_recv > 0)
                         break;
                 /* fall through */
         case CCID3_FBACK_PERIODIC:
-                delta = ktime_us_delta(now, hcrx->ccid3hcrx_tstamp_last_feedback);
+                delta = ktime_us_delta(now, hc->rx_tstamp_last_feedback);
                 if (delta <= 0)
                         DCCP_BUG("delta (%ld) <= 0", (long)delta);
                 else
-                        hcrx->ccid3hcrx_x_recv =
-                                scaled_div32(hcrx->ccid3hcrx_bytes_recv, delta);
+                        hc->rx_x_recv = scaled_div32(hc->rx_bytes_recv, delta);
                 break;
         default:
                 return;
         }
 
         ccid3_pr_debug("Interval %ldusec, X_recv=%u, 1/p=%u\n", (long)delta,
-                       hcrx->ccid3hcrx_x_recv, hcrx->ccid3hcrx_pinv);
+                       hc->rx_x_recv, hc->rx_pinv);
 
-        hcrx->ccid3hcrx_tstamp_last_feedback = now;
-        hcrx->ccid3hcrx_last_counter         = dccp_hdr(skb)->dccph_ccval;
-        hcrx->ccid3hcrx_bytes_recv           = 0;
+        hc->rx_tstamp_last_feedback = now;
+        hc->rx_last_counter         = dccp_hdr(skb)->dccph_ccval;
+        hc->rx_bytes_recv           = 0;
 
         dp->dccps_hc_rx_insert_options = 1;
         dccp_send_ack(sk);
@@ -725,19 +701,19 @@ static void ccid3_hc_rx_send_feedback(struct sock *sk,
 
 static int ccid3_hc_rx_insert_options(struct sock *sk, struct sk_buff *skb)
 {
-        const struct ccid3_hc_rx_sock *hcrx;
+        const struct ccid3_hc_rx_sock *hc;
         __be32 x_recv, pinv;
 
         if (!(sk->sk_state == DCCP_OPEN || sk->sk_state == DCCP_PARTOPEN))
                 return 0;
 
-        hcrx = ccid3_hc_rx_sk(sk);
+        hc = ccid3_hc_rx_sk(sk);
 
         if (dccp_packet_without_ack(skb))
                 return 0;
 
-        x_recv = htonl(hcrx->ccid3hcrx_x_recv);
-        pinv   = htonl(hcrx->ccid3hcrx_pinv);
+        x_recv = htonl(hc->rx_x_recv);
+        pinv   = htonl(hc->rx_pinv);
 
         if (dccp_insert_option(sk, skb, TFRC_OPT_LOSS_EVENT_RATE,
                                &pinv, sizeof(pinv)) ||
@@ -760,26 +736,26 @@ static int ccid3_hc_rx_insert_options(struct sock *sk, struct sk_buff *skb)
  */
 static u32 ccid3_first_li(struct sock *sk)
 {
-        struct ccid3_hc_rx_sock *hcrx = ccid3_hc_rx_sk(sk);
+        struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
         u32 x_recv, p, delta;
         u64 fval;
 
-        if (hcrx->ccid3hcrx_rtt == 0) {
+        if (hc->rx_rtt == 0) {
                 DCCP_WARN("No RTT estimate available, using fallback RTT\n");
-                hcrx->ccid3hcrx_rtt = DCCP_FALLBACK_RTT;
+                hc->rx_rtt = DCCP_FALLBACK_RTT;
         }
 
-        delta = ktime_to_us(net_timedelta(hcrx->ccid3hcrx_tstamp_last_feedback));
-        x_recv = scaled_div32(hcrx->ccid3hcrx_bytes_recv, delta);
+        delta  = ktime_to_us(net_timedelta(hc->rx_tstamp_last_feedback));
+        x_recv = scaled_div32(hc->rx_bytes_recv, delta);
         if (x_recv == 0) {              /* would also trigger divide-by-zero */
                 DCCP_WARN("X_recv==0\n");
-                if ((x_recv = hcrx->ccid3hcrx_x_recv) == 0) {
+                if ((x_recv = hc->rx_x_recv) == 0) {
                         DCCP_BUG("stored value of X_recv is zero");
                         return ~0U;
                 }
         }
 
-        fval = scaled_div(hcrx->ccid3hcrx_s, hcrx->ccid3hcrx_rtt);
+        fval = scaled_div(hc->rx_s, hc->rx_rtt);
         fval = scaled_div32(fval, x_recv);
         p = tfrc_calc_x_reverse_lookup(fval);
 
@@ -791,19 +767,19 @@ static u32 ccid3_first_li(struct sock *sk)
 
 static void ccid3_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
 {
-        struct ccid3_hc_rx_sock *hcrx = ccid3_hc_rx_sk(sk);
+        struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
         enum ccid3_fback_type do_feedback = CCID3_FBACK_NONE;
         const u64 ndp = dccp_sk(sk)->dccps_options_received.dccpor_ndp;
         const bool is_data_packet = dccp_data_packet(skb);
 
-        if (unlikely(hcrx->ccid3hcrx_state == TFRC_RSTATE_NO_DATA)) {
+        if (unlikely(hc->rx_state == TFRC_RSTATE_NO_DATA)) {
                 if (is_data_packet) {
                         const u32 payload = skb->len - dccp_hdr(skb)->dccph_doff * 4;
                         do_feedback = CCID3_FBACK_INITIAL;
                         ccid3_hc_rx_set_state(sk, TFRC_RSTATE_DATA);
-                        hcrx->ccid3hcrx_s = payload;
+                        hc->rx_s = payload;
                         /*
-                         * Not necessary to update ccid3hcrx_bytes_recv here,
+                         * Not necessary to update rx_bytes_recv here,
                          * since X_recv = 0 for the first feedback packet (cf.
                          * RFC 3448, 6.3) -- gerrit
                          */
@@ -811,7 +787,7 @@ static void ccid3_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
                 goto update_records;
         }
 
-        if (tfrc_rx_hist_duplicate(&hcrx->ccid3hcrx_hist, skb))
+        if (tfrc_rx_hist_duplicate(&hc->rx_hist, skb))
                 return; /* done receiving */
 
         if (is_data_packet) {
@@ -819,20 +795,20 @@ static void ccid3_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
                 /*
                  * Update moving-average of s and the sum of received payload bytes
                  */
-                hcrx->ccid3hcrx_s = tfrc_ewma(hcrx->ccid3hcrx_s, payload, 9);
-                hcrx->ccid3hcrx_bytes_recv += payload;
+                hc->rx_s = tfrc_ewma(hc->rx_s, payload, 9);
+                hc->rx_bytes_recv += payload;
         }
 
         /*
          * Perform loss detection and handle pending losses
          */
-        if (tfrc_rx_handle_loss(&hcrx->ccid3hcrx_hist, &hcrx->ccid3hcrx_li_hist,
+        if (tfrc_rx_handle_loss(&hc->rx_hist, &hc->rx_li_hist,
                                 skb, ndp, ccid3_first_li, sk)) {
                 do_feedback = CCID3_FBACK_PARAM_CHANGE;
                 goto done_receiving;
         }
 
-        if (tfrc_rx_hist_loss_pending(&hcrx->ccid3hcrx_hist))
+        if (tfrc_rx_hist_loss_pending(&hc->rx_hist))
                 return; /* done receiving */
 
         /*
@@ -841,17 +817,17 @@ static void ccid3_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
         if (unlikely(!is_data_packet))
                 goto update_records;
 
-        if (!tfrc_lh_is_initialised(&hcrx->ccid3hcrx_li_hist)) {
-                const u32 sample = tfrc_rx_hist_sample_rtt(&hcrx->ccid3hcrx_hist, skb);
+        if (!tfrc_lh_is_initialised(&hc->rx_li_hist)) {
+                const u32 sample = tfrc_rx_hist_sample_rtt(&hc->rx_hist, skb);
                 /*
                  * Empty loss history: no loss so far, hence p stays 0.
                  * Sample RTT values, since an RTT estimate is required for the
                  * computation of p when the first loss occurs; RFC 3448, 6.3.1.
                  */
                 if (sample != 0)
-                        hcrx->ccid3hcrx_rtt = tfrc_ewma(hcrx->ccid3hcrx_rtt, sample, 9);
+                        hc->rx_rtt = tfrc_ewma(hc->rx_rtt, sample, 9);
 
-        } else if (tfrc_lh_update_i_mean(&hcrx->ccid3hcrx_li_hist, skb)) {
+        } else if (tfrc_lh_update_i_mean(&hc->rx_li_hist, skb)) {
                 /*
                  * Step (3) of [RFC 3448, 6.1]: Recompute I_mean and, if I_mean
                  * has decreased (resp. p has increased), send feedback now.
@@ -862,11 +838,11 @@ static void ccid3_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
         /*
          * Check if the periodic once-per-RTT feedback is due; RFC 4342, 10.3
          */
-        if (SUB16(dccp_hdr(skb)->dccph_ccval, hcrx->ccid3hcrx_last_counter) > 3)
+        if (SUB16(dccp_hdr(skb)->dccph_ccval, hc->rx_last_counter) > 3)
                 do_feedback = CCID3_FBACK_PERIODIC;
 
 update_records:
-        tfrc_rx_hist_add_packet(&hcrx->ccid3hcrx_hist, skb, ndp);
+        tfrc_rx_hist_add_packet(&hc->rx_hist, skb, ndp);
 
 done_receiving:
         if (do_feedback)
@@ -875,41 +851,41 @@ done_receiving:
 
 static int ccid3_hc_rx_init(struct ccid *ccid, struct sock *sk)
 {
-        struct ccid3_hc_rx_sock *hcrx = ccid_priv(ccid);
+        struct ccid3_hc_rx_sock *hc = ccid_priv(ccid);
 
-        hcrx->ccid3hcrx_state = TFRC_RSTATE_NO_DATA;
-        tfrc_lh_init(&hcrx->ccid3hcrx_li_hist);
-        return tfrc_rx_hist_alloc(&hcrx->ccid3hcrx_hist);
+        hc->rx_state = TFRC_RSTATE_NO_DATA;
+        tfrc_lh_init(&hc->rx_li_hist);
+        return tfrc_rx_hist_alloc(&hc->rx_hist);
 }
 
 static void ccid3_hc_rx_exit(struct sock *sk)
 {
-        struct ccid3_hc_rx_sock *hcrx = ccid3_hc_rx_sk(sk);
+        struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
 
         ccid3_hc_rx_set_state(sk, TFRC_RSTATE_TERM);
 
-        tfrc_rx_hist_purge(&hcrx->ccid3hcrx_hist);
-        tfrc_lh_cleanup(&hcrx->ccid3hcrx_li_hist);
+        tfrc_rx_hist_purge(&hc->rx_hist);
+        tfrc_lh_cleanup(&hc->rx_li_hist);
 }
 
 static void ccid3_hc_rx_get_info(struct sock *sk, struct tcp_info *info)
 {
-        const struct ccid3_hc_rx_sock *hcrx;
+        const struct ccid3_hc_rx_sock *hc;
 
         /* Listen socks doesn't have a private CCID block */
         if (sk->sk_state == DCCP_LISTEN)
                 return;
 
-        hcrx = ccid3_hc_rx_sk(sk);
-        info->tcpi_ca_state = hcrx->ccid3hcrx_state;
+        hc = ccid3_hc_rx_sk(sk);
+        info->tcpi_ca_state = hc->rx_state;
         info->tcpi_options  |= TCPI_OPT_TIMESTAMPS;
-        info->tcpi_rcv_rtt  = hcrx->ccid3hcrx_rtt;
+        info->tcpi_rcv_rtt  = hc->rx_rtt;
 }
 
 static int ccid3_hc_rx_getsockopt(struct sock *sk, const int optname, int len,
                                   u32 __user *optval, int __user *optlen)
 {
-        const struct ccid3_hc_rx_sock *hcrx;
+        const struct ccid3_hc_rx_sock *hc;
         struct tfrc_rx_info rx_info;
         const void *val;
 
@@ -917,15 +893,15 @@ static int ccid3_hc_rx_getsockopt(struct sock *sk, const int optname, int len,
         if (sk->sk_state == DCCP_LISTEN)
                 return -EINVAL;
 
-        hcrx = ccid3_hc_rx_sk(sk);
+        hc = ccid3_hc_rx_sk(sk);
         switch (optname) {
         case DCCP_SOCKOPT_CCID_RX_INFO:
                 if (len < sizeof(rx_info))
                         return -EINVAL;
-                rx_info.tfrcrx_x_recv = hcrx->ccid3hcrx_x_recv;
-                rx_info.tfrcrx_rtt    = hcrx->ccid3hcrx_rtt;
-                rx_info.tfrcrx_p      = hcrx->ccid3hcrx_pinv == 0 ? ~0U :
-                                           scaled_div(1, hcrx->ccid3hcrx_pinv);
+                rx_info.tfrcrx_x_recv = hc->rx_x_recv;
+                rx_info.tfrcrx_rtt    = hc->rx_rtt;
+                rx_info.tfrcrx_p      = hc->rx_pinv == 0 ? ~0U :
+                                           scaled_div(1, hc->rx_pinv);
                 len = sizeof(rx_info);
                 val = &rx_info;
                 break;
diff --git a/net/dccp/ccids/ccid3.h b/net/dccp/ccids/ccid3.h
index e5a244143846..032635776653 100644
--- a/net/dccp/ccids/ccid3.h
+++ b/net/dccp/ccids/ccid3.h
@@ -75,44 +75,44 @@ enum ccid3_hc_tx_states {
 
 /**
  * struct ccid3_hc_tx_sock - CCID3 sender half-connection socket
- * @ccid3hctx_x - Current sending rate in 64 * bytes per second
- * @ccid3hctx_x_recv - Receive rate    in 64 * bytes per second
- * @ccid3hctx_x_calc - Calculated rate in bytes per second
- * @ccid3hctx_rtt - Estimate of current round trip time in usecs
- * @ccid3hctx_p - Current loss event rate (0-1) scaled by 1000000
- * @ccid3hctx_s - Packet size in bytes
- * @ccid3hctx_t_rto - Nofeedback Timer setting in usecs
- * @ccid3hctx_t_ipi - Interpacket (send) interval (RFC 3448, 4.6) in usecs
- * @ccid3hctx_state - Sender state, one of %ccid3_hc_tx_states
- * @ccid3hctx_last_win_count - Last window counter sent
- * @ccid3hctx_t_last_win_count - Timestamp of earliest packet
- *                               with last_win_count value sent
- * @ccid3hctx_no_feedback_timer - Handle to no feedback timer
- * @ccid3hctx_t_ld - Time last doubled during slow start
- * @ccid3hctx_t_nom - Nominal send time of next packet
- * @ccid3hctx_delta - Send timer delta (RFC 3448, 4.6) in usecs
- * @ccid3hctx_hist - Packet history
- * @ccid3hctx_options_received - Parsed set of retrieved options
+ * @tx_x:                 Current sending rate in 64 * bytes per second
+ * @tx_x_recv:            Receive rate in 64 * bytes per second
+ * @tx_x_calc:            Calculated rate in bytes per second
+ * @tx_rtt:               Estimate of current round trip time in usecs
+ * @tx_p:                 Current loss event rate (0-1) scaled by 1000000
+ * @tx_s:                 Packet size in bytes
+ * @tx_t_rto:             Nofeedback Timer setting in usecs
+ * @tx_t_ipi:             Interpacket (send) interval (RFC 3448, 4.6) in usecs
+ * @tx_state:             Sender state, one of %ccid3_hc_tx_states
+ * @tx_last_win_count:    Last window counter sent
+ * @tx_t_last_win_count:  Timestamp of earliest packet
+ *                        with last_win_count value sent
+ * @tx_no_feedback_timer: Handle to no feedback timer
+ * @tx_t_ld:              Time last doubled during slow start
+ * @tx_t_nom:             Nominal send time of next packet
+ * @tx_delta:             Send timer delta (RFC 3448, 4.6) in usecs
+ * @tx_hist:              Packet history
+ * @tx_options_received:  Parsed set of retrieved options
  */
 struct ccid3_hc_tx_sock {
-        struct tfrc_tx_info             ccid3hctx_tfrc;
-#define ccid3hctx_x                     ccid3hctx_tfrc.tfrctx_x
-#define ccid3hctx_x_recv                ccid3hctx_tfrc.tfrctx_x_recv
-#define ccid3hctx_x_calc                ccid3hctx_tfrc.tfrctx_x_calc
-#define ccid3hctx_rtt                   ccid3hctx_tfrc.tfrctx_rtt
-#define ccid3hctx_p                     ccid3hctx_tfrc.tfrctx_p
-#define ccid3hctx_t_rto                 ccid3hctx_tfrc.tfrctx_rto
-#define ccid3hctx_t_ipi                 ccid3hctx_tfrc.tfrctx_ipi
-        u16                             ccid3hctx_s;
-        enum ccid3_hc_tx_states         ccid3hctx_state:8;
-        u8                              ccid3hctx_last_win_count;
-        ktime_t                         ccid3hctx_t_last_win_count;
-        struct timer_list               ccid3hctx_no_feedback_timer;
-        ktime_t                         ccid3hctx_t_ld;
-        ktime_t                         ccid3hctx_t_nom;
-        u32                             ccid3hctx_delta;
-        struct tfrc_tx_hist_entry       *ccid3hctx_hist;
-        struct ccid3_options_received   ccid3hctx_options_received;
+        struct tfrc_tx_info             tx_tfrc;
+#define tx_x                            tx_tfrc.tfrctx_x
+#define tx_x_recv                       tx_tfrc.tfrctx_x_recv
+#define tx_x_calc                       tx_tfrc.tfrctx_x_calc
+#define tx_rtt                          tx_tfrc.tfrctx_rtt
+#define tx_p                            tx_tfrc.tfrctx_p
+#define tx_t_rto                        tx_tfrc.tfrctx_rto
+#define tx_t_ipi                        tx_tfrc.tfrctx_ipi
+        u16                             tx_s;
+        enum ccid3_hc_tx_states         tx_state:8;
+        u8                              tx_last_win_count;
+        ktime_t                         tx_t_last_win_count;
+        struct timer_list               tx_no_feedback_timer;
+        ktime_t                         tx_t_ld;
+        ktime_t                         tx_t_nom;
+        u32                             tx_delta;
+        struct tfrc_tx_hist_entry       *tx_hist;
+        struct ccid3_options_received   tx_options_received;
 };
 
 static inline struct ccid3_hc_tx_sock *ccid3_hc_tx_sk(const struct sock *sk)
@@ -131,32 +131,32 @@ enum ccid3_hc_rx_states {
 
 /**
  * struct ccid3_hc_rx_sock - CCID3 receiver half-connection socket
- * @ccid3hcrx_x_recv  -  Receiver estimate of send rate (RFC 3448 4.3)
- * @ccid3hcrx_rtt  -  Receiver estimate of rtt (non-standard)
- * @ccid3hcrx_p  -  Current loss event rate (RFC 3448 5.4)
- * @ccid3hcrx_last_counter  -  Tracks window counter (RFC 4342, 8.1)
- * @ccid3hcrx_state  -  Receiver state, one of %ccid3_hc_rx_states
- * @ccid3hcrx_bytes_recv  -  Total sum of DCCP payload bytes
- * @ccid3hcrx_x_recv  -  Receiver estimate of send rate (RFC 3448, sec. 4.3)
- * @ccid3hcrx_rtt  -  Receiver estimate of RTT
- * @ccid3hcrx_tstamp_last_feedback  -  Time at which last feedback was sent
- * @ccid3hcrx_tstamp_last_ack  -  Time at which last feedback was sent
- * @ccid3hcrx_hist  -  Packet history (loss detection + RTT sampling)
- * @ccid3hcrx_li_hist  -  Loss Interval database
- * @ccid3hcrx_s  -  Received packet size in bytes
- * @ccid3hcrx_pinv  -  Inverse of Loss Event Rate (RFC 4342, sec. 8.5)
+ * @rx_x_recv:               Receiver estimate of send rate (RFC 3448 4.3)
+ * @rx_rtt:                  Receiver estimate of rtt (non-standard)
+ * @rx_p:                    Current loss event rate (RFC 3448 5.4)
+ * @rx_last_counter:         Tracks window counter (RFC 4342, 8.1)
+ * @rx_state:                Receiver state, one of %ccid3_hc_rx_states
+ * @rx_bytes_recv:           Total sum of DCCP payload bytes
+ * @rx_x_recv:               Receiver estimate of send rate (RFC 3448, sec. 4.3)
+ * @rx_rtt:                  Receiver estimate of RTT
+ * @rx_tstamp_last_feedback: Time at which last feedback was sent
+ * @rx_tstamp_last_ack:      Time at which last feedback was sent
+ * @rx_hist:                 Packet history (loss detection + RTT sampling)
+ * @rx_li_hist:              Loss Interval database
+ * @rx_s:                    Received packet size in bytes
+ * @rx_pinv:                 Inverse of Loss Event Rate (RFC 4342, sec. 8.5)
  */
 struct ccid3_hc_rx_sock {
-        u8                              ccid3hcrx_last_counter:4;
-        enum ccid3_hc_rx_states         ccid3hcrx_state:8;
-        u32                             ccid3hcrx_bytes_recv;
-        u32                             ccid3hcrx_x_recv;
-        u32                             ccid3hcrx_rtt;
-        ktime_t                         ccid3hcrx_tstamp_last_feedback;
-        struct tfrc_rx_hist             ccid3hcrx_hist;
-        struct tfrc_loss_hist           ccid3hcrx_li_hist;
-        u16                             ccid3hcrx_s;
-#define ccid3hcrx_pinv                  ccid3hcrx_li_hist.i_mean
+        u8                              rx_last_counter:4;
+        enum ccid3_hc_rx_states         rx_state:8;
+        u32                             rx_bytes_recv;
+        u32                             rx_x_recv;
+        u32                             rx_rtt;
+        ktime_t                         rx_tstamp_last_feedback;
+        struct tfrc_rx_hist             rx_hist;
+        struct tfrc_loss_hist           rx_li_hist;
+        u16                             rx_s;
+#define rx_pinv                         rx_li_hist.i_mean
 };
 
 static inline struct ccid3_hc_rx_sock *ccid3_hc_rx_sk(const struct sock *sk)
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 7302e1498d46..00028d4b09d9 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -62,10 +62,10 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 nexthop = inet->opt->faddr;
         }
 
-        tmp = ip_route_connect(&rt, nexthop, inet->saddr,
+        tmp = ip_route_connect(&rt, nexthop, inet->inet_saddr,
                                RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
                                IPPROTO_DCCP,
-                               inet->sport, usin->sin_port, sk, 1);
+                               inet->inet_sport, usin->sin_port, sk, 1);
         if (tmp < 0)
                 return tmp;
 
@@ -77,12 +77,12 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (inet->opt == NULL || !inet->opt->srr)
                 daddr = rt->rt_dst;
 
-        if (inet->saddr == 0)
-                inet->saddr = rt->rt_src;
-        inet->rcv_saddr = inet->saddr;
+        if (inet->inet_saddr == 0)
+                inet->inet_saddr = rt->rt_src;
+        inet->inet_rcv_saddr = inet->inet_saddr;
 
-        inet->dport = usin->sin_port;
-        inet->daddr = daddr;
+        inet->inet_dport = usin->sin_port;
+        inet->inet_daddr = daddr;
 
         inet_csk(sk)->icsk_ext_hdr_len = 0;
         if (inet->opt != NULL)
@@ -98,17 +98,19 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (err != 0)
                 goto failure;
 
-        err = ip_route_newports(&rt, IPPROTO_DCCP, inet->sport, inet->dport,
-                                sk);
+        err = ip_route_newports(&rt, IPPROTO_DCCP, inet->inet_sport,
+                                inet->inet_dport, sk);
         if (err != 0)
                 goto failure;
 
         /* OK, now commit destination to socket.  */
         sk_setup_caps(sk, &rt->u.dst);
 
-        dp->dccps_iss = secure_dccp_sequence_number(inet->saddr, inet->daddr,
-                                                    inet->sport, inet->dport);
-        inet->id = dp->dccps_iss ^ jiffies;
+        dp->dccps_iss = secure_dccp_sequence_number(inet->inet_saddr,
+                                                    inet->inet_daddr,
+                                                    inet->inet_sport,
+                                                    inet->inet_dport);
+        inet->inet_id = dp->dccps_iss ^ jiffies;
 
         err = dccp_connect(sk);
         rt = NULL;
@@ -123,7 +125,7 @@ failure:
         dccp_set_state(sk, DCCP_CLOSED);
         ip_rt_put(rt);
         sk->sk_route_caps = 0;
-        inet->dport = 0;
+        inet->inet_dport = 0;
         goto out;
 }
 
@@ -352,7 +354,9 @@ void dccp_v4_send_check(struct sock *sk, int unused, struct sk_buff *skb)
         struct dccp_hdr *dh = dccp_hdr(skb);
 
         dccp_csum_outgoing(skb);
-        dh->dccph_checksum = dccp_v4_csum_finish(skb, inet->saddr, inet->daddr);
+        dh->dccph_checksum = dccp_v4_csum_finish(skb,
+                                                 inet->inet_saddr,
+                                                 inet->inet_daddr);
 }
 
 EXPORT_SYMBOL_GPL(dccp_v4_send_check);
@@ -393,14 +397,14 @@ struct sock *dccp_v4_request_recv_sock(struct sock *sk, struct sk_buff *skb,
 
         newinet            = inet_sk(newsk);
         ireq               = inet_rsk(req);
-        newinet->daddr     = ireq->rmt_addr;
-        newinet->rcv_saddr = ireq->loc_addr;
-        newinet->saddr     = ireq->loc_addr;
+        newinet->inet_daddr     = ireq->rmt_addr;
+        newinet->inet_rcv_saddr = ireq->loc_addr;
+        newinet->inet_saddr     = ireq->loc_addr;
         newinet->opt       = ireq->opt;
         ireq->opt          = NULL;
         newinet->mc_index  = inet_iif(skb);
         newinet->mc_ttl    = ip_hdr(skb)->ttl;
-        newinet->id        = jiffies;
+        newinet->inet_id   = jiffies;
 
         dccp_sync_mss(newsk, dst_mtu(dst));
 
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index e48ca5d45658..6d89f9f7d5d8 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -158,8 +158,8 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
                         fl.oif = sk->sk_bound_dev_if;
-                        fl.fl_ip_dport = inet->dport;
-                        fl.fl_ip_sport = inet->sport;
+                        fl.fl_ip_dport = inet->inet_dport;
+                        fl.fl_ip_sport = inet->inet_sport;
                         security_sk_classify_flow(sk, &fl);
 
                         err = ip6_dst_lookup(sk, &dst, &fl);
@@ -510,11 +510,9 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
 
                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 
-                ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
-                              newinet->daddr);
+                ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
 
-                ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
-                              newinet->saddr);
+                ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
 
                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
 
@@ -642,7 +640,8 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
 
         dccp_sync_mss(newsk, dst_mtu(dst));
 
-        newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
+        newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
+        newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
 
         __inet6_hash(newsk);
         __inet_inherit_port(sk, newsk);
@@ -970,12 +969,9 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                         icsk->icsk_af_ops = &dccp_ipv6_af_ops;
                         sk->sk_backlog_rcv = dccp_v6_do_rcv;
                         goto failure;
-                } else {
-                        ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
-                                      inet->saddr);
-                        ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
-                                      inet->rcv_saddr);
                 }
+                ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
+                ipv6_addr_set_v4mapped(inet->inet_rcv_saddr, &np->rcv_saddr);
 
                 return err;
         }
@@ -988,7 +984,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         ipv6_addr_copy(&fl.fl6_src, saddr ? saddr : &np->saddr);
         fl.oif = sk->sk_bound_dev_if;
         fl.fl_ip_dport = usin->sin6_port;
-        fl.fl_ip_sport = inet->sport;
+        fl.fl_ip_sport = inet->inet_sport;
         security_sk_classify_flow(sk, &fl);
 
         if (np->opt != NULL && np->opt->srcrt != NULL) {
@@ -1021,7 +1017,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 
         /* set the source address */
         ipv6_addr_copy(&np->saddr, saddr);
-        inet->rcv_saddr = LOOPBACK4_IPV6;
+        inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 
         __ip6_dst_store(sk, dst, NULL, NULL);
 
@@ -1030,7 +1026,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                 icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
                                           np->opt->opt_nflen);
 
-        inet->dport = usin->sin6_port;
+        inet->inet_dport = usin->sin6_port;
 
         dccp_set_state(sk, DCCP_REQUESTING);
         err = inet6_hash_connect(&dccp_death_row, sk);
@@ -1039,7 +1035,8 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 
         dp->dccps_iss = secure_dccpv6_sequence_number(np->saddr.s6_addr32,
                                                       np->daddr.s6_addr32,
-                                                      inet->sport, inet->dport);
+                                                      inet->inet_sport,
+                                                      inet->inet_dport);
         err = dccp_connect(sk);
         if (err)
                 goto late_failure;
@@ -1050,7 +1047,7 @@ late_failure:
         dccp_set_state(sk, DCCP_CLOSED);
         __sk_dst_reset(sk);
 failure:
-        inet->dport = 0;
+        inet->inet_dport = 0;
         sk->sk_route_caps = 0;
         return err;
 }
diff --git a/net/dccp/output.c b/net/dccp/output.c
index c96119fda688..d6bb753bf6ad 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -99,8 +99,8 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                 /* Build DCCP header and checksum it. */
                 dh = dccp_zeroed_hdr(skb, dccp_header_size);
                 dh->dccph_type  = dcb->dccpd_type;
-                dh->dccph_sport = inet->sport;
-                dh->dccph_dport = inet->dport;
+                dh->dccph_sport = inet->inet_sport;
+                dh->dccph_dport = inet->inet_dport;
                 dh->dccph_doff  = (dccp_header_size + dcb->dccpd_opt_len) / 4;
                 dh->dccph_ccval = dcb->dccpd_ccval;
                 dh->dccph_cscov = dp->dccps_pcslen;
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 37731da41481..dc328425fa20 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -75,26 +75,25 @@ static int jdccp_sendmsg(struct kiocb *iocb, struct sock *sk,
                          struct msghdr *msg, size_t size)
 {
         const struct inet_sock *inet = inet_sk(sk);
-        struct ccid3_hc_tx_sock *hctx = NULL;
+        struct ccid3_hc_tx_sock *hc = NULL;
 
         if (ccid_get_current_tx_ccid(dccp_sk(sk)) == DCCPC_CCID3)
-                hctx = ccid3_hc_tx_sk(sk);
-
-        if (port == 0 || ntohs(inet->dport) == port ||
-            ntohs(inet->sport) == port) {
-                if (hctx)
-                        printl("%pI4:%u %pI4:%u %d %d %d %d %u "
-                               "%llu %llu %d\n",
-                               &inet->saddr, ntohs(inet->sport),
-                               &inet->daddr, ntohs(inet->dport), size,
-                               hctx->ccid3hctx_s, hctx->ccid3hctx_rtt,
-                               hctx->ccid3hctx_p, hctx->ccid3hctx_x_calc,
-                               hctx->ccid3hctx_x_recv >> 6,
-                               hctx->ccid3hctx_x >> 6, hctx->ccid3hctx_t_ipi);
+                hc = ccid3_hc_tx_sk(sk);
+
+        if (port == 0 || ntohs(inet->inet_dport) == port ||
+            ntohs(inet->inet_sport) == port) {
+                if (hc)
+                        printl("%pI4:%u %pI4:%u %d %d %d %d %u %llu %llu %d\n",
+                               &inet->inet_saddr, ntohs(inet->inet_sport),
+                               &inet->inet_daddr, ntohs(inet->inet_dport), size,
+                               hc->tx_s, hc->tx_rtt, hc->tx_p,
+                               hc->tx_x_calc, hc->tx_x_recv >> 6,
+                               hc->tx_x >> 6, hc->tx_t_ipi);
                 else
                         printl("%pI4:%u %pI4:%u %d\n",
-                               &inet->saddr, ntohs(inet->sport),
-                               &inet->daddr, ntohs(inet->dport), size);
+                               &inet->inet_saddr, ntohs(inet->inet_sport),
+                               &inet->inet_daddr, ntohs(inet->inet_dport),
+                               size);
         }
 
         jprobe_return();
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index a156319fd0ac..671cd1413d59 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -278,7 +278,7 @@ int dccp_disconnect(struct sock *sk, int flags)
                 sk->sk_send_head = NULL;
         }
 
-        inet->dport = 0;
+        inet->inet_dport = 0;
 
         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
                 inet_reset_saddr(sk);
@@ -290,7 +290,7 @@ int dccp_disconnect(struct sock *sk, int flags)
         inet_csk_delack_init(sk);
         __sk_dst_reset(sk);
 
-        WARN_ON(inet->num && !icsk->icsk_bind_hash);
+        WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
 
         sk->sk_error_report(sk);
         return err;
@@ -1060,11 +1060,12 @@ static int __init dccp_init(void)
         for (ehash_order = 0; (1UL << ehash_order) < goal; ehash_order++)
                 ;
         do {
-                dccp_hashinfo.ehash_size = (1UL << ehash_order) * PAGE_SIZE /
+                unsigned long hash_size = (1UL << ehash_order) * PAGE_SIZE /
                                         sizeof(struct inet_ehash_bucket);
-                while (dccp_hashinfo.ehash_size &
-                       (dccp_hashinfo.ehash_size - 1))
-                        dccp_hashinfo.ehash_size--;
+
+                while (hash_size & (hash_size - 1))
+                        hash_size--;
+                dccp_hashinfo.ehash_mask = hash_size - 1;
                 dccp_hashinfo.ehash = (struct inet_ehash_bucket *)
                         __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, ehash_order);
         } while (!dccp_hashinfo.ehash && --ehash_order > 0);
@@ -1074,7 +1075,7 @@ static int __init dccp_init(void)
                 goto out_free_bind_bucket_cachep;
         }
 
-        for (i = 0; i < dccp_hashinfo.ehash_size; i++) {
+        for (i = 0; i <= dccp_hashinfo.ehash_mask; i++) {
                 INIT_HLIST_NULLS_HEAD(&dccp_hashinfo.ehash[i].chain, i);
                 INIT_HLIST_NULLS_HEAD(&dccp_hashinfo.ehash[i].twchain, i);
         }
@@ -1153,7 +1154,7 @@ static void __exit dccp_fini(void)
                    get_order(dccp_hashinfo.bhash_size *
                              sizeof(struct inet_bind_hashbucket)));
         free_pages((unsigned long)dccp_hashinfo.ehash,
-                   get_order(dccp_hashinfo.ehash_size *
+                   get_order((dccp_hashinfo.ehash_mask + 1) *
                              sizeof(struct inet_ehash_bucket)));
         inet_ehash_locks_free(&dccp_hashinfo);
         kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
diff --git a/net/dccp/timer.c b/net/dccp/timer.c
index 162d1e683c39..bbfeb5eae46a 100644
--- a/net/dccp/timer.c
+++ b/net/dccp/timer.c
@@ -38,7 +38,7 @@ static int dccp_write_timeout(struct sock *sk)
 
         if (sk->sk_state == DCCP_REQUESTING || sk->sk_state == DCCP_PARTOPEN) {
                 if (icsk->icsk_retransmits != 0)
-                        dst_negative_advice(&sk->sk_dst_cache);
+                        dst_negative_advice(&sk->sk_dst_cache, sk);
                 retry_until = icsk->icsk_syn_retries ?
                             : sysctl_dccp_request_retries;
         } else {
@@ -63,7 +63,7 @@ static int dccp_write_timeout(struct sock *sk)
                            Golden words :-).
                    */
 
-                        dst_negative_advice(&sk->sk_dst_cache);
+                        dst_negative_advice(&sk->sk_dst_cache, sk);
                 }
 
                 retry_until = sysctl_dccp_retries2;
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 7a58c87baf17..664965c87e16 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1955,7 +1955,7 @@ static int dn_sendmsg(struct kiocb *iocb, struct socket *sock,
         }
 
         if ((flags & MSG_TRYHARD) && sk->sk_dst_cache)
-                dst_negative_advice(&sk->sk_dst_cache);
+                dst_negative_advice(&sk->sk_dst_cache, sk);
 
         mss = scp->segsize_rem;
         fctype = scp->services_rem & NSP_FC_MASK;
@@ -2325,7 +2325,7 @@ static const struct file_operations dn_socket_seq_fops = {
 };
 #endif
 
-static struct net_proto_family  dn_family_ops = {
+static const struct net_proto_family    dn_family_ops = {
         .family =       AF_DECnet,
         .create =       dn_create,
         .owner  =       THIS_MODULE,
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 0e0254fd767d..5e9426a11c3e 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -457,15 +457,15 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
         iov[0].iov_len = size;
         for (i = 0; i < msg->msg_iovlen; i++) {
                 void __user *base = msg->msg_iov[i].iov_base;
-                size_t len = msg->msg_iov[i].iov_len;
+                size_t iov_len = msg->msg_iov[i].iov_len;
                 /* Check it now since we switch to KERNEL_DS later. */
-                if (!access_ok(VERIFY_READ, base, len)) {
+                if (!access_ok(VERIFY_READ, base, iov_len)) {
                         mutex_unlock(&econet_mutex);
                         return -EFAULT;
                 }
                 iov[i+1].iov_base = base;
-                iov[i+1].iov_len = len;
-                size += len;
+                iov[i+1].iov_len = iov_len;
+                size += iov_len;
         }
 
         /* Get a skbuff (no data, just holds our cb information) */
@@ -742,7 +742,7 @@ static int econet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg
         return 0;
 }
 
-static struct net_proto_family econet_family_ops = {
+static const struct net_proto_family econet_family_ops = {
         .family =       PF_ECONET,
         .create =       econet_create,
         .owner  =       THIS_MODULE,
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index cd949d5e451b..309348fba72b 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -285,7 +285,7 @@ out:
         return rc;
 }
 
-static struct net_proto_family ieee802154_family_ops = {
+static const struct net_proto_family ieee802154_family_ops = {
         .family         = PF_IEEE802154,
         .create         = ieee802154_create,
         .owner          = THIS_MODULE,
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index a413b1bf4465..9aac5aee1575 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -303,7 +303,7 @@ static int dgram_recvmsg(struct kiocb *iocb, struct sock *sk,
         if (err)
                 goto done;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         if (flags & MSG_TRUNC)
                 copied = skb->len;
@@ -318,7 +318,6 @@ out:
 static int dgram_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         if (sock_queue_rcv_skb(sk, skb) < 0) {
-                atomic_inc(&sk->sk_drops);
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index 30e74eee07d6..9c9b85c00033 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -191,7 +191,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (err)
                 goto done;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         if (flags & MSG_TRUNC)
                 copied = skb->len;
@@ -206,7 +206,6 @@ out:
 static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         if (sock_queue_rcv_skb(sk, skb) < 0) {
-                atomic_inc(&sk->sk_drops);
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 57737b8d1711..538e84d0bcba 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -174,12 +174,12 @@ static int inet_autobind(struct sock *sk)
         /* We may need to bind the socket. */
         lock_sock(sk);
         inet = inet_sk(sk);
-        if (!inet->num) {
+        if (!inet->inet_num) {
                 if (sk->sk_prot->get_port(sk, 0)) {
                         release_sock(sk);
                         return -EAGAIN;
                 }
-                inet->sport = htons(inet->num);
+                inet->inet_sport = htons(inet->inet_num);
         }
         release_sock(sk);
         return 0;
@@ -354,7 +354,7 @@ lookup_protocol:
         inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
 
         if (SOCK_RAW == sock->type) {
-                inet->num = protocol;
+                inet->inet_num = protocol;
                 if (IPPROTO_RAW == protocol)
                         inet->hdrincl = 1;
         }
@@ -364,7 +364,7 @@ lookup_protocol:
         else
                 inet->pmtudisc = IP_PMTUDISC_WANT;
 
-        inet->id = 0;
+        inet->inet_id = 0;
 
         sock_init_data(sock, sk);
 
@@ -381,13 +381,13 @@ lookup_protocol:
 
         sk_refcnt_debug_inc(sk);
 
-        if (inet->num) {
+        if (inet->inet_num) {
                 /* It assumes that any protocol which allows
                  * the user to assign a number at socket
                  * creation time automatically
                  * shares.
                  */
-                inet->sport = htons(inet->num);
+                inet->inet_sport = htons(inet->inet_num);
                 /* Add to protocol hash chains. */
                 sk->sk_prot->hash(sk);
         }
@@ -494,27 +494,27 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
         /* Check these errors (active socket, double bind). */
         err = -EINVAL;
-        if (sk->sk_state != TCP_CLOSE || inet->num)
+        if (sk->sk_state != TCP_CLOSE || inet->inet_num)
                 goto out_release_sock;
 
-        inet->rcv_saddr = inet->saddr = addr->sin_addr.s_addr;
+        inet->inet_rcv_saddr = inet->inet_saddr = addr->sin_addr.s_addr;
         if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
-                inet->saddr = 0;  /* Use device */
+                inet->inet_saddr = 0;  /* Use device */
 
         /* Make sure we are allowed to bind here. */
         if (sk->sk_prot->get_port(sk, snum)) {
-                inet->saddr = inet->rcv_saddr = 0;
+                inet->inet_saddr = inet->inet_rcv_saddr = 0;
                 err = -EADDRINUSE;
                 goto out_release_sock;
         }
 
-        if (inet->rcv_saddr)
+        if (inet->inet_rcv_saddr)
                 sk->sk_userlocks |= SOCK_BINDADDR_LOCK;
         if (snum)
                 sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
-        inet->sport = htons(inet->num);
-        inet->daddr = 0;
-        inet->dport = 0;
+        inet->inet_sport = htons(inet->inet_num);
+        inet->inet_daddr = 0;
+        inet->inet_dport = 0;
         sk_dst_reset(sk);
         err = 0;
 out_release_sock:
@@ -532,7 +532,7 @@ int inet_dgram_connect(struct socket *sock, struct sockaddr * uaddr,
         if (uaddr->sa_family == AF_UNSPEC)
                 return sk->sk_prot->disconnect(sk, flags);
 
-        if (!inet_sk(sk)->num && inet_autobind(sk))
+        if (!inet_sk(sk)->inet_num && inet_autobind(sk))
                 return -EAGAIN;
         return sk->sk_prot->connect(sk, (struct sockaddr *)uaddr, addr_len);
 }
@@ -685,21 +685,21 @@ int inet_getname(struct socket *sock, struct sockaddr *uaddr,
 {
         struct sock *sk         = sock->sk;
         struct inet_sock *inet  = inet_sk(sk);
-        struct sockaddr_in *sin = (struct sockaddr_in *)uaddr;
+        DECLARE_SOCKADDR(struct sockaddr_in *, sin, uaddr);
 
         sin->sin_family = AF_INET;
         if (peer) {
-                if (!inet->dport ||
+                if (!inet->inet_dport ||
                     (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT)) &&
                      peer == 1))
                         return -ENOTCONN;
-                sin->sin_port = inet->dport;
-                sin->sin_addr.s_addr = inet->daddr;
+                sin->sin_port = inet->inet_dport;
+                sin->sin_addr.s_addr = inet->inet_daddr;
         } else {
-                __be32 addr = inet->rcv_saddr;
+                __be32 addr = inet->inet_rcv_saddr;
                 if (!addr)
-                        addr = inet->saddr;
-                sin->sin_port = inet->sport;
+                        addr = inet->inet_saddr;
+                sin->sin_port = inet->inet_sport;
                 sin->sin_addr.s_addr = addr;
         }
         memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
@@ -714,7 +714,7 @@ int inet_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         struct sock *sk = sock->sk;
 
         /* We may need to bind the socket. */
-        if (!inet_sk(sk)->num && inet_autobind(sk))
+        if (!inet_sk(sk)->inet_num && inet_autobind(sk))
                 return -EAGAIN;
 
         return sk->sk_prot->sendmsg(iocb, sk, msg, size);
@@ -728,7 +728,7 @@ static ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset,
         struct sock *sk = sock->sk;
 
         /* We may need to bind the socket. */
-        if (!inet_sk(sk)->num && inet_autobind(sk))
+        if (!inet_sk(sk)->inet_num && inet_autobind(sk))
                 return -EAGAIN;
 
         if (sk->sk_prot->sendpage)
@@ -931,7 +931,7 @@ static const struct proto_ops inet_sockraw_ops = {
 #endif
 };
 
-static struct net_proto_family inet_family_ops = {
+static const struct net_proto_family inet_family_ops = {
         .family = PF_INET,
         .create = inet_create,
         .owner  = THIS_MODULE,
@@ -1059,9 +1059,9 @@ static int inet_sk_reselect_saddr(struct sock *sk)
         struct inet_sock *inet = inet_sk(sk);
         int err;
         struct rtable *rt;
-        __be32 old_saddr = inet->saddr;
+        __be32 old_saddr = inet->inet_saddr;
         __be32 new_saddr;
-        __be32 daddr = inet->daddr;
+        __be32 daddr = inet->inet_daddr;
 
         if (inet->opt && inet->opt->srr)
                 daddr = inet->opt->faddr;
@@ -1071,7 +1071,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
                                RT_CONN_FLAGS(sk),
                                sk->sk_bound_dev_if,
                                sk->sk_protocol,
-                               inet->sport, inet->dport, sk, 0);
+                               inet->inet_sport, inet->inet_dport, sk, 0);
         if (err)
                 return err;
 
@@ -1087,7 +1087,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
                        __func__, &old_saddr, &new_saddr);
         }
 
-        inet->saddr = inet->rcv_saddr = new_saddr;
+        inet->inet_saddr = inet->inet_rcv_saddr = new_saddr;
 
         /*
          * XXX The only one ugly spot where we need to
@@ -1113,7 +1113,7 @@ int inet_sk_rebuild_header(struct sock *sk)
                 return 0;
 
         /* Reroute. */
-        daddr = inet->daddr;
+        daddr = inet->inet_daddr;
         if (inet->opt && inet->opt->srr)
                 daddr = inet->opt->faddr;
 {
@@ -1123,7 +1123,7 @@ int inet_sk_rebuild_header(struct sock *sk)
                 .nl_u = {
                         .ip4_u = {
                                 .daddr  = daddr,
-                                .saddr  = inet->saddr,
+                                .saddr  = inet->inet_saddr,
                                 .tos    = RT_CONN_FLAGS(sk),
                         },
                 },
@@ -1131,8 +1131,8 @@ int inet_sk_rebuild_header(struct sock *sk)
                 .flags = inet_sk_flowi_flags(sk),
                 .uli_u = {
                         .ports = {
-                                .sport = inet->sport,
-                                .dport = inet->dport,
+                                .sport = inet->inet_sport,
+                                .dport = inet->inet_dport,
                         },
                 },
         };
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 5c662703eb1e..d07b0c1dd350 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -1,3 +1,4 @@
+#include <crypto/hash.h>
 #include <linux/err.h>
 #include <linux/module.h>
 #include <net/ip.h>
@@ -5,10 +6,67 @@
 #include <net/ah.h>
 #include <linux/crypto.h>
 #include <linux/pfkeyv2.h>
-#include <linux/spinlock.h>
+#include <linux/scatterlist.h>
 #include <net/icmp.h>
 #include <net/protocol.h>
 
+struct ah_skb_cb {
+        struct xfrm_skb_cb xfrm;
+        void *tmp;
+};
+
+#define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+
+static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+                          unsigned int size)
+{
+        unsigned int len;
+
+        len = size + crypto_ahash_digestsize(ahash) +
+              (crypto_ahash_alignmask(ahash) &
+               ~(crypto_tfm_ctx_alignment() - 1));
+
+        len = ALIGN(len, crypto_tfm_ctx_alignment());
+
+        len += sizeof(struct ahash_request) + crypto_ahash_reqsize(ahash);
+        len = ALIGN(len, __alignof__(struct scatterlist));
+
+        len += sizeof(struct scatterlist) * nfrags;
+
+        return kmalloc(len, GFP_ATOMIC);
+}
+
+static inline u8 *ah_tmp_auth(void *tmp, unsigned int offset)
+{
+        return tmp + offset;
+}
+
+static inline u8 *ah_tmp_icv(struct crypto_ahash *ahash, void *tmp,
+                             unsigned int offset)
+{
+        return PTR_ALIGN((u8 *)tmp + offset, crypto_ahash_alignmask(ahash) + 1);
+}
+
+static inline struct ahash_request *ah_tmp_req(struct crypto_ahash *ahash,
+                                               u8 *icv)
+{
+        struct ahash_request *req;
+
+        req = (void *)PTR_ALIGN(icv + crypto_ahash_digestsize(ahash),
+                                crypto_tfm_ctx_alignment());
+
+        ahash_request_set_tfm(req, ahash);
+
+        return req;
+}
+
+static inline struct scatterlist *ah_req_sg(struct crypto_ahash *ahash,
+                                             struct ahash_request *req)
+{
+        return (void *)ALIGN((unsigned long)(req + 1) +
+                             crypto_ahash_reqsize(ahash),
+                             __alignof__(struct scatterlist));
+}
 
 /* Clear mutable options and find final destination to substitute
  * into IP header for icv calculation. Options are already checked
@@ -54,20 +112,72 @@ static int ip_clear_mutable_options(struct iphdr *iph, __be32 *daddr)
         return 0;
 }
 
+static void ah_output_done(struct crypto_async_request *base, int err)
+{
+        u8 *icv;
+        struct iphdr *iph;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = skb_dst(skb)->xfrm;
+        struct ah_data *ahp = x->data;
+        struct iphdr *top_iph = ip_hdr(skb);
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        int ihl = ip_hdrlen(skb);
+
+        iph = AH_SKB_CB(skb)->tmp;
+        icv = ah_tmp_icv(ahp->ahash, iph, ihl);
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+
+        top_iph->tos = iph->tos;
+        top_iph->ttl = iph->ttl;
+        top_iph->frag_off = iph->frag_off;
+        if (top_iph->ihl != 5) {
+                top_iph->daddr = iph->daddr;
+                memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
+        }
+
+        err = ah->nexthdr;
+
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_output_resume(skb, err);
+}
+
 static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
+        int nfrags;
+        int ihl;
+        u8 *icv;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
         struct iphdr *iph, *top_iph;
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
-        union {
-                struct iphdr    iph;
-                char            buf[60];
-        } tmp_iph;
+
+        ahp = x->data;
+        ahash = ahp->ahash;
+
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
 
         skb_push(skb, -skb_network_offset(skb));
+        ah = ip_auth_hdr(skb);
+        ihl = ip_hdrlen(skb);
+
+        err = -ENOMEM;
+        iph = ah_alloc_tmp(ahash, nfrags, ihl);
+        if (!iph)
+                goto out;
+
+        icv = ah_tmp_icv(ahash, iph, ihl);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
+
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
+
         top_iph = ip_hdr(skb);
-        iph = &tmp_iph.iph;
 
         iph->tos = top_iph->tos;
         iph->ttl = top_iph->ttl;
@@ -78,10 +188,9 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
                 memcpy(iph+1, top_iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
                 err = ip_clear_mutable_options(top_iph, &top_iph->daddr);
                 if (err)
-                        goto error;
+                        goto out_free;
         }
 
-        ah = ip_auth_hdr(skb);
         ah->nexthdr = *skb_mac_header(skb);
         *skb_mac_header(skb) = IPPROTO_AH;
 
@@ -91,20 +200,31 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
         top_iph->ttl = 0;
         top_iph->check = 0;
 
-        ahp = x->data;
         ah->hdrlen  = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2;
 
         ah->reserved = 0;
         ah->spi = x->id.spi;
         ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output);
 
-        spin_lock_bh(&x->lock);
-        err = ah_mac_digest(ahp, skb, ah->auth_data);
-        memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len);
-        spin_unlock_bh(&x->lock);
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, 0, skb->len);
 
-        if (err)
-                goto error;
+        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_callback(req, 0, ah_output_done, skb);
+
+        AH_SKB_CB(skb)->tmp = iph;
+
+        err = crypto_ahash_digest(req);
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
+        }
+
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
 
         top_iph->tos = iph->tos;
         top_iph->ttl = iph->ttl;
@@ -114,28 +234,67 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
                 memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
         }
 
-        err = 0;
-
-error:
+out_free:
+        kfree(iph);
+out:
         return err;
 }
 
+static void ah_input_done(struct crypto_async_request *base, int err)
+{
+        u8 *auth_data;
+        u8 *icv;
+        struct iphdr *work_iph;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = xfrm_input_state(skb);
+        struct ah_data *ahp = x->data;
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        int ihl = ip_hdrlen(skb);
+        int ah_hlen = (ah->hdrlen + 2) << 2;
+
+        work_iph = AH_SKB_CB(skb)->tmp;
+        auth_data = ah_tmp_auth(work_iph, ihl);
+        icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
+
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
+        if (err)
+                goto out;
+
+        skb->network_header += ah_hlen;
+        memcpy(skb_network_header(skb), work_iph, ihl);
+        __skb_pull(skb, ah_hlen + ihl);
+        skb_set_transport_header(skb, -ihl);
+
+        err = ah->nexthdr;
+out:
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_input_resume(skb, err);
+}
+
 static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int ah_hlen;
         int ihl;
         int nexthdr;
-        int err = -EINVAL;
-        struct iphdr *iph;
+        int nfrags;
+        u8 *auth_data;
+        u8 *icv;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
+        struct iphdr *iph, *work_iph;
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
-        char work_buf[60];
+        int err = -ENOMEM;
 
         if (!pskb_may_pull(skb, sizeof(*ah)))
                 goto out;
 
         ah = (struct ip_auth_hdr *)skb->data;
         ahp = x->data;
+        ahash = ahp->ahash;
+
         nexthdr = ah->nexthdr;
         ah_hlen = (ah->hdrlen + 2) << 2;
 
@@ -156,9 +315,24 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 
         ah = (struct ip_auth_hdr *)skb->data;
         iph = ip_hdr(skb);
+        ihl = ip_hdrlen(skb);
+
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
+
+        work_iph = ah_alloc_tmp(ahash, nfrags, ihl + ahp->icv_trunc_len);
+        if (!work_iph)
+                goto out;
+
+        auth_data = ah_tmp_auth(work_iph, ihl);
+        icv = ah_tmp_icv(ahash, auth_data, ahp->icv_trunc_len);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
 
-        ihl = skb->data - skb_network_header(skb);
-        memcpy(work_buf, iph, ihl);
+        memcpy(work_iph, iph, ihl);
+        memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
 
         iph->ttl = 0;
         iph->tos = 0;
@@ -166,35 +340,44 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
         iph->check = 0;
         if (ihl > sizeof(*iph)) {
                 __be32 dummy;
-                if (ip_clear_mutable_options(iph, &dummy))
-                        goto out;
+                err = ip_clear_mutable_options(iph, &dummy);
+                if (err)
+                        goto out_free;
         }
 
-        spin_lock(&x->lock);
-        {
-                u8 auth_data[MAX_AH_AUTH_LEN];
+        skb_push(skb, ihl);
 
-                memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
-                skb_push(skb, ihl);
-                err = ah_mac_digest(ahp, skb, ah->auth_data);
-                if (err)
-                        goto unlock;
-                if (memcmp(ahp->work_icv, auth_data, ahp->icv_trunc_len))
-                        err = -EBADMSG;
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, 0, skb->len);
+
+        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_callback(req, 0, ah_input_done, skb);
+
+        AH_SKB_CB(skb)->tmp = work_iph;
+
+        err = crypto_ahash_digest(req);
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
         }
-unlock:
-        spin_unlock(&x->lock);
 
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
         if (err)
-                goto out;
+                goto out_free;
 
         skb->network_header += ah_hlen;
-        memcpy(skb_network_header(skb), work_buf, ihl);
-        skb->transport_header = skb->network_header;
+        memcpy(skb_network_header(skb), work_iph, ihl);
         __skb_pull(skb, ah_hlen + ihl);
+        skb_set_transport_header(skb, -ihl);
 
-        return nexthdr;
+        err = nexthdr;
 
+out_free:
+        kfree (work_iph);
 out:
         return err;
 }
@@ -222,7 +405,7 @@ static int ah_init_state(struct xfrm_state *x)
 {
         struct ah_data *ahp = NULL;
         struct xfrm_algo_desc *aalg_desc;
-        struct crypto_hash *tfm;
+        struct crypto_ahash *ahash;
 
         if (!x->aalg)
                 goto error;
@@ -231,31 +414,31 @@ static int ah_init_state(struct xfrm_state *x)
                 goto error;
 
         ahp = kzalloc(sizeof(*ahp), GFP_KERNEL);
-        if (ahp == NULL)
+        if (!ahp)
                 return -ENOMEM;
 
-        tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(tfm))
+        ahash = crypto_alloc_ahash(x->aalg->alg_name, 0, 0);
+        if (IS_ERR(ahash))
                 goto error;
 
-        ahp->tfm = tfm;
-        if (crypto_hash_setkey(tfm, x->aalg->alg_key,
-                               (x->aalg->alg_key_len + 7) / 8))
+        ahp->ahash = ahash;
+        if (crypto_ahash_setkey(ahash, x->aalg->alg_key,
+                                (x->aalg->alg_key_len + 7) / 8))
                 goto error;
 
         /*
          * Lookup the algorithm description maintained by xfrm_algo,
          * verify crypto transform properties, and store information
          * we need for AH processing.  This lookup cannot fail here
-         * after a successful crypto_alloc_hash().
+         * after a successful crypto_alloc_ahash().
          */
         aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
         BUG_ON(!aalg_desc);
 
         if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
-            crypto_hash_digestsize(tfm)) {
+            crypto_ahash_digestsize(ahash)) {
                 printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
-                       x->aalg->alg_name, crypto_hash_digestsize(tfm),
+                       x->aalg->alg_name, crypto_ahash_digestsize(ahash),
                        aalg_desc->uinfo.auth.icv_fullbits/8);
                 goto error;
         }
@@ -265,10 +448,6 @@ static int ah_init_state(struct xfrm_state *x)
 
         BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
 
-        ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
-        if (!ahp->work_icv)
-                goto error;
-
         x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) +
                                           ahp->icv_trunc_len);
         if (x->props.mode == XFRM_MODE_TUNNEL)
@@ -279,8 +458,7 @@ static int ah_init_state(struct xfrm_state *x)
 
 error:
         if (ahp) {
-                kfree(ahp->work_icv);
-                crypto_free_hash(ahp->tfm);
+                crypto_free_ahash(ahp->ahash);
                 kfree(ahp);
         }
         return -EINVAL;
@@ -293,8 +471,7 @@ static void ah_destroy(struct xfrm_state *x)
         if (!ahp)
                 return;
 
-        kfree(ahp->work_icv);
-        crypto_free_hash(ahp->tfm);
+        crypto_free_ahash(ahp->ahash);
         kfree(ahp);
 }
 
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 039cc1ffe977..1e029dc75455 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -2017,7 +2017,7 @@ req_setattr_failure:
  * values on failure.
  *
  */
-int cipso_v4_delopt(struct ip_options **opt_ptr)
+static int cipso_v4_delopt(struct ip_options **opt_ptr)
 {
         int hdr_delta = 0;
         struct ip_options *opt = *opt_ptr;
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 5e6c5a0f3fde..fb2465811b48 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -39,7 +39,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         sk_dst_reset(sk);
 
         oif = sk->sk_bound_dev_if;
-        saddr = inet->saddr;
+        saddr = inet->inet_saddr;
         if (ipv4_is_multicast(usin->sin_addr.s_addr)) {
                 if (!oif)
                         oif = inet->mc_index;
@@ -49,7 +49,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         err = ip_route_connect(&rt, usin->sin_addr.s_addr, saddr,
                                RT_CONN_FLAGS(sk), oif,
                                sk->sk_protocol,
-                               inet->sport, usin->sin_port, sk, 1);
+                               inet->inet_sport, usin->sin_port, sk, 1);
         if (err) {
                 if (err == -ENETUNREACH)
                         IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
@@ -60,14 +60,14 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 ip_rt_put(rt);
                 return -EACCES;
         }
-        if (!inet->saddr)
-                inet->saddr = rt->rt_src;       /* Update source address */
-        if (!inet->rcv_saddr)
-                inet->rcv_saddr = rt->rt_src;
-        inet->daddr = rt->rt_dst;
-        inet->dport = usin->sin_port;
+        if (!inet->inet_saddr)
+                inet->inet_saddr = rt->rt_src;  /* Update source address */
+        if (!inet->inet_rcv_saddr)
+                inet->inet_rcv_saddr = rt->rt_src;
+        inet->inet_daddr = rt->rt_dst;
+        inet->inet_dport = usin->sin_port;
         sk->sk_state = TCP_ESTABLISHED;
-        inet->id = jiffies;
+        inet->inet_id = jiffies;
 
         sk_dst_set(sk, &rt->u.dst);
         return(0);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index e2f950592566..f73dbed0f0d7 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -125,7 +125,7 @@ void fib_select_default(struct net *net,
 #endif
         tb = fib_get_table(net, table);
         if (FIB_RES_GW(*res) && FIB_RES_NH(*res).nh_scope == RT_SCOPE_LINK)
-                tb->tb_select_default(tb, flp, res);
+                fib_table_select_default(tb, flp, res);
 }
 
 static void fib_flush(struct net *net)
@@ -139,7 +139,7 @@ static void fib_flush(struct net *net)
         for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
                 head = &net->ipv4.fib_table_hash[h];
                 hlist_for_each_entry(tb, node, head, tb_hlist)
-                        flushed += tb->tb_flush(tb);
+                        flushed += fib_table_flush(tb);
         }
 
         if (flushed)
@@ -162,7 +162,7 @@ struct net_device * ip_dev_find(struct net *net, __be32 addr)
 #endif
 
         local_table = fib_get_table(net, RT_TABLE_LOCAL);
-        if (!local_table || local_table->tb_lookup(local_table, &fl, &res))
+        if (!local_table || fib_table_lookup(local_table, &fl, &res))
                 return NULL;
         if (res.type != RTN_LOCAL)
                 goto out;
@@ -200,7 +200,7 @@ static inline unsigned __inet_dev_addr_type(struct net *net,
         local_table = fib_get_table(net, RT_TABLE_LOCAL);
         if (local_table) {
                 ret = RTN_UNICAST;
-                if (!local_table->tb_lookup(local_table, &fl, &res)) {
+                if (!fib_table_lookup(local_table, &fl, &res)) {
                         if (!dev || dev == res.fi->fib_dev)
                                 ret = res.type;
                         fib_res_put(&res);
@@ -473,13 +473,13 @@ int ip_rt_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                         if (cmd == SIOCDELRT) {
                                 tb = fib_get_table(net, cfg.fc_table);
                                 if (tb)
-                                        err = tb->tb_delete(tb, &cfg);
+                                        err = fib_table_delete(tb, &cfg);
                                 else
                                         err = -ESRCH;
                         } else {
                                 tb = fib_new_table(net, cfg.fc_table);
                                 if (tb)
-                                        err = tb->tb_insert(tb, &cfg);
+                                        err = fib_table_insert(tb, &cfg);
                                 else
                                         err = -ENOBUFS;
                         }
@@ -594,7 +594,7 @@ static int inet_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh, void *ar
                 goto errout;
         }
 
-        err = tb->tb_delete(tb, &cfg);
+        err = fib_table_delete(tb, &cfg);
 errout:
         return err;
 }
@@ -616,7 +616,7 @@ static int inet_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh, void *ar
                 goto errout;
         }
 
-        err = tb->tb_insert(tb, &cfg);
+        err = fib_table_insert(tb, &cfg);
 errout:
         return err;
 }
@@ -647,7 +647,7 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
                         if (dumped)
                                 memset(&cb->args[2], 0, sizeof(cb->args) -
                                                  2 * sizeof(cb->args[0]));
-                        if (tb->tb_dump(tb, skb, cb) < 0)
+                        if (fib_table_dump(tb, skb, cb) < 0)
                                 goto out;
                         dumped = 1;
 next:
@@ -701,9 +701,9 @@ static void fib_magic(int cmd, int type, __be32 dst, int dst_len, struct in_ifad
                 cfg.fc_scope = RT_SCOPE_HOST;
 
         if (cmd == RTM_NEWROUTE)
-                tb->tb_insert(tb, &cfg);
+                fib_table_insert(tb, &cfg);
         else
-                tb->tb_delete(tb, &cfg);
+                fib_table_delete(tb, &cfg);
 }
 
 void fib_add_ifaddr(struct in_ifaddr *ifa)
@@ -832,7 +832,7 @@ static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb )
                 local_bh_disable();
 
                 frn->tb_id = tb->tb_id;
-                frn->err = tb->tb_lookup(tb, &fl, &res);
+                frn->err = fib_table_lookup(tb, &fl, &res);
 
                 if (!frn->err) {
                         frn->prefixlen = res.prefixlen;
@@ -1009,7 +1009,7 @@ static void __net_exit ip_fib_net_exit(struct net *net)
                 head = &net->ipv4.fib_table_hash[i];
                 hlist_for_each_entry_safe(tb, node, tmp, head, tb_hlist) {
                         hlist_del(node);
-                        tb->tb_flush(tb);
+                        fib_table_flush(tb);
                         kfree(tb);
                 }
         }
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index ecd39454235c..14972017b9c2 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -242,8 +242,8 @@ fn_new_zone(struct fn_hash *table, int z)
         return fz;
 }
 
-static int
-fn_hash_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result *res)
+int fib_table_lookup(struct fib_table *tb,
+                     const struct flowi *flp, struct fib_result *res)
 {
         int err;
         struct fn_zone *fz;
@@ -274,8 +274,8 @@ out:
         return err;
 }
 
-static void
-fn_hash_select_default(struct fib_table *tb, const struct flowi *flp, struct fib_result *res)
+void fib_table_select_default(struct fib_table *tb,
+                              const struct flowi *flp, struct fib_result *res)
 {
         int order, last_idx;
         struct hlist_node *node;
@@ -366,7 +366,7 @@ static struct fib_node *fib_find_node(struct fn_zone *fz, __be32 key)
         return NULL;
 }
 
-static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
 {
         struct fn_hash *table = (struct fn_hash *) tb->tb_data;
         struct fib_node *new_f = NULL;
@@ -544,8 +544,7 @@ out:
         return err;
 }
 
-
-static int fn_hash_delete(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_delete(struct fib_table *tb, struct fib_config *cfg)
 {
         struct fn_hash *table = (struct fn_hash *)tb->tb_data;
         struct fib_node *f;
@@ -662,7 +661,7 @@ static int fn_flush_list(struct fn_zone *fz, int idx)
         return found;
 }
 
-static int fn_hash_flush(struct fib_table *tb)
+int fib_table_flush(struct fib_table *tb)
 {
         struct fn_hash *table = (struct fn_hash *) tb->tb_data;
         struct fn_zone *fz;
@@ -743,7 +742,8 @@ fn_hash_dump_zone(struct sk_buff *skb, struct netlink_callback *cb,
         return skb->len;
 }
 
-static int fn_hash_dump(struct fib_table *tb, struct sk_buff *skb, struct netlink_callback *cb)
+int fib_table_dump(struct fib_table *tb, struct sk_buff *skb,
+                   struct netlink_callback *cb)
 {
         int m, s_m;
         struct fn_zone *fz;
@@ -787,12 +787,7 @@ struct fib_table *fib_hash_table(u32 id)
 
         tb->tb_id = id;
         tb->tb_default = -1;
-        tb->tb_lookup = fn_hash_lookup;
-        tb->tb_insert = fn_hash_insert;
-        tb->tb_delete = fn_hash_delete;
-        tb->tb_flush = fn_hash_flush;
-        tb->tb_select_default = fn_hash_select_default;
-        tb->tb_dump = fn_hash_dump;
+
         memset(tb->tb_data, 0, sizeof(struct fn_hash));
         return tb;
 }
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 92d9d97ec5e3..835262c2b867 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -94,7 +94,7 @@ static int fib4_rule_action(struct fib_rule *rule, struct flowi *flp,
         if ((tbl = fib_get_table(rule->fr_net, rule->table)) == NULL)
                 goto errout;
 
-        err = tbl->tb_lookup(tbl, flp, (struct fib_result *) arg->result);
+        err = fib_table_lookup(tbl, flp, (struct fib_result *) arg->result);
         if (err > 0)
                 err = -EAGAIN;
 errout:
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 291bdf50a21f..af5d89792860 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1174,7 +1174,7 @@ done:
 /*
  * Caller must hold RTNL.
  */
-static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         struct fib_alias *fa, *new_fa;
@@ -1373,8 +1373,8 @@ static int check_leaf(struct trie *t, struct leaf *l,
         return 1;
 }
 
-static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
-                          struct fib_result *res)
+int fib_table_lookup(struct fib_table *tb, const struct flowi *flp,
+                     struct fib_result *res)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         int ret;
@@ -1595,7 +1595,7 @@ static void trie_leaf_remove(struct trie *t, struct leaf *l)
 /*
  * Caller must hold RTNL.
  */
-static int fn_trie_delete(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_delete(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         u32 key, mask;
@@ -1786,7 +1786,7 @@ static struct leaf *trie_leafindex(struct trie *t, int index)
 /*
  * Caller must hold RTNL.
  */
-static int fn_trie_flush(struct fib_table *tb)
+int fib_table_flush(struct fib_table *tb)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         struct leaf *l, *ll = NULL;
@@ -1807,9 +1807,9 @@ static int fn_trie_flush(struct fib_table *tb)
         return found;
 }
 
-static void fn_trie_select_default(struct fib_table *tb,
-                                   const struct flowi *flp,
-                                   struct fib_result *res)
+void fib_table_select_default(struct fib_table *tb,
+                              const struct flowi *flp,
+                              struct fib_result *res)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         int order, last_idx;
@@ -1952,8 +1952,8 @@ static int fn_trie_dump_leaf(struct leaf *l, struct fib_table *tb,
         return skb->len;
 }
 
-static int fn_trie_dump(struct fib_table *tb, struct sk_buff *skb,
-                        struct netlink_callback *cb)
+int fib_table_dump(struct fib_table *tb, struct sk_buff *skb,
+                   struct netlink_callback *cb)
 {
         struct leaf *l;
         struct trie *t = (struct trie *) tb->tb_data;
@@ -2020,12 +2020,6 @@ struct fib_table *fib_hash_table(u32 id)
 
         tb->tb_id = id;
         tb->tb_default = -1;
-        tb->tb_lookup = fn_trie_lookup;
-        tb->tb_insert = fn_trie_insert;
-        tb->tb_delete = fn_trie_delete;
-        tb->tb_flush = fn_trie_flush;
-        tb->tb_select_default = fn_trie_select_default;
-        tb->tb_dump = fn_trie_dump;
 
         t = (struct trie *) tb->tb_data;
         memset(t, 0, sizeof(*t));
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 5bc13fe816d1..84adb5754c96 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -1165,6 +1165,10 @@ static int __net_init icmp_sk_init(struct net *net)
                 sk->sk_sndbuf =
                         (2 * ((64 * 1024) + sizeof(struct sk_buff)));
 
+                /*
+                 * Speedup sock_wfree()
+                 */
+                sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
                 inet_sk(sk)->pmtudisc = IP_PMTUDISC_DONT;
         }
 
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 537731b3bcb3..26fb50e91311 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -358,6 +358,7 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
         const struct inet_request_sock *ireq = inet_rsk(req);
         struct ip_options *opt = inet_rsk(req)->opt;
         struct flowi fl = { .oif = sk->sk_bound_dev_if,
+                            .mark = sk->sk_mark,
                             .nl_u = { .ip4_u =
                                       { .daddr = ((opt && opt->srr) ?
                                                   opt->faddr :
@@ -367,7 +368,7 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
                             .proto = sk->sk_protocol,
                             .flags = inet_sk_flowi_flags(sk),
                             .uli_u = { .ports =
-                                       { .sport = inet_sk(sk)->sport,
+                                       { .sport = inet_sk(sk)->inet_sport,
                                          .dport = ireq->rmt_port } } };
         struct net *net = sock_net(sk);
 
@@ -574,9 +575,9 @@ struct sock *inet_csk_clone(struct sock *sk, const struct request_sock *req,
                 newsk->sk_state = TCP_SYN_RECV;
                 newicsk->icsk_bind_hash = NULL;
 
-                inet_sk(newsk)->dport = inet_rsk(req)->rmt_port;
-                inet_sk(newsk)->num = ntohs(inet_rsk(req)->loc_port);
-                inet_sk(newsk)->sport = inet_rsk(req)->loc_port;
+                inet_sk(newsk)->inet_dport = inet_rsk(req)->rmt_port;
+                inet_sk(newsk)->inet_num = ntohs(inet_rsk(req)->loc_port);
+                inet_sk(newsk)->inet_sport = inet_rsk(req)->loc_port;
                 newsk->sk_write_space = sk_stream_write_space;
 
                 newicsk->icsk_retransmits = 0;
@@ -607,8 +608,8 @@ void inet_csk_destroy_sock(struct sock *sk)
         /* It cannot be in hash table! */
         WARN_ON(!sk_unhashed(sk));
 
-        /* If it has not 0 inet_sk(sk)->num, it must be bound */
-        WARN_ON(inet_sk(sk)->num && !inet_csk(sk)->icsk_bind_hash);
+        /* If it has not 0 inet_sk(sk)->inet_num, it must be bound */
+        WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash);
 
         sk->sk_prot->destroy(sk);
 
@@ -643,8 +644,8 @@ int inet_csk_listen_start(struct sock *sk, const int nr_table_entries)
          * after validation is complete.
          */
         sk->sk_state = TCP_LISTEN;
-        if (!sk->sk_prot->get_port(sk, inet->num)) {
-                inet->sport = htons(inet->num);
+        if (!sk->sk_prot->get_port(sk, inet->inet_num)) {
+                inet->inet_sport = htons(inet->inet_num);
 
                 sk_dst_reset(sk);
                 sk->sk_prot->hash(sk);
@@ -720,8 +721,8 @@ void inet_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr)
         const struct inet_sock *inet = inet_sk(sk);
 
         sin->sin_family         = AF_INET;
-        sin->sin_addr.s_addr    = inet->daddr;
-        sin->sin_port           = inet->dport;
+        sin->sin_addr.s_addr    = inet->inet_daddr;
+        sin->sin_port           = inet->inet_dport;
 }
 
 EXPORT_SYMBOL_GPL(inet_csk_addr2sockaddr);
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index a706a47f4dbb..bdb78dd180ce 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -116,10 +116,10 @@ static int inet_csk_diag_fill(struct sock *sk,
         r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
         r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
 
-        r->id.idiag_sport = inet->sport;
-        r->id.idiag_dport = inet->dport;
-        r->id.idiag_src[0] = inet->rcv_saddr;
-        r->id.idiag_dst[0] = inet->daddr;
+        r->id.idiag_sport = inet->inet_sport;
+        r->id.idiag_dport = inet->inet_dport;
+        r->id.idiag_src[0] = inet->inet_rcv_saddr;
+        r->id.idiag_dst[0] = inet->inet_daddr;
 
 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
         if (r->idiag_family == AF_INET6) {
@@ -504,11 +504,11 @@ static int inet_csk_diag_dump(struct sock *sk,
                 } else
 #endif
                 {
-                        entry.saddr = &inet->rcv_saddr;
-                        entry.daddr = &inet->daddr;
+                        entry.saddr = &inet->inet_rcv_saddr;
+                        entry.daddr = &inet->inet_daddr;
                 }
-                entry.sport = inet->num;
-                entry.dport = ntohs(inet->dport);
+                entry.sport = inet->inet_num;
+                entry.dport = ntohs(inet->inet_dport);
                 entry.userlocks = sk->sk_userlocks;
 
                 if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
@@ -584,7 +584,7 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
         if (tmo < 0)
                 tmo = 0;
 
-        r->id.idiag_sport = inet->sport;
+        r->id.idiag_sport = inet->inet_sport;
         r->id.idiag_dport = ireq->rmt_port;
         r->id.idiag_src[0] = ireq->loc_addr;
         r->id.idiag_dst[0] = ireq->rmt_addr;
@@ -639,7 +639,7 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
 
         if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
                 bc = (struct rtattr *)(r + 1);
-                entry.sport = inet->num;
+                entry.sport = inet->inet_num;
                 entry.userlocks = sk->sk_userlocks;
         }
 
@@ -732,7 +732,7 @@ static int inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
                                         continue;
                                 }
 
-                                if (r->id.idiag_sport != inet->sport &&
+                                if (r->id.idiag_sport != inet->inet_sport &&
                                     r->id.idiag_sport)
                                         goto next_listen;
 
@@ -774,7 +774,7 @@ skip_listen_ht:
         if (!(r->idiag_states & ~(TCPF_LISTEN | TCPF_SYN_RECV)))
                 goto unlock;
 
-        for (i = s_i; i < hashinfo->ehash_size; i++) {
+        for (i = s_i; i <= hashinfo->ehash_mask; i++) {
                 struct inet_ehash_bucket *head = &hashinfo->ehash[i];
                 spinlock_t *lock = inet_ehash_lockp(hashinfo, i);
                 struct sock *sk;
@@ -797,10 +797,10 @@ skip_listen_ht:
                                 goto next_normal;
                         if (!(r->idiag_states & (1 << sk->sk_state)))
                                 goto next_normal;
-                        if (r->id.idiag_sport != inet->sport &&
+                        if (r->id.idiag_sport != inet->inet_sport &&
                             r->id.idiag_sport)
                                 goto next_normal;
-                        if (r->id.idiag_dport != inet->dport &&
+                        if (r->id.idiag_dport != inet->inet_dport &&
                             r->id.idiag_dport)
                                 goto next_normal;
                         if (inet_csk_diag_dump(sk, skb, cb) < 0) {
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 625cc5f64c94..47ad7aab51e3 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -64,7 +64,7 @@ void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
 
         atomic_inc(&hashinfo->bsockets);
 
-        inet_sk(sk)->num = snum;
+        inet_sk(sk)->inet_num = snum;
         sk_add_bind_node(sk, &tb->owners);
         tb->num_owners++;
         inet_csk(sk)->icsk_bind_hash = tb;
@@ -76,7 +76,7 @@ void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
 static void __inet_put_port(struct sock *sk)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
-        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(sk)->num,
+        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(sk)->inet_num,
                         hashinfo->bhash_size);
         struct inet_bind_hashbucket *head = &hashinfo->bhash[bhash];
         struct inet_bind_bucket *tb;
@@ -88,7 +88,7 @@ static void __inet_put_port(struct sock *sk)
         __sk_del_bind_node(sk);
         tb->num_owners--;
         inet_csk(sk)->icsk_bind_hash = NULL;
-        inet_sk(sk)->num = 0;
+        inet_sk(sk)->inet_num = 0;
         inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
         spin_unlock(&head->lock);
 }
@@ -105,7 +105,7 @@ EXPORT_SYMBOL(inet_put_port);
 void __inet_inherit_port(struct sock *sk, struct sock *child)
 {
         struct inet_hashinfo *table = sk->sk_prot->h.hashinfo;
-        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(child)->num,
+        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(child)->inet_num,
                         table->bhash_size);
         struct inet_bind_hashbucket *head = &table->bhash[bhash];
         struct inet_bind_bucket *tb;
@@ -126,9 +126,9 @@ static inline int compute_score(struct sock *sk, struct net *net,
         int score = -1;
         struct inet_sock *inet = inet_sk(sk);
 
-        if (net_eq(sock_net(sk), net) && inet->num == hnum &&
+        if (net_eq(sock_net(sk), net) && inet->inet_num == hnum &&
                         !ipv6_only_sock(sk)) {
-                __be32 rcv_saddr = inet->rcv_saddr;
+                __be32 rcv_saddr = inet->inet_rcv_saddr;
                 score = sk->sk_family == PF_INET ? 1 : 0;
                 if (rcv_saddr) {
                         if (rcv_saddr != daddr)
@@ -209,7 +209,7 @@ struct sock * __inet_lookup_established(struct net *net,
          * have wildcards anyways.
          */
         unsigned int hash = inet_ehashfn(net, daddr, hnum, saddr, sport);
-        unsigned int slot = hash & (hashinfo->ehash_size - 1);
+        unsigned int slot = hash & hashinfo->ehash_mask;
         struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
 
         rcu_read_lock();
@@ -273,13 +273,14 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
         struct inet_sock *inet = inet_sk(sk);
-        __be32 daddr = inet->rcv_saddr;
-        __be32 saddr = inet->daddr;
+        __be32 daddr = inet->inet_rcv_saddr;
+        __be32 saddr = inet->inet_daddr;
         int dif = sk->sk_bound_dev_if;
         INET_ADDR_COOKIE(acookie, saddr, daddr)
-        const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
+        const __portpair ports = INET_COMBINED_PORTS(inet->inet_dport, lport);
         struct net *net = sock_net(sk);
-        unsigned int hash = inet_ehashfn(net, daddr, lport, saddr, inet->dport);
+        unsigned int hash = inet_ehashfn(net, daddr, lport,
+                                         saddr, inet->inet_dport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
         spinlock_t *lock = inet_ehash_lockp(hinfo, hash);
         struct sock *sk2;
@@ -312,8 +313,8 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
 unique:
         /* Must record num and sport now. Otherwise we will see
          * in hash table socket with a funny identity. */
-        inet->num = lport;
-        inet->sport = htons(lport);
+        inet->inet_num = lport;
+        inet->inet_sport = htons(lport);
         sk->sk_hash = hash;
         WARN_ON(!sk_unhashed(sk));
         __sk_nulls_add_node_rcu(sk, &head->chain);
@@ -341,8 +342,9 @@ not_unique:
 static inline u32 inet_sk_port_offset(const struct sock *sk)
 {
         const struct inet_sock *inet = inet_sk(sk);
-        return secure_ipv4_port_ephemeral(inet->rcv_saddr, inet->daddr,
-                                          inet->dport);
+        return secure_ipv4_port_ephemeral(inet->inet_rcv_saddr,
+                                          inet->inet_daddr,
+                                          inet->inet_dport);
 }
 
 void __inet_hash_nolisten(struct sock *sk)
@@ -424,7 +426,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                 void (*hash)(struct sock *sk))
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
-        const unsigned short snum = inet_sk(sk)->num;
+        const unsigned short snum = inet_sk(sk)->inet_num;
         struct inet_bind_hashbucket *head;
         struct inet_bind_bucket *tb;
         int ret;
@@ -485,7 +487,7 @@ ok:
                 /* Head lock still held and bh's disabled */
                 inet_bind_hash(sk, tb, port);
                 if (sk_unhashed(sk)) {
-                        inet_sk(sk)->sport = htons(port);
+                        inet_sk(sk)->inet_sport = htons(port);
                         hash(sk);
                 }
                 spin_unlock(&head->lock);
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 13f0781f35cd..1f5d508bb18b 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -86,7 +86,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
            Note, that any socket with inet->num != 0 MUST be bound in
            binding cache, even if it is closed.
          */
-        bhead = &hashinfo->bhash[inet_bhashfn(twsk_net(tw), inet->num,
+        bhead = &hashinfo->bhash[inet_bhashfn(twsk_net(tw), inet->inet_num,
                         hashinfo->bhash_size)];
         spin_lock(&bhead->lock);
         tw->tw_tb = icsk->icsk_bind_hash;
@@ -124,14 +124,14 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat
                 kmemcheck_annotate_bitfield(tw, flags);
 
                 /* Give us an identity. */
-                tw->tw_daddr        = inet->daddr;
-                tw->tw_rcv_saddr    = inet->rcv_saddr;
+                tw->tw_daddr        = inet->inet_daddr;
+                tw->tw_rcv_saddr    = inet->inet_rcv_saddr;
                 tw->tw_bound_dev_if = sk->sk_bound_dev_if;
-                tw->tw_num          = inet->num;
+                tw->tw_num          = inet->inet_num;
                 tw->tw_state        = TCP_TIME_WAIT;
                 tw->tw_substate     = state;
-                tw->tw_sport        = inet->sport;
-                tw->tw_dport        = inet->dport;
+                tw->tw_sport        = inet->inet_sport;
+                tw->tw_dport        = inet->inet_dport;
                 tw->tw_family       = sk->sk_family;
                 tw->tw_reuse        = sk->sk_reuse;
                 tw->tw_hash         = sk->sk_hash;
@@ -430,7 +430,7 @@ void inet_twsk_purge(struct net *net, struct inet_hashinfo *hashinfo,
         int h;
 
         local_bh_disable();
-        for (h = 0; h < (hashinfo->ehash_size); h++) {
+        for (h = 0; h <= hashinfo->ehash_mask; h++) {
                 struct inet_ehash_bucket *head =
                         inet_ehash_bucket(hashinfo, h);
                 spinlock_t *lock = inet_ehash_lockp(hashinfo, h);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 41ada9904d31..a77807d449e3 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -156,8 +156,13 @@ struct ipgre_net {
 #define tunnels_r       tunnels[2]
 #define tunnels_l       tunnels[1]
 #define tunnels_wc      tunnels[0]
+/*
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ipgre_lock);
 
-static DEFINE_RWLOCK(ipgre_lock);
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 
 /* Given src, dst and key, find appropriate for input tunnel. */
 
@@ -175,7 +180,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                        ARPHRD_ETHER : ARPHRD_IPGRE;
         int score, cand_score = 4;
 
-        for (t = ign->tunnels_r_l[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_r_l[h0 ^ h1]) {
                 if (local != t->parms.iph.saddr ||
                     remote != t->parms.iph.daddr ||
                     key != t->parms.i_key ||
@@ -200,7 +205,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                 }
         }
 
-        for (t = ign->tunnels_r[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_r[h0 ^ h1]) {
                 if (remote != t->parms.iph.daddr ||
                     key != t->parms.i_key ||
                     !(t->dev->flags & IFF_UP))
@@ -224,7 +229,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                 }
         }
 
-        for (t = ign->tunnels_l[h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_l[h1]) {
                 if ((local != t->parms.iph.saddr &&
                      (local != t->parms.iph.daddr ||
                       !ipv4_is_multicast(local))) ||
@@ -250,7 +255,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                 }
         }
 
-        for (t = ign->tunnels_wc[h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_wc[h1]) {
                 if (t->parms.i_key != key ||
                     !(t->dev->flags & IFF_UP))
                         continue;
@@ -276,8 +281,9 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
         if (cand != NULL)
                 return cand;
 
-        if (ign->fb_tunnel_dev->flags & IFF_UP)
-                return netdev_priv(ign->fb_tunnel_dev);
+        dev = ign->fb_tunnel_dev;
+        if (dev->flags & IFF_UP)
+                return netdev_priv(dev);
 
         return NULL;
 }
@@ -311,10 +317,10 @@ static void ipgre_tunnel_link(struct ipgre_net *ign, struct ip_tunnel *t)
 {
         struct ip_tunnel **tp = ipgre_bucket(ign, t);
 
+        spin_lock_bh(&ipgre_lock);
         t->next = *tp;
-        write_lock_bh(&ipgre_lock);
-        *tp = t;
-        write_unlock_bh(&ipgre_lock);
+        rcu_assign_pointer(*tp, t);
+        spin_unlock_bh(&ipgre_lock);
 }
 
 static void ipgre_tunnel_unlink(struct ipgre_net *ign, struct ip_tunnel *t)
@@ -323,9 +329,9 @@ static void ipgre_tunnel_unlink(struct ipgre_net *ign, struct ip_tunnel *t)
 
         for (tp = ipgre_bucket(ign, t); *tp; tp = &(*tp)->next) {
                 if (t == *tp) {
-                        write_lock_bh(&ipgre_lock);
+                        spin_lock_bh(&ipgre_lock);
                         *tp = t->next;
-                        write_unlock_bh(&ipgre_lock);
+                        spin_unlock_bh(&ipgre_lock);
                         break;
                 }
         }
@@ -476,7 +482,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
                 break;
         }
 
-        read_lock(&ipgre_lock);
+        rcu_read_lock();
         t = ipgre_tunnel_lookup(skb->dev, iph->daddr, iph->saddr,
                                 flags & GRE_KEY ?
                                 *(((__be32 *)p) + (grehlen / 4) - 1) : 0,
@@ -494,7 +500,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
                 t->err_count = 1;
         t->err_time = jiffies;
 out:
-        read_unlock(&ipgre_lock);
+        rcu_read_unlock();
         return;
 }
 
@@ -573,7 +579,7 @@ static int ipgre_rcv(struct sk_buff *skb)
 
         gre_proto = *(__be16 *)(h + 2);
 
-        read_lock(&ipgre_lock);
+        rcu_read_lock();
         if ((tunnel = ipgre_tunnel_lookup(skb->dev,
                                           iph->saddr, iph->daddr, key,
                                           gre_proto))) {
@@ -647,13 +653,13 @@ static int ipgre_rcv(struct sk_buff *skb)
                 ipgre_ecn_decapsulate(iph, skb);
 
                 netif_rx(skb);
-                read_unlock(&ipgre_lock);
+                rcu_read_unlock();
                 return(0);
         }
         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
 
 drop:
-        read_unlock(&ipgre_lock);
+        rcu_read_unlock();
 drop_nolock:
         kfree_skb(skb);
         return(0);
@@ -662,7 +668,8 @@ drop_nolock:
 static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->dev->stats;
+        struct net_device_stats *stats = &dev->stats;
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
         struct iphdr  *old_iph = ip_hdr(skb);
         struct iphdr  *tiph;
         u8     tos;
@@ -810,7 +817,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb) {
                         ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        txq->tx_dropped++;
                         dev_kfree_skb(skb);
                         return NETDEV_TX_OK;
                 }
@@ -1283,16 +1290,19 @@ static const struct net_protocol ipgre_protocol = {
         .netns_ok       =       1,
 };
 
-static void ipgre_destroy_tunnels(struct ipgre_net *ign)
+static void ipgre_destroy_tunnels(struct ipgre_net *ign, struct list_head *head)
 {
         int prio;
 
         for (prio = 0; prio < 4; prio++) {
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t;
-                        while ((t = ign->tunnels[prio][h]) != NULL)
-                                unregister_netdevice(t->dev);
+                        struct ip_tunnel *t = ign->tunnels[prio][h];
+
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = t->next;
+                        }
                 }
         }
 }
@@ -1340,10 +1350,12 @@ err_alloc:
 static void ipgre_exit_net(struct net *net)
 {
         struct ipgre_net *ign;
+        LIST_HEAD(list);
 
         ign = net_generic(net, ipgre_net_id);
         rtnl_lock();
-        ipgre_destroy_tunnels(ign);
+        ipgre_destroy_tunnels(ign, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
         kfree(ign);
 }
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 6c98b43badf4..fdf51badc8e5 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -161,7 +161,7 @@ int ip_call_ra_chain(struct sk_buff *skb)
                 /* If socket is bound to an interface, only report
                  * the packet if it came  from that interface.
                  */
-                if (sk && inet_sk(sk)->num == protocol &&
+                if (sk && inet_sk(sk)->inet_num == protocol &&
                     (!sk->sk_bound_dev_if ||
                      sk->sk_bound_dev_if == dev->ifindex) &&
                     sock_net(sk) == dev_net(dev)) {
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index f9895180f481..322b40864ac0 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -329,7 +329,7 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
                 __be32 daddr;
 
                 /* Use correct destination address if we have options. */
-                daddr = inet->daddr;
+                daddr = inet->inet_daddr;
                 if(opt && opt->srr)
                         daddr = opt->faddr;
 
@@ -338,13 +338,13 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
                                             .mark = sk->sk_mark,
                                             .nl_u = { .ip4_u =
                                                       { .daddr = daddr,
-                                                        .saddr = inet->saddr,
+                                                        .saddr = inet->inet_saddr,
                                                         .tos = RT_CONN_FLAGS(sk) } },
                                             .proto = sk->sk_protocol,
                                             .flags = inet_sk_flowi_flags(sk),
                                             .uli_u = { .ports =
-                                                       { .sport = inet->sport,
-                                                         .dport = inet->dport } } };
+                                                       { .sport = inet->inet_sport,
+                                                         .dport = inet->inet_dport } } };
 
                         /* If this fails, retransmit mechanism of transport layer will
                          * keep trying until route appears or the connection times
@@ -379,7 +379,7 @@ packet_routed:
 
         if (opt && opt->optlen) {
                 iph->ihl += opt->optlen >> 2;
-                ip_options_build(skb, opt, inet->daddr, rt, 0);
+                ip_options_build(skb, opt, inet->inet_daddr, rt, 0);
         }
 
         ip_select_ident_more(iph, &rt->u.dst, sk,
@@ -846,7 +846,8 @@ int ip_append_data(struct sock *sk,
         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen;
 
         if (inet->cork.length + length > 0xFFFF - fragheaderlen) {
-                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->dport, mtu-exthdrlen);
+                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->inet_dport,
+                               mtu-exthdrlen);
                 return -EMSGSIZE;
         }
 
@@ -1100,7 +1101,7 @@ ssize_t	ip_append_page(struct sock *sk, struct page *page,
         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen;
 
         if (inet->cork.length + size > 0xFFFF - fragheaderlen) {
-                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->dport, mtu);
+                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->inet_dport, mtu);
                 return -EMSGSIZE;
         }
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index e982b5c1ee17..cafad9baff03 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -245,7 +245,7 @@ int ip_ra_control(struct sock *sk, unsigned char on,
 {
         struct ip_ra_chain *ra, *new_ra, **rap;
 
-        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->num == IPPROTO_RAW)
+        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->inet_num == IPPROTO_RAW)
                 return -EINVAL;
 
         new_ra = on ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL;
@@ -480,7 +480,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
         case IP_OPTIONS:
         {
                 struct ip_options *opt = NULL;
-                if (optlen > 40 || optlen < 0)
+                if (optlen > 40)
                         goto e_inval;
                 err = ip_options_get_from_user(sock_net(sk), &opt,
                                                optval, optlen);
@@ -492,7 +492,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                         if (sk->sk_family == PF_INET ||
                             (!((1 << sk->sk_state) &
                                (TCPF_LISTEN | TCPF_CLOSE)) &&
-                             inet->daddr != LOOPBACK4_IPV6)) {
+                             inet->inet_daddr != LOOPBACK4_IPV6)) {
 #endif
                                 if (inet->opt)
                                         icsk->icsk_ext_hdr_len -= inet->opt->optlen;
@@ -575,7 +575,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                 inet->hdrincl = val ? 1 : 0;
                 break;
         case IP_MTU_DISCOVER:
-                if (val < 0 || val > 3)
+                if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)
                         goto e_inval;
                 inet->pmtudisc = val;
                 break;
@@ -1180,8 +1180,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
                 if (inet->cmsg_flags & IP_CMSG_PKTINFO) {
                         struct in_pktinfo info;
 
-                        info.ipi_addr.s_addr = inet->rcv_saddr;
-                        info.ipi_spec_dst.s_addr = inet->rcv_saddr;
+                        info.ipi_addr.s_addr = inet->inet_rcv_saddr;
+                        info.ipi_spec_dst.s_addr = inet->inet_rcv_saddr;
                         info.ipi_ifindex = inet->mc_index;
                         put_cmsg(&msg, SOL_IP, IP_PKTINFO, sizeof(info), &info);
                 }
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 08ccd344de7a..a2ca53da4372 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -134,7 +134,13 @@ static void ipip_fb_tunnel_init(struct net_device *dev);
 static void ipip_tunnel_init(struct net_device *dev);
 static void ipip_tunnel_setup(struct net_device *dev);
 
-static DEFINE_RWLOCK(ipip_lock);
+/*
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ipip_lock);
+
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 
 static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
                 __be32 remote, __be32 local)
@@ -144,20 +150,21 @@ static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
         struct ip_tunnel *t;
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 
-        for (t = ipn->tunnels_r_l[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ipn->tunnels_r_l[h0 ^ h1])
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
                         return t;
-        }
-        for (t = ipn->tunnels_r[h0]; t; t = t->next) {
+
+        for_each_ip_tunnel_rcu(ipn->tunnels_r[h0])
                 if (remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
                         return t;
-        }
-        for (t = ipn->tunnels_l[h1]; t; t = t->next) {
+
+        for_each_ip_tunnel_rcu(ipn->tunnels_l[h1])
                 if (local == t->parms.iph.saddr && (t->dev->flags&IFF_UP))
                         return t;
-        }
-        if ((t = ipn->tunnels_wc[0]) != NULL && (t->dev->flags&IFF_UP))
+
+        t = rcu_dereference(ipn->tunnels_wc[0]);
+        if (t && (t->dev->flags&IFF_UP))
                 return t;
         return NULL;
 }
@@ -193,9 +200,9 @@ static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
 
         for (tp = ipip_bucket(ipn, t); *tp; tp = &(*tp)->next) {
                 if (t == *tp) {
-                        write_lock_bh(&ipip_lock);
+                        spin_lock_bh(&ipip_lock);
                         *tp = t->next;
-                        write_unlock_bh(&ipip_lock);
+                        spin_unlock_bh(&ipip_lock);
                         break;
                 }
         }
@@ -205,10 +212,10 @@ static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
 {
         struct ip_tunnel **tp = ipip_bucket(ipn, t);
 
+        spin_lock_bh(&ipip_lock);
         t->next = *tp;
-        write_lock_bh(&ipip_lock);
-        *tp = t;
-        write_unlock_bh(&ipip_lock);
+        rcu_assign_pointer(*tp, t);
+        spin_unlock_bh(&ipip_lock);
 }
 
 static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
@@ -267,9 +274,9 @@ static void ipip_tunnel_uninit(struct net_device *dev)
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 
         if (dev == ipn->fb_tunnel_dev) {
-                write_lock_bh(&ipip_lock);
+                spin_lock_bh(&ipip_lock);
                 ipn->tunnels_wc[0] = NULL;
-                write_unlock_bh(&ipip_lock);
+                spin_unlock_bh(&ipip_lock);
         } else
                 ipip_tunnel_unlink(ipn, netdev_priv(dev));
         dev_put(dev);
@@ -318,7 +325,7 @@ static int ipip_err(struct sk_buff *skb, u32 info)
 
         err = -ENOENT;
 
-        read_lock(&ipip_lock);
+        rcu_read_lock();
         t = ipip_tunnel_lookup(dev_net(skb->dev), iph->daddr, iph->saddr);
         if (t == NULL || t->parms.iph.daddr == 0)
                 goto out;
@@ -333,7 +340,7 @@ static int ipip_err(struct sk_buff *skb, u32 info)
                 t->err_count = 1;
         t->err_time = jiffies;
 out:
-        read_unlock(&ipip_lock);
+        rcu_read_unlock();
         return err;
 }
 
@@ -351,11 +358,11 @@ static int ipip_rcv(struct sk_buff *skb)
         struct ip_tunnel *tunnel;
         const struct iphdr *iph = ip_hdr(skb);
 
-        read_lock(&ipip_lock);
+        rcu_read_lock();
         if ((tunnel = ipip_tunnel_lookup(dev_net(skb->dev),
                                         iph->saddr, iph->daddr)) != NULL) {
                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                        read_unlock(&ipip_lock);
+                        rcu_read_unlock();
                         kfree_skb(skb);
                         return 0;
                 }
@@ -374,10 +381,10 @@ static int ipip_rcv(struct sk_buff *skb)
                 nf_reset(skb);
                 ipip_ecn_decapsulate(iph, skb);
                 netif_rx(skb);
-                read_unlock(&ipip_lock);
+                rcu_read_unlock();
                 return 0;
         }
-        read_unlock(&ipip_lock);
+        rcu_read_unlock();
 
         return -1;
 }
@@ -390,7 +397,8 @@ static int ipip_rcv(struct sk_buff *skb)
 static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->dev->stats;
+        struct net_device_stats *stats = &dev->stats;
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
         struct iphdr  *tiph = &tunnel->parms.iph;
         u8     tos = tunnel->parms.iph.tos;
         __be16 df = tiph->frag_off;
@@ -478,7 +486,7 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb) {
                         ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        txq->tx_dropped++;
                         dev_kfree_skb(skb);
                         return NETDEV_TX_OK;
                 }
@@ -746,16 +754,19 @@ static struct xfrm_tunnel ipip_handler = {
 static const char banner[] __initconst =
         KERN_INFO "IPv4 over IPv4 tunneling driver\n";
 
-static void ipip_destroy_tunnels(struct ipip_net *ipn)
+static void ipip_destroy_tunnels(struct ipip_net *ipn, struct list_head *head)
 {
         int prio;
 
         for (prio = 1; prio < 4; prio++) {
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t;
-                        while ((t = ipn->tunnels[prio][h]) != NULL)
-                                unregister_netdevice(t->dev);
+                        struct ip_tunnel *t = ipn->tunnels[prio][h];
+
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = t->next;
+                        }
                 }
         }
 }
@@ -808,11 +819,13 @@ err_alloc:
 static void ipip_exit_net(struct net *net)
 {
         struct ipip_net *ipn;
+        LIST_HEAD(list);
 
         ipn = net_generic(net, ipip_net_id);
         rtnl_lock();
-        ipip_destroy_tunnels(ipn);
-        unregister_netdevice(ipn->fb_tunnel_dev);
+        ipip_destroy_tunnels(ipn, &list);
+        unregister_netdevice_queue(ipn->fb_tunnel_dev, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
         kfree(ipn);
 }
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 630a56df7b47..ef4ee45b928f 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -275,7 +275,8 @@ failure:
  *      @notify: Set to 1, if the caller is a notifier_call
  */
 
-static int vif_delete(struct net *net, int vifi, int notify)
+static int vif_delete(struct net *net, int vifi, int notify,
+                      struct list_head *head)
 {
         struct vif_device *v;
         struct net_device *dev;
@@ -319,7 +320,7 @@ static int vif_delete(struct net *net, int vifi, int notify)
         }
 
         if (v->flags&(VIFF_TUNNEL|VIFF_REGISTER) && !notify)
-                unregister_netdevice(dev);
+                unregister_netdevice_queue(dev, head);
 
         dev_put(dev);
         return 0;
@@ -469,8 +470,18 @@ static int vif_add(struct net *net, struct vifctl *vifc, int mrtsock)
                         return err;
                 }
                 break;
+
+        case VIFF_USE_IFINDEX:
         case 0:
-                dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);
+                if (vifc->vifc_flags == VIFF_USE_IFINDEX) {
+                        dev = dev_get_by_index(net, vifc->vifc_lcl_ifindex);
+                        if (dev && dev->ip_ptr == NULL) {
+                                dev_put(dev);
+                                return -EADDRNOTAVAIL;
+                        }
+                } else
+                        dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);
+
                 if (!dev)
                         return -EADDRNOTAVAIL;
                 err = dev_set_allmulti(dev, 1);
@@ -860,14 +871,16 @@ static int ipmr_mfc_add(struct net *net, struct mfcctl *mfc, int mrtsock)
 static void mroute_clean_tables(struct net *net)
 {
         int i;
+        LIST_HEAD(list);
 
         /*
          *      Shut down all active vif entries
          */
         for (i = 0; i < net->ipv4.maxvif; i++) {
                 if (!(net->ipv4.vif_table[i].flags&VIFF_STATIC))
-                        vif_delete(net, i, 0);
+                        vif_delete(net, i, 0, &list);
         }
+        unregister_netdevice_many(&list);
 
         /*
          *      Wipe the cache
@@ -946,7 +959,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
         switch (optname) {
         case MRT_INIT:
                 if (sk->sk_type != SOCK_RAW ||
-                    inet_sk(sk)->num != IPPROTO_IGMP)
+                    inet_sk(sk)->inet_num != IPPROTO_IGMP)
                         return -EOPNOTSUPP;
                 if (optlen != sizeof(int))
                         return -ENOPROTOOPT;
@@ -983,7 +996,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
                 if (optname == MRT_ADD_VIF) {
                         ret = vif_add(net, &vif, sk == net->ipv4.mroute_sk);
                 } else {
-                        ret = vif_delete(net, vif.vifc_vifi, 0);
+                        ret = vif_delete(net, vif.vifc_vifi, 0, NULL);
                 }
                 rtnl_unlock();
                 return ret;
@@ -1146,6 +1159,7 @@ static int ipmr_device_event(struct notifier_block *this, unsigned long event, v
         struct net *net = dev_net(dev);
         struct vif_device *v;
         int ct;
+        LIST_HEAD(list);
 
         if (!net_eq(dev_net(dev), net))
                 return NOTIFY_DONE;
@@ -1155,8 +1169,9 @@ static int ipmr_device_event(struct notifier_block *this, unsigned long event, v
         v = &net->ipv4.vif_table[0];
         for (ct = 0; ct < net->ipv4.maxvif; ct++, v++) {
                 if (v->dev == dev)
-                        vif_delete(net, ct, 1);
+                        vif_delete(net, ct, 1, &list);
         }
+        unregister_netdevice_many(&list);
         return NOTIFY_DONE;
 }
 
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index aa95bb82ee6c..9cd423ffafa8 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -255,10 +255,10 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
         struct nf_conntrack_tuple tuple;
 
         memset(&tuple, 0, sizeof(tuple));
-        tuple.src.u3.ip = inet->rcv_saddr;
-        tuple.src.u.tcp.port = inet->sport;
-        tuple.dst.u3.ip = inet->daddr;
-        tuple.dst.u.tcp.port = inet->dport;
+        tuple.src.u3.ip = inet->inet_rcv_saddr;
+        tuple.src.u.tcp.port = inet->inet_sport;
+        tuple.dst.u3.ip = inet->inet_daddr;
+        tuple.dst.u.tcp.port = inet->inet_dport;
         tuple.src.l3num = PF_INET;
         tuple.dst.protonum = sk->sk_protocol;
 
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index ab996f9c0fe0..ce154b47f1da 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -87,7 +87,7 @@ void raw_hash_sk(struct sock *sk)
         struct raw_hashinfo *h = sk->sk_prot->h.raw_hash;
         struct hlist_head *head;
 
-        head = &h->ht[inet_sk(sk)->num & (RAW_HTABLE_SIZE - 1)];
+        head = &h->ht[inet_sk(sk)->inet_num & (RAW_HTABLE_SIZE - 1)];
 
         write_lock_bh(&h->lock);
         sk_add_node(sk, head);
@@ -115,9 +115,9 @@ static struct sock *__raw_v4_lookup(struct net *net, struct sock *sk,
         sk_for_each_from(sk, node) {
                 struct inet_sock *inet = inet_sk(sk);
 
-                if (net_eq(sock_net(sk), net) && inet->num == num       &&
-                    !(inet->daddr && inet->daddr != raddr)              &&
-                    !(inet->rcv_saddr && inet->rcv_saddr != laddr)      &&
+                if (net_eq(sock_net(sk), net) && inet->inet_num == num  &&
+                    !(inet->inet_daddr && inet->inet_daddr != raddr)    &&
+                    !(inet->inet_rcv_saddr && inet->inet_rcv_saddr != laddr) &&
                     !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
                         goto found; /* gotcha */
         }
@@ -292,7 +292,6 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
         /* Charge it to the socket. */
 
         if (sock_queue_rcv_skb(sk, skb) < 0) {
-                atomic_inc(&sk->sk_drops);
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
@@ -327,7 +326,7 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
         int err;
 
         if (length > rt->u.dst.dev->mtu) {
-                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->dport,
+                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->inet_dport,
                                rt->u.dst.dev->mtu);
                 return -EMSGSIZE;
         }
@@ -500,10 +499,10 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 err = -EDESTADDRREQ;
                 if (sk->sk_state != TCP_ESTABLISHED)
                         goto out;
-                daddr = inet->daddr;
+                daddr = inet->inet_daddr;
         }
 
-        ipc.addr = inet->saddr;
+        ipc.addr = inet->inet_saddr;
         ipc.opt = NULL;
         ipc.shtx.flags = 0;
         ipc.oif = sk->sk_bound_dev_if;
@@ -645,9 +644,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (addr->sin_addr.s_addr && chk_addr_ret != RTN_LOCAL &&
             chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST)
                 goto out;
-        inet->rcv_saddr = inet->saddr = addr->sin_addr.s_addr;
+        inet->inet_rcv_saddr = inet->inet_saddr = addr->sin_addr.s_addr;
         if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
-                inet->saddr = 0;  /* Use device */
+                inet->inet_saddr = 0;  /* Use device */
         sk_dst_reset(sk);
         ret = 0;
 out:    return ret;
@@ -692,7 +691,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (err)
                 goto done;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         /* Copy the address. */
         if (sin) {
@@ -717,7 +716,7 @@ static int raw_init(struct sock *sk)
 {
         struct raw_sock *rp = raw_sk(sk);
 
-        if (inet_sk(sk)->num == IPPROTO_ICMP)
+        if (inet_sk(sk)->inet_num == IPPROTO_ICMP)
                 memset(&rp->filter, 0, sizeof(rp->filter));
         return 0;
 }
@@ -754,7 +753,7 @@ static int do_raw_setsockopt(struct sock *sk, int level, int optname,
                           char __user *optval, unsigned int optlen)
 {
         if (optname == ICMP_FILTER) {
-                if (inet_sk(sk)->num != IPPROTO_ICMP)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMP)
                         return -EOPNOTSUPP;
                 else
                         return raw_seticmpfilter(sk, optval, optlen);
@@ -784,7 +783,7 @@ static int do_raw_getsockopt(struct sock *sk, int level, int optname,
                           char __user *optval, int __user *optlen)
 {
         if (optname == ICMP_FILTER) {
-                if (inet_sk(sk)->num != IPPROTO_ICMP)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMP)
                         return -EOPNOTSUPP;
                 else
                         return raw_geticmpfilter(sk, optval, optlen);
@@ -943,10 +942,10 @@ EXPORT_SYMBOL_GPL(raw_seq_stop);
 static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
 {
         struct inet_sock *inet = inet_sk(sp);
-        __be32 dest = inet->daddr,
-               src = inet->rcv_saddr;
+        __be32 dest = inet->inet_daddr,
+               src = inet->inet_rcv_saddr;
         __u16 destp = 0,
-              srcp  = inet->num;
+              srcp  = inet->inet_num;
 
         seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index bb4199252026..68fb22702051 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1628,9 +1628,6 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
         __be32  daddr = iph->daddr;
         unsigned short est_mtu = 0;
 
-        if (ipv4_config.no_pmtu_disc)
-                return 0;
-
         for (k = 0; k < 2; k++) {
                 for (i = 0; i < 2; i++) {
                         unsigned hash = rt_hash(daddr, skeys[i], ikeys[k],
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index a6e0e077ac33..3146cc401748 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -276,13 +276,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
 
-        /* check for timestamp cookie support */
-        memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, 0);
-
-        if (tcp_opt.saw_tstamp)
-                cookie_check_timestamp(&tcp_opt);
-
         ret = NULL;
         req = inet_reqsk_alloc(&tcp_request_sock_ops); /* for safety */
         if (!req)
@@ -298,12 +291,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         ireq->loc_addr          = ip_hdr(skb)->daddr;
         ireq->rmt_addr          = ip_hdr(skb)->saddr;
         ireq->ecn_ok            = 0;
-        ireq->snd_wscale        = tcp_opt.snd_wscale;
-        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
-        ireq->sack_ok           = tcp_opt.sack_ok;
-        ireq->wscale_ok         = tcp_opt.wscale_ok;
-        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
-        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
 
         /* We throwed the options of the initial SYN away, so we hope
          * the ACK carries the same options again (see RFC1122 4.2.3.8)
@@ -333,7 +320,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
          * no easy way to do this.
          */
         {
-                struct flowi fl = { .nl_u = { .ip4_u =
+                struct flowi fl = { .mark = sk->sk_mark,
+                                    .nl_u = { .ip4_u =
                                               { .daddr = ((opt && opt->srr) ?
                                                           opt->faddr :
                                                           ireq->rmt_addr),
@@ -351,6 +339,20 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                 }
         }
 
+        /* check for timestamp cookie support */
+        memset(&tcp_opt, 0, sizeof(tcp_opt));
+        tcp_parse_options(skb, &tcp_opt, 0, &rt->u.dst);
+
+        if (tcp_opt.saw_tstamp)
+                cookie_check_timestamp(&tcp_opt);
+
+        ireq->snd_wscale        = tcp_opt.snd_wscale;
+        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
+        ireq->sack_ok           = tcp_opt.sack_ok;
+        ireq->wscale_ok         = tcp_opt.wscale_ok;
+        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
+        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
+
         /* Try to redo what tcp_v4_send_synack did. */
         req->window_clamp = tp->window_clamp ? :dst_metric(&rt->u.dst, RTAX_WINDOW);
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 98440ad82558..e0cfa633680a 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2037,7 +2037,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         __skb_queue_purge(&sk->sk_async_wait_queue);
 #endif
 
-        inet->dport = 0;
+        inet->inet_dport = 0;
 
         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
                 inet_reset_saddr(sk);
@@ -2061,7 +2061,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
         __sk_dst_reset(sk);
 
-        WARN_ON(inet->num && !icsk->icsk_bind_hash);
+        WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
 
         sk->sk_error_report(sk);
         return err;
@@ -2898,11 +2898,10 @@ void __init tcp_init(void)
                                         (totalram_pages >= 128 * 1024) ?
                                         13 : 15,
                                         0,
-                                        &tcp_hashinfo.ehash_size,
                                         NULL,
+                                        &tcp_hashinfo.ehash_mask,
                                         thash_entries ? 0 : 512 * 1024);
-        tcp_hashinfo.ehash_size = 1 << tcp_hashinfo.ehash_size;
-        for (i = 0; i < tcp_hashinfo.ehash_size; i++) {
+        for (i = 0; i <= tcp_hashinfo.ehash_mask; i++) {
                 INIT_HLIST_NULLS_HEAD(&tcp_hashinfo.ehash[i].chain, i);
                 INIT_HLIST_NULLS_HEAD(&tcp_hashinfo.ehash[i].twchain, i);
         }
@@ -2911,7 +2910,7 @@ void __init tcp_init(void)
         tcp_hashinfo.bhash =
                 alloc_large_system_hash("TCP bind",
                                         sizeof(struct inet_bind_hashbucket),
-                                        tcp_hashinfo.ehash_size,
+                                        tcp_hashinfo.ehash_mask + 1,
                                         (totalram_pages >= 128 * 1024) ?
                                         13 : 15,
                                         0,
@@ -2966,8 +2965,8 @@ void __init tcp_init(void)
         sysctl_tcp_rmem[2] = max(87380, max_share);
 
         printk(KERN_INFO "TCP: Hash tables configured "
-               "(established %d bind %d)\n",
-               tcp_hashinfo.ehash_size, tcp_hashinfo.bhash_size);
+               "(established %u bind %u)\n",
+               tcp_hashinfo.ehash_mask + 1, tcp_hashinfo.bhash_size);
 
         tcp_register_congestion_control(&tcp_reno);
 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index d86784be7ab3..ba0eab65fe80 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2300,7 +2300,7 @@ static inline int tcp_fackets_out(struct tcp_sock *tp)
  * they differ. Since neither occurs due to loss, TCP should really
  * ignore them.
  */
-static inline int tcp_dupack_heurestics(struct tcp_sock *tp)
+static inline int tcp_dupack_heuristics(struct tcp_sock *tp)
 {
         return tcp_is_fack(tp) ? tp->fackets_out : tp->sacked_out + 1;
 }
@@ -2425,7 +2425,7 @@ static int tcp_time_to_recover(struct sock *sk)
                 return 1;
 
         /* Not-A-Trick#2 : Classic rule... */
-        if (tcp_dupack_heurestics(tp) > tp->reordering)
+        if (tcp_dupack_heuristics(tp) > tp->reordering)
                 return 1;
 
         /* Trick#3 : when we use RFC2988 timer restart, fast
@@ -3698,12 +3698,14 @@ old_ack:
  * the fast version below fails.
  */
 void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
-                       int estab)
+                       int estab,  struct dst_entry *dst)
 {
         unsigned char *ptr;
         struct tcphdr *th = tcp_hdr(skb);
         int length = (th->doff * 4) - sizeof(struct tcphdr);
 
+        BUG_ON(!estab && !dst);
+
         ptr = (unsigned char *)(th + 1);
         opt_rx->saw_tstamp = 0;
 
@@ -3737,7 +3739,8 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                 break;
                         case TCPOPT_WINDOW:
                                 if (opsize == TCPOLEN_WINDOW && th->syn &&
-                                    !estab && sysctl_tcp_window_scaling) {
+                                    !estab && sysctl_tcp_window_scaling &&
+                                    !dst_feature(dst, RTAX_FEATURE_NO_WSCALE)) {
                                         __u8 snd_wscale = *(__u8 *)ptr;
                                         opt_rx->wscale_ok = 1;
                                         if (snd_wscale > 14) {
@@ -3753,7 +3756,8 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                         case TCPOPT_TIMESTAMP:
                                 if ((opsize == TCPOLEN_TIMESTAMP) &&
                                     ((estab && opt_rx->tstamp_ok) ||
-                                     (!estab && sysctl_tcp_timestamps))) {
+                                     (!estab && sysctl_tcp_timestamps &&
+                                      !dst_feature(dst, RTAX_FEATURE_NO_TSTAMP)))) {
                                         opt_rx->saw_tstamp = 1;
                                         opt_rx->rcv_tsval = get_unaligned_be32(ptr);
                                         opt_rx->rcv_tsecr = get_unaligned_be32(ptr + 4);
@@ -3761,7 +3765,8 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                 break;
                         case TCPOPT_SACK_PERM:
                                 if (opsize == TCPOLEN_SACK_PERM && th->syn &&
-                                    !estab && sysctl_tcp_sack) {
+                                    !estab && sysctl_tcp_sack &&
+                                    !dst_feature(dst, RTAX_FEATURE_NO_SACK)) {
                                         opt_rx->sack_ok = 1;
                                         tcp_sack_reset(opt_rx);
                                 }
@@ -3820,7 +3825,7 @@ static int tcp_fast_parse_options(struct sk_buff *skb, struct tcphdr *th,
                 if (tcp_parse_aligned_timestamp(tp, th))
                         return 1;
         }
-        tcp_parse_options(skb, &tp->rx_opt, 1);
+        tcp_parse_options(skb, &tp->rx_opt, 1, NULL);
         return 1;
 }
 
@@ -4075,8 +4080,10 @@ static inline int tcp_sack_extend(struct tcp_sack_block *sp, u32 seq,
 static void tcp_dsack_set(struct sock *sk, u32 seq, u32 end_seq)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        struct dst_entry *dst = __sk_dst_get(sk);
 
-        if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
+        if (tcp_is_sack(tp) && sysctl_tcp_dsack &&
+            !dst_feature(dst, RTAX_FEATURE_NO_DSACK)) {
                 int mib_idx;
 
                 if (before(seq, tp->rcv_nxt))
@@ -4105,13 +4112,15 @@ static void tcp_dsack_extend(struct sock *sk, u32 seq, u32 end_seq)
 static void tcp_send_dupack(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        struct dst_entry *dst = __sk_dst_get(sk);
 
         if (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq &&
             before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_DELAYEDACKLOST);
                 tcp_enter_quickack_mode(sk);
 
-                if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
+                if (tcp_is_sack(tp) && sysctl_tcp_dsack &&
+                    !dst_feature(dst, RTAX_FEATURE_NO_DSACK)) {
                         u32 end_seq = TCP_SKB_CB(skb)->end_seq;
 
                         if (after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt))
@@ -5364,8 +5373,9 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
         int saved_clamp = tp->rx_opt.mss_clamp;
+        struct dst_entry *dst = __sk_dst_get(sk);
 
-        tcp_parse_options(skb, &tp->rx_opt, 0);
+        tcp_parse_options(skb, &tp->rx_opt, 0, dst);
 
         if (th->ack) {
                 /* rfc793:
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 7cda24b53f61..657ae334f125 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -165,10 +165,10 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 nexthop = inet->opt->faddr;
         }
 
-        tmp = ip_route_connect(&rt, nexthop, inet->saddr,
+        tmp = ip_route_connect(&rt, nexthop, inet->inet_saddr,
                                RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
                                IPPROTO_TCP,
-                               inet->sport, usin->sin_port, sk, 1);
+                               inet->inet_sport, usin->sin_port, sk, 1);
         if (tmp < 0) {
                 if (tmp == -ENETUNREACH)
                         IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
@@ -183,11 +183,11 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (!inet->opt || !inet->opt->srr)
                 daddr = rt->rt_dst;
 
-        if (!inet->saddr)
-                inet->saddr = rt->rt_src;
-        inet->rcv_saddr = inet->saddr;
+        if (!inet->inet_saddr)
+                inet->inet_saddr = rt->rt_src;
+        inet->inet_rcv_saddr = inet->inet_saddr;
 
-        if (tp->rx_opt.ts_recent_stamp && inet->daddr != daddr) {
+        if (tp->rx_opt.ts_recent_stamp && inet->inet_daddr != daddr) {
                 /* Reset inherited state */
                 tp->rx_opt.ts_recent       = 0;
                 tp->rx_opt.ts_recent_stamp = 0;
@@ -210,8 +210,8 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 }
         }
 
-        inet->dport = usin->sin_port;
-        inet->daddr = daddr;
+        inet->inet_dport = usin->sin_port;
+        inet->inet_daddr = daddr;
 
         inet_csk(sk)->icsk_ext_hdr_len = 0;
         if (inet->opt)
@@ -230,7 +230,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 goto failure;
 
         err = ip_route_newports(&rt, IPPROTO_TCP,
-                                inet->sport, inet->dport, sk);
+                                inet->inet_sport, inet->inet_dport, sk);
         if (err)
                 goto failure;
 
@@ -239,12 +239,12 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         sk_setup_caps(sk, &rt->u.dst);
 
         if (!tp->write_seq)
-                tp->write_seq = secure_tcp_sequence_number(inet->saddr,
-                                                           inet->daddr,
-                                                           inet->sport,
+                tp->write_seq = secure_tcp_sequence_number(inet->inet_saddr,
+                                                           inet->inet_daddr,
+                                                           inet->inet_sport,
                                                            usin->sin_port);
 
-        inet->id = tp->write_seq ^ jiffies;
+        inet->inet_id = tp->write_seq ^ jiffies;
 
         err = tcp_connect(sk);
         rt = NULL;
@@ -261,7 +261,7 @@ failure:
         tcp_set_state(sk, TCP_CLOSE);
         ip_rt_put(rt);
         sk->sk_route_caps = 0;
-        inet->dport = 0;
+        inet->inet_dport = 0;
         return err;
 }
 
@@ -520,12 +520,13 @@ void tcp_v4_send_check(struct sock *sk, int len, struct sk_buff *skb)
         struct tcphdr *th = tcp_hdr(skb);
 
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                th->check = ~tcp_v4_check(len, inet->saddr,
-                                          inet->daddr, 0);
+                th->check = ~tcp_v4_check(len, inet->inet_saddr,
+                                          inet->inet_daddr, 0);
                 skb->csum_start = skb_transport_header(skb) - skb->head;
                 skb->csum_offset = offsetof(struct tcphdr, check);
         } else {
-                th->check = tcp_v4_check(len, inet->saddr, inet->daddr,
+                th->check = tcp_v4_check(len, inet->inet_saddr,
+                                         inet->inet_daddr,
                                          csum_partial(th,
                                                       th->doff << 2,
                                                       skb->csum));
@@ -848,7 +849,7 @@ static struct tcp_md5sig_key *
 struct tcp_md5sig_key *tcp_v4_md5_lookup(struct sock *sk,
                                          struct sock *addr_sk)
 {
-        return tcp_v4_md5_do_lookup(sk, inet_sk(addr_sk)->daddr);
+        return tcp_v4_md5_do_lookup(sk, inet_sk(addr_sk)->inet_daddr);
 }
 
 EXPORT_SYMBOL(tcp_v4_md5_lookup);
@@ -923,7 +924,7 @@ EXPORT_SYMBOL(tcp_v4_md5_do_add);
 static int tcp_v4_md5_add_func(struct sock *sk, struct sock *addr_sk,
                                u8 *newkey, u8 newkeylen)
 {
-        return tcp_v4_md5_do_add(sk, inet_sk(addr_sk)->daddr,
+        return tcp_v4_md5_do_add(sk, inet_sk(addr_sk)->inet_daddr,
                                  newkey, newkeylen);
 }
 
@@ -1089,8 +1090,8 @@ int tcp_v4_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
         __be32 saddr, daddr;
 
         if (sk) {
-                saddr = inet_sk(sk)->saddr;
-                daddr = inet_sk(sk)->daddr;
+                saddr = inet_sk(sk)->inet_saddr;
+                daddr = inet_sk(sk)->inet_daddr;
         } else if (req) {
                 saddr = inet_rsk(req)->loc_addr;
                 daddr = inet_rsk(req)->rmt_addr;
@@ -1256,11 +1257,21 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv4_ops;
 #endif
 
+        ireq = inet_rsk(req);
+        ireq->loc_addr = daddr;
+        ireq->rmt_addr = saddr;
+        ireq->no_srccheck = inet_sk(sk)->transparent;
+        ireq->opt = tcp_v4_save_options(sk, skb);
+
+        dst = inet_csk_route_req(sk, req);
+        if(!dst)
+                goto drop_and_free;
+
         tcp_clear_options(&tmp_opt);
         tmp_opt.mss_clamp = 536;
         tmp_opt.user_mss  = tcp_sk(sk)->rx_opt.user_mss;
 
-        tcp_parse_options(skb, &tmp_opt, 0);
+        tcp_parse_options(skb, &tmp_opt, 0, dst);
 
         if (want_cookie && !tmp_opt.saw_tstamp)
                 tcp_clear_options(&tmp_opt);
@@ -1269,14 +1280,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 
         tcp_openreq_init(req, &tmp_opt, skb);
 
-        ireq = inet_rsk(req);
-        ireq->loc_addr = daddr;
-        ireq->rmt_addr = saddr;
-        ireq->no_srccheck = inet_sk(sk)->transparent;
-        ireq->opt = tcp_v4_save_options(sk, skb);
-
         if (security_inet_conn_request(sk, skb, req))
-                goto drop_and_free;
+                goto drop_and_release;
 
         if (!want_cookie)
                 TCP_ECN_create_request(req, tcp_hdr(skb));
@@ -1301,7 +1306,6 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                  */
                 if (tmp_opt.saw_tstamp &&
                     tcp_death_row.sysctl_tw_recycle &&
-                    (dst = inet_csk_route_req(sk, req)) != NULL &&
                     (peer = rt_get_peer((struct rtable *)dst)) != NULL &&
                     peer->v4daddr == saddr) {
                         if (get_seconds() < peer->tcp_ts_stamp + TCP_PAWS_MSL &&
@@ -1380,9 +1384,9 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         newtp                 = tcp_sk(newsk);
         newinet               = inet_sk(newsk);
         ireq                  = inet_rsk(req);
-        newinet->daddr        = ireq->rmt_addr;
-        newinet->rcv_saddr    = ireq->loc_addr;
-        newinet->saddr        = ireq->loc_addr;
+        newinet->inet_daddr   = ireq->rmt_addr;
+        newinet->inet_rcv_saddr = ireq->loc_addr;
+        newinet->inet_saddr           = ireq->loc_addr;
         newinet->opt          = ireq->opt;
         ireq->opt             = NULL;
         newinet->mc_index     = inet_iif(skb);
@@ -1390,7 +1394,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         inet_csk(newsk)->icsk_ext_hdr_len = 0;
         if (newinet->opt)
                 inet_csk(newsk)->icsk_ext_hdr_len = newinet->opt->optlen;
-        newinet->id = newtp->write_seq ^ jiffies;
+        newinet->inet_id = newtp->write_seq ^ jiffies;
 
         tcp_mtup_init(newsk);
         tcp_sync_mss(newsk, dst_mtu(dst));
@@ -1403,7 +1407,8 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Copy over the MD5 key from the original socket */
-        if ((key = tcp_v4_md5_do_lookup(sk, newinet->daddr)) != NULL) {
+        key = tcp_v4_md5_do_lookup(sk, newinet->inet_daddr);
+        if (key != NULL) {
                 /*
                  * We're using one, so create a matching key
                  * on the newsk structure. If we fail to get
@@ -1412,7 +1417,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                  */
                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
                 if (newkey != NULL)
-                        tcp_v4_md5_do_add(newsk, newinet->daddr,
+                        tcp_v4_md5_do_add(newsk, newinet->inet_daddr,
                                           newkey, key->keylen);
                 newsk->sk_route_caps &= ~NETIF_F_GSO_MASK;
         }
@@ -1711,8 +1716,8 @@ int tcp_v4_remember_stamp(struct sock *sk)
         struct inet_peer *peer = NULL;
         int release_it = 0;
 
-        if (!rt || rt->rt_dst != inet->daddr) {
-                peer = inet_getpeer(inet->daddr, 1);
+        if (!rt || rt->rt_dst != inet->inet_daddr) {
+                peer = inet_getpeer(inet->inet_daddr, 1);
                 release_it = 1;
         } else {
                 if (!rt->peer)
@@ -2000,7 +2005,7 @@ static void *established_get_first(struct seq_file *seq)
         struct net *net = seq_file_net(seq);
         void *rc = NULL;
 
-        for (st->bucket = 0; st->bucket < tcp_hashinfo.ehash_size; ++st->bucket) {
+        for (st->bucket = 0; st->bucket <= tcp_hashinfo.ehash_mask; ++st->bucket) {
                 struct sock *sk;
                 struct hlist_nulls_node *node;
                 struct inet_timewait_sock *tw;
@@ -2061,10 +2066,10 @@ get_tw:
                 st->state = TCP_SEQ_STATE_ESTABLISHED;
 
                 /* Look for next non empty bucket */
-                while (++st->bucket < tcp_hashinfo.ehash_size &&
+                while (++st->bucket <= tcp_hashinfo.ehash_mask &&
                                 empty_bucket(st))
                         ;
-                if (st->bucket >= tcp_hashinfo.ehash_size)
+                if (st->bucket > tcp_hashinfo.ehash_mask)
                         return NULL;
 
                 spin_lock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket));
@@ -2225,7 +2230,7 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %p%n",
                 i,
                 ireq->loc_addr,
-                ntohs(inet_sk(sk)->sport),
+                ntohs(inet_sk(sk)->inet_sport),
                 ireq->rmt_addr,
                 ntohs(ireq->rmt_port),
                 TCP_SYN_RECV,
@@ -2248,10 +2253,10 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
         struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct inet_sock *inet = inet_sk(sk);
-        __be32 dest = inet->daddr;
-        __be32 src = inet->rcv_saddr;
-        __u16 destp = ntohs(inet->dport);
-        __u16 srcp = ntohs(inet->sport);
+        __be32 dest = inet->inet_daddr;
+        __be32 src = inet->inet_rcv_saddr;
+        __u16 destp = ntohs(inet->inet_dport);
+        __u16 srcp = ntohs(inet->inet_sport);
 
         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
                 timer_active    = 1;
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 4c03598ed924..463d51b53d37 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -100,9 +100,9 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
         struct tcp_options_received tmp_opt;
         int paws_reject = 0;
 
-        tmp_opt.saw_tstamp = 0;
         if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
-                tcp_parse_options(skb, &tmp_opt, 0);
+                tmp_opt.tstamp_ok = 1;
+                tcp_parse_options(skb, &tmp_opt, 1, NULL);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent       = tcptw->tw_ts_recent;
@@ -500,10 +500,11 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
         int paws_reject = 0;
         struct tcp_options_received tmp_opt;
         struct sock *child;
+        struct dst_entry *dst = inet_csk_route_req(sk, req);
 
         tmp_opt.saw_tstamp = 0;
         if (th->doff > (sizeof(struct tcphdr)>>2)) {
-                tcp_parse_options(skb, &tmp_opt, 0);
+                tcp_parse_options(skb, &tmp_opt, 0, dst);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent = req->ts_recent;
@@ -516,6 +517,8 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
                 }
         }
 
+        dst_release(dst);
+
         /* Check for pure retransmitted SYN. */
         if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn &&
             flg == TCP_FLAG_SYN &&
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index fcd278a7080e..616c686ca253 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -464,6 +464,7 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
                                 struct tcp_md5sig_key **md5) {
         struct tcp_sock *tp = tcp_sk(sk);
         unsigned size = 0;
+        struct dst_entry *dst = __sk_dst_get(sk);
 
 #ifdef CONFIG_TCP_MD5SIG
         *md5 = tp->af_specific->md5_lookup(sk, sk);
@@ -487,18 +488,22 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
         opts->mss = tcp_advertise_mss(sk);
         size += TCPOLEN_MSS_ALIGNED;
 
-        if (likely(sysctl_tcp_timestamps && *md5 == NULL)) {
+        if (likely(sysctl_tcp_timestamps &&
+                   !dst_feature(dst, RTAX_FEATURE_NO_TSTAMP) &&
+                   *md5 == NULL)) {
                 opts->options |= OPTION_TS;
                 opts->tsval = TCP_SKB_CB(skb)->when;
                 opts->tsecr = tp->rx_opt.ts_recent;
                 size += TCPOLEN_TSTAMP_ALIGNED;
         }
-        if (likely(sysctl_tcp_window_scaling)) {
+        if (likely(sysctl_tcp_window_scaling &&
+                   !dst_feature(dst, RTAX_FEATURE_NO_WSCALE))) {
                 opts->ws = tp->rx_opt.rcv_wscale;
                 opts->options |= OPTION_WSCALE;
                 size += TCPOLEN_WSCALE_ALIGNED;
         }
-        if (likely(sysctl_tcp_sack)) {
+        if (likely(sysctl_tcp_sack &&
+                   !dst_feature(dst, RTAX_FEATURE_NO_SACK))) {
                 opts->options |= OPTION_SACK_ADVERTISE;
                 if (unlikely(!(OPTION_TS & opts->options)))
                         size += TCPOLEN_SACKPERM_ALIGNED;
@@ -661,8 +666,8 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
 
         /* Build TCP header and checksum it. */
         th = tcp_hdr(skb);
-        th->source              = inet->sport;
-        th->dest                = inet->dport;
+        th->source              = inet->inet_sport;
+        th->dest                = inet->inet_dport;
         th->seq                 = htonl(tcb->seq);
         th->ack_seq             = htonl(tp->rcv_nxt);
         *(((__be16 *)th) + 6)   = htons(((tcp_header_size >> 2) << 12) |
@@ -2315,7 +2320,9 @@ static void tcp_connect_init(struct sock *sk)
          * See tcp_input.c:tcp_rcv_state_process case TCP_SYN_SENT.
          */
         tp->tcp_header_len = sizeof(struct tcphdr) +
-                (sysctl_tcp_timestamps ? TCPOLEN_TSTAMP_ALIGNED : 0);
+                (sysctl_tcp_timestamps &&
+                (!dst_feature(dst, RTAX_FEATURE_NO_TSTAMP) ?
+                  TCPOLEN_TSTAMP_ALIGNED : 0));
 
 #ifdef CONFIG_TCP_MD5SIG
         if (tp->af_specific->md5_lookup(sk, sk) != NULL)
@@ -2341,7 +2348,8 @@ static void tcp_connect_init(struct sock *sk)
                                   tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
                                   &tp->rcv_wnd,
                                   &tp->window_clamp,
-                                  sysctl_tcp_window_scaling,
+                                  (sysctl_tcp_window_scaling &&
+                                   !dst_feature(dst, RTAX_FEATURE_NO_WSCALE)),
                                   &rcv_wscale);
 
         tp->rx_opt.rcv_wscale = rcv_wscale;
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 59f5b5e7c566..7a3cc2ffad84 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -94,7 +94,8 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
         const struct inet_sock *inet = inet_sk(sk);
 
         /* Only update if port matches */
-        if ((port == 0 || ntohs(inet->dport) == port || ntohs(inet->sport) == port)
+        if ((port == 0 || ntohs(inet->inet_dport) == port ||
+             ntohs(inet->inet_sport) == port)
             && (full || tp->snd_cwnd != tcp_probe.lastcwnd)) {
 
                 spin_lock(&tcp_probe.lock);
@@ -103,10 +104,10 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                         struct tcp_log *p = tcp_probe.log + tcp_probe.head;
 
                         p->tstamp = ktime_get();
-                        p->saddr = inet->saddr;
-                        p->sport = inet->sport;
-                        p->daddr = inet->daddr;
-                        p->dport = inet->dport;
+                        p->saddr = inet->inet_saddr;
+                        p->sport = inet->inet_sport;
+                        p->daddr = inet->inet_daddr;
+                        p->dport = inet->inet_dport;
                         p->length = skb->len;
                         p->snd_nxt = tp->snd_nxt;
                         p->snd_una = tp->snd_una;
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index cdb2ca7684d4..8353a538cd4c 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -141,14 +141,14 @@ static int tcp_write_timeout(struct sock *sk)
 
         if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
                 if (icsk->icsk_retransmits)
-                        dst_negative_advice(&sk->sk_dst_cache);
+                        dst_negative_advice(&sk->sk_dst_cache, sk);
                 retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
         } else {
                 if (retransmits_timed_out(sk, sysctl_tcp_retries1)) {
                         /* Black hole detection */
                         tcp_mtu_probing(icsk, sk);
 
-                        dst_negative_advice(&sk->sk_dst_cache);
+                        dst_negative_advice(&sk->sk_dst_cache, sk);
                 }
 
                 retry_until = sysctl_tcp_retries2;
@@ -303,15 +303,15 @@ void tcp_retransmit_timer(struct sock *sk)
                 struct inet_sock *inet = inet_sk(sk);
                 if (sk->sk_family == AF_INET) {
                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: Peer %pI4:%u/%u unexpectedly shrunk window %u:%u (repaired)\n",
-                               &inet->daddr, ntohs(inet->dport),
-                               inet->num, tp->snd_una, tp->snd_nxt);
+                               &inet->inet_daddr, ntohs(inet->inet_dport),
+                               inet->inet_num, tp->snd_una, tp->snd_nxt);
                 }
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                 else if (sk->sk_family == AF_INET6) {
                         struct ipv6_pinfo *np = inet6_sk(sk);
                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: Peer %pI6:%u/%u unexpectedly shrunk window %u:%u (repaired)\n",
-                               &np->daddr, ntohs(inet->dport),
-                               inet->num, tp->snd_una, tp->snd_nxt);
+                               &np->daddr, ntohs(inet->inet_dport),
+                               inet->inet_num, tp->snd_una, tp->snd_nxt);
                 }
 #endif
 #endif
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index d0d436d6216c..4274c1cc78fd 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -106,7 +106,7 @@
 #include <net/xfrm.h>
 #include "udp_impl.h"
 
-struct udp_table udp_table;
+struct udp_table udp_table __read_mostly;
 EXPORT_SYMBOL(udp_table);
 
 int sysctl_udp_mem[3] __read_mostly;
@@ -121,14 +121,16 @@ EXPORT_SYMBOL(sysctl_udp_wmem_min);
 atomic_t udp_memory_allocated;
 EXPORT_SYMBOL(udp_memory_allocated);
 
-#define PORTS_PER_CHAIN (65536 / UDP_HTABLE_SIZE)
+#define MAX_UDP_PORTS 65536
+#define PORTS_PER_CHAIN (MAX_UDP_PORTS / UDP_HTABLE_SIZE_MIN)
 
 static int udp_lib_lport_inuse(struct net *net, __u16 num,
                                const struct udp_hslot *hslot,
                                unsigned long *bitmap,
                                struct sock *sk,
                                int (*saddr_comp)(const struct sock *sk1,
-                                                 const struct sock *sk2))
+                                                 const struct sock *sk2),
+                               unsigned int log)
 {
         struct sock *sk2;
         struct hlist_nulls_node *node;
@@ -142,8 +144,7 @@ static int udp_lib_lport_inuse(struct net *net, __u16 num,
                         || sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
                     (*saddr_comp)(sk, sk2)) {
                         if (bitmap)
-                                __set_bit(sk2->sk_hash / UDP_HTABLE_SIZE,
-                                          bitmap);
+                                __set_bit(sk2->sk_hash >> log, bitmap);
                         else
                                 return 1;
                 }
@@ -180,13 +181,15 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                 /*
                  * force rand to be an odd multiple of UDP_HTABLE_SIZE
                  */
-                rand = (rand | 1) * UDP_HTABLE_SIZE;
-                for (last = first + UDP_HTABLE_SIZE; first != last; first++) {
-                        hslot = &udptable->hash[udp_hashfn(net, first)];
+                rand = (rand | 1) * (udptable->mask + 1);
+                for (last = first + udptable->mask + 1;
+                     first != last;
+                     first++) {
+                        hslot = udp_hashslot(udptable, net, first);
                         bitmap_zero(bitmap, PORTS_PER_CHAIN);
                         spin_lock_bh(&hslot->lock);
                         udp_lib_lport_inuse(net, snum, hslot, bitmap, sk,
-                                            saddr_comp);
+                                            saddr_comp, udptable->log);
 
                         snum = first;
                         /*
@@ -196,7 +199,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                          */
                         do {
                                 if (low <= snum && snum <= high &&
-                                    !test_bit(snum / UDP_HTABLE_SIZE, bitmap))
+                                    !test_bit(snum >> udptable->log, bitmap))
                                         goto found;
                                 snum += rand;
                         } while (snum != first);
@@ -204,13 +207,14 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                 }
                 goto fail;
         } else {
-                hslot = &udptable->hash[udp_hashfn(net, snum)];
+                hslot = udp_hashslot(udptable, net, snum);
                 spin_lock_bh(&hslot->lock);
-                if (udp_lib_lport_inuse(net, snum, hslot, NULL, sk, saddr_comp))
+                if (udp_lib_lport_inuse(net, snum, hslot, NULL, sk,
+                                        saddr_comp, 0))
                         goto fail_unlock;
         }
 found:
-        inet_sk(sk)->num = snum;
+        inet_sk(sk)->inet_num = snum;
         sk->sk_hash = snum;
         if (sk_unhashed(sk)) {
                 sk_nulls_add_node_rcu(sk, &hslot->head);
@@ -229,8 +233,8 @@ static int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
         struct inet_sock *inet1 = inet_sk(sk1), *inet2 = inet_sk(sk2);
 
         return  (!ipv6_only_sock(sk2)  &&
-                 (!inet1->rcv_saddr || !inet2->rcv_saddr ||
-                   inet1->rcv_saddr == inet2->rcv_saddr));
+                 (!inet1->inet_rcv_saddr || !inet2->inet_rcv_saddr ||
+                   inet1->inet_rcv_saddr == inet2->inet_rcv_saddr));
 }
 
 int udp_v4_get_port(struct sock *sk, unsigned short snum)
@@ -249,18 +253,18 @@ static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
                 struct inet_sock *inet = inet_sk(sk);
 
                 score = (sk->sk_family == PF_INET ? 1 : 0);
-                if (inet->rcv_saddr) {
-                        if (inet->rcv_saddr != daddr)
+                if (inet->inet_rcv_saddr) {
+                        if (inet->inet_rcv_saddr != daddr)
                                 return -1;
                         score += 2;
                 }
-                if (inet->daddr) {
-                        if (inet->daddr != saddr)
+                if (inet->inet_daddr) {
+                        if (inet->inet_daddr != saddr)
                                 return -1;
                         score += 2;
                 }
-                if (inet->dport) {
-                        if (inet->dport != sport)
+                if (inet->inet_dport) {
+                        if (inet->inet_dport != sport)
                                 return -1;
                         score += 2;
                 }
@@ -283,7 +287,7 @@ static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
         struct sock *sk, *result;
         struct hlist_nulls_node *node;
         unsigned short hnum = ntohs(dport);
-        unsigned int hash = udp_hashfn(net, hnum);
+        unsigned int hash = udp_hashfn(net, hnum, udptable->mask);
         struct udp_hslot *hslot = &udptable->hash[hash];
         int score, badness;
 
@@ -356,9 +360,10 @@ static inline struct sock *udp_v4_mcast_next(struct net *net, struct sock *sk,
 
                 if (!net_eq(sock_net(s), net)                           ||
                     s->sk_hash != hnum                                  ||
-                    (inet->daddr && inet->daddr != rmt_addr)            ||
-                    (inet->dport != rmt_port && inet->dport)            ||
-                    (inet->rcv_saddr && inet->rcv_saddr != loc_addr)    ||
+                    (inet->inet_daddr && inet->inet_daddr != rmt_addr)  ||
+                    (inet->inet_dport != rmt_port && inet->inet_dport)  ||
+                    (inet->inet_rcv_saddr       &&
+                     inet->inet_rcv_saddr != loc_addr)                  ||
                     ipv6_only_sock(s)                                   ||
                     (s->sk_bound_dev_if && s->sk_bound_dev_if != dif))
                         continue;
@@ -642,14 +647,14 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         } else {
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -EDESTADDRREQ;
-                daddr = inet->daddr;
-                dport = inet->dport;
+                daddr = inet->inet_daddr;
+                dport = inet->inet_dport;
                 /* Open fast path for connected socket.
                    Route will not be used, if at least one option is set.
                  */
                 connected = 1;
         }
-        ipc.addr = inet->saddr;
+        ipc.addr = inet->inet_saddr;
 
         ipc.oif = sk->sk_bound_dev_if;
         err = sock_tx_timestamp(msg, sk, &ipc.shtx);
@@ -704,7 +709,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                     .proto = sk->sk_protocol,
                                     .flags = inet_sk_flowi_flags(sk),
                                     .uli_u = { .ports =
-                                               { .sport = inet->sport,
+                                               { .sport = inet->inet_sport,
                                                  .dport = dport } } };
                 struct net *net = sock_net(sk);
 
@@ -748,7 +753,7 @@ back_from_confirm:
         inet->cork.fl.fl4_dst = daddr;
         inet->cork.fl.fl_ip_dport = dport;
         inet->cork.fl.fl4_src = saddr;
-        inet->cork.fl.fl_ip_sport = inet->sport;
+        inet->cork.fl.fl_ip_sport = inet->inet_sport;
         up->pending = AF_INET;
 
 do_append_data:
@@ -862,6 +867,7 @@ static unsigned int first_packet_length(struct sock *sk)
                 udp_lib_checksum_complete(skb)) {
                 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
                                  IS_UDPLITE(sk));
+                atomic_inc(&sk->sk_drops);
                 __skb_unlink(skb, rcvq);
                 __skb_queue_tail(&list_kill, skb);
         }
@@ -982,7 +988,7 @@ try_again:
                 UDP_INC_STATS_USER(sock_net(sk),
                                 UDP_MIB_INDATAGRAMS, is_udplite);
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         /* Copy the address. */
         if (sin) {
@@ -1025,15 +1031,15 @@ int udp_disconnect(struct sock *sk, int flags)
          */
 
         sk->sk_state = TCP_CLOSE;
-        inet->daddr = 0;
-        inet->dport = 0;
+        inet->inet_daddr = 0;
+        inet->inet_dport = 0;
         sk->sk_bound_dev_if = 0;
         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
                 inet_reset_saddr(sk);
 
         if (!(sk->sk_userlocks & SOCK_BINDPORT_LOCK)) {
                 sk->sk_prot->unhash(sk);
-                inet->sport = 0;
+                inet->inet_sport = 0;
         }
         sk_dst_reset(sk);
         return 0;
@@ -1044,12 +1050,12 @@ void udp_lib_unhash(struct sock *sk)
 {
         if (sk_hashed(sk)) {
                 struct udp_table *udptable = sk->sk_prot->h.udp_table;
-                unsigned int hash = udp_hashfn(sock_net(sk), sk->sk_hash);
-                struct udp_hslot *hslot = &udptable->hash[hash];
+                struct udp_hslot *hslot = udp_hashslot(udptable, sock_net(sk),
+                                                     sk->sk_hash);
 
                 spin_lock_bh(&hslot->lock);
                 if (sk_nulls_del_node_init_rcu(sk)) {
-                        inet_sk(sk)->num = 0;
+                        inet_sk(sk)->inet_num = 0;
                         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
                 }
                 spin_unlock_bh(&hslot->lock);
@@ -1059,25 +1065,22 @@ EXPORT_SYMBOL(udp_lib_unhash);
 
 static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
-        int is_udplite = IS_UDPLITE(sk);
-        int rc;
+        int rc = sock_queue_rcv_skb(sk, skb);
+
+        if (rc < 0) {
+                int is_udplite = IS_UDPLITE(sk);
 
-        if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
                 /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM) {
+                if (rc == -ENOMEM)
                         UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
                                          is_udplite);
-                        atomic_inc(&sk->sk_drops);
-                }
-                goto drop;
+                UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+                kfree_skb(skb);
+                return -1;
         }
 
         return 0;
 
-drop:
-        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
-        kfree_skb(skb);
-        return -1;
 }
 
 /* returns:
@@ -1184,6 +1187,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
 drop:
         UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+        atomic_inc(&sk->sk_drops);
         kfree_skb(skb);
         return -1;
 }
@@ -1200,7 +1204,7 @@ static int __udp4_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                                     struct udp_table *udptable)
 {
         struct sock *sk;
-        struct udp_hslot *hslot = &udptable->hash[udp_hashfn(net, ntohs(uh->dest))];
+        struct udp_hslot *hslot = udp_hashslot(udptable, net, ntohs(uh->dest));
         int dif;
 
         spin_lock(&hslot->lock);
@@ -1622,9 +1626,14 @@ static struct sock *udp_get_first(struct seq_file *seq, int start)
         struct udp_iter_state *state = seq->private;
         struct net *net = seq_file_net(seq);
 
-        for (state->bucket = start; state->bucket < UDP_HTABLE_SIZE; ++state->bucket) {
+        for (state->bucket = start; state->bucket <= state->udp_table->mask;
+             ++state->bucket) {
                 struct hlist_nulls_node *node;
                 struct udp_hslot *hslot = &state->udp_table->hash[state->bucket];
+
+                if (hlist_nulls_empty(&hslot->head))
+                        continue;
+
                 spin_lock_bh(&hslot->lock);
                 sk_nulls_for_each(sk, node, &hslot->head) {
                         if (!net_eq(sock_net(sk), net))
@@ -1649,7 +1658,7 @@ static struct sock *udp_get_next(struct seq_file *seq, struct sock *sk)
         } while (sk && (!net_eq(sock_net(sk), net) || sk->sk_family != state->family));
 
         if (!sk) {
-                if (state->bucket < UDP_HTABLE_SIZE)
+                if (state->bucket <= state->udp_table->mask)
                         spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
                 return udp_get_first(seq, state->bucket + 1);
         }
@@ -1669,7 +1678,7 @@ static struct sock *udp_get_idx(struct seq_file *seq, loff_t pos)
 static void *udp_seq_start(struct seq_file *seq, loff_t *pos)
 {
         struct udp_iter_state *state = seq->private;
-        state->bucket = UDP_HTABLE_SIZE;
+        state->bucket = MAX_UDP_PORTS;
 
         return *pos ? udp_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
 }
@@ -1691,7 +1700,7 @@ static void udp_seq_stop(struct seq_file *seq, void *v)
 {
         struct udp_iter_state *state = seq->private;
 
-        if (state->bucket < UDP_HTABLE_SIZE)
+        if (state->bucket <= state->udp_table->mask)
                 spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
 }
 
@@ -1746,12 +1755,12 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
                 int bucket, int *len)
 {
         struct inet_sock *inet = inet_sk(sp);
-        __be32 dest = inet->daddr;
-        __be32 src  = inet->rcv_saddr;
-        __u16 destp       = ntohs(inet->dport);
-        __u16 srcp        = ntohs(inet->sport);
+        __be32 dest = inet->inet_daddr;
+        __be32 src  = inet->inet_rcv_saddr;
+        __u16 destp       = ntohs(inet->inet_dport);
+        __u16 srcp        = ntohs(inet->inet_sport);
 
-        seq_printf(f, "%4d: %08X:%04X %08X:%04X"
+        seq_printf(f, "%5d: %08X:%04X %08X:%04X"
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d%n",
                 bucket, src, srcp, dest, destp, sp->sk_state,
                 sk_wmem_alloc_get(sp),
@@ -1817,11 +1826,43 @@ void udp4_proc_exit(void)
 }
 #endif /* CONFIG_PROC_FS */
 
-void __init udp_table_init(struct udp_table *table)
+static __initdata unsigned long uhash_entries;
+static int __init set_uhash_entries(char *str)
 {
-        int i;
+        if (!str)
+                return 0;
+        uhash_entries = simple_strtoul(str, &str, 0);
+        if (uhash_entries && uhash_entries < UDP_HTABLE_SIZE_MIN)
+                uhash_entries = UDP_HTABLE_SIZE_MIN;
+        return 1;
+}
+__setup("uhash_entries=", set_uhash_entries);
 
-        for (i = 0; i < UDP_HTABLE_SIZE; i++) {
+void __init udp_table_init(struct udp_table *table, const char *name)
+{
+        unsigned int i;
+
+        if (!CONFIG_BASE_SMALL)
+                table->hash = alloc_large_system_hash(name,
+                        sizeof(struct udp_hslot),
+                        uhash_entries,
+                        21, /* one slot per 2 MB */
+                        0,
+                        &table->log,
+                        &table->mask,
+                        64 * 1024);
+        /*
+         * Make sure hash table has the minimum size
+         */
+        if (CONFIG_BASE_SMALL || table->mask < UDP_HTABLE_SIZE_MIN - 1) {
+                table->hash = kmalloc(UDP_HTABLE_SIZE_MIN *
+                                      sizeof(struct udp_hslot), GFP_KERNEL);
+                if (!table->hash)
+                        panic(name);
+                table->log = ilog2(UDP_HTABLE_SIZE_MIN);
+                table->mask = UDP_HTABLE_SIZE_MIN - 1;
+        }
+        for (i = 0; i <= table->mask; i++) {
                 INIT_HLIST_NULLS_HEAD(&table->hash[i].head, i);
                 spin_lock_init(&table->hash[i].lock);
         }
@@ -1831,7 +1872,7 @@ void __init udp_init(void)
 {
         unsigned long nr_pages, limit;
 
-        udp_table_init(&udp_table);
+        udp_table_init(&udp_table, "UDP");
         /* Set the pressure threshold up by the same strategy of TCP. It is a
          * fraction of global memory that is up to 1/2 at 256 MB, decreasing
          * toward zero with the amount of memory, with a floor of 128 pages.
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index 95248d7f75ec..470c504b9554 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -12,7 +12,7 @@
  */
 #include "udp_impl.h"
 
-struct udp_table        udplite_table;
+struct udp_table        udplite_table __read_mostly;
 EXPORT_SYMBOL(udplite_table);
 
 static int udplite_rcv(struct sk_buff *skb)
@@ -110,7 +110,7 @@ static inline int udplite4_proc_init(void)
 
 void __init udplite4_register(void)
 {
-        udp_table_init(&udplite_table);
+        udp_table_init(&udplite_table, "UDP-Lite");
         if (proto_register(&udplite_prot, 1))
                 goto out_register_err;
 
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index ead6c7a42f44..a578096152ab 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -170,6 +170,25 @@ config IPV6_SIT
 
           Saying M here will produce a module called sit. If unsure, say Y.
 
+config IPV6_SIT_6RD
+        bool "IPv6: IPv6 Rapid Deployment (6RD) (EXPERIMENTAL)"
+        depends on IPV6_SIT && EXPERIMENTAL
+        default n
+        ---help---
+          IPv6 Rapid Deployment (6rd; draft-ietf-softwire-ipv6-6rd) builds upon
+          mechanisms of 6to4 (RFC3056) to enable a service provider to rapidly
+          deploy IPv6 unicast service to IPv4 sites to which it provides
+          customer premise equipment.  Like 6to4, it utilizes stateless IPv6 in
+          IPv4 encapsulation in order to transit IPv4-only network
+          infrastructure.  Unlike 6to4, a 6rd service provider uses an IPv6
+          prefix of its own in place of the fixed 6to4 prefix.
+
+          With this option enabled, the SIT driver offers 6rd functionality by
+          providing additional ioctl API to configure the IPv6 Prefix for in
+          stead of static 2002::/16 for 6to4.
+
+          If unsure, say N.
+
 config IPV6_NDISC_NODETYPE
         bool
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 1fd0a3d775d2..918648409612 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3708,6 +3708,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 #endif
         array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6;
         array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad;
+        array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
 }
 
 static inline size_t inet6_if_nlmsg_size(void)
@@ -4353,6 +4354,14 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       proc_dointvec,
                 },
                 {
+                        .ctl_name       = CTL_UNNUMBERED,
+                        .procname       = "force_tllao",
+                        .data           = &ipv6_devconf.force_tllao,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = proc_dointvec
+                },
+                {
                         .ctl_name       =       0,      /* sentinel */
                 }
         },
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index e127a32f9540..b6d058818673 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -185,7 +185,7 @@ lookup_protocol:
         inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
 
         if (SOCK_RAW == sock->type) {
-                inet->num = protocol;
+                inet->inet_num = protocol;
                 if (IPPROTO_RAW == protocol)
                         inet->hdrincl = 1;
         }
@@ -228,12 +228,12 @@ lookup_protocol:
          */
         sk_refcnt_debug_inc(sk);
 
-        if (inet->num) {
+        if (inet->inet_num) {
                 /* It assumes that any protocol which allows
                  * the user to assign a number at socket
                  * creation time automatically shares.
                  */
-                inet->sport = htons(inet->num);
+                inet->inet_sport = htons(inet->inet_num);
                 sk->sk_prot->hash(sk);
         }
         if (sk->sk_prot->init) {
@@ -281,7 +281,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         lock_sock(sk);
 
         /* Check these errors (active socket, double bind). */
-        if (sk->sk_state != TCP_CLOSE || inet->num) {
+        if (sk->sk_state != TCP_CLOSE || inet->inet_num) {
                 err = -EINVAL;
                 goto out;
         }
@@ -353,8 +353,8 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 }
         }
 
-        inet->rcv_saddr = v4addr;
-        inet->saddr = v4addr;
+        inet->inet_rcv_saddr = v4addr;
+        inet->inet_saddr = v4addr;
 
         ipv6_addr_copy(&np->rcv_saddr, &addr->sin6_addr);
 
@@ -375,9 +375,9 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         }
         if (snum)
                 sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
-        inet->sport = htons(inet->num);
-        inet->dport = 0;
-        inet->daddr = 0;
+        inet->inet_sport = htons(inet->inet_num);
+        inet->inet_dport = 0;
+        inet->inet_daddr = 0;
 out:
         release_sock(sk);
         return err;
@@ -441,12 +441,12 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
         sin->sin6_flowinfo = 0;
         sin->sin6_scope_id = 0;
         if (peer) {
-                if (!inet->dport)
+                if (!inet->inet_dport)
                         return -ENOTCONN;
                 if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT)) &&
                     peer == 1)
                         return -ENOTCONN;
-                sin->sin6_port = inet->dport;
+                sin->sin6_port = inet->inet_dport;
                 ipv6_addr_copy(&sin->sin6_addr, &np->daddr);
                 if (np->sndflow)
                         sin->sin6_flowinfo = np->flow_label;
@@ -456,7 +456,7 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
                 else
                         ipv6_addr_copy(&sin->sin6_addr, &np->rcv_saddr);
 
-                sin->sin6_port = inet->sport;
+                sin->sin6_port = inet->inet_sport;
         }
         if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                 sin->sin6_scope_id = sk->sk_bound_dev_if;
@@ -552,7 +552,7 @@ const struct proto_ops inet6_dgram_ops = {
 #endif
 };
 
-static struct net_proto_family inet6_family_ops = {
+static const struct net_proto_family inet6_family_ops = {
         .family = PF_INET6,
         .create = inet6_create,
         .owner  = THIS_MODULE,
@@ -654,8 +654,9 @@ int inet6_sk_rebuild_header(struct sock *sk)
                 ipv6_addr_copy(&fl.fl6_src, &np->saddr);
                 fl.fl6_flowlabel = np->flow_label;
                 fl.oif = sk->sk_bound_dev_if;
-                fl.fl_ip_dport = inet->dport;
-                fl.fl_ip_sport = inet->sport;
+                fl.mark = sk->sk_mark;
+                fl.fl_ip_dport = inet->inet_dport;
+                fl.fl_ip_sport = inet->inet_sport;
                 security_sk_classify_flow(sk, &fl);
 
                 if (np->opt && np->opt->srcrt) {
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index c1589e2f1dc9..0f526f8ea518 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -24,18 +24,92 @@
  *      This file is derived from net/ipv4/ah.c.
  */
 
+#include <crypto/hash.h>
 #include <linux/module.h>
 #include <net/ip.h>
 #include <net/ah.h>
 #include <linux/crypto.h>
 #include <linux/pfkeyv2.h>
-#include <linux/spinlock.h>
 #include <linux/string.h>
+#include <linux/scatterlist.h>
 #include <net/icmp.h>
 #include <net/ipv6.h>
 #include <net/protocol.h>
 #include <net/xfrm.h>
 
+#define IPV6HDR_BASELEN 8
+
+struct tmp_ext {
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
+                struct in6_addr saddr;
+#endif
+                struct in6_addr daddr;
+                char hdrs[0];
+};
+
+struct ah_skb_cb {
+        struct xfrm_skb_cb xfrm;
+        void *tmp;
+};
+
+#define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+
+static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+                          unsigned int size)
+{
+        unsigned int len;
+
+        len = size + crypto_ahash_digestsize(ahash) +
+              (crypto_ahash_alignmask(ahash) &
+               ~(crypto_tfm_ctx_alignment() - 1));
+
+        len = ALIGN(len, crypto_tfm_ctx_alignment());
+
+        len += sizeof(struct ahash_request) + crypto_ahash_reqsize(ahash);
+        len = ALIGN(len, __alignof__(struct scatterlist));
+
+        len += sizeof(struct scatterlist) * nfrags;
+
+        return kmalloc(len, GFP_ATOMIC);
+}
+
+static inline struct tmp_ext *ah_tmp_ext(void *base)
+{
+        return base + IPV6HDR_BASELEN;
+}
+
+static inline u8 *ah_tmp_auth(u8 *tmp, unsigned int offset)
+{
+        return tmp + offset;
+}
+
+static inline u8 *ah_tmp_icv(struct crypto_ahash *ahash, void *tmp,
+                             unsigned int offset)
+{
+        return PTR_ALIGN((u8 *)tmp + offset, crypto_ahash_alignmask(ahash) + 1);
+}
+
+static inline struct ahash_request *ah_tmp_req(struct crypto_ahash *ahash,
+                                               u8 *icv)
+{
+        struct ahash_request *req;
+
+        req = (void *)PTR_ALIGN(icv + crypto_ahash_digestsize(ahash),
+                                crypto_tfm_ctx_alignment());
+
+        ahash_request_set_tfm(req, ahash);
+
+        return req;
+}
+
+static inline struct scatterlist *ah_req_sg(struct crypto_ahash *ahash,
+                                             struct ahash_request *req)
+{
+        return (void *)ALIGN((unsigned long)(req + 1) +
+                             crypto_ahash_reqsize(ahash),
+                             __alignof__(struct scatterlist));
+}
+
 static int zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
 {
         u8 *opt = (u8 *)opthdr;
@@ -218,24 +292,85 @@ static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
         return 0;
 }
 
+static void ah6_output_done(struct crypto_async_request *base, int err)
+{
+        int extlen;
+        u8 *iph_base;
+        u8 *icv;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = skb_dst(skb)->xfrm;
+        struct ah_data *ahp = x->data;
+        struct ipv6hdr *top_iph = ipv6_hdr(skb);
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        struct tmp_ext *iph_ext;
+
+        extlen = skb_network_header_len(skb) - sizeof(struct ipv6hdr);
+        if (extlen)
+                extlen += sizeof(*iph_ext);
+
+        iph_base = AH_SKB_CB(skb)->tmp;
+        iph_ext = ah_tmp_ext(iph_base);
+        icv = ah_tmp_icv(ahp->ahash, iph_ext, extlen);
+
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+        memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+
+        if (extlen) {
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
+                memcpy(&top_iph->saddr, iph_ext, extlen);
+#else
+                memcpy(&top_iph->daddr, iph_ext, extlen);
+#endif
+        }
+
+        err = ah->nexthdr;
+
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_output_resume(skb, err);
+}
+
 static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
+        int nfrags;
         int extlen;
+        u8 *iph_base;
+        u8 *icv;
+        u8 nexthdr;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
         struct ipv6hdr *top_iph;
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
-        u8 nexthdr;
-        char tmp_base[8];
-        struct {
-#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
-                struct in6_addr saddr;
-#endif
-                struct in6_addr daddr;
-                char hdrs[0];
-        } *tmp_ext;
+        struct tmp_ext *iph_ext;
+
+        ahp = x->data;
+        ahash = ahp->ahash;
+
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
 
         skb_push(skb, -skb_network_offset(skb));
+        extlen = skb_network_header_len(skb) - sizeof(struct ipv6hdr);
+        if (extlen)
+                extlen += sizeof(*iph_ext);
+
+        err = -ENOMEM;
+        iph_base = ah_alloc_tmp(ahash, nfrags, IPV6HDR_BASELEN + extlen);
+        if (!iph_base)
+                goto out;
+
+        iph_ext = ah_tmp_ext(iph_base);
+        icv = ah_tmp_icv(ahash, iph_ext, extlen);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
+
+        ah = ip_auth_hdr(skb);
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
+
         top_iph = ipv6_hdr(skb);
         top_iph->payload_len = htons(skb->len - sizeof(*top_iph));
 
@@ -245,31 +380,22 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         /* When there are no extension headers, we only need to save the first
          * 8 bytes of the base IP header.
          */
-        memcpy(tmp_base, top_iph, sizeof(tmp_base));
+        memcpy(iph_base, top_iph, IPV6HDR_BASELEN);
 
-        tmp_ext = NULL;
-        extlen = skb_transport_offset(skb) - sizeof(struct ipv6hdr);
         if (extlen) {
-                extlen += sizeof(*tmp_ext);
-                tmp_ext = kmalloc(extlen, GFP_ATOMIC);
-                if (!tmp_ext) {
-                        err = -ENOMEM;
-                        goto error;
-                }
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
-                memcpy(tmp_ext, &top_iph->saddr, extlen);
+                memcpy(iph_ext, &top_iph->saddr, extlen);
 #else
-                memcpy(tmp_ext, &top_iph->daddr, extlen);
+                memcpy(iph_ext, &top_iph->daddr, extlen);
 #endif
                 err = ipv6_clear_mutable_options(top_iph,
-                                                 extlen - sizeof(*tmp_ext) +
+                                                 extlen - sizeof(*iph_ext) +
                                                  sizeof(*top_iph),
                                                  XFRM_POLICY_OUT);
                 if (err)
-                        goto error_free_iph;
+                        goto out_free;
         }
 
-        ah = ip_auth_hdr(skb);
         ah->nexthdr = nexthdr;
 
         top_iph->priority    = 0;
@@ -278,36 +404,80 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         top_iph->flow_lbl[2] = 0;
         top_iph->hop_limit   = 0;
 
-        ahp = x->data;
         ah->hdrlen  = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2;
 
         ah->reserved = 0;
         ah->spi = x->id.spi;
         ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output);
 
-        spin_lock_bh(&x->lock);
-        err = ah_mac_digest(ahp, skb, ah->auth_data);
-        memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len);
-        spin_unlock_bh(&x->lock);
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, 0, skb->len);
 
-        if (err)
-                goto error_free_iph;
+        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_callback(req, 0, ah6_output_done, skb);
+
+        AH_SKB_CB(skb)->tmp = iph_base;
 
-        memcpy(top_iph, tmp_base, sizeof(tmp_base));
-        if (tmp_ext) {
+        err = crypto_ahash_digest(req);
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
+        }
+
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+        memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+
+        if (extlen) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
-                memcpy(&top_iph->saddr, tmp_ext, extlen);
+                memcpy(&top_iph->saddr, iph_ext, extlen);
 #else
-                memcpy(&top_iph->daddr, tmp_ext, extlen);
+                memcpy(&top_iph->daddr, iph_ext, extlen);
 #endif
-error_free_iph:
-                kfree(tmp_ext);
         }
 
-error:
+out_free:
+        kfree(iph_base);
+out:
         return err;
 }
 
+static void ah6_input_done(struct crypto_async_request *base, int err)
+{
+        u8 *auth_data;
+        u8 *icv;
+        u8 *work_iph;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = xfrm_input_state(skb);
+        struct ah_data *ahp = x->data;
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        int hdr_len = skb_network_header_len(skb);
+        int ah_hlen = (ah->hdrlen + 2) << 2;
+
+        work_iph = AH_SKB_CB(skb)->tmp;
+        auth_data = ah_tmp_auth(work_iph, hdr_len);
+        icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
+
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
+        if (err)
+                goto out;
+
+        skb->network_header += ah_hlen;
+        memcpy(skb_network_header(skb), work_iph, hdr_len);
+        __skb_pull(skb, ah_hlen + hdr_len);
+        skb_set_transport_header(skb, -hdr_len);
+
+        err = ah->nexthdr;
+out:
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_input_resume(skb, err);
+}
+
+
+
 static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         /*
@@ -325,14 +495,21 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
          * There is offset of AH before IPv6 header after the process.
          */
 
+        u8 *auth_data;
+        u8 *icv;
+        u8 *work_iph;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
         struct ip_auth_hdr *ah;
         struct ipv6hdr *ip6h;
         struct ah_data *ahp;
-        unsigned char *tmp_hdr = NULL;
         u16 hdr_len;
         u16 ah_hlen;
         int nexthdr;
-        int err = -EINVAL;
+        int nfrags;
+        int err = -ENOMEM;
 
         if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr)))
                 goto out;
@@ -345,9 +522,11 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb->ip_summed = CHECKSUM_NONE;
 
-        hdr_len = skb->data - skb_network_header(skb);
+        hdr_len = skb_network_header_len(skb);
         ah = (struct ip_auth_hdr *)skb->data;
         ahp = x->data;
+        ahash = ahp->ahash;
+
         nexthdr = ah->nexthdr;
         ah_hlen = (ah->hdrlen + 2) << 2;
 
@@ -358,48 +537,67 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!pskb_may_pull(skb, ah_hlen))
                 goto out;
 
-        tmp_hdr = kmemdup(skb_network_header(skb), hdr_len, GFP_ATOMIC);
-        if (!tmp_hdr)
-                goto out;
         ip6h = ipv6_hdr(skb);
+
+        skb_push(skb, hdr_len);
+
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
+
+        work_iph = ah_alloc_tmp(ahash, nfrags, hdr_len + ahp->icv_trunc_len);
+        if (!work_iph)
+                goto out;
+
+        auth_data = ah_tmp_auth(work_iph, hdr_len);
+        icv = ah_tmp_icv(ahash, auth_data, ahp->icv_trunc_len);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
+
+        memcpy(work_iph, ip6h, hdr_len);
+        memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
+
         if (ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN))
-                goto free_out;
+                goto out_free;
+
         ip6h->priority    = 0;
         ip6h->flow_lbl[0] = 0;
         ip6h->flow_lbl[1] = 0;
         ip6h->flow_lbl[2] = 0;
         ip6h->hop_limit   = 0;
 
-        spin_lock(&x->lock);
-        {
-                u8 auth_data[MAX_AH_AUTH_LEN];
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, 0, skb->len);
 
-                memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
-                memset(ah->auth_data, 0, ahp->icv_trunc_len);
-                skb_push(skb, hdr_len);
-                err = ah_mac_digest(ahp, skb, ah->auth_data);
-                if (err)
-                        goto unlock;
-                if (memcmp(ahp->work_icv, auth_data, ahp->icv_trunc_len))
-                        err = -EBADMSG;
+        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_callback(req, 0, ah6_input_done, skb);
+
+        AH_SKB_CB(skb)->tmp = work_iph;
+
+        err = crypto_ahash_digest(req);
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
         }
-unlock:
-        spin_unlock(&x->lock);
 
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
         if (err)
-                goto free_out;
+                goto out_free;
 
         skb->network_header += ah_hlen;
-        memcpy(skb_network_header(skb), tmp_hdr, hdr_len);
+        memcpy(skb_network_header(skb), work_iph, hdr_len);
         skb->transport_header = skb->network_header;
         __skb_pull(skb, ah_hlen + hdr_len);
 
-        kfree(tmp_hdr);
+        err = nexthdr;
 
-        return nexthdr;
-
-free_out:
-        kfree(tmp_hdr);
+out_free:
+        kfree(work_iph);
 out:
         return err;
 }
@@ -430,7 +628,7 @@ static int ah6_init_state(struct xfrm_state *x)
 {
         struct ah_data *ahp = NULL;
         struct xfrm_algo_desc *aalg_desc;
-        struct crypto_hash *tfm;
+        struct crypto_ahash *ahash;
 
         if (!x->aalg)
                 goto error;
@@ -442,12 +640,12 @@ static int ah6_init_state(struct xfrm_state *x)
         if (ahp == NULL)
                 return -ENOMEM;
 
-        tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(tfm))
+        ahash = crypto_alloc_ahash(x->aalg->alg_name, 0, 0);
+        if (IS_ERR(ahash))
                 goto error;
 
-        ahp->tfm = tfm;
-        if (crypto_hash_setkey(tfm, x->aalg->alg_key,
+        ahp->ahash = ahash;
+        if (crypto_ahash_setkey(ahash, x->aalg->alg_key,
                                (x->aalg->alg_key_len + 7) / 8))
                 goto error;
 
@@ -461,9 +659,9 @@ static int ah6_init_state(struct xfrm_state *x)
         BUG_ON(!aalg_desc);
 
         if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
-            crypto_hash_digestsize(tfm)) {
+            crypto_ahash_digestsize(ahash)) {
                 printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
-                       x->aalg->alg_name, crypto_hash_digestsize(tfm),
+                       x->aalg->alg_name, crypto_ahash_digestsize(ahash),
                        aalg_desc->uinfo.auth.icv_fullbits/8);
                 goto error;
         }
@@ -473,10 +671,6 @@ static int ah6_init_state(struct xfrm_state *x)
 
         BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
 
-        ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
-        if (!ahp->work_icv)
-                goto error;
-
         x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) +
                                           ahp->icv_trunc_len);
         switch (x->props.mode) {
@@ -495,8 +689,7 @@ static int ah6_init_state(struct xfrm_state *x)
 
 error:
         if (ahp) {
-                kfree(ahp->work_icv);
-                crypto_free_hash(ahp->tfm);
+                crypto_free_ahash(ahp->ahash);
                 kfree(ahp);
         }
         return -EINVAL;
@@ -509,8 +702,7 @@ static void ah6_destroy(struct xfrm_state *x)
         if (!ahp)
                 return;
 
-        kfree(ahp->work_icv);
-        crypto_free_hash(ahp->tfm);
+        crypto_free_ahash(ahp->ahash);
         kfree(ahp);
 }
 
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index e2bdc6d83a43..9f70452a69e7 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -98,17 +98,15 @@ ipv4_connected:
                 if (err)
                         goto out;
 
-                ipv6_addr_set(&np->daddr, 0, 0, htonl(0x0000ffff), inet->daddr);
+                ipv6_addr_set_v4mapped(inet->inet_daddr, &np->daddr);
 
-                if (ipv6_addr_any(&np->saddr)) {
-                        ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000ffff),
-                                      inet->saddr);
-                }
+                if (ipv6_addr_any(&np->saddr))
+                        ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
+
+                if (ipv6_addr_any(&np->rcv_saddr))
+                        ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
+                                               &np->rcv_saddr);
 
-                if (ipv6_addr_any(&np->rcv_saddr)) {
-                        ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000ffff),
-                                      inet->rcv_saddr);
-                }
                 goto out;
         }
 
@@ -136,7 +134,7 @@ ipv4_connected:
         ipv6_addr_copy(&np->daddr, daddr);
         np->flow_label = fl.fl6_flowlabel;
 
-        inet->dport = usin->sin6_port;
+        inet->inet_dport = usin->sin6_port;
 
         /*
          *      Check for a route to destination an obtain the
@@ -147,8 +145,9 @@ ipv4_connected:
         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
         fl.oif = sk->sk_bound_dev_if;
-        fl.fl_ip_dport = inet->dport;
-        fl.fl_ip_sport = inet->sport;
+        fl.mark = sk->sk_mark;
+        fl.fl_ip_dport = inet->inet_dport;
+        fl.fl_ip_sport = inet->inet_sport;
 
         if (!fl.oif && (addr_type&IPV6_ADDR_MULTICAST))
                 fl.oif = np->mcast_oif;
@@ -190,7 +189,7 @@ ipv4_connected:
 
         if (ipv6_addr_any(&np->rcv_saddr)) {
                 ipv6_addr_copy(&np->rcv_saddr, &fl.fl6_src);
-                inet->rcv_saddr = LOOPBACK4_IPV6;
+                inet->inet_rcv_saddr = LOOPBACK4_IPV6;
         }
 
         ip6_dst_store(sk, dst,
@@ -329,9 +328,8 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                         if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                                 sin->sin6_scope_id = IP6CB(skb)->iif;
                 } else {
-                        ipv6_addr_set(&sin->sin6_addr, 0, 0,
-                                      htonl(0xffff),
-                                      *(__be32 *)(nh + serr->addr_offset));
+                        ipv6_addr_set_v4mapped(*(__be32 *)(nh + serr->addr_offset),
+                                               &sin->sin6_addr);
                 }
         }
 
@@ -351,8 +349,8 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                 } else {
                         struct inet_sock *inet = inet_sk(sk);
 
-                        ipv6_addr_set(&sin->sin6_addr, 0, 0,
-                                      htonl(0xffff), ip_hdr(skb)->saddr);
+                        ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
+                                               &sin->sin6_addr);
                         if (inet->cmsg_flags)
                                 ip_cmsg_recv(msg, skb);
                 }
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index cc4797dd8325..3516e6fe2e56 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -132,7 +132,7 @@ void inet6_csk_addr2sockaddr(struct sock *sk, struct sockaddr * uaddr)
 
         sin6->sin6_family = AF_INET6;
         ipv6_addr_copy(&sin6->sin6_addr, &np->daddr);
-        sin6->sin6_port = inet_sk(sk)->dport;
+        sin6->sin6_port = inet_sk(sk)->inet_dport;
         /* We do not store received flowlabel for TCP */
         sin6->sin6_flowinfo = 0;
         sin6->sin6_scope_id = 0;
@@ -168,8 +168,7 @@ struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
         if (dst) {
                 struct rt6_info *rt = (struct rt6_info *)dst;
                 if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
-                        sk->sk_dst_cache = NULL;
-                        dst_release(dst);
+                        __sk_dst_reset(sk);
                         dst = NULL;
                 }
         }
@@ -194,8 +193,9 @@ int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
         fl.fl6_flowlabel = np->flow_label;
         IP6_ECN_flow_xmit(sk, fl.fl6_flowlabel);
         fl.oif = sk->sk_bound_dev_if;
-        fl.fl_ip_sport = inet->sport;
-        fl.fl_ip_dport = inet->dport;
+        fl.mark = sk->sk_mark;
+        fl.fl_ip_sport = inet->inet_sport;
+        fl.fl_ip_dport = inet->inet_dport;
         security_sk_classify_flow(sk, &fl);
 
         if (np->opt && np->opt->srcrt) {
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 1bcc3431859e..00c6a3e6cddf 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -73,7 +73,7 @@ struct sock *__inet6_lookup_established(struct net *net,
          * have wildcards anyways.
          */
         unsigned int hash = inet6_ehashfn(net, daddr, hnum, saddr, sport);
-        unsigned int slot = hash & (hashinfo->ehash_size - 1);
+        unsigned int slot = hash & hashinfo->ehash_mask;
         struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
 
 
@@ -125,7 +125,7 @@ static int inline compute_score(struct sock *sk, struct net *net,
 {
         int score = -1;
 
-        if (net_eq(sock_net(sk), net) && inet_sk(sk)->num == hnum &&
+        if (net_eq(sock_net(sk), net) && inet_sk(sk)->inet_num == hnum &&
             sk->sk_family == PF_INET6) {
                 const struct ipv6_pinfo *np = inet6_sk(sk);
 
@@ -214,10 +214,10 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         const struct in6_addr *daddr = &np->rcv_saddr;
         const struct in6_addr *saddr = &np->daddr;
         const int dif = sk->sk_bound_dev_if;
-        const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
+        const __portpair ports = INET_COMBINED_PORTS(inet->inet_dport, lport);
         struct net *net = sock_net(sk);
         const unsigned int hash = inet6_ehashfn(net, daddr, lport, saddr,
-                                                inet->dport);
+                                                inet->inet_dport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
         spinlock_t *lock = inet_ehash_lockp(hinfo, hash);
         struct sock *sk2;
@@ -248,8 +248,8 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
 unique:
         /* Must record num and sport now. Otherwise we will see
          * in hash table socket with a funny identity. */
-        inet->num = lport;
-        inet->sport = htons(lport);
+        inet->inet_num = lport;
+        inet->inet_sport = htons(lport);
         WARN_ON(!sk_unhashed(sk));
         __sk_nulls_add_node_rcu(sk, &head->chain);
         sk->sk_hash = hash;
@@ -279,7 +279,7 @@ static inline u32 inet6_sk_port_offset(const struct sock *sk)
         const struct ipv6_pinfo *np = inet6_sk(sk);
         return secure_ipv6_port_ephemeral(np->rcv_saddr.s6_addr32,
                                           np->daddr.s6_addr32,
-                                          inet->dport);
+                                          inet->inet_dport);
 }
 
 int inet6_hash_connect(struct inet_timewait_death_row *death_row,
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index c595bbe1ed99..6c1b5c98e818 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -88,8 +88,10 @@ struct ip6_tnl_net {
         struct ip6_tnl **tnls[2];
 };
 
-/* lock for the tunnel lists */
-static DEFINE_RWLOCK(ip6_tnl_lock);
+/*
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ip6_tnl_lock);
 
 static inline struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
 {
@@ -130,6 +132,9 @@ static inline void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
  *   else %NULL
  **/
 
+#define for_each_ip6_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
+
 static struct ip6_tnl *
 ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
 {
@@ -138,13 +143,14 @@ ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
         struct ip6_tnl *t;
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
-        for (t = ip6n->tnls_r_l[h0 ^ h1]; t; t = t->next) {
+        for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[h0 ^ h1]) {
                 if (ipv6_addr_equal(local, &t->parms.laddr) &&
                     ipv6_addr_equal(remote, &t->parms.raddr) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
-        if ((t = ip6n->tnls_wc[0]) != NULL && (t->dev->flags & IFF_UP))
+        t = rcu_dereference(ip6n->tnls_wc[0]);
+        if (t && (t->dev->flags & IFF_UP))
                 return t;
 
         return NULL;
@@ -186,10 +192,10 @@ ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 {
         struct ip6_tnl **tp = ip6_tnl_bucket(ip6n, &t->parms);
 
+        spin_lock_bh(&ip6_tnl_lock);
         t->next = *tp;
-        write_lock_bh(&ip6_tnl_lock);
-        *tp = t;
-        write_unlock_bh(&ip6_tnl_lock);
+        rcu_assign_pointer(*tp, t);
+        spin_unlock_bh(&ip6_tnl_lock);
 }
 
 /**
@@ -204,9 +210,9 @@ ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 
         for (tp = ip6_tnl_bucket(ip6n, &t->parms); *tp; tp = &(*tp)->next) {
                 if (t == *tp) {
-                        write_lock_bh(&ip6_tnl_lock);
+                        spin_lock_bh(&ip6_tnl_lock);
                         *tp = t->next;
-                        write_unlock_bh(&ip6_tnl_lock);
+                        spin_unlock_bh(&ip6_tnl_lock);
                         break;
                 }
         }
@@ -313,9 +319,9 @@ ip6_tnl_dev_uninit(struct net_device *dev)
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
         if (dev == ip6n->fb_tnl_dev) {
-                write_lock_bh(&ip6_tnl_lock);
+                spin_lock_bh(&ip6_tnl_lock);
                 ip6n->tnls_wc[0] = NULL;
-                write_unlock_bh(&ip6_tnl_lock);
+                spin_unlock_bh(&ip6_tnl_lock);
         } else {
                 ip6_tnl_unlink(ip6n, t);
         }
@@ -409,7 +415,7 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
            in trouble since we might need the source address for further
            processing of the error. */
 
-        read_lock(&ip6_tnl_lock);
+        rcu_read_lock();
         if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->daddr,
                                         &ipv6h->saddr)) == NULL)
                 goto out;
@@ -482,7 +488,7 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
         *msg = rel_msg;
 
 out:
-        read_unlock(&ip6_tnl_lock);
+        rcu_read_unlock();
         return err;
 }
 
@@ -693,23 +699,23 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
         struct ip6_tnl *t;
         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 
-        read_lock(&ip6_tnl_lock);
+        rcu_read_lock();
 
         if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->saddr,
                                         &ipv6h->daddr)) != NULL) {
                 if (t->parms.proto != ipproto && t->parms.proto != 0) {
-                        read_unlock(&ip6_tnl_lock);
+                        rcu_read_unlock();
                         goto discard;
                 }
 
                 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                        read_unlock(&ip6_tnl_lock);
+                        rcu_read_unlock();
                         goto discard;
                 }
 
                 if (!ip6_tnl_rcv_ctl(t)) {
                         t->dev->stats.rx_dropped++;
-                        read_unlock(&ip6_tnl_lock);
+                        rcu_read_unlock();
                         goto discard;
                 }
                 secpath_reset(skb);
@@ -727,10 +733,10 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                 t->dev->stats.rx_packets++;
                 t->dev->stats.rx_bytes += skb->len;
                 netif_rx(skb);
-                read_unlock(&ip6_tnl_lock);
+                rcu_read_unlock();
                 return 0;
         }
-        read_unlock(&ip6_tnl_lock);
+        rcu_read_unlock();
         return 1;
 
 discard:
@@ -1387,14 +1393,19 @@ static void ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
 {
         int h;
         struct ip6_tnl *t;
+        LIST_HEAD(list);
 
         for (h = 0; h < HASH_SIZE; h++) {
-                while ((t = ip6n->tnls_r_l[h]) != NULL)
-                        unregister_netdevice(t->dev);
+                t = ip6n->tnls_r_l[h];
+                while (t != NULL) {
+                        unregister_netdevice_queue(t->dev, &list);
+                        t = t->next;
+                }
         }
 
         t = ip6n->tnls_wc[0];
-        unregister_netdevice(t->dev);
+        unregister_netdevice_queue(t->dev, &list);
+        unregister_netdevice_many(&list);
 }
 
 static int ip6_tnl_init_net(struct net *net)
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 716153941fc4..52e0f74fdfe0 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -477,7 +477,7 @@ failure:
  *      Delete a VIF entry
  */
 
-static int mif6_delete(struct net *net, int vifi)
+static int mif6_delete(struct net *net, int vifi, struct list_head *head)
 {
         struct mif_device *v;
         struct net_device *dev;
@@ -519,7 +519,7 @@ static int mif6_delete(struct net *net, int vifi)
                 in6_dev->cnf.mc_forwarding--;
 
         if (v->flags & MIFF_REGISTER)
-                unregister_netdevice(dev);
+                unregister_netdevice_queue(dev, head);
 
         dev_put(dev);
         return 0;
@@ -976,6 +976,7 @@ static int ip6mr_device_event(struct notifier_block *this,
         struct net *net = dev_net(dev);
         struct mif_device *v;
         int ct;
+        LIST_HEAD(list);
 
         if (event != NETDEV_UNREGISTER)
                 return NOTIFY_DONE;
@@ -983,8 +984,10 @@ static int ip6mr_device_event(struct notifier_block *this,
         v = &net->ipv6.vif6_table[0];
         for (ct = 0; ct < net->ipv6.maxvif; ct++, v++) {
                 if (v->dev == dev)
-                        mif6_delete(net, ct);
+                        mif6_delete(net, ct, &list);
         }
+        unregister_netdevice_many(&list);
+
         return NOTIFY_DONE;
 }
 
@@ -1188,14 +1191,16 @@ static int ip6mr_mfc_add(struct net *net, struct mf6cctl *mfc, int mrtsock)
 static void mroute_clean_tables(struct net *net)
 {
         int i;
+        LIST_HEAD(list);
 
         /*
          *      Shut down all active vif entries
          */
         for (i = 0; i < net->ipv6.maxvif; i++) {
                 if (!(net->ipv6.vif6_table[i].flags & VIFF_STATIC))
-                        mif6_delete(net, i);
+                        mif6_delete(net, i, &list);
         }
+        unregister_netdevice_many(&list);
 
         /*
          *      Wipe the cache
@@ -1297,7 +1302,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
         switch (optname) {
         case MRT6_INIT:
                 if (sk->sk_type != SOCK_RAW ||
-                    inet_sk(sk)->num != IPPROTO_ICMPV6)
+                    inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                         return -EOPNOTSUPP;
                 if (optlen < sizeof(int))
                         return -EINVAL;
@@ -1325,7 +1330,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
                 if (copy_from_user(&mifi, optval, sizeof(mifi_t)))
                         return -EFAULT;
                 rtnl_lock();
-                ret = mif6_delete(net, mifi);
+                ret = mif6_delete(net, mifi, NULL);
                 rtnl_unlock();
                 return ret;
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 4f7aaf6996a3..430454ee5ead 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -64,7 +64,7 @@ int ip6_ra_control(struct sock *sk, int sel)
         struct ip6_ra_chain *ra, *new_ra, **rap;
 
         /* RA packet may be delivered ONLY to IPPROTO_RAW socket */
-        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->num != IPPROTO_RAW)
+        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->inet_num != IPPROTO_RAW)
                 return -ENOPROTOOPT;
 
         new_ra = (sel>=0) ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL;
@@ -106,7 +106,7 @@ struct ipv6_txoptions *ipv6_update_options(struct sock *sk,
         if (inet_sk(sk)->is_icsk) {
                 if (opt &&
                     !((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE)) &&
-                    inet_sk(sk)->daddr != LOOPBACK4_IPV6) {
+                    inet_sk(sk)->inet_daddr != LOOPBACK4_IPV6) {
                         struct inet_connection_sock *icsk = inet_csk(sk);
                         icsk->icsk_ext_hdr_len = opt->opt_flen + opt->opt_nflen;
                         icsk->icsk_sync_mss(sk, icsk->icsk_pmtu_cookie);
@@ -234,7 +234,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
 
         case IPV6_V6ONLY:
                 if (optlen < sizeof(int) ||
-                    inet_sk(sk)->num)
+                    inet_sk(sk)->inet_num)
                         goto e_inval;
                 np->ipv6only = valbool;
                 retv = 0;
@@ -424,6 +424,7 @@ sticky_done:
 
                 fl.fl6_flowlabel = 0;
                 fl.oif = sk->sk_bound_dev_if;
+                fl.mark = sk->sk_mark;
 
                 if (optlen == 0)
                         goto update;
@@ -665,7 +666,7 @@ done:
         case IPV6_MTU_DISCOVER:
                 if (optlen < sizeof(int))
                         goto e_inval;
-                if (val<0 || val>3)
+                if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)
                         goto e_inval;
                 np->pmtudisc = val;
                 retv = 0;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index f74e4e2cdd06..3507cfe1e7a2 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -598,6 +598,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
         icmp6h.icmp6_solicited = solicited;
         icmp6h.icmp6_override = override;
 
+        inc_opt |= ifp->idev->cnf.force_tllao;
         __ndisc_send(dev, neigh, daddr, src_addr,
                      &icmp6h, solicited_addr,
                      inc_opt ? ND_OPT_TARGET_LL_ADDR : 0);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 4f24570b0869..cb834ab7f071 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -72,7 +72,7 @@ static struct sock *__raw_v6_lookup(struct net *net, struct sock *sk,
         int is_multicast = ipv6_addr_is_multicast(loc_addr);
 
         sk_for_each_from(sk, node)
-                if (inet_sk(sk)->num == num) {
+                if (inet_sk(sk)->inet_num == num) {
                         struct ipv6_pinfo *np = inet6_sk(sk);
 
                         if (!net_eq(sock_net(sk), net))
@@ -298,7 +298,7 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                         dev_put(dev);
         }
 
-        inet->rcv_saddr = inet->saddr = v4addr;
+        inet->inet_rcv_saddr = inet->inet_saddr = v4addr;
         ipv6_addr_copy(&np->rcv_saddr, &addr->sin6_addr);
         if (!(addr_type & IPV6_ADDR_MULTICAST))
                 ipv6_addr_copy(&np->saddr, &addr->sin6_addr);
@@ -381,8 +381,7 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
         }
 
         /* Charge it to the socket. */
-        if (sock_queue_rcv_skb(sk,skb)<0) {
-                atomic_inc(&sk->sk_drops);
+        if (sock_queue_rcv_skb(sk, skb) < 0) {
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
@@ -416,14 +415,14 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
                                    skb_network_header_len(skb));
                 if (!csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
                                      &ipv6_hdr(skb)->daddr,
-                                     skb->len, inet->num, skb->csum))
+                                     skb->len, inet->inet_num, skb->csum))
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
         }
         if (!skb_csum_unnecessary(skb))
                 skb->csum = ~csum_unfold(csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
                                                          &ipv6_hdr(skb)->daddr,
                                                          skb->len,
-                                                         inet->num, 0));
+                                                         inet->inet_num, 0));
 
         if (inet->hdrincl) {
                 if (skb_checksum_complete(skb)) {
@@ -497,7 +496,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
                         sin6->sin6_scope_id = IP6CB(skb)->iif;
         }
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         if (np->rxopt.all)
                 datagram_recv_ctl(sk, msg, skb);
@@ -518,7 +517,6 @@ csum_copy_err:
            as some normal condition.
          */
         err = (flags&MSG_DONTWAIT) ? -EAGAIN : -EHOSTUNREACH;
-        atomic_inc(&sk->sk_drops);
         goto out;
 }
 
@@ -766,8 +764,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 proto = ntohs(sin6->sin6_port);
 
                 if (!proto)
-                        proto = inet->num;
-                else if (proto != inet->num)
+                        proto = inet->inet_num;
+                else if (proto != inet->inet_num)
                         return(-EINVAL);
 
                 if (proto > 255)
@@ -800,7 +798,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -EDESTADDRREQ;
 
-                proto = inet->num;
+                proto = inet->inet_num;
                 daddr = &np->daddr;
                 fl.fl6_flowlabel = np->flow_label;
         }
@@ -967,7 +965,7 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
 
         switch (optname) {
                 case IPV6_CHECKSUM:
-                        if (inet_sk(sk)->num == IPPROTO_ICMPV6 &&
+                        if (inet_sk(sk)->inet_num == IPPROTO_ICMPV6 &&
                             level == IPPROTO_IPV6) {
                                 /*
                                  * RFC3542 tells that IPV6_CHECKSUM socket
@@ -1007,7 +1005,7 @@ static int rawv6_setsockopt(struct sock *sk, int level, int optname,
                         break;
 
                 case SOL_ICMPV6:
-                        if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                        if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                                 return -EOPNOTSUPP;
                         return rawv6_seticmpfilter(sk, level, optname, optval,
                                                    optlen);
@@ -1030,7 +1028,7 @@ static int compat_rawv6_setsockopt(struct sock *sk, int level, int optname,
         case SOL_RAW:
                 break;
         case SOL_ICMPV6:
-                if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                         return -EOPNOTSUPP;
                 return rawv6_seticmpfilter(sk, level, optname, optval, optlen);
         case SOL_IPV6:
@@ -1087,7 +1085,7 @@ static int rawv6_getsockopt(struct sock *sk, int level, int optname,
                         break;
 
                 case SOL_ICMPV6:
-                        if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                        if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                                 return -EOPNOTSUPP;
                         return rawv6_geticmpfilter(sk, level, optname, optval,
                                                    optlen);
@@ -1110,7 +1108,7 @@ static int compat_rawv6_getsockopt(struct sock *sk, int level, int optname,
         case SOL_RAW:
                 break;
         case SOL_ICMPV6:
-                if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                         return -EOPNOTSUPP;
                 return rawv6_geticmpfilter(sk, level, optname, optval, optlen);
         case SOL_IPV6:
@@ -1157,7 +1155,7 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
 
 static void rawv6_close(struct sock *sk, long timeout)
 {
-        if (inet_sk(sk)->num == IPPROTO_RAW)
+        if (inet_sk(sk)->inet_num == IPPROTO_RAW)
                 ip6_ra_control(sk, -1);
         ip6mr_sk_done(sk);
         sk_common_release(sk);
@@ -1176,7 +1174,7 @@ static int rawv6_init_sk(struct sock *sk)
 {
         struct raw6_sock *rp = raw6_sk(sk);
 
-        switch (inet_sk(sk)->num) {
+        switch (inet_sk(sk)->inet_num) {
         case IPPROTO_ICMPV6:
                 rp->checksum = 1;
                 rp->offset   = 2;
@@ -1226,7 +1224,7 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
         dest  = &np->daddr;
         src   = &np->rcv_saddr;
         destp = 0;
-        srcp  = inet_sk(sp)->num;
+        srcp  = inet_sk(sp)->inet_num;
         seq_printf(seq,
                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d6fe7646a8ff..df9432a46ffc 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1471,9 +1471,10 @@ static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
                                 },
                         },
                 },
-                .gateway = *gateway,
         };
 
+        ipv6_addr_copy(&rdfl.gateway, gateway);
+
         if (rt6_need_strict(dest))
                 flags |= RT6_LOOKUP_F_IFACE;
 
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index dbd19a78ca73..2362a3397e91 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -77,8 +77,17 @@ struct sit_net {
         struct net_device *fb_tunnel_dev;
 };
 
-static DEFINE_RWLOCK(ipip6_lock);
+/*
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ipip6_lock);
 
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
+
+/*
+ * Must be invoked with rcu_read_lock
+ */
 static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
                 struct net_device *dev, __be32 remote, __be32 local)
 {
@@ -87,26 +96,26 @@ static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
         struct ip_tunnel *t;
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
-        for (t = sitn->tunnels_r_l[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_r_l[h0 ^ h1]) {
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr &&
                     (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
-        for (t = sitn->tunnels_r[h0]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_r[h0]) {
                 if (remote == t->parms.iph.daddr &&
                     (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
-        for (t = sitn->tunnels_l[h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_l[h1]) {
                 if (local == t->parms.iph.saddr &&
                     (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
-        t = sitn->tunnels_wc[0];
+        t = rcu_dereference(sitn->tunnels_wc[0]);
         if ((t != NULL) && (t->dev->flags & IFF_UP))
                 return t;
         return NULL;
@@ -143,9 +152,9 @@ static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
 
         for (tp = ipip6_bucket(sitn, t); *tp; tp = &(*tp)->next) {
                 if (t == *tp) {
-                        write_lock_bh(&ipip6_lock);
+                        spin_lock_bh(&ipip6_lock);
                         *tp = t->next;
-                        write_unlock_bh(&ipip6_lock);
+                        spin_unlock_bh(&ipip6_lock);
                         break;
                 }
         }
@@ -155,10 +164,27 @@ static void ipip6_tunnel_link(struct sit_net *sitn, struct ip_tunnel *t)
 {
         struct ip_tunnel **tp = ipip6_bucket(sitn, t);
 
+        spin_lock_bh(&ipip6_lock);
         t->next = *tp;
-        write_lock_bh(&ipip6_lock);
-        *tp = t;
-        write_unlock_bh(&ipip6_lock);
+        rcu_assign_pointer(*tp, t);
+        spin_unlock_bh(&ipip6_lock);
+}
+
+static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
+{
+#ifdef CONFIG_IPV6_SIT_6RD
+        struct ip_tunnel *t = netdev_priv(dev);
+
+        if (t->dev == sitn->fb_tunnel_dev) {
+                ipv6_addr_set(&t->ip6rd.prefix, htonl(0x20020000), 0, 0, 0);
+                t->ip6rd.relay_prefix = 0;
+                t->ip6rd.prefixlen = 16;
+                t->ip6rd.relay_prefixlen = 0;
+        } else {
+                struct ip_tunnel *t0 = netdev_priv(sitn->fb_tunnel_dev);
+                memcpy(&t->ip6rd, &t0->ip6rd, sizeof(t->ip6rd));
+        }
+#endif
 }
 
 static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
@@ -204,6 +230,7 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
 
         nt->parms = *parms;
         ipip6_tunnel_init(dev);
+        ipip6_tunnel_clone_6rd(dev, sitn);
 
         if (parms->i_flags & SIT_ISATAP)
                 dev->priv_flags |= IFF_ISATAP;
@@ -222,15 +249,22 @@ failed:
         return NULL;
 }
 
+static DEFINE_SPINLOCK(ipip6_prl_lock);
+
+#define for_each_prl_rcu(start)                 \
+        for (prl = rcu_dereference(start);      \
+             prl;                               \
+             prl = rcu_dereference(prl->next))
+
 static struct ip_tunnel_prl_entry *
 __ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr)
 {
-        struct ip_tunnel_prl_entry *p = (struct ip_tunnel_prl_entry *)NULL;
+        struct ip_tunnel_prl_entry *prl;
 
-        for (p = t->prl; p; p = p->next)
-                if (p->addr == addr)
+        for_each_prl_rcu(t->prl)
+                if (prl->addr == addr)
                         break;
-        return p;
+        return prl;
 
 }
 
@@ -255,7 +289,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
                 kcalloc(cmax, sizeof(*kp), GFP_KERNEL) :
                 NULL;
 
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
 
         ca = t->prl_count < cmax ? t->prl_count : cmax;
 
@@ -273,7 +307,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
         }
 
         c = 0;
-        for (prl = t->prl; prl; prl = prl->next) {
+        for_each_prl_rcu(t->prl) {
                 if (c >= cmax)
                         break;
                 if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
@@ -285,7 +319,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
                         break;
         }
 out:
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
 
         len = sizeof(*kp) * c;
         ret = 0;
@@ -306,12 +340,14 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
         if (a->addr == htonl(INADDR_ANY))
                 return -EINVAL;
 
-        write_lock(&ipip6_lock);
+        spin_lock(&ipip6_prl_lock);
 
         for (p = t->prl; p; p = p->next) {
                 if (p->addr == a->addr) {
-                        if (chg)
-                                goto update;
+                        if (chg) {
+                                p->flags = a->flags;
+                                goto out;
+                        }
                         err = -EEXIST;
                         goto out;
                 }
@@ -328,46 +364,63 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
                 goto out;
         }
 
+        INIT_RCU_HEAD(&p->rcu_head);
         p->next = t->prl;
-        t->prl = p;
-        t->prl_count++;
-update:
         p->addr = a->addr;
         p->flags = a->flags;
+        t->prl_count++;
+        rcu_assign_pointer(t->prl, p);
 out:
-        write_unlock(&ipip6_lock);
+        spin_unlock(&ipip6_prl_lock);
         return err;
 }
 
+static void prl_entry_destroy_rcu(struct rcu_head *head)
+{
+        kfree(container_of(head, struct ip_tunnel_prl_entry, rcu_head));
+}
+
+static void prl_list_destroy_rcu(struct rcu_head *head)
+{
+        struct ip_tunnel_prl_entry *p, *n;
+
+        p = container_of(head, struct ip_tunnel_prl_entry, rcu_head);
+        do {
+                n = p->next;
+                kfree(p);
+                p = n;
+        } while (p);
+}
+
 static int
 ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
 {
         struct ip_tunnel_prl_entry *x, **p;
         int err = 0;
 
-        write_lock(&ipip6_lock);
+        spin_lock(&ipip6_prl_lock);
 
         if (a && a->addr != htonl(INADDR_ANY)) {
                 for (p = &t->prl; *p; p = &(*p)->next) {
                         if ((*p)->addr == a->addr) {
                                 x = *p;
                                 *p = x->next;
-                                kfree(x);
+                                call_rcu(&x->rcu_head, prl_entry_destroy_rcu);
                                 t->prl_count--;
                                 goto out;
                         }
                 }
                 err = -ENXIO;
         } else {
-                while (t->prl) {
+                if (t->prl) {
+                        t->prl_count = 0;
                         x = t->prl;
-                        t->prl = t->prl->next;
-                        kfree(x);
-                        t->prl_count--;
+                        call_rcu(&x->rcu_head, prl_list_destroy_rcu);
+                        t->prl = NULL;
                 }
         }
 out:
-        write_unlock(&ipip6_lock);
+        spin_unlock(&ipip6_prl_lock);
         return err;
 }
 
@@ -377,7 +430,7 @@ isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
         struct ip_tunnel_prl_entry *p;
         int ok = 1;
 
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
         p = __ipip6_tunnel_locate_prl(t, iph->saddr);
         if (p) {
                 if (p->flags & PRL_DEFAULT)
@@ -393,7 +446,7 @@ isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
                 else
                         ok = 0;
         }
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
         return ok;
 }
 
@@ -403,9 +456,9 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
         if (dev == sitn->fb_tunnel_dev) {
-                write_lock_bh(&ipip6_lock);
+                spin_lock_bh(&ipip6_lock);
                 sitn->tunnels_wc[0] = NULL;
-                write_unlock_bh(&ipip6_lock);
+                spin_unlock_bh(&ipip6_lock);
                 dev_put(dev);
         } else {
                 ipip6_tunnel_unlink(sitn, netdev_priv(dev));
@@ -458,7 +511,7 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
 
         err = -ENOENT;
 
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
         t = ipip6_tunnel_lookup(dev_net(skb->dev),
                                 skb->dev,
                                 iph->daddr,
@@ -476,7 +529,7 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
                 t->err_count = 1;
         t->err_time = jiffies;
 out:
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
         return err;
 }
 
@@ -496,7 +549,7 @@ static int ipip6_rcv(struct sk_buff *skb)
 
         iph = ip_hdr(skb);
 
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
         tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
                                      iph->saddr, iph->daddr);
         if (tunnel != NULL) {
@@ -510,7 +563,7 @@ static int ipip6_rcv(struct sk_buff *skb)
                 if ((tunnel->dev->priv_flags & IFF_ISATAP) &&
                     !isatap_chksrc(skb, iph, tunnel)) {
                         tunnel->dev->stats.rx_errors++;
-                        read_unlock(&ipip6_lock);
+                        rcu_read_unlock();
                         kfree_skb(skb);
                         return 0;
                 }
@@ -521,28 +574,52 @@ static int ipip6_rcv(struct sk_buff *skb)
                 nf_reset(skb);
                 ipip6_ecn_decapsulate(iph, skb);
                 netif_rx(skb);
-                read_unlock(&ipip6_lock);
+                rcu_read_unlock();
                 return 0;
         }
 
         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
 out:
         kfree_skb(skb);
         return 0;
 }
 
-/* Returns the embedded IPv4 address if the IPv6 address
-   comes from 6to4 (RFC 3056) addr space */
-
-static inline __be32 try_6to4(struct in6_addr *v6dst)
+/*
+ * Returns the embedded IPv4 address if the IPv6 address
+ * comes from 6rd / 6to4 (RFC 3056) addr space.
+ */
+static inline
+__be32 try_6rd(struct in6_addr *v6dst, struct ip_tunnel *tunnel)
 {
         __be32 dst = 0;
 
+#ifdef CONFIG_IPV6_SIT_6RD
+        if (ipv6_prefix_equal(v6dst, &tunnel->ip6rd.prefix,
+                              tunnel->ip6rd.prefixlen)) {
+                unsigned pbw0, pbi0;
+                int pbi1;
+                u32 d;
+
+                pbw0 = tunnel->ip6rd.prefixlen >> 5;
+                pbi0 = tunnel->ip6rd.prefixlen & 0x1f;
+
+                d = (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >>
+                    tunnel->ip6rd.relay_prefixlen;
+
+                pbi1 = pbi0 - tunnel->ip6rd.relay_prefixlen;
+                if (pbi1 > 0)
+                        d |= ntohl(v6dst->s6_addr32[pbw0 + 1]) >>
+                             (32 - pbi1);
+
+                dst = tunnel->ip6rd.relay_prefix | htonl(d);
+        }
+#else
         if (v6dst->s6_addr16[0] == htons(0x2002)) {
                 /* 6to4 v6 addr has 16 bits prefix, 32 v4addr, 16 SLA, ... */
                 memcpy(&dst, &v6dst->s6_addr16[1], 4);
         }
+#endif
         return dst;
 }
 
@@ -555,7 +632,8 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                                      struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->dev->stats;
+        struct net_device_stats *stats = &dev->stats;
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
         struct iphdr  *tiph = &tunnel->parms.iph;
         struct ipv6hdr *iph6 = ipv6_hdr(skb);
         u8     tos = tunnel->parms.iph.tos;
@@ -595,7 +673,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         }
 
         if (!dst)
-                dst = try_6to4(&iph6->daddr);
+                dst = try_6rd(&iph6->daddr, tunnel);
 
         if (!dst) {
                 struct neighbour *neigh = NULL;
@@ -688,7 +766,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb) {
                         ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        txq->tx_dropped++;
                         dev_kfree_skb(skb);
                         return NETDEV_TX_OK;
                 }
@@ -785,9 +863,15 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
         struct ip_tunnel *t;
         struct net *net = dev_net(dev);
         struct sit_net *sitn = net_generic(net, sit_net_id);
+#ifdef CONFIG_IPV6_SIT_6RD
+        struct ip_tunnel_6rd ip6rd;
+#endif
 
         switch (cmd) {
         case SIOCGETTUNNEL:
+#ifdef CONFIG_IPV6_SIT_6RD
+        case SIOCGET6RD:
+#endif
                 t = NULL;
                 if (dev == sitn->fb_tunnel_dev) {
                         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
@@ -798,9 +882,25 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                 }
                 if (t == NULL)
                         t = netdev_priv(dev);
-                memcpy(&p, &t->parms, sizeof(p));
-                if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
-                        err = -EFAULT;
+
+                err = -EFAULT;
+                if (cmd == SIOCGETTUNNEL) {
+                        memcpy(&p, &t->parms, sizeof(p));
+                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &p,
+                                         sizeof(p)))
+                                goto done;
+#ifdef CONFIG_IPV6_SIT_6RD
+                } else {
+                        ipv6_addr_copy(&ip6rd.prefix, &t->ip6rd.prefix);
+                        ip6rd.relay_prefix = t->ip6rd.relay_prefix;
+                        ip6rd.prefixlen = t->ip6rd.prefixlen;
+                        ip6rd.relay_prefixlen = t->ip6rd.relay_prefixlen;
+                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &ip6rd,
+                                         sizeof(ip6rd)))
+                                goto done;
+#endif
+                }
+                err = 0;
                 break;
 
         case SIOCADDTUNNEL:
@@ -921,6 +1021,54 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                 netdev_state_change(dev);
                 break;
 
+#ifdef CONFIG_IPV6_SIT_6RD
+        case SIOCADD6RD:
+        case SIOCCHG6RD:
+        case SIOCDEL6RD:
+                err = -EPERM;
+                if (!capable(CAP_NET_ADMIN))
+                        goto done;
+
+                err = -EFAULT;
+                if (copy_from_user(&ip6rd, ifr->ifr_ifru.ifru_data,
+                                   sizeof(ip6rd)))
+                        goto done;
+
+                t = netdev_priv(dev);
+
+                if (cmd != SIOCDEL6RD) {
+                        struct in6_addr prefix;
+                        __be32 relay_prefix;
+
+                        err = -EINVAL;
+                        if (ip6rd.relay_prefixlen > 32 ||
+                            ip6rd.prefixlen + (32 - ip6rd.relay_prefixlen) > 64)
+                                goto done;
+
+                        ipv6_addr_prefix(&prefix, &ip6rd.prefix,
+                                         ip6rd.prefixlen);
+                        if (!ipv6_addr_equal(&prefix, &ip6rd.prefix))
+                                goto done;
+                        if (ip6rd.relay_prefixlen)
+                                relay_prefix = ip6rd.relay_prefix &
+                                               htonl(0xffffffffUL <<
+                                                     (32 - ip6rd.relay_prefixlen));
+                        else
+                                relay_prefix = 0;
+                        if (relay_prefix != ip6rd.relay_prefix)
+                                goto done;
+
+                        ipv6_addr_copy(&t->ip6rd.prefix, &prefix);
+                        t->ip6rd.relay_prefix = relay_prefix;
+                        t->ip6rd.prefixlen = ip6rd.prefixlen;
+                        t->ip6rd.relay_prefixlen = ip6rd.relay_prefixlen;
+                } else
+                        ipip6_tunnel_clone_6rd(dev, sitn);
+
+                err = 0;
+                break;
+#endif
+
         default:
                 err = -EINVAL;
         }
@@ -997,16 +1145,19 @@ static struct xfrm_tunnel sit_handler = {
         .priority       =       1,
 };
 
-static void sit_destroy_tunnels(struct sit_net *sitn)
+static void sit_destroy_tunnels(struct sit_net *sitn, struct list_head *head)
 {
         int prio;
 
         for (prio = 1; prio < 4; prio++) {
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t;
-                        while ((t = sitn->tunnels[prio][h]) != NULL)
-                                unregister_netdevice(t->dev);
+                        struct ip_tunnel *t = sitn->tunnels[prio][h];
+
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = t->next;
+                        }
                 }
         }
 }
@@ -1039,6 +1190,7 @@ static int sit_init_net(struct net *net)
         dev_net_set(sitn->fb_tunnel_dev, net);
 
         ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
+        ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn);
 
         if ((err = register_netdev(sitn->fb_tunnel_dev)))
                 goto err_reg_dev;
@@ -1059,11 +1211,13 @@ err_alloc:
 static void sit_exit_net(struct net *net)
 {
         struct sit_net *sitn;
+        LIST_HEAD(list);
 
         sitn = net_generic(net, sit_net_id);
         rtnl_lock();
-        sit_destroy_tunnels(sitn);
-        unregister_netdevice(sitn->fb_tunnel_dev);
+        sit_destroy_tunnels(sitn, &list);
+        unregister_netdevice_queue(sitn->fb_tunnel_dev, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
         kfree(sitn);
 }
@@ -1078,6 +1232,7 @@ static void __exit sit_cleanup(void)
         xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
 
         unregister_pernet_gen_device(sit_net_id, &sit_net_ops);
+        rcu_barrier(); /* Wait for completion of call_rcu()'s */
 }
 
 static int __init sit_init(void)
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 6b6ae913b5d4..612fc53e0bb9 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -184,13 +184,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
 
-        /* check for timestamp cookie support */
-        memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, 0);
-
-        if (tcp_opt.saw_tstamp)
-                cookie_check_timestamp(&tcp_opt);
-
         ret = NULL;
         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
         if (!req)
@@ -224,12 +217,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         req->expires = 0UL;
         req->retrans = 0;
         ireq->ecn_ok            = 0;
-        ireq->snd_wscale        = tcp_opt.snd_wscale;
-        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
-        ireq->sack_ok           = tcp_opt.sack_ok;
-        ireq->wscale_ok         = tcp_opt.wscale_ok;
-        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
-        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
         treq->rcv_isn = ntohl(th->seq) - 1;
         treq->snt_isn = cookie;
 
@@ -252,8 +239,9 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                 }
                 ipv6_addr_copy(&fl.fl6_src, &ireq6->loc_addr);
                 fl.oif = sk->sk_bound_dev_if;
+                fl.mark = sk->sk_mark;
                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
-                fl.fl_ip_sport = inet_sk(sk)->sport;
+                fl.fl_ip_sport = inet_sk(sk)->inet_sport;
                 security_req_classify_flow(req, &fl);
                 if (ip6_dst_lookup(sk, &dst, &fl))
                         goto out_free;
@@ -264,6 +252,21 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                         goto out_free;
         }
 
+        /* check for timestamp cookie support */
+        memset(&tcp_opt, 0, sizeof(tcp_opt));
+        tcp_parse_options(skb, &tcp_opt, 0, dst);
+
+        if (tcp_opt.saw_tstamp)
+                cookie_check_timestamp(&tcp_opt);
+
+        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
+
+        ireq->snd_wscale        = tcp_opt.snd_wscale;
+        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
+        ireq->sack_ok           = tcp_opt.sack_ok;
+        ireq->wscale_ok         = tcp_opt.wscale_ok;
+        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
+
         req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
         tcp_select_initial_window(tcp_full_space(sk), req->mss,
                                   &req->rcv_wnd, &req->window_clamp,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 21d100b68b19..34925f089e07 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -226,10 +226,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 #endif
                         goto failure;
                 } else {
-                        ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
-                                      inet->saddr);
-                        ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
-                                      inet->rcv_saddr);
+                        ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
+                        ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
+                                               &np->rcv_saddr);
                 }
 
                 return err;
@@ -243,8 +242,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         ipv6_addr_copy(&fl.fl6_src,
                        (saddr ? saddr : &np->saddr));
         fl.oif = sk->sk_bound_dev_if;
+        fl.mark = sk->sk_mark;
         fl.fl_ip_dport = usin->sin6_port;
-        fl.fl_ip_sport = inet->sport;
+        fl.fl_ip_sport = inet->inet_sport;
 
         if (np->opt && np->opt->srcrt) {
                 struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
@@ -276,7 +276,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 
         /* set the source address */
         ipv6_addr_copy(&np->saddr, saddr);
-        inet->rcv_saddr = LOOPBACK4_IPV6;
+        inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 
         sk->sk_gso_type = SKB_GSO_TCPV6;
         __ip6_dst_store(sk, dst, NULL, NULL);
@@ -288,7 +288,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 
         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 
-        inet->dport = usin->sin6_port;
+        inet->inet_dport = usin->sin6_port;
 
         tcp_set_state(sk, TCP_SYN_SENT);
         err = inet6_hash_connect(&tcp_death_row, sk);
@@ -298,8 +298,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         if (!tp->write_seq)
                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
                                                              np->daddr.s6_addr32,
-                                                             inet->sport,
-                                                             inet->dport);
+                                                             inet->inet_sport,
+                                                             inet->inet_dport);
 
         err = tcp_connect(sk);
         if (err)
@@ -311,7 +311,7 @@ late_failure:
         tcp_set_state(sk, TCP_CLOSE);
         __sk_dst_reset(sk);
 failure:
-        inet->dport = 0;
+        inet->inet_dport = 0;
         sk->sk_route_caps = 0;
         return err;
 }
@@ -383,8 +383,9 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                         ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
                         ipv6_addr_copy(&fl.fl6_src, &np->saddr);
                         fl.oif = sk->sk_bound_dev_if;
-                        fl.fl_ip_dport = inet->dport;
-                        fl.fl_ip_sport = inet->sport;
+                        fl.mark = sk->sk_mark;
+                        fl.fl_ip_dport = inet->inet_dport;
+                        fl.fl_ip_sport = inet->inet_sport;
                         security_skb_classify_flow(skb, &fl);
 
                         if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
@@ -477,6 +478,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
         ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
         fl.fl6_flowlabel = 0;
         fl.oif = treq->iif;
+        fl.mark = sk->sk_mark;
         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
         fl.fl_ip_sport = inet_rsk(req)->loc_port;
         security_req_classify_flow(req, &fl);
@@ -1165,6 +1167,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         struct tcp_sock *tp = tcp_sk(sk);
         struct request_sock *req = NULL;
         __u32 isn = TCP_SKB_CB(skb)->when;
+        struct dst_entry *dst = __sk_dst_get(sk);
 #ifdef CONFIG_SYN_COOKIES
         int want_cookie = 0;
 #else
@@ -1203,7 +1206,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
         tmp_opt.user_mss = tp->rx_opt.user_mss;
 
-        tcp_parse_options(skb, &tmp_opt, 0);
+        tcp_parse_options(skb, &tmp_opt, 0, dst);
 
         if (want_cookie && !tmp_opt.saw_tstamp)
                 tcp_clear_options(&tmp_opt);
@@ -1290,11 +1293,9 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
                 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 
-                ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
-                              newinet->daddr);
+                ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
 
-                ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
-                              newinet->saddr);
+                ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
 
                 ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
 
@@ -1345,6 +1346,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 }
                 ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
                 fl.oif = sk->sk_bound_dev_if;
+                fl.mark = sk->sk_mark;
                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
                 fl.fl_ip_sport = inet_rsk(req)->loc_port;
                 security_req_classify_flow(req, &fl);
@@ -1431,7 +1433,8 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
         tcp_initialize_rcv_mss(newsk);
 
-        newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
+        newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
+        newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Copy over the MD5 key from the original socket */
@@ -1931,8 +1934,8 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
 
         dest  = &np->daddr;
         src   = &np->rcv_saddr;
-        destp = ntohs(inet->dport);
-        srcp  = ntohs(inet->sport);
+        destp = ntohs(inet->inet_dport);
+        srcp  = ntohs(inet->inet_sport);
 
         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
                 timer_active    = 1;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 3a60f12b34ed..d3b59d73f507 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -53,7 +53,7 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
 {
         const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
         const struct in6_addr *sk2_rcv_saddr6 = inet6_rcv_saddr(sk2);
-        __be32 sk_rcv_saddr = inet_sk(sk)->rcv_saddr;
+        __be32 sk1_rcv_saddr = inet_sk(sk)->inet_rcv_saddr;
         __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
         int sk_ipv6only = ipv6_only_sock(sk);
         int sk2_ipv6only = inet_v6_ipv6only(sk2);
@@ -63,8 +63,8 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
         /* if both are mapped, treat as IPv4 */
         if (addr_type == IPV6_ADDR_MAPPED && addr_type2 == IPV6_ADDR_MAPPED)
                 return (!sk2_ipv6only &&
-                        (!sk_rcv_saddr || !sk2_rcv_saddr ||
-                          sk_rcv_saddr == sk2_rcv_saddr));
+                        (!sk1_rcv_saddr || !sk2_rcv_saddr ||
+                          sk1_rcv_saddr == sk2_rcv_saddr));
 
         if (addr_type2 == IPV6_ADDR_ANY &&
             !(sk2_ipv6only && addr_type == IPV6_ADDR_MAPPED))
@@ -100,8 +100,8 @@ static inline int compute_score(struct sock *sk, struct net *net,
                 struct inet_sock *inet = inet_sk(sk);
 
                 score = 0;
-                if (inet->dport) {
-                        if (inet->dport != sport)
+                if (inet->inet_dport) {
+                        if (inet->inet_dport != sport)
                                 return -1;
                         score++;
                 }
@@ -132,7 +132,7 @@ static struct sock *__udp6_lib_lookup(struct net *net,
         struct sock *sk, *result;
         struct hlist_nulls_node *node;
         unsigned short hnum = ntohs(dport);
-        unsigned int hash = udp_hashfn(net, hnum);
+        unsigned int hash = udp_hashfn(net, hnum, udptable->mask);
         struct udp_hslot *hslot = &udptable->hash[hash];
         int score, badness;
 
@@ -252,7 +252,7 @@ try_again:
                                         UDP_MIB_INDATAGRAMS, is_udplite);
         }
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         /* Copy the address. */
         if (msg->msg_name) {
@@ -265,8 +265,8 @@ try_again:
                 sin6->sin6_scope_id = 0;
 
                 if (is_udp4)
-                        ipv6_addr_set(&sin6->sin6_addr, 0, 0,
-                                      htonl(0xffff), ip_hdr(skb)->saddr);
+                        ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
+                                               &sin6->sin6_addr);
                 else {
                         ipv6_addr_copy(&sin6->sin6_addr,
                                        &ipv6_hdr(skb)->saddr);
@@ -385,18 +385,18 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                         goto drop;
         }
 
-        if ((rc = sock_queue_rcv_skb(sk,skb)) < 0) {
+        if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
                 /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM) {
+                if (rc == -ENOMEM)
                         UDP6_INC_STATS_BH(sock_net(sk),
                                         UDP_MIB_RCVBUFERRORS, is_udplite);
-                        atomic_inc(&sk->sk_drops);
-                }
-                goto drop;
+                goto drop_no_sk_drops_inc;
         }
 
         return 0;
 drop:
+        atomic_inc(&sk->sk_drops);
+drop_no_sk_drops_inc:
         UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
         kfree_skb(skb);
         return -1;
@@ -419,8 +419,8 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
 
                 if (s->sk_hash == num && s->sk_family == PF_INET6) {
                         struct ipv6_pinfo *np = inet6_sk(s);
-                        if (inet->dport) {
-                                if (inet->dport != rmt_port)
+                        if (inet->inet_dport) {
+                                if (inet->inet_dport != rmt_port)
                                         continue;
                         }
                         if (!ipv6_addr_any(&np->daddr) &&
@@ -452,7 +452,7 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
 {
         struct sock *sk, *sk2;
         const struct udphdr *uh = udp_hdr(skb);
-        struct udp_hslot *hslot = &udptable->hash[udp_hashfn(net, ntohs(uh->dest))];
+        struct udp_hslot *hslot = udp_hashslot(udptable, net, ntohs(uh->dest));
         int dif;
 
         spin_lock(&hslot->lock);
@@ -794,7 +794,7 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 if (ipv6_addr_v4mapped(daddr)) {
                         struct sockaddr_in sin;
                         sin.sin_family = AF_INET;
-                        sin.sin_port = sin6 ? sin6->sin6_port : inet->dport;
+                        sin.sin_port = sin6 ? sin6->sin6_port : inet->inet_dport;
                         sin.sin_addr.s_addr = daddr->s6_addr32[3];
                         msg->msg_name = &sin;
                         msg->msg_namelen = sizeof(sin);
@@ -867,7 +867,7 @@ do_udp_sendmsg:
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -EDESTADDRREQ;
 
-                fl.fl_ip_dport = inet->dport;
+                fl.fl_ip_dport = inet->inet_dport;
                 daddr = &np->daddr;
                 fl.fl6_flowlabel = np->flow_label;
                 connected = 1;
@@ -879,6 +879,8 @@ do_udp_sendmsg:
         if (!fl.oif)
                 fl.oif = np->sticky_pktinfo.ipi6_ifindex;
 
+        fl.mark = sk->sk_mark;
+
         if (msg->msg_controllen) {
                 opt = &opt_space;
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
@@ -911,7 +913,7 @@ do_udp_sendmsg:
                 fl.fl6_dst.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
         if (ipv6_addr_any(&fl.fl6_src) && !ipv6_addr_any(&np->saddr))
                 ipv6_addr_copy(&fl.fl6_src, &np->saddr);
-        fl.fl_ip_sport = inet->sport;
+        fl.fl_ip_sport = inet->inet_sport;
 
         /* merge ip6_build_xmit from ip6_output */
         if (opt && opt->srcrt) {
@@ -1192,10 +1194,10 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
 
         dest  = &np->daddr;
         src   = &np->rcv_saddr;
-        destp = ntohs(inet->dport);
-        srcp  = ntohs(inet->sport);
+        destp = ntohs(inet->inet_dport);
+        srcp  = ntohs(inet->inet_sport);
         seq_printf(seq,
-                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
+                   "%5d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
                    bucket,
                    src->s6_addr32[0], src->s6_addr32[1],
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 81a95c00e503..438831d33593 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -23,7 +23,7 @@
  */
 #include <linux/module.h>
 #include <linux/xfrm.h>
-#include <linux/list.h>
+#include <linux/rculist.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/ipv6.h>
@@ -36,14 +36,15 @@
  * per xfrm_address_t.
  */
 struct xfrm6_tunnel_spi {
-        struct hlist_node list_byaddr;
-        struct hlist_node list_byspi;
-        xfrm_address_t addr;
-        u32 spi;
-        atomic_t refcnt;
+        struct hlist_node       list_byaddr;
+        struct hlist_node       list_byspi;
+        xfrm_address_t          addr;
+        u32                     spi;
+        atomic_t                refcnt;
+        struct rcu_head         rcu_head;
 };
 
-static DEFINE_RWLOCK(xfrm6_tunnel_spi_lock);
+static DEFINE_SPINLOCK(xfrm6_tunnel_spi_lock);
 
 static u32 xfrm6_tunnel_spi;
 
@@ -107,6 +108,7 @@ static void xfrm6_tunnel_spi_fini(void)
                 if (!hlist_empty(&xfrm6_tunnel_spi_byspi[i]))
                         return;
         }
+        rcu_barrier();
         kmem_cache_destroy(xfrm6_tunnel_spi_kmem);
         xfrm6_tunnel_spi_kmem = NULL;
 }
@@ -116,7 +118,7 @@ static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
         struct xfrm6_tunnel_spi *x6spi;
         struct hlist_node *pos;
 
-        hlist_for_each_entry(x6spi, pos,
+        hlist_for_each_entry_rcu(x6spi, pos,
                              &xfrm6_tunnel_spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
                              list_byaddr) {
                 if (memcmp(&x6spi->addr, saddr, sizeof(x6spi->addr)) == 0)
@@ -131,10 +133,10 @@ __be32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
         struct xfrm6_tunnel_spi *x6spi;
         u32 spi;
 
-        read_lock_bh(&xfrm6_tunnel_spi_lock);
+        rcu_read_lock_bh();
         x6spi = __xfrm6_tunnel_spi_lookup(saddr);
         spi = x6spi ? x6spi->spi : 0;
-        read_unlock_bh(&xfrm6_tunnel_spi_lock);
+        rcu_read_unlock_bh();
         return htonl(spi);
 }
 
@@ -185,14 +187,15 @@ alloc_spi:
         if (!x6spi)
                 goto out;
 
+        INIT_RCU_HEAD(&x6spi->rcu_head);
         memcpy(&x6spi->addr, saddr, sizeof(x6spi->addr));
         x6spi->spi = spi;
         atomic_set(&x6spi->refcnt, 1);
 
-        hlist_add_head(&x6spi->list_byspi, &xfrm6_tunnel_spi_byspi[index]);
+        hlist_add_head_rcu(&x6spi->list_byspi, &xfrm6_tunnel_spi_byspi[index]);
 
         index = xfrm6_tunnel_spi_hash_byaddr(saddr);
-        hlist_add_head(&x6spi->list_byaddr, &xfrm6_tunnel_spi_byaddr[index]);
+        hlist_add_head_rcu(&x6spi->list_byaddr, &xfrm6_tunnel_spi_byaddr[index]);
 out:
         return spi;
 }
@@ -202,26 +205,32 @@ __be32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
         struct xfrm6_tunnel_spi *x6spi;
         u32 spi;
 
-        write_lock_bh(&xfrm6_tunnel_spi_lock);
+        spin_lock_bh(&xfrm6_tunnel_spi_lock);
         x6spi = __xfrm6_tunnel_spi_lookup(saddr);
         if (x6spi) {
                 atomic_inc(&x6spi->refcnt);
                 spi = x6spi->spi;
         } else
                 spi = __xfrm6_tunnel_alloc_spi(saddr);
-        write_unlock_bh(&xfrm6_tunnel_spi_lock);
+        spin_unlock_bh(&xfrm6_tunnel_spi_lock);
 
         return htonl(spi);
 }
 
 EXPORT_SYMBOL(xfrm6_tunnel_alloc_spi);
 
+static void x6spi_destroy_rcu(struct rcu_head *head)
+{
+        kmem_cache_free(xfrm6_tunnel_spi_kmem,
+                        container_of(head, struct xfrm6_tunnel_spi, rcu_head));
+}
+
 void xfrm6_tunnel_free_spi(xfrm_address_t *saddr)
 {
         struct xfrm6_tunnel_spi *x6spi;
         struct hlist_node *pos, *n;
 
-        write_lock_bh(&xfrm6_tunnel_spi_lock);
+        spin_lock_bh(&xfrm6_tunnel_spi_lock);
 
         hlist_for_each_entry_safe(x6spi, pos, n,
                                   &xfrm6_tunnel_spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
@@ -229,14 +238,14 @@ void xfrm6_tunnel_free_spi(xfrm_address_t *saddr)
         {
                 if (memcmp(&x6spi->addr, saddr, sizeof(x6spi->addr)) == 0) {
                         if (atomic_dec_and_test(&x6spi->refcnt)) {
-                                hlist_del(&x6spi->list_byaddr);
-                                hlist_del(&x6spi->list_byspi);
-                                kmem_cache_free(xfrm6_tunnel_spi_kmem, x6spi);
+                                hlist_del_rcu(&x6spi->list_byaddr);
+                                hlist_del_rcu(&x6spi->list_byspi);
+                                call_rcu(&x6spi->rcu_head, x6spi_destroy_rcu);
                                 break;
                         }
                 }
         }
-        write_unlock_bh(&xfrm6_tunnel_spi_lock);
+        spin_unlock_bh(&xfrm6_tunnel_spi_lock);
 }
 
 EXPORT_SYMBOL(xfrm6_tunnel_free_spi);
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 66c7a20011f3..6481ee4bdf72 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -1927,7 +1927,7 @@ static int ipx_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long
  * Socket family declarations
  */
 
-static struct net_proto_family ipx_family_ops = {
+static const struct net_proto_family ipx_family_ops = {
         .family         = PF_IPX,
         .create         = ipx_create,
         .owner          = THIS_MODULE,
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index dd35641835f4..9429e4002bca 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -2463,7 +2463,7 @@ bed:
         return 0;
 }
 
-static struct net_proto_family irda_family_ops = {
+static const struct net_proto_family irda_family_ops = {
         .family = PF_IRDA,
         .create = irda_create,
         .owner  = THIS_MODULE,
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index bada1b9c670b..3aebabb158a8 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -428,7 +428,6 @@ static void iucv_sock_close(struct sock *sk)
                 break;
 
         default:
-                sock_set_flag(sk, SOCK_ZAPPED);
                 /* nothing to do here */
                 break;
         }
@@ -536,7 +535,7 @@ void iucv_accept_enqueue(struct sock *parent, struct sock *sk)
         list_add_tail(&iucv_sk(sk)->accept_q, &par->accept_q);
         spin_unlock_irqrestore(&par->accept_q_lock, flags);
         iucv_sk(sk)->parent = parent;
-        parent->sk_ack_backlog++;
+        sk_acceptq_added(parent);
 }
 
 void iucv_accept_unlink(struct sock *sk)
@@ -547,7 +546,7 @@ void iucv_accept_unlink(struct sock *sk)
         spin_lock_irqsave(&par->accept_q_lock, flags);
         list_del_init(&iucv_sk(sk)->accept_q);
         spin_unlock_irqrestore(&par->accept_q_lock, flags);
-        iucv_sk(sk)->parent->sk_ack_backlog--;
+        sk_acceptq_removed(iucv_sk(sk)->parent);
         iucv_sk(sk)->parent = NULL;
         sock_put(sk);
 }
@@ -1715,7 +1714,7 @@ static const struct proto_ops iucv_sock_ops = {
         .getsockopt     = iucv_sock_getsockopt,
 };
 
-static struct net_proto_family iucv_sock_family_ops = {
+static const struct net_proto_family iucv_sock_family_ops = {
         .family = AF_IUCV,
         .owner  = THIS_MODULE,
         .create = iucv_sock_create,
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 4e98193dfa0f..472f6594184a 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3606,7 +3606,7 @@ static int pfkey_recvmsg(struct kiocb *kiocb,
         if (err)
                 goto out_free;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         err = (flags & MSG_TRUNC) ? skb->len : copied;
 
@@ -3644,7 +3644,7 @@ static const struct proto_ops pfkey_ops = {
         .recvmsg        =       pfkey_recvmsg,
 };
 
-static struct net_proto_family pfkey_family_ops = {
+static const struct net_proto_family pfkey_family_ops = {
         .family =       PF_KEY,
         .create =       pfkey_create,
         .owner  =       THIS_MODULE,
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 7aa4fd170104..4866b4fb0c27 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -1092,7 +1092,7 @@ out:
         return rc;
 }
 
-static struct net_proto_family llc_ui_family_ops = {
+static const struct net_proto_family llc_ui_family_ops = {
         .family = PF_LLC,
         .create = llc_ui_create,
         .owner  = THIS_MODULE,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index b8295cbd7e8f..14f10eb91c5c 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -184,10 +184,12 @@ static int ieee80211_open(struct net_device *dev)
                  * No need to check netif_running since we do not allow
                  * it to start up with this invalid address.
                  */
-                if (compare_ether_addr(null_addr, ndev->dev_addr) == 0)
+                if (compare_ether_addr(null_addr, ndev->dev_addr) == 0) {
                         memcpy(ndev->dev_addr,
                                local->hw.wiphy->perm_addr,
                                ETH_ALEN);
+                        memcpy(ndev->perm_addr, ndev->dev_addr, ETH_ALEN);
+                }
         }
 
         /*
@@ -312,7 +314,7 @@ static int ieee80211_open(struct net_device *dev)
         if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 ieee80211_queue_work(&local->hw, &sdata->u.mgd.work);
 
-        netif_tx_start_all_queues(dev);
+        netif_start_queue(dev);
 
         return 0;
  err_del_interface:
@@ -341,7 +343,7 @@ static int ieee80211_stop(struct net_device *dev)
         /*
          * Stop TX on this interface first.
          */
-        netif_tx_stop_all_queues(dev);
+        netif_stop_queue(dev);
 
         /*
          * Now delete all active aggregation sessions.
@@ -754,10 +756,6 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-static struct device_type wiphy_type = {
-        .name   = "wlan",
-};
-
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                      struct net_device **new_dev, enum nl80211_iftype type,
                      struct vif_params *params)
@@ -788,8 +786,8 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                 goto fail;
 
         memcpy(ndev->dev_addr, local->hw.wiphy->perm_addr, ETH_ALEN);
+        memcpy(ndev->perm_addr, ndev->dev_addr, ETH_ALEN);
         SET_NETDEV_DEV(ndev, wiphy_dev(local->hw.wiphy));
-        SET_NETDEV_DEVTYPE(ndev, &wiphy_type);
 
         /* don't use IEEE80211_DEV_TO_SUB_IF because it checks too much */
         sdata = netdev_priv(ndev);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index f7364e56f1ee..9a733890eb47 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -50,7 +50,7 @@ static void ieee80211_mesh_housekeeping_timer(unsigned long data)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
-        ifmsh->wrkq_flags |= MESH_WORK_HOUSEKEEPING;
+        set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
 
         if (local->quiescing) {
                 set_bit(TMR_RUNNING_HK, &ifmsh->timers_running);
@@ -480,7 +480,7 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
 
-        ifmsh->wrkq_flags |= MESH_WORK_HOUSEKEEPING;
+        set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
         ieee80211_queue_work(&local->hw, &ifmsh->work);
         sdata->vif.bss_conf.beacon_int = MESH_DEFAULT_BEACON_INTERVAL;
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index dc5049d58c51..dcc14e99227c 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -458,9 +458,15 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
         mgmt->u.deauth.reason_code = cpu_to_le16(reason);
 
         if (stype == IEEE80211_STYPE_DEAUTH)
-                cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len, cookie);
+                if (cookie)
+                        __cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
+                else
+                        cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
         else
-                cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len, cookie);
+                if (cookie)
+                        __cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
+                else
+                        cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
         ieee80211_tx_skb(sdata, skb, ifmgd->flags & IEEE80211_STA_MFP_ENABLED);
 }
 
@@ -923,7 +929,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         ieee80211_recalc_ps(local, -1);
         mutex_unlock(&local->iflist_mtx);
 
-        netif_tx_start_all_queues(sdata->dev);
+        netif_start_queue(sdata->dev);
         netif_carrier_on(sdata->dev);
 }
 
@@ -1055,7 +1061,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
          * time -- we don't want the scan code to enable queues.
          */
 
-        netif_tx_stop_all_queues(sdata->dev);
+        netif_stop_queue(sdata->dev);
         netif_carrier_off(sdata->dev);
 
         rcu_read_lock();
@@ -1958,12 +1964,10 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                         /* no action */
                         break;
                 case RX_MGMT_CFG80211_DEAUTH:
-                        cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len,
-                                             NULL);
+                        cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
                         break;
                 case RX_MGMT_CFG80211_DISASSOC:
-                        cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len,
-                                               NULL);
+                        cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
                         break;
                 default:
                         WARN(1, "unexpected: %d", rma);
@@ -2018,7 +2022,7 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                 cfg80211_send_rx_assoc(sdata->dev, (u8 *) mgmt, skb->len);
                 break;
         case RX_MGMT_CFG80211_DEAUTH:
-                cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len, NULL);
+                cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
                 break;
         default:
                 WARN(1, "unexpected: %d", rma);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 7170bf4565a8..5c385e3c1d1f 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1504,19 +1504,28 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 /* illegal frame */
                 return RX_DROP_MONITOR;
 
-        if (!is_multicast_ether_addr(hdr->addr1) &&
-                        (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6)) {
+        if (mesh_hdr->flags & MESH_FLAGS_AE) {
                 struct mesh_path *mppath;
+                char *proxied_addr;
+                char *mpp_addr;
+
+                if (is_multicast_ether_addr(hdr->addr1)) {
+                        mpp_addr = hdr->addr3;
+                        proxied_addr = mesh_hdr->eaddr1;
+                } else {
+                        mpp_addr = hdr->addr4;
+                        proxied_addr = mesh_hdr->eaddr2;
+                }
 
                 rcu_read_lock();
-                mppath = mpp_path_lookup(mesh_hdr->eaddr2, sdata);
+                mppath = mpp_path_lookup(proxied_addr, sdata);
                 if (!mppath) {
-                        mpp_path_add(mesh_hdr->eaddr2, hdr->addr4, sdata);
+                        mpp_path_add(proxied_addr, mpp_addr, sdata);
                 } else {
                         spin_lock_bh(&mppath->state_lock);
                         mppath->exp_time = jiffies;
-                        if (compare_ether_addr(mppath->mpp, hdr->addr4) != 0)
-                                memcpy(mppath->mpp, hdr->addr4, ETH_ALEN);
+                        if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
+                                memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
                         spin_unlock_bh(&mppath->state_lock);
                 }
                 rcu_read_unlock();
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 71e10cabf811..7a350d2690a0 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -306,10 +306,10 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                         if (sdata->u.mgd.associated) {
                                 ieee80211_scan_ps_disable(sdata);
-                                netif_tx_wake_all_queues(sdata->dev);
+                                netif_wake_queue(sdata->dev);
                         }
                 } else
-                        netif_tx_wake_all_queues(sdata->dev);
+                        netif_wake_queue(sdata->dev);
 
                 /* re-enable beaconing */
                 if (sdata->vif.type == NL80211_IFTYPE_AP ||
@@ -364,7 +364,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
                  * are handled in the scan state machine
                  */
                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                        netif_tx_stop_all_queues(sdata->dev);
+                        netif_stop_queue(sdata->dev);
         }
         mutex_unlock(&local->iflist_mtx);
 
@@ -523,7 +523,7 @@ static void ieee80211_scan_state_leave_oper_channel(struct ieee80211_local *loca
                         continue;
 
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        netif_tx_stop_all_queues(sdata->dev);
+                        netif_stop_queue(sdata->dev);
                         if (sdata->u.mgd.associated)
                                 ieee80211_scan_ps_enable(sdata);
                 }
@@ -558,7 +558,7 @@ static void ieee80211_scan_state_enter_oper_channel(struct ieee80211_local *loca
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                         if (sdata->u.mgd.associated)
                                 ieee80211_scan_ps_disable(sdata);
-                        netif_tx_wake_all_queues(sdata->dev);
+                        netif_wake_queue(sdata->dev);
                 }
         }
         mutex_unlock(&local->iflist_mtx);
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index ebf00ad5b194..362afbd60a96 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -149,7 +149,7 @@ socket_match(const struct sk_buff *skb, const struct xt_match_param *par,
 
                 /* Ignore sockets listening on INADDR_ANY */
                 wildcard = (sk->sk_state != TCP_TIME_WAIT &&
-                            inet_sk(sk)->rcv_saddr == 0);
+                            inet_sk(sk)->inet_rcv_saddr == 0);
 
                 /* Ignore non-transparent sockets,
                    if XT_SOCKET_TRANSPARENT is used */
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 19e98007691c..0cd2d8829313 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2050,7 +2050,7 @@ static const struct proto_ops netlink_ops = {
         .sendpage =     sock_no_sendpage,
 };
 
-static struct net_proto_family netlink_family_ops = {
+static const struct net_proto_family netlink_family_ops = {
         .family = PF_NETLINK,
         .create = netlink_create,
         .owner  = THIS_MODULE,  /* for consistency 8) */
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 44ff3f3810fa..d07ecda0a92d 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -97,25 +97,17 @@ static struct genl_ops *genl_get_cmd(u8 cmd, struct genl_family *family)
 */
 static inline u16 genl_generate_id(void)
 {
-        static u16 id_gen_idx;
-        int overflowed = 0;
+        static u16 id_gen_idx = GENL_MIN_ID;
+        int i;
 
-        do {
-                if (id_gen_idx == 0)
+        for (i = 0; i <= GENL_MAX_ID - GENL_MIN_ID; i++) {
+                if (!genl_family_find_byid(id_gen_idx))
+                        return id_gen_idx;
+                if (++id_gen_idx > GENL_MAX_ID)
                         id_gen_idx = GENL_MIN_ID;
+        }
 
-                if (++id_gen_idx > GENL_MAX_ID) {
-                        if (!overflowed) {
-                                overflowed = 1;
-                                id_gen_idx = 0;
-                                continue;
-                        } else
-                                return 0;
-                }
-
-        } while (genl_family_find_byid(id_gen_idx));
-
-        return id_gen_idx;
+        return 0;
 }
 
 static struct genl_multicast_group notify_grp;
@@ -374,11 +366,6 @@ int genl_register_family(struct genl_family *family)
                 goto errout_locked;
         }
 
-        if (genl_family_find_byid(family->id)) {
-                err = -EEXIST;
-                goto errout_locked;
-        }
-
         if (family->id == GENL_ID_GENERATE) {
                 u16 newid = genl_generate_id();
 
@@ -388,6 +375,9 @@ int genl_register_family(struct genl_family *family)
                 }
 
                 family->id = newid;
+        } else if (genl_family_find_byid(family->id)) {
+                err = -EEXIST;
+                goto errout_locked;
         }
 
         if (family->maxattr) {
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 7a834952f67f..281fa597cae5 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1372,7 +1372,7 @@ static const struct file_operations nr_info_fops = {
 };
 #endif  /* CONFIG_PROC_FS */
 
-static struct net_proto_family nr_family_ops = {
+static const struct net_proto_family nr_family_ops = {
         .family         =       PF_NETROM,
         .create         =       nr_create,
         .owner          =       THIS_MODULE,
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 48b18dad6763..95ef64e4189a 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -79,6 +79,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/mutex.h>
+#include <linux/if_vlan.h>
 
 #ifdef CONFIG_INET
 #include <net/inet_common.h>
@@ -188,7 +189,6 @@ struct packet_sock {
         struct packet_ring_buffer       tx_ring;
         int                     copy_thresh;
 #endif
-        struct packet_type      prot_hook;
         spinlock_t              bind_lock;
         struct mutex            pg_vec_lock;
         unsigned int            running:1,      /* prot_hook is attached*/
@@ -204,6 +204,7 @@ struct packet_sock {
         unsigned int            tp_reserve;
         unsigned int            tp_loss:1;
 #endif
+        struct packet_type      prot_hook ____cacheline_aligned_in_smp;
 };
 
 struct packet_skb_cb {
@@ -490,6 +491,7 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
         skb->protocol = proto;
         skb->dev = dev;
         skb->priority = sk->sk_priority;
+        skb->mark = sk->sk_mark;
         if (err)
                 goto out_free;
 
@@ -626,15 +628,14 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
 
         spin_lock(&sk->sk_receive_queue.lock);
         po->stats.tp_packets++;
+        skb->dropcount = atomic_read(&sk->sk_drops);
         __skb_queue_tail(&sk->sk_receive_queue, skb);
         spin_unlock(&sk->sk_receive_queue.lock);
         sk->sk_data_ready(sk, skb->len);
         return 0;
 
 drop_n_acct:
-        spin_lock(&sk->sk_receive_queue.lock);
-        po->stats.tp_drops++;
-        spin_unlock(&sk->sk_receive_queue.lock);
+        po->stats.tp_drops = atomic_inc_return(&sk->sk_drops);
 
 drop_n_restore:
         if (skb_head != skb->data && skb_shared(skb)) {
@@ -766,7 +767,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
                         getnstimeofday(&ts);
                 h.h2->tp_sec = ts.tv_sec;
                 h.h2->tp_nsec = ts.tv_nsec;
-                h.h2->tp_vlan_tci = skb->vlan_tci;
+                h.h2->tp_vlan_tci = vlan_tx_tag_get(skb);
                 hdrlen = sizeof(*h.h2);
                 break;
         default:
@@ -856,6 +857,7 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
         skb->protocol = proto;
         skb->dev = dev;
         skb->priority = po->sk.sk_priority;
+        skb->mark = po->sk.sk_mark;
         skb_shinfo(skb)->destructor_arg = ph.raw;
 
         switch (po->tp_version) {
@@ -1122,6 +1124,7 @@ static int packet_snd(struct socket *sock,
         skb->protocol = proto;
         skb->dev = dev;
         skb->priority = sk->sk_priority;
+        skb->mark = sk->sk_mark;
 
         /*
          *      Now send it
@@ -1472,7 +1475,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (err)
                 goto out_free;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         if (msg->msg_name)
                 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
@@ -1488,7 +1491,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
                 aux.tp_snaplen = skb->len;
                 aux.tp_mac = 0;
                 aux.tp_net = skb_network_offset(skb);
-                aux.tp_vlan_tci = skb->vlan_tci;
+                aux.tp_vlan_tci = vlan_tx_tag_get(skb);
 
                 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
         }
@@ -1659,11 +1662,9 @@ static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
                         if (--ml->count == 0) {
                                 struct net_device *dev;
                                 *mlp = ml->next;
-                                dev = dev_get_by_index(sock_net(sk), ml->ifindex);
-                                if (dev) {
+                                dev = __dev_get_by_index(sock_net(sk), ml->ifindex);
+                                if (dev)
                                         packet_dev_mc(dev, ml, -1);
-                                        dev_put(dev);
-                                }
                                 kfree(ml);
                         }
                         rtnl_unlock();
@@ -1687,11 +1688,9 @@ static void packet_flush_mclist(struct sock *sk)
                 struct net_device *dev;
 
                 po->mclist = ml->next;
-                dev = dev_get_by_index(sock_net(sk), ml->ifindex);
-                if (dev != NULL) {
+                dev = __dev_get_by_index(sock_net(sk), ml->ifindex);
+                if (dev != NULL)
                         packet_dev_mc(dev, ml, -1);
-                        dev_put(dev);
-                }
                 kfree(ml);
         }
         rtnl_unlock();
@@ -2081,7 +2080,7 @@ static void packet_mm_close(struct vm_area_struct *vma)
                 atomic_dec(&pkt_sk(sk)->mapped);
 }
 
-static struct vm_operations_struct packet_mmap_ops = {
+static const struct vm_operations_struct packet_mmap_ops = {
         .open   =       packet_mm_open,
         .close  =       packet_mm_close,
 };
@@ -2360,7 +2359,7 @@ static const struct proto_ops packet_ops = {
         .sendpage =     sock_no_sendpage,
 };
 
-static struct net_proto_family packet_family_ops = {
+static const struct net_proto_family packet_family_ops = {
         .family =       PF_PACKET,
         .create =       packet_create,
         .owner  =       THIS_MODULE,
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index f60c0c2aacba..66737aa995ea 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -118,7 +118,7 @@ out:
         return err;
 }
 
-static struct net_proto_family phonet_proto_family = {
+static const struct net_proto_family phonet_proto_family = {
         .family = PF_PHONET,
         .create = pn_socket_create,
         .owner = THIS_MODULE,
@@ -190,9 +190,8 @@ static int pn_send(struct sk_buff *skb, struct net_device *dev,
         skb->priority = 0;
         skb->dev = dev;
 
-        if (pn_addr(src) == pn_addr(dst)) {
+        if (skb->pkt_type == PACKET_LOOPBACK) {
                 skb_reset_mac_header(skb);
-                skb->pkt_type = PACKET_LOOPBACK;
                 skb_orphan(skb);
                 if (irq)
                         netif_rx(skb);
@@ -222,6 +221,9 @@ static int pn_raw_send(const void *data, int len, struct net_device *dev,
         if (skb == NULL)
                 return -ENOMEM;
 
+        if (phonet_address_lookup(dev_net(dev), pn_addr(dst)) == 0)
+                skb->pkt_type = PACKET_LOOPBACK;
+
         skb_reserve(skb, MAX_PHONET_HEADER);
         __skb_put(skb, len);
         skb_copy_to_linear_data(skb, data, len);
@@ -235,6 +237,7 @@ static int pn_raw_send(const void *data, int len, struct net_device *dev,
 int pn_skb_send(struct sock *sk, struct sk_buff *skb,
                 const struct sockaddr_pn *target)
 {
+        struct net *net = sock_net(sk);
         struct net_device *dev;
         struct pn_sock *pn = pn_sk(sk);
         int err;
@@ -243,9 +246,13 @@ int pn_skb_send(struct sock *sk, struct sk_buff *skb,
 
         err = -EHOSTUNREACH;
         if (sk->sk_bound_dev_if)
-                dev = dev_get_by_index(sock_net(sk), sk->sk_bound_dev_if);
-        else
-                dev = phonet_device_get(sock_net(sk));
+                dev = dev_get_by_index(net, sk->sk_bound_dev_if);
+        else if (phonet_address_lookup(net, daddr) == 0) {
+                dev = phonet_device_get(net);
+                skb->pkt_type = PACKET_LOOPBACK;
+        } else
+                dev = phonet_route_output(net, daddr);
+
         if (!dev || !(dev->flags & IFF_UP))
                 goto drop;
 
@@ -369,6 +376,12 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
 
         pn_skb_get_dst_sockaddr(skb, &sa);
 
+        /* check if this is broadcasted */
+        if (pn_sockaddr_get_addr(&sa) == PNADDR_BROADCAST) {
+                pn_deliver_sock_broadcast(net, skb);
+                goto out;
+        }
+
         /* check if we are the destination */
         if (phonet_address_lookup(net, pn_sockaddr_get_addr(&sa)) == 0) {
                 /* Phonet packet input */
@@ -381,6 +394,38 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
                         send_obj_unreachable(skb);
                         send_reset_indications(skb);
                 }
+        } else if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
+                goto out; /* Race between address deletion and loopback */
+        else {
+                /* Phonet packet routing */
+                struct net_device *out_dev;
+
+                out_dev = phonet_route_output(net, pn_sockaddr_get_addr(&sa));
+                if (!out_dev) {
+                        LIMIT_NETDEBUG(KERN_WARNING"No Phonet route to %02X\n",
+                                        pn_sockaddr_get_addr(&sa));
+                        goto out;
+                }
+
+                __skb_push(skb, sizeof(struct phonethdr));
+                skb->dev = out_dev;
+                if (out_dev == dev) {
+                        LIMIT_NETDEBUG(KERN_ERR"Phonet loop to %02X on %s\n",
+                                        pn_sockaddr_get_addr(&sa), dev->name);
+                        goto out_dev;
+                }
+                /* Some drivers (e.g. TUN) do not allocate HW header space */
+                if (skb_cow_head(skb, out_dev->hard_header_len))
+                        goto out_dev;
+
+                if (dev_hard_header(skb, out_dev, ETH_P_PHONET, NULL, NULL,
+                                        skb->len) < 0)
+                        goto out_dev;
+                dev_queue_xmit(skb);
+                dev_put(out_dev);
+                return NET_RX_SUCCESS;
+out_dev:
+                dev_put(out_dev);
         }
 
 out:
diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
index ef5c75c372e4..67f072e94d00 100644
--- a/net/phonet/datagram.c
+++ b/net/phonet/datagram.c
@@ -159,11 +159,9 @@ out_nofree:
 static int pn_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 {
         int err = sock_queue_rcv_skb(sk, skb);
-        if (err < 0) {
+
+        if (err < 0)
                 kfree_skb(skb);
-                if (err == -ENOMEM)
-                        atomic_inc(&sk->sk_drops);
-        }
         return err ? NET_RX_DROP : NET_RX_SUCCESS;
 }
 
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 5f32d217535b..cbaa1d67d77b 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -360,8 +360,6 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
                         err = sock_queue_rcv_skb(sk, skb);
                         if (!err)
                                 return 0;
-                        if (err == -ENOMEM)
-                                atomic_inc(&sk->sk_drops);
                         break;
                 }
 
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 5f42f30dd168..6d64fda1afc9 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -33,8 +33,14 @@
 #include <net/netns/generic.h>
 #include <net/phonet/pn_dev.h>
 
+struct phonet_routes {
+        spinlock_t              lock;
+        struct net_device       *table[64];
+};
+
 struct phonet_net {
         struct phonet_device_list pndevs;
+        struct phonet_routes routes;
 };
 
 int phonet_net_id;
@@ -154,10 +160,11 @@ int phonet_address_del(struct net_device *dev, u8 addr)
 }
 
 /* Gets a source address toward a destination, through a interface. */
-u8 phonet_address_get(struct net_device *dev, u8 addr)
+u8 phonet_address_get(struct net_device *dev, u8 daddr)
 {
         struct phonet_device_list *pndevs = phonet_device_list(dev_net(dev));
         struct phonet_device *pnd;
+        u8 saddr;
 
         spin_lock_bh(&pndevs->lock);
         pnd = __phonet_get(dev);
@@ -165,12 +172,26 @@ u8 phonet_address_get(struct net_device *dev, u8 addr)
                 BUG_ON(bitmap_empty(pnd->addrs, 64));
 
                 /* Use same source address as destination, if possible */
-                if (!test_bit(addr >> 2, pnd->addrs))
-                        addr = find_first_bit(pnd->addrs, 64) << 2;
+                if (test_bit(daddr >> 2, pnd->addrs))
+                        saddr = daddr;
+                else
+                        saddr = find_first_bit(pnd->addrs, 64) << 2;
         } else
-                addr = PN_NO_ADDR;
+                saddr = PN_NO_ADDR;
         spin_unlock_bh(&pndevs->lock);
-        return addr;
+
+        if (saddr == PN_NO_ADDR) {
+                /* Fallback to another device */
+                struct net_device *def_dev;
+
+                def_dev = phonet_device_get(dev_net(dev));
+                if (def_dev) {
+                        if (def_dev != dev)
+                                saddr = phonet_address_get(def_dev, daddr);
+                        dev_put(def_dev);
+                }
+        }
+        return saddr;
 }
 
 int phonet_address_lookup(struct net *net, u8 addr)
@@ -219,6 +240,27 @@ static int phonet_device_autoconf(struct net_device *dev)
         return 0;
 }
 
+static void phonet_route_autodel(struct net_device *dev)
+{
+        struct phonet_net *pnn = net_generic(dev_net(dev), phonet_net_id);
+        unsigned i;
+        DECLARE_BITMAP(deleted, 64);
+
+        /* Remove left-over Phonet routes */
+        bitmap_zero(deleted, 64);
+        spin_lock_bh(&pnn->routes.lock);
+        for (i = 0; i < 64; i++)
+                if (dev == pnn->routes.table[i]) {
+                        set_bit(i, deleted);
+                        pnn->routes.table[i] = NULL;
+                        dev_put(dev);
+                }
+        spin_unlock_bh(&pnn->routes.lock);
+        for (i = find_first_bit(deleted, 64); i < 64;
+                        i = find_next_bit(deleted, 64, i + 1))
+                rtm_phonet_notify(RTM_DELROUTE, dev, i);
+}
+
 /* notify Phonet of device events */
 static int phonet_device_notify(struct notifier_block *me, unsigned long what,
                                 void *arg)
@@ -232,6 +274,7 @@ static int phonet_device_notify(struct notifier_block *me, unsigned long what,
                 break;
         case NETDEV_UNREGISTER:
                 phonet_device_destroy(dev);
+                phonet_route_autodel(dev);
                 break;
         }
         return 0;
@@ -246,7 +289,7 @@ static struct notifier_block phonet_device_notifier = {
 /* Per-namespace Phonet devices handling */
 static int phonet_init_net(struct net *net)
 {
-        struct phonet_net *pnn = kmalloc(sizeof(*pnn), GFP_KERNEL);
+        struct phonet_net *pnn = kzalloc(sizeof(*pnn), GFP_KERNEL);
         if (!pnn)
                 return -ENOMEM;
 
@@ -257,6 +300,7 @@ static int phonet_init_net(struct net *net)
 
         INIT_LIST_HEAD(&pnn->pndevs.list);
         spin_lock_init(&pnn->pndevs.lock);
+        spin_lock_init(&pnn->routes.lock);
         net_assign_generic(net, phonet_net_id, pnn);
         return 0;
 }
@@ -265,10 +309,19 @@ static void phonet_exit_net(struct net *net)
 {
         struct phonet_net *pnn = net_generic(net, phonet_net_id);
         struct net_device *dev;
+        unsigned i;
 
         rtnl_lock();
         for_each_netdev(net, dev)
                 phonet_device_destroy(dev);
+
+        for (i = 0; i < 64; i++) {
+                dev = pnn->routes.table[i];
+                if (dev) {
+                        rtm_phonet_notify(RTM_DELROUTE, dev, i);
+                        dev_put(dev);
+                }
+        }
         rtnl_unlock();
 
         proc_net_remove(net, "phonet");
@@ -300,3 +353,69 @@ void phonet_device_exit(void)
         unregister_netdevice_notifier(&phonet_device_notifier);
         unregister_pernet_gen_device(phonet_net_id, &phonet_net_ops);
 }
+
+int phonet_route_add(struct net_device *dev, u8 daddr)
+{
+        struct phonet_net *pnn = net_generic(dev_net(dev), phonet_net_id);
+        struct phonet_routes *routes = &pnn->routes;
+        int err = -EEXIST;
+
+        daddr = daddr >> 2;
+        spin_lock_bh(&routes->lock);
+        if (routes->table[daddr] == NULL) {
+                routes->table[daddr] = dev;
+                dev_hold(dev);
+                err = 0;
+        }
+        spin_unlock_bh(&routes->lock);
+        return err;
+}
+
+int phonet_route_del(struct net_device *dev, u8 daddr)
+{
+        struct phonet_net *pnn = net_generic(dev_net(dev), phonet_net_id);
+        struct phonet_routes *routes = &pnn->routes;
+        int err = -ENOENT;
+
+        daddr = daddr >> 2;
+        spin_lock_bh(&routes->lock);
+        if (dev == routes->table[daddr]) {
+                routes->table[daddr] = NULL;
+                dev_put(dev);
+                err = 0;
+        }
+        spin_unlock_bh(&routes->lock);
+        return err;
+}
+
+struct net_device *phonet_route_get(struct net *net, u8 daddr)
+{
+        struct phonet_net *pnn = net_generic(net, phonet_net_id);
+        struct phonet_routes *routes = &pnn->routes;
+        struct net_device *dev;
+
+        ASSERT_RTNL(); /* no need to hold the device */
+
+        daddr >>= 2;
+        spin_lock_bh(&routes->lock);
+        dev = routes->table[daddr];
+        spin_unlock_bh(&routes->lock);
+        return dev;
+}
+
+struct net_device *phonet_route_output(struct net *net, u8 daddr)
+{
+        struct phonet_net *pnn = net_generic(net, phonet_net_id);
+        struct phonet_routes *routes = &pnn->routes;
+        struct net_device *dev;
+
+        spin_lock_bh(&routes->lock);
+        dev = routes->table[daddr >> 2];
+        if (dev)
+                dev_hold(dev);
+        spin_unlock_bh(&routes->lock);
+
+        if (!dev)
+                dev = phonet_device_get(net); /* Default route */
+        return dev;
+}
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index d21fd3576610..d8f5d3fb9ee2 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c
@@ -29,6 +29,8 @@
 #include <net/sock.h>
 #include <net/phonet/pn_dev.h>
 
+/* Device address handling */
+
 static int fill_addr(struct sk_buff *skb, struct net_device *dev, u8 addr,
                      u32 pid, u32 seq, int event);
 
@@ -160,6 +162,131 @@ out:
         return skb->len;
 }
 
+/* Routes handling */
+
+static int fill_route(struct sk_buff *skb, struct net_device *dev, u8 dst,
+                        u32 pid, u32 seq, int event)
+{
+        struct rtmsg *rtm;
+        struct nlmsghdr *nlh;
+
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(*rtm), 0);
+        if (nlh == NULL)
+                return -EMSGSIZE;
+
+        rtm = nlmsg_data(nlh);
+        rtm->rtm_family = AF_PHONET;
+        rtm->rtm_dst_len = 6;
+        rtm->rtm_src_len = 0;
+        rtm->rtm_tos = 0;
+        rtm->rtm_table = RT_TABLE_MAIN;
+        rtm->rtm_protocol = RTPROT_STATIC;
+        rtm->rtm_scope = RT_SCOPE_UNIVERSE;
+        rtm->rtm_type = RTN_UNICAST;
+        rtm->rtm_flags = 0;
+        NLA_PUT_U8(skb, RTA_DST, dst);
+        NLA_PUT_U32(skb, RTA_OIF, dev->ifindex);
+        return nlmsg_end(skb, nlh);
+
+nla_put_failure:
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
+}
+
+void rtm_phonet_notify(int event, struct net_device *dev, u8 dst)
+{
+        struct sk_buff *skb;
+        int err = -ENOBUFS;
+
+        skb = nlmsg_new(NLMSG_ALIGN(sizeof(struct ifaddrmsg)) +
+                        nla_total_size(1) + nla_total_size(4), GFP_KERNEL);
+        if (skb == NULL)
+                goto errout;
+        err = fill_route(skb, dev, dst, 0, 0, event);
+        if (err < 0) {
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
+        rtnl_notify(skb, dev_net(dev), 0,
+                          RTNLGRP_PHONET_ROUTE, NULL, GFP_KERNEL);
+        return;
+errout:
+        if (err < 0)
+                rtnl_set_sk_err(dev_net(dev), RTNLGRP_PHONET_ROUTE, err);
+}
+
+static const struct nla_policy rtm_phonet_policy[RTA_MAX+1] = {
+        [RTA_DST] = { .type = NLA_U8 },
+        [RTA_OIF] = { .type = NLA_U32 },
+};
+
+static int route_doit(struct sk_buff *skb, struct nlmsghdr *nlh, void *attr)
+{
+        struct net *net = sock_net(skb->sk);
+        struct nlattr *tb[RTA_MAX+1];
+        struct net_device *dev;
+        struct rtmsg *rtm;
+        int err;
+        u8 dst;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        ASSERT_RTNL();
+
+        err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_phonet_policy);
+        if (err < 0)
+                return err;
+
+        rtm = nlmsg_data(nlh);
+        if (rtm->rtm_table != RT_TABLE_MAIN || rtm->rtm_type != RTN_UNICAST)
+                return -EINVAL;
+        if (tb[RTA_DST] == NULL || tb[RTA_OIF] == NULL)
+                return -EINVAL;
+        dst = nla_get_u8(tb[RTA_DST]);
+        if (dst & 3) /* Phonet addresses only have 6 high-order bits */
+                return -EINVAL;
+
+        dev = __dev_get_by_index(net, nla_get_u32(tb[RTA_OIF]));
+        if (dev == NULL)
+                return -ENODEV;
+
+        if (nlh->nlmsg_type == RTM_NEWROUTE)
+                err = phonet_route_add(dev, dst);
+        else
+                err = phonet_route_del(dev, dst);
+        if (!err)
+                rtm_phonet_notify(nlh->nlmsg_type, dev, dst);
+        return err;
+}
+
+static int route_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        struct net *net = sock_net(skb->sk);
+        u8 addr, addr_idx = 0, addr_start_idx = cb->args[0];
+
+        for (addr = 0; addr < 64; addr++) {
+                struct net_device *dev;
+
+                dev = phonet_route_get(net, addr << 2);
+                if (!dev)
+                        continue;
+
+                if (addr_idx++ < addr_start_idx)
+                        continue;
+                if (fill_route(skb, dev, addr << 2, NETLINK_CB(cb->skb).pid,
+                                cb->nlh->nlmsg_seq, RTM_NEWROUTE))
+                        goto out;
+        }
+
+out:
+        cb->args[0] = addr_idx;
+        cb->args[1] = 0;
+
+        return skb->len;
+}
+
 int __init phonet_netlink_register(void)
 {
         int err = __rtnl_register(PF_PHONET, RTM_NEWADDR, addr_doit, NULL);
@@ -169,5 +296,8 @@ int __init phonet_netlink_register(void)
         /* Further __rtnl_register() cannot fail */
         __rtnl_register(PF_PHONET, RTM_DELADDR, addr_doit, NULL);
         __rtnl_register(PF_PHONET, RTM_GETADDR, NULL, getaddr_dumpit);
+        __rtnl_register(PF_PHONET, RTM_NEWROUTE, route_doit, NULL);
+        __rtnl_register(PF_PHONET, RTM_DELROUTE, route_doit, NULL);
+        __rtnl_register(PF_PHONET, RTM_GETROUTE, NULL, route_dumpit);
         return 0;
 }
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index aa5b5a972bff..0412beb59a05 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -94,7 +94,30 @@ struct sock *pn_find_sock_by_sa(struct net *net, const struct sockaddr_pn *spn)
         spin_unlock_bh(&pnsocks.lock);
 
         return rval;
+}
+
+/* Deliver a broadcast packet (only in bottom-half) */
+void pn_deliver_sock_broadcast(struct net *net, struct sk_buff *skb)
+{
+        struct hlist_node *node;
+        struct sock *sknode;
+
+        spin_lock(&pnsocks.lock);
+        sk_for_each(sknode, node, &pnsocks.hlist) {
+                struct sk_buff *clone;
 
+                if (!net_eq(sock_net(sknode), net))
+                        continue;
+                if (!sock_flag(sknode, SOCK_BROADCAST))
+                        continue;
+
+                clone = skb_clone(skb, GFP_ATOMIC);
+                if (clone) {
+                        sock_hold(sknode);
+                        sk_receive_skb(sknode, clone, 0);
+                }
+        }
+        spin_unlock(&pnsocks.lock);
 }
 
 void pn_sock_hash(struct sock *sk)
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index 98e05382fd3c..a202e5b36079 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -431,7 +431,7 @@ void rds_sock_put(struct rds_sock *rs)
         sock_put(rds_rs_to_sk(rs));
 }
 
-static struct net_proto_family rds_family_ops = {
+static const struct net_proto_family rds_family_ops = {
         .family =       AF_RDS,
         .create =       rds_create,
         .owner  =       THIS_MODULE,
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 24b743eb0b1b..45474a436862 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -67,11 +67,11 @@ static int rds_tcp_accept_one(struct socket *sock)
         inet = inet_sk(new_sock->sk);
 
         rdsdebug("accepted tcp %u.%u.%u.%u:%u -> %u.%u.%u.%u:%u\n",
-                  NIPQUAD(inet->saddr), ntohs(inet->sport),
-                  NIPQUAD(inet->daddr), ntohs(inet->dport));
+                  NIPQUAD(inet->inet_saddr), ntohs(inet->inet_sport),
+                  NIPQUAD(inet->inet_daddr), ntohs(inet->inet_dport));
 
-        conn = rds_conn_create(inet->saddr, inet->daddr, &rds_tcp_transport,
-                               GFP_KERNEL);
+        conn = rds_conn_create(inet->inet_saddr, inet->inet_daddr,
+                               &rds_tcp_transport, GFP_KERNEL);
         if (IS_ERR(conn)) {
                 ret = PTR_ERR(conn);
                 goto out;
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index dbeaf2983822..ba2efb960c60 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -27,6 +27,7 @@
 #include <linux/list.h>
 #include <linux/mutex.h>
 #include <linux/rfkill.h>
+#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/miscdevice.h>
 #include <linux/wait.h>
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 502cce76621d..c17734c2ce89 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1509,7 +1509,7 @@ static const struct file_operations rose_info_fops = {
 };
 #endif  /* CONFIG_PROC_FS */
 
-static struct net_proto_family rose_family_ops = {
+static const struct net_proto_family rose_family_ops = {
         .family         =       PF_ROSE,
         .create         =       rose_create,
         .owner          =       THIS_MODULE,
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index a86afceaa94f..6817c9781ef3 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -777,7 +777,7 @@ static struct proto rxrpc_proto = {
         .max_header     = sizeof(struct rxrpc_header),
 };
 
-static struct net_proto_family rxrpc_family_ops = {
+static const struct net_proto_family rxrpc_family_ops = {
         .family = PF_RXRPC,
         .create = rxrpc_create,
         .owner  = THIS_MODULE,
diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
index a39bf97f8830..60c2b94e6b54 100644
--- a/net/rxrpc/ar-recvmsg.c
+++ b/net/rxrpc/ar-recvmsg.c
@@ -146,7 +146,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
                                 memcpy(msg->msg_name,
                                        &call->conn->trans->peer->srx,
                                        sizeof(call->conn->trans->peer->srx));
-                        sock_recv_timestamp(msg, &rx->sk, skb);
+                        sock_recv_ts_and_drops(msg, &rx->sk, skb);
                 }
 
                 /* receive the message */
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 2dfb3e7a040d..ca2e1fd2bf69 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -618,7 +618,8 @@ int tcf_action_copy_stats(struct sk_buff *skb, struct tc_action *a,
                         goto errout;
 
         if (gnet_stats_copy_basic(&d, &h->tcf_bstats) < 0 ||
-            gnet_stats_copy_rate_est(&d, &h->tcf_rate_est) < 0 ||
+            gnet_stats_copy_rate_est(&d, &h->tcf_bstats,
+                                     &h->tcf_rate_est) < 0 ||
             gnet_stats_copy_queue(&d, &h->tcf_qstats) < 0)
                 goto errout;
 
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 4ab916b8074b..e9607fe55b58 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -54,6 +54,8 @@ static int tcf_skbedit(struct sk_buff *skb, struct tc_action *a,
         if (d->flags & SKBEDIT_F_QUEUE_MAPPING &&
             skb->dev->real_num_tx_queues > d->queue_mapping)
                 skb_set_queue_mapping(skb, d->queue_mapping);
+        if (d->flags & SKBEDIT_F_MARK)
+                skb->mark = d->mark;
 
         spin_unlock(&d->tcf_lock);
         return d->tcf_action;
@@ -63,6 +65,7 @@ static const struct nla_policy skbedit_policy[TCA_SKBEDIT_MAX + 1] = {
         [TCA_SKBEDIT_PARMS]             = { .len = sizeof(struct tc_skbedit) },
         [TCA_SKBEDIT_PRIORITY]          = { .len = sizeof(u32) },
         [TCA_SKBEDIT_QUEUE_MAPPING]     = { .len = sizeof(u16) },
+        [TCA_SKBEDIT_MARK]              = { .len = sizeof(u32) },
 };
 
 static int tcf_skbedit_init(struct nlattr *nla, struct nlattr *est,
@@ -72,7 +75,7 @@ static int tcf_skbedit_init(struct nlattr *nla, struct nlattr *est,
         struct tc_skbedit *parm;
         struct tcf_skbedit *d;
         struct tcf_common *pc;
-        u32 flags = 0, *priority = NULL;
+        u32 flags = 0, *priority = NULL, *mark = NULL;
         u16 *queue_mapping = NULL;
         int ret = 0, err;
 
@@ -95,6 +98,12 @@ static int tcf_skbedit_init(struct nlattr *nla, struct nlattr *est,
                 flags |= SKBEDIT_F_QUEUE_MAPPING;
                 queue_mapping = nla_data(tb[TCA_SKBEDIT_QUEUE_MAPPING]);
         }
+
+        if (tb[TCA_SKBEDIT_MARK] != NULL) {
+                flags |= SKBEDIT_F_MARK;
+                mark = nla_data(tb[TCA_SKBEDIT_MARK]);
+        }
+
         if (!flags)
                 return -EINVAL;
 
@@ -124,6 +133,9 @@ static int tcf_skbedit_init(struct nlattr *nla, struct nlattr *est,
                 d->priority = *priority;
         if (flags & SKBEDIT_F_QUEUE_MAPPING)
                 d->queue_mapping = *queue_mapping;
+        if (flags & SKBEDIT_F_MARK)
+                d->mark = *mark;
+
         d->tcf_action = parm->action;
 
         spin_unlock_bh(&d->tcf_lock);
@@ -161,6 +173,9 @@ static inline int tcf_skbedit_dump(struct sk_buff *skb, struct tc_action *a,
         if (d->flags & SKBEDIT_F_QUEUE_MAPPING)
                 NLA_PUT(skb, TCA_SKBEDIT_QUEUE_MAPPING,
                         sizeof(d->queue_mapping), &d->queue_mapping);
+        if (d->flags & SKBEDIT_F_MARK)
+                NLA_PUT(skb, TCA_SKBEDIT_MARK, sizeof(d->mark),
+                        &d->mark);
         t.install = jiffies_to_clock_t(jiffies - d->tcf_tm.install);
         t.lastuse = jiffies_to_clock_t(jiffies - d->tcf_tm.lastuse);
         t.expires = jiffies_to_clock_t(d->tcf_tm.expires);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 903e4188b6ca..1acfd29cc826 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1179,7 +1179,7 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
                 goto nla_put_failure;
 
         if (gnet_stats_copy_basic(&d, &q->bstats) < 0 ||
-            gnet_stats_copy_rate_est(&d, &q->rate_est) < 0 ||
+            gnet_stats_copy_rate_est(&d, &q->bstats, &q->rate_est) < 0 ||
             gnet_stats_copy_queue(&d, &q->qstats) < 0)
                 goto nla_put_failure;
 
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 5b132c473264..3846d65bc03e 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1609,7 +1609,7 @@ cbq_dump_class_stats(struct Qdisc *sch, unsigned long arg,
                 cl->xstats.undertime = cl->undertime - q->now;
 
         if (gnet_stats_copy_basic(d, &cl->bstats) < 0 ||
-            gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
+            gnet_stats_copy_rate_est(d, &cl->bstats, &cl->rate_est) < 0 ||
             gnet_stats_copy_queue(d, &cl->qstats) < 0)
                 return -1;
 
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 5a888af7e5da..a65604f8f2b8 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -280,7 +280,7 @@ static int drr_dump_class_stats(struct Qdisc *sch, unsigned long arg,
         }
 
         if (gnet_stats_copy_basic(d, &cl->bstats) < 0 ||
-            gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
+            gnet_stats_copy_rate_est(d, &cl->bstats, &cl->rate_est) < 0 ||
             gnet_stats_copy_queue(d, &cl->qdisc->qstats) < 0)
                 return -1;
 
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 2c5c76be18f8..b38b39c60752 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1375,7 +1375,7 @@ hfsc_dump_class_stats(struct Qdisc *sch, unsigned long arg,
         xstats.rtwork  = cl->cl_cumul;
 
         if (gnet_stats_copy_basic(d, &cl->bstats) < 0 ||
-            gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
+            gnet_stats_copy_rate_est(d, &cl->bstats, &cl->rate_est) < 0 ||
             gnet_stats_copy_queue(d, &cl->qstats) < 0)
                 return -1;
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 85acab9dc6fd..2e38d1abd830 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1105,7 +1105,7 @@ htb_dump_class_stats(struct Qdisc *sch, unsigned long arg, struct gnet_dump *d)
         cl->xstats.ctokens = cl->ctokens;
 
         if (gnet_stats_copy_basic(d, &cl->bstats) < 0 ||
-            gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
+            gnet_stats_copy_rate_est(d, NULL, &cl->rate_est) < 0 ||
             gnet_stats_copy_queue(d, &cl->qstats) < 0)
                 return -1;
 
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 612dc878e05c..d9f4cc2c7869 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -296,19 +296,19 @@ static void sctp_v4_from_sk(union sctp_addr *addr, struct sock *sk)
 {
         addr->v4.sin_family = AF_INET;
         addr->v4.sin_port = 0;
-        addr->v4.sin_addr.s_addr = inet_sk(sk)->rcv_saddr;
+        addr->v4.sin_addr.s_addr = inet_sk(sk)->inet_rcv_saddr;
 }
 
 /* Initialize sk->sk_rcv_saddr from sctp_addr. */
 static void sctp_v4_to_sk_saddr(union sctp_addr *addr, struct sock *sk)
 {
-        inet_sk(sk)->rcv_saddr = addr->v4.sin_addr.s_addr;
+        inet_sk(sk)->inet_rcv_saddr = addr->v4.sin_addr.s_addr;
 }
 
 /* Initialize sk->sk_daddr from sctp_addr. */
 static void sctp_v4_to_sk_daddr(union sctp_addr *addr, struct sock *sk)
 {
-        inet_sk(sk)->daddr = addr->v4.sin_addr.s_addr;
+        inet_sk(sk)->inet_daddr = addr->v4.sin_addr.s_addr;
 }
 
 /* Initialize a sctp_addr from an address parameter. */
@@ -598,7 +598,7 @@ static struct sock *sctp_v4_create_accept_sk(struct sock *sk,
 
         newinet = inet_sk(newsk);
 
-        newinet->daddr = asoc->peer.primary_addr.v4.sin_addr.s_addr;
+        newinet->inet_daddr = asoc->peer.primary_addr.v4.sin_addr.s_addr;
 
         sk_refcnt_debug_inc(newsk);
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index c8d05758661d..4085db99033d 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -394,7 +394,7 @@ SCTP_STATIC int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
 
         /* Refresh ephemeral port.  */
         if (!bp->port)
-                bp->port = inet_sk(sk)->num;
+                bp->port = inet_sk(sk)->inet_num;
 
         /* Add the address to the bind address list.
          * Use GFP_ATOMIC since BHs will be disabled.
@@ -403,7 +403,7 @@ SCTP_STATIC int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
 
         /* Copy back into socket for getsockname() use. */
         if (!ret) {
-                inet_sk(sk)->sport = htons(inet_sk(sk)->num);
+                inet_sk(sk)->inet_sport = htons(inet_sk(sk)->inet_num);
                 af->to_sk_saddr(addr, sk);
         }
 
@@ -1115,7 +1115,7 @@ static int __sctp_connect(struct sock* sk,
         }
 
         /* Initialize sk's dport and daddr for getpeername() */
-        inet_sk(sk)->dport = htons(asoc->peer.port);
+        inet_sk(sk)->inet_dport = htons(asoc->peer.port);
         af = sctp_get_af_specific(sa_addr->sa.sa_family);
         af->to_sk_daddr(sa_addr, sk);
         sk->sk_err = 0;
@@ -1958,7 +1958,7 @@ SCTP_STATIC int sctp_recvmsg(struct kiocb *iocb, struct sock *sk,
         if (err)
                 goto out_free;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
         if (sctp_ulpevent_is_notification(event)) {
                 msg->msg_flags |= MSG_NOTIFICATION;
                 sp->pf->event_msgname(event, msg->msg_name, addr_len);
@@ -5851,7 +5851,7 @@ pp_not_found:
          */
 success:
         if (!sctp_sk(sk)->bind_hash) {
-                inet_sk(sk)->num = snum;
+                inet_sk(sk)->inet_num = snum;
                 sk_add_bind_node(sk, &pp->owner);
                 sctp_sk(sk)->bind_hash = pp;
         }
@@ -5923,7 +5923,7 @@ SCTP_STATIC int sctp_listen_start(struct sock *sk, int backlog)
                 if (sctp_autobind(sk))
                         return -EAGAIN;
         } else {
-                if (sctp_get_port(sk, inet_sk(sk)->num)) {
+                if (sctp_get_port(sk, inet_sk(sk)->inet_num)) {
                         sk->sk_state = SCTP_SS_CLOSED;
                         return -EADDRINUSE;
                 }
@@ -6094,14 +6094,14 @@ static void sctp_bucket_destroy(struct sctp_bind_bucket *pp)
 static inline void __sctp_put_port(struct sock *sk)
 {
         struct sctp_bind_hashbucket *head =
-                &sctp_port_hashtable[sctp_phashfn(inet_sk(sk)->num)];
+                &sctp_port_hashtable[sctp_phashfn(inet_sk(sk)->inet_num)];
         struct sctp_bind_bucket *pp;
 
         sctp_spin_lock(&head->lock);
         pp = sctp_sk(sk)->bind_hash;
         __sk_del_bind_node(sk);
         sctp_sk(sk)->bind_hash = NULL;
-        inet_sk(sk)->num = 0;
+        inet_sk(sk)->inet_num = 0;
         sctp_bucket_destroy(pp);
         sctp_spin_unlock(&head->lock);
 }
@@ -6128,7 +6128,7 @@ static int sctp_autobind(struct sock *sk)
         /* Initialize a local sockaddr structure to INADDR_ANY. */
         af = sctp_sk(sk)->pf->af;
 
-        port = htons(inet_sk(sk)->num);
+        port = htons(inet_sk(sk)->inet_num);
         af->inaddr_any(&autoaddr, port);
 
         return sctp_do_bind(sk, &autoaddr, af->sockaddr_len);
@@ -6697,12 +6697,12 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
         /* Initialize sk's sport, dport, rcv_saddr and daddr for
          * getsockname() and getpeername()
          */
-        newinet->sport = inet->sport;
-        newinet->saddr = inet->saddr;
-        newinet->rcv_saddr = inet->rcv_saddr;
-        newinet->dport = htons(asoc->peer.port);
+        newinet->inet_sport = inet->inet_sport;
+        newinet->inet_saddr = inet->inet_saddr;
+        newinet->inet_rcv_saddr = inet->inet_rcv_saddr;
+        newinet->inet_dport = htons(asoc->peer.port);
         newinet->pmtudisc = inet->pmtudisc;
-        newinet->id = asoc->next_tsn ^ jiffies;
+        newinet->inet_id = asoc->next_tsn ^ jiffies;
 
         newinet->uc_ttl = inet->uc_ttl;
         newinet->mc_loop = 1;
@@ -6741,13 +6741,13 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         newsp->hmac = NULL;
 
         /* Hook this new socket in to the bind_hash list. */
-        head = &sctp_port_hashtable[sctp_phashfn(inet_sk(oldsk)->num)];
+        head = &sctp_port_hashtable[sctp_phashfn(inet_sk(oldsk)->inet_num)];
         sctp_local_bh_disable();
         sctp_spin_lock(&head->lock);
         pp = sctp_sk(oldsk)->bind_hash;
         sk_add_bind_node(newsk, &pp->owner);
         sctp_sk(newsk)->bind_hash = pp;
-        inet_sk(newsk)->num = inet_sk(oldsk)->num;
+        inet_sk(newsk)->inet_num = inet_sk(oldsk)->inet_num;
         sctp_spin_unlock(&head->lock);
         sctp_local_bh_enable();
 
diff --git a/net/socket.c b/net/socket.c
index 75655365b5fd..9dff31c9b799 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -668,10 +668,24 @@ void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
 
 EXPORT_SYMBOL_GPL(__sock_recv_timestamp);
 
-static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
-                                 struct msghdr *msg, size_t size, int flags)
+inline void sock_recv_drops(struct msghdr *msg, struct sock *sk, struct sk_buff *skb)
+{
+        if (sock_flag(sk, SOCK_RXQ_OVFL) && skb && skb->dropcount)
+                put_cmsg(msg, SOL_SOCKET, SO_RXQ_OVFL,
+                        sizeof(__u32), &skb->dropcount);
+}
+
+void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
+        struct sk_buff *skb)
+{
+        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_drops(msg, sk, skb);
+}
+EXPORT_SYMBOL_GPL(sock_recv_ts_and_drops);
+
+static inline int __sock_recvmsg_nosec(struct kiocb *iocb, struct socket *sock,
+                                       struct msghdr *msg, size_t size, int flags)
 {
-        int err;
         struct sock_iocb *si = kiocb_to_siocb(iocb);
 
         si->sock = sock;
@@ -680,13 +694,17 @@ static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         si->size = size;
         si->flags = flags;
 
-        err = security_socket_recvmsg(sock, msg, size, flags);
-        if (err)
-                return err;
-
         return sock->ops->recvmsg(iocb, sock, msg, size, flags);
 }
 
+static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
+                                 struct msghdr *msg, size_t size, int flags)
+{
+        int err = security_socket_recvmsg(sock, msg, size, flags);
+
+        return err ?: __sock_recvmsg_nosec(iocb, sock, msg, size, flags);
+}
+
 int sock_recvmsg(struct socket *sock, struct msghdr *msg,
                  size_t size, int flags)
 {
@@ -702,6 +720,21 @@ int sock_recvmsg(struct socket *sock, struct msghdr *msg,
         return ret;
 }
 
+static int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
+                              size_t size, int flags)
+{
+        struct kiocb iocb;
+        struct sock_iocb siocb;
+        int ret;
+
+        init_sync_kiocb(&iocb, NULL);
+        iocb.private = &siocb;
+        ret = __sock_recvmsg_nosec(&iocb, sock, msg, size, flags);
+        if (-EIOCBQUEUED == ret)
+                ret = wait_on_sync_kiocb(&iocb);
+        return ret;
+}
+
 int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
                    struct kvec *vec, size_t num, size_t size, int flags)
 {
@@ -905,11 +938,11 @@ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
         if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15)) {
                 err = dev_ioctl(net, cmd, argp);
         } else
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_WEXT_CORE
         if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
                 err = dev_ioctl(net, cmd, argp);
         } else
-#endif                          /* CONFIG_WIRELESS_EXT */
+#endif
                 switch (cmd) {
                 case FIOSETOWN:
                 case SIOCSPGRP:
@@ -1100,11 +1133,14 @@ static int sock_fasync(int fd, struct file *filp, int on)
                 fna->fa_next = sock->fasync_list;
                 write_lock_bh(&sk->sk_callback_lock);
                 sock->fasync_list = fna;
+                sock_set_flag(sk, SOCK_FASYNC);
                 write_unlock_bh(&sk->sk_callback_lock);
         } else {
                 if (fa != NULL) {
                         write_lock_bh(&sk->sk_callback_lock);
                         *prev = fa->fa_next;
+                        if (!sock->fasync_list)
+                                sock_reset_flag(sk, SOCK_FASYNC);
                         write_unlock_bh(&sk->sk_callback_lock);
                         kfree(fa);
                 }
@@ -1965,22 +2001,15 @@ out:
         return err;
 }
 
-/*
- *      BSD recvmsg interface
- */
-
-SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
-                unsigned int, flags)
+static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+                         struct msghdr *msg_sys, unsigned flags, int nosec)
 {
         struct compat_msghdr __user *msg_compat =
             (struct compat_msghdr __user *)msg;
-        struct socket *sock;
         struct iovec iovstack[UIO_FASTIOV];
         struct iovec *iov = iovstack;
-        struct msghdr msg_sys;
         unsigned long cmsg_ptr;
         int err, iov_size, total_len, len;
-        int fput_needed;
 
         /* kernel mode address */
         struct sockaddr_storage addr;
@@ -1990,27 +2019,23 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
         int __user *uaddr_len;
 
         if (MSG_CMSG_COMPAT & flags) {
-                if (get_compat_msghdr(&msg_sys, msg_compat))
+                if (get_compat_msghdr(msg_sys, msg_compat))
                         return -EFAULT;
         }
-        else if (copy_from_user(&msg_sys, msg, sizeof(struct msghdr)))
+        else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
                 return -EFAULT;
 
-        sock = sockfd_lookup_light(fd, &err, &fput_needed);
-        if (!sock)
-                goto out;
-
         err = -EMSGSIZE;
-        if (msg_sys.msg_iovlen > UIO_MAXIOV)
-                goto out_put;
+        if (msg_sys->msg_iovlen > UIO_MAXIOV)
+                goto out;
 
         /* Check whether to allocate the iovec area */
         err = -ENOMEM;
-        iov_size = msg_sys.msg_iovlen * sizeof(struct iovec);
-        if (msg_sys.msg_iovlen > UIO_FASTIOV) {
+        iov_size = msg_sys->msg_iovlen * sizeof(struct iovec);
+        if (msg_sys->msg_iovlen > UIO_FASTIOV) {
                 iov = sock_kmalloc(sock->sk, iov_size, GFP_KERNEL);
                 if (!iov)
-                        goto out_put;
+                        goto out;
         }
 
         /*
@@ -2018,46 +2043,47 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
          *      kernel msghdr to use the kernel address space)
          */
 
-        uaddr = (__force void __user *)msg_sys.msg_name;
+        uaddr = (__force void __user *)msg_sys->msg_name;
         uaddr_len = COMPAT_NAMELEN(msg);
         if (MSG_CMSG_COMPAT & flags) {
-                err = verify_compat_iovec(&msg_sys, iov,
+                err = verify_compat_iovec(msg_sys, iov,
                                           (struct sockaddr *)&addr,
                                           VERIFY_WRITE);
         } else
-                err = verify_iovec(&msg_sys, iov,
+                err = verify_iovec(msg_sys, iov,
                                    (struct sockaddr *)&addr,
                                    VERIFY_WRITE);
         if (err < 0)
                 goto out_freeiov;
         total_len = err;
 
-        cmsg_ptr = (unsigned long)msg_sys.msg_control;
-        msg_sys.msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
+        cmsg_ptr = (unsigned long)msg_sys->msg_control;
+        msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
 
         if (sock->file->f_flags & O_NONBLOCK)
                 flags |= MSG_DONTWAIT;
-        err = sock_recvmsg(sock, &msg_sys, total_len, flags);
+        err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
+                                                          total_len, flags);
         if (err < 0)
                 goto out_freeiov;
         len = err;
 
         if (uaddr != NULL) {
                 err = move_addr_to_user((struct sockaddr *)&addr,
-                                        msg_sys.msg_namelen, uaddr,
+                                        msg_sys->msg_namelen, uaddr,
                                         uaddr_len);
                 if (err < 0)
                         goto out_freeiov;
         }
-        err = __put_user((msg_sys.msg_flags & ~MSG_CMSG_COMPAT),
+        err = __put_user((msg_sys->msg_flags & ~MSG_CMSG_COMPAT),
                          COMPAT_FLAGS(msg));
         if (err)
                 goto out_freeiov;
         if (MSG_CMSG_COMPAT & flags)
-                err = __put_user((unsigned long)msg_sys.msg_control - cmsg_ptr,
+                err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
                                  &msg_compat->msg_controllen);
         else
-                err = __put_user((unsigned long)msg_sys.msg_control - cmsg_ptr,
+                err = __put_user((unsigned long)msg_sys->msg_control - cmsg_ptr,
                                  &msg->msg_controllen);
         if (err)
                 goto out_freeiov;
@@ -2066,21 +2092,150 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
 out_freeiov:
         if (iov != iovstack)
                 sock_kfree_s(sock->sk, iov, iov_size);
-out_put:
+out:
+        return err;
+}
+
+/*
+ *      BSD recvmsg interface
+ */
+
+SYSCALL_DEFINE3(recvmsg, int, fd, struct msghdr __user *, msg,
+                unsigned int, flags)
+{
+        int fput_needed, err;
+        struct msghdr msg_sys;
+        struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
+
+        if (!sock)
+                goto out;
+
+        err = __sys_recvmsg(sock, msg, &msg_sys, flags, 0);
+
         fput_light(sock->file, fput_needed);
 out:
         return err;
 }
 
-#ifdef __ARCH_WANT_SYS_SOCKETCALL
+/*
+ *     Linux recvmmsg interface
+ */
+
+int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
+                   unsigned int flags, struct timespec *timeout)
+{
+        int fput_needed, err, datagrams;
+        struct socket *sock;
+        struct mmsghdr __user *entry;
+        struct msghdr msg_sys;
+        struct timespec end_time;
+
+        if (timeout &&
+            poll_select_set_timeout(&end_time, timeout->tv_sec,
+                                    timeout->tv_nsec))
+                return -EINVAL;
+
+        datagrams = 0;
+
+        sock = sockfd_lookup_light(fd, &err, &fput_needed);
+        if (!sock)
+                return err;
+
+        err = sock_error(sock->sk);
+        if (err)
+                goto out_put;
+
+        entry = mmsg;
+
+        while (datagrams < vlen) {
+                /*
+                 * No need to ask LSM for more than the first datagram.
+                 */
+                err = __sys_recvmsg(sock, (struct msghdr __user *)entry,
+                                    &msg_sys, flags, datagrams);
+                if (err < 0)
+                        break;
+                err = put_user(err, &entry->msg_len);
+                if (err)
+                        break;
+                ++entry;
+                ++datagrams;
+
+                if (timeout) {
+                        ktime_get_ts(timeout);
+                        *timeout = timespec_sub(end_time, *timeout);
+                        if (timeout->tv_sec < 0) {
+                                timeout->tv_sec = timeout->tv_nsec = 0;
+                                break;
+                        }
+
+                        /* Timeout, return less than vlen datagrams */
+                        if (timeout->tv_nsec == 0 && timeout->tv_sec == 0)
+                                break;
+                }
+
+                /* Out of band data, return right away */
+                if (msg_sys.msg_flags & MSG_OOB)
+                        break;
+        }
+
+out_put:
+        fput_light(sock->file, fput_needed);
+
+        if (err == 0)
+                return datagrams;
+
+        if (datagrams != 0) {
+                /*
+                 * We may return less entries than requested (vlen) if the
+                 * sock is non block and there aren't enough datagrams...
+                 */
+                if (err != -EAGAIN) {
+                        /*
+                         * ... or  if recvmsg returns an error after we
+                         * received some datagrams, where we record the
+                         * error to return on the next call or if the
+                         * app asks about it using getsockopt(SO_ERROR).
+                         */
+                        sock->sk->sk_err = -err;
+                }
 
+                return datagrams;
+        }
+
+        return err;
+}
+
+SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
+                unsigned int, vlen, unsigned int, flags,
+                struct timespec __user *, timeout)
+{
+        int datagrams;
+        struct timespec timeout_sys;
+
+        if (!timeout)
+                return __sys_recvmmsg(fd, mmsg, vlen, flags, NULL);
+
+        if (copy_from_user(&timeout_sys, timeout, sizeof(timeout_sys)))
+                return -EFAULT;
+
+        datagrams = __sys_recvmmsg(fd, mmsg, vlen, flags, &timeout_sys);
+
+        if (datagrams > 0 &&
+            copy_to_user(timeout, &timeout_sys, sizeof(timeout_sys)))
+                datagrams = -EFAULT;
+
+        return datagrams;
+}
+
+#ifdef __ARCH_WANT_SYS_SOCKETCALL
 /* Argument list sizes for sys_socketcall */
 #define AL(x) ((x) * sizeof(unsigned long))
-static const unsigned char nargs[19]={
+static const unsigned char nargs[20] = {
         AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
         AL(3),AL(3),AL(4),AL(4),AL(4),AL(6),
         AL(6),AL(2),AL(5),AL(5),AL(3),AL(3),
-        AL(4)
+        AL(4),AL(5)
 };
 
 #undef AL
@@ -2100,7 +2255,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
         int err;
         unsigned int len;
 
-        if (call < 1 || call > SYS_ACCEPT4)
+        if (call < 1 || call > SYS_RECVMMSG)
                 return -EINVAL;
 
         len = nargs[call];
@@ -2178,6 +2333,10 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
         case SYS_RECVMSG:
                 err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
                 break;
+        case SYS_RECVMMSG:
+                err = sys_recvmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3],
+                                   (struct timespec __user *)a[4]);
+                break;
         case SYS_ACCEPT4:
                 err = sys_accept4(a0, (struct sockaddr __user *)a1,
                                   (int __user *)a[2], a[3]);
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 117f68a8aa40..f4c7ff3a53e6 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -686,8 +686,7 @@ svcauth_unix_set_client(struct svc_rqst *rqstp)
         case AF_INET:
                 sin = svc_addr_in(rqstp);
                 sin6 = &sin6_storage;
-                ipv6_addr_set(&sin6->sin6_addr, 0, 0,
-                                htonl(0x0000FFFF), sin->sin_addr.s_addr);
+                ipv6_addr_set_v4mapped(sin->sin_addr.s_addr, &sin6->sin6_addr);
                 break;
         case AF_INET6:
                 sin6 = svc_addr_in6(rqstp);
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index ccc5e83cae5d..c2a17876defd 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -272,14 +272,14 @@ static int svc_one_sock_name(struct svc_sock *svsk, char *buf, int remaining)
         case PF_INET:
                 len = snprintf(buf, remaining, "ipv4 %s %pI4 %d\n",
                                 proto_name,
-                                &inet_sk(sk)->rcv_saddr,
-                                inet_sk(sk)->num);
+                                &inet_sk(sk)->inet_rcv_saddr,
+                                inet_sk(sk)->inet_num);
                 break;
         case PF_INET6:
                 len = snprintf(buf, remaining, "ipv6 %s %pI6 %d\n",
                                 proto_name,
                                 &inet6_sk(sk)->rcv_saddr,
-                                inet_sk(sk)->num);
+                                inet_sk(sk)->inet_num);
                 break;
         default:
                 len = snprintf(buf, remaining, "*unknown-%d*\n",
@@ -1311,7 +1311,7 @@ static struct svc_sock *svc_setup_socket(struct svc_serv *serv,
         /* Register socket with portmapper */
         if (*errp >= 0 && pmap_register)
                 *errp = svc_register(serv, inet->sk_family, inet->sk_protocol,
-                                     ntohs(inet_sk(inet)->sport));
+                                     ntohs(inet_sk(inet)->inet_sport));
 
         if (*errp < 0) {
                 kfree(svsk);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index fc820cd75453..3291902f0b88 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2216,7 +2216,7 @@ static const struct file_operations unix_seq_fops = {
 
 #endif
 
-static struct net_proto_family unix_family_ops = {
+static const struct net_proto_family unix_family_ops = {
         .family = PF_UNIX,
         .create = unix_create,
         .owner  = THIS_MODULE,
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index abf7ca3f9ff9..614bdcec1c80 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -1,3 +1,21 @@
+config WIRELESS_EXT
+        bool
+
+config WEXT_CORE
+        def_bool y
+        depends on CFG80211_WEXT || WIRELESS_EXT
+
+config WEXT_PROC
+        def_bool y
+        depends on PROC_FS
+        depends on WEXT_CORE
+
+config WEXT_SPY
+        bool
+
+config WEXT_PRIV
+        bool
+
 config CFG80211
         tristate "cfg80211 - wireless configuration API"
         depends on RFKILL || !RFKILL
@@ -56,6 +74,12 @@ config CFG80211_REG_DEBUG
 
           If unsure, say N.
 
+config CFG80211_DEFAULT_PS_VALUE
+        int
+        default 1 if CFG80211_DEFAULT_PS
+        default 0
+        depends on CFG80211
+
 config CFG80211_DEFAULT_PS
         bool "enable powersave by default"
         depends on CFG80211
@@ -67,14 +91,10 @@ config CFG80211_DEFAULT_PS
           applications instead -- they need to register their network
           latency requirement, see Documentation/power/pm_qos_interface.txt.
 
-config CFG80211_DEFAULT_PS_VALUE
-        int
-        default 1 if CFG80211_DEFAULT_PS
-        default 0
-
 config CFG80211_DEBUGFS
         bool "cfg80211 DebugFS entries"
-        depends on CFG80211 && DEBUG_FS
+        depends on CFG80211
+        depends on DEBUG_FS
         ---help---
           You can enable this if you want to debugfs entries for cfg80211.
 
@@ -83,6 +103,7 @@ config CFG80211_DEBUGFS
 config WIRELESS_OLD_REGULATORY
         bool "Old wireless static regulatory definitions"
         default n
+        depends on CFG80211
         ---help---
           This option enables the old static regulatory information
           and uses it within the new framework. This option is available
@@ -94,20 +115,19 @@ config WIRELESS_OLD_REGULATORY
 
           Say N and if you say Y, please tell us why. The default is N.
 
-config WIRELESS_EXT
-        bool "Wireless extensions"
+config CFG80211_WEXT
+        bool "cfg80211 wireless extensions compatibility"
+        depends on CFG80211
+        select WEXT_CORE
         default y
-        ---help---
-          This option enables the legacy wireless extensions
-          (wireless network interface configuration via ioctls.)
-
-          Say Y unless you've upgraded all your userspace to use
-          nl80211 instead of wireless extensions.
+        help
+          Enable this option if you need old userspace for wireless
+          extensions with cfg80211-based drivers.
 
 config WIRELESS_EXT_SYSFS
         bool "Wireless extensions sysfs files"
         default y
-        depends on WIRELESS_EXT && SYSFS
+        depends on WEXT_CORE && SYSFS
         help
           This option enables the deprecated wireless statistics
           files in /sys/class/net/*/wireless/. The same information
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index 3ecaa9179977..f07c8dc7aab2 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -1,13 +1,17 @@
-obj-$(CONFIG_WIRELESS_EXT) += wext.o
 obj-$(CONFIG_CFG80211) += cfg80211.o
 obj-$(CONFIG_LIB80211) += lib80211.o
 obj-$(CONFIG_LIB80211_CRYPT_WEP) += lib80211_crypt_wep.o
 obj-$(CONFIG_LIB80211_CRYPT_CCMP) += lib80211_crypt_ccmp.o
 obj-$(CONFIG_LIB80211_CRYPT_TKIP) += lib80211_crypt_tkip.o
 
+obj-$(CONFIG_WEXT_CORE) += wext-core.o
+obj-$(CONFIG_WEXT_PROC) += wext-proc.o
+obj-$(CONFIG_WEXT_SPY) += wext-spy.o
+obj-$(CONFIG_WEXT_PRIV) += wext-priv.o
+
 cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o
-cfg80211-y += mlme.o ibss.o sme.o chan.o
+cfg80211-y += mlme.o ibss.o sme.o chan.o ethtool.o
 cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o
-cfg80211-$(CONFIG_WIRELESS_EXT) += wext-compat.o wext-sme.o
+cfg80211-$(CONFIG_CFG80211_WEXT) += wext-compat.o wext-sme.o
 
 ccflags-y += -D__CHECK_ENDIAN__
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 45b2be3274db..07252967be9c 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -21,6 +21,7 @@
 #include "sysfs.h"
 #include "debugfs.h"
 #include "wext-compat.h"
+#include "ethtool.h"
 
 /* name for sysfs, %d is appended */
 #define PHY_NAME "phy"
@@ -358,6 +359,10 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         INIT_LIST_HEAD(&rdev->bss_list);
         INIT_WORK(&rdev->scan_done_wk, __cfg80211_scan_done);
 
+#ifdef CONFIG_CFG80211_WEXT
+        rdev->wiphy.wext = &cfg80211_wext_handler;
+#endif
+
         device_initialize(&rdev->wiphy.dev);
         rdev->wiphy.dev.class = &ieee80211_class;
         rdev->wiphy.dev.platform_data = rdev;
@@ -625,6 +630,10 @@ static void wdev_cleanup_work(struct work_struct *work)
         dev_put(wdev->netdev);
 }
 
+static struct device_type wiphy_type = {
+        .name   = "wlan",
+};
+
 static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                                          unsigned long state,
                                          void *ndev)
@@ -641,6 +650,9 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
         WARN_ON(wdev->iftype == NL80211_IFTYPE_UNSPECIFIED);
 
         switch (state) {
+        case NETDEV_POST_INIT:
+                SET_NETDEV_DEVTYPE(dev, &wiphy_type);
+                break;
         case NETDEV_REGISTER:
                 /*
                  * NB: cannot take rdev->mtx here because this may be
@@ -665,9 +677,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 wdev->netdev = dev;
                 wdev->sme_state = CFG80211_SME_IDLE;
                 mutex_unlock(&rdev->devlist_mtx);
-#ifdef CONFIG_WIRELESS_EXT
-                if (!dev->wireless_handlers)
-                        dev->wireless_handlers = &cfg80211_wext_handler;
+#ifdef CONFIG_CFG80211_WEXT
                 wdev->wext.default_key = -1;
                 wdev->wext.default_mgmt_key = -1;
                 wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
@@ -681,6 +691,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                                 wdev->wext.ps = false;
                         }
 #endif
+                if (!dev->ethtool_ops)
+                        dev->ethtool_ops = &cfg80211_ethtool_ops;
                 break;
         case NETDEV_GOING_DOWN:
                 switch (wdev->iftype) {
@@ -689,7 +701,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         break;
                 case NL80211_IFTYPE_STATION:
                         wdev_lock(wdev);
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
                         kfree(wdev->wext.ie);
                         wdev->wext.ie = NULL;
                         wdev->wext.ie_len = 0;
@@ -721,7 +733,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         mutex_unlock(&rdev->devlist_mtx);
                         dev_put(dev);
                 }
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
                 cfg80211_lock_rdev(rdev);
                 mutex_lock(&rdev->devlist_mtx);
                 wdev_lock(wdev);
@@ -759,7 +771,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         sysfs_remove_link(&dev->dev.kobj, "phy80211");
                         list_del_init(&wdev->list);
                         rdev->devlist_generation++;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
                         kfree(wdev->wext.keys);
 #endif
                 }
diff --git a/net/wireless/ethtool.c b/net/wireless/ethtool.c
new file mode 100644
index 000000000000..ca4c825be93d
--- /dev/null
+++ b/net/wireless/ethtool.c
@@ -0,0 +1,45 @@
+#include <linux/utsname.h>
+#include <net/cfg80211.h>
+#include "ethtool.h"
+
+static void cfg80211_get_drvinfo(struct net_device *dev,
+                                        struct ethtool_drvinfo *info)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        strlcpy(info->driver, wiphy_dev(wdev->wiphy)->driver->name,
+                sizeof(info->driver));
+
+        strlcpy(info->version, init_utsname()->release, sizeof(info->version));
+
+        if (wdev->wiphy->fw_version[0])
+                strncpy(info->fw_version, wdev->wiphy->fw_version,
+                        sizeof(info->fw_version));
+        else
+                strncpy(info->fw_version, "N/A", sizeof(info->fw_version));
+
+        strlcpy(info->bus_info, dev_name(wiphy_dev(wdev->wiphy)),
+                sizeof(info->bus_info));
+}
+
+static int cfg80211_get_regs_len(struct net_device *dev)
+{
+        /* For now, return 0... */
+        return 0;
+}
+
+static void cfg80211_get_regs(struct net_device *dev, struct ethtool_regs *regs,
+                        void *data)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        regs->version = wdev->wiphy->hw_version;
+        regs->len = 0;
+}
+
+const struct ethtool_ops cfg80211_ethtool_ops = {
+        .get_drvinfo = cfg80211_get_drvinfo,
+        .get_regs_len = cfg80211_get_regs_len,
+        .get_regs = cfg80211_get_regs,
+        .get_link = ethtool_op_get_link,
+};
diff --git a/net/wireless/ethtool.h b/net/wireless/ethtool.h
new file mode 100644
index 000000000000..695ecad20bd6
--- /dev/null
+++ b/net/wireless/ethtool.h
@@ -0,0 +1,6 @@
+#ifndef __CFG80211_ETHTOOL__
+#define __CFG80211_ETHTOOL__
+
+extern const struct ethtool_ops cfg80211_ethtool_ops;
+
+#endif /* __CFG80211_ETHTOOL__ */
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index c88338911979..39b6d92e2828 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -15,7 +15,7 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_bss *bss;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -44,7 +44,7 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
 
         nl80211_send_ibss_bssid(wiphy_to_dev(wdev->wiphy), dev, bssid,
                                 GFP_KERNEL);
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         memset(&wrqu, 0, sizeof(wrqu));
         memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
@@ -96,7 +96,7 @@ int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
                 kfree(wdev->connect_keys);
         wdev->connect_keys = connkeys;
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         wdev->wext.ibss.channel = params->channel;
 #endif
         err = rdev->ops->join_ibss(&rdev->wiphy, dev, params);
@@ -154,7 +154,7 @@ static void __cfg80211_clear_ibss(struct net_device *dev, bool nowext)
 
         wdev->current_bss = NULL;
         wdev->ssid_len = 0;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (!nowext)
                 wdev->wext.ibss.ssid_len = 0;
 #endif
@@ -203,7 +203,7 @@ int cfg80211_leave_ibss(struct cfg80211_registered_device *rdev,
         return err;
 }
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
 int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
                             struct wireless_dev *wdev)
 {
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 0a6b7a0eca6b..83c2a288dc63 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -130,7 +130,7 @@ void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
 }
 EXPORT_SYMBOL(cfg80211_send_rx_assoc);
 
-static void __cfg80211_send_deauth(struct net_device *dev,
+void __cfg80211_send_deauth(struct net_device *dev,
                                    const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
@@ -139,7 +139,6 @@ static void __cfg80211_send_deauth(struct net_device *dev,
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
         const u8 *bssid = mgmt->bssid;
         int i;
-        bool done = false;
 
         ASSERT_WDEV_LOCK(wdev);
 
@@ -147,7 +146,6 @@ static void __cfg80211_send_deauth(struct net_device *dev,
 
         if (wdev->current_bss &&
             memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
-                done = true;
                 cfg80211_unhold_bss(wdev->current_bss);
                 cfg80211_put_bss(&wdev->current_bss->pub);
                 wdev->current_bss = NULL;
@@ -157,7 +155,6 @@ static void __cfg80211_send_deauth(struct net_device *dev,
                         cfg80211_unhold_bss(wdev->auth_bsses[i]);
                         cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
                         wdev->auth_bsses[i] = NULL;
-                        done = true;
                         break;
                 }
                 if (wdev->authtry_bsses[i] &&
@@ -165,13 +162,10 @@ static void __cfg80211_send_deauth(struct net_device *dev,
                         cfg80211_unhold_bss(wdev->authtry_bsses[i]);
                         cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
                         wdev->authtry_bsses[i] = NULL;
-                        done = true;
                         break;
                 }
         }
 
-        WARN_ON(!done);
-
         if (wdev->sme_state == CFG80211_SME_CONNECTED) {
                 u16 reason_code;
                 bool from_ap;
@@ -186,27 +180,19 @@ static void __cfg80211_send_deauth(struct net_device *dev,
                                           false, NULL);
         }
 }
+EXPORT_SYMBOL(__cfg80211_send_deauth);
 
-
-void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len,
-                          void *cookie)
+void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
-        BUG_ON(cookie && wdev != cookie);
-
-        if (cookie) {
-                /* called within callback */
-                __cfg80211_send_deauth(dev, buf, len);
-        } else {
-                wdev_lock(wdev);
-                __cfg80211_send_deauth(dev, buf, len);
-                wdev_unlock(wdev);
-        }
+        wdev_lock(wdev);
+        __cfg80211_send_deauth(dev, buf, len);
+        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_deauth);
 
-static void __cfg80211_send_disassoc(struct net_device *dev,
+void __cfg80211_send_disassoc(struct net_device *dev,
                                      const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
@@ -247,22 +233,15 @@ static void __cfg80211_send_disassoc(struct net_device *dev,
         from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
         __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 }
+EXPORT_SYMBOL(__cfg80211_send_disassoc);
 
-void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len,
-                            void *cookie)
+void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
-        BUG_ON(cookie && wdev != cookie);
-
-        if (cookie) {
-                /* called within callback */
-                __cfg80211_send_disassoc(dev, buf, len);
-        } else {
-                wdev_lock(wdev);
-                __cfg80211_send_disassoc(dev, buf, len);
-                wdev_unlock(wdev);
-        }
+        wdev_lock(wdev);
+        __cfg80211_send_disassoc(dev, buf, len);
+        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_disassoc);
 
@@ -340,7 +319,7 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 {
         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
         char *buf = kmalloc(128, gfp);
 
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index ca3c92a0a14f..f48394126bf9 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1264,7 +1264,7 @@ static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
         if (!err)
                 err = func(&rdev->wiphy, dev, key.idx);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (!err) {
                 if (func == rdev->ops->set_default_key)
                         dev->ieee80211_ptr->wext.default_key = key.idx;
@@ -1365,7 +1365,7 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
         if (!err)
                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (!err) {
                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
                         dev->ieee80211_ptr->wext.default_key = -1;
@@ -3105,6 +3105,8 @@ static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
+        NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
+                jiffies_to_msecs(jiffies - intbss->ts));
 
         switch (rdev->wiphy.signal_type) {
         case CFG80211_SIGNAL_TYPE_MBM:
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index e5f92ee758f4..2e8c515f3c5c 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -22,7 +22,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
 {
         struct cfg80211_scan_request *request;
         struct net_device *dev;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -47,7 +47,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
         else
                 nl80211_send_scan_done(rdev, dev);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (!request->aborted) {
                 memset(&wrqu, 0, sizeof(wrqu));
 
@@ -592,7 +592,7 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 }
 EXPORT_SYMBOL(cfg80211_unlink_bss);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
 int cfg80211_wext_siwscan(struct net_device *dev,
                           struct iw_request_info *info,
                           union iwreq_data *wrqu, char *extra)
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index ece378d531ef..98a3b7efac4c 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -362,7 +362,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         u8 *country_ie;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -379,7 +379,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                                     resp_ie, resp_ie_len,
                                     status, GFP_KERNEL);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (wextev) {
                 if (req_ie && status == WLAN_STATUS_SUCCESS) {
                         memset(&wrqu, 0, sizeof(wrqu));
@@ -494,7 +494,7 @@ void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
                        const u8 *resp_ie, size_t resp_ie_len)
 {
         struct cfg80211_bss *bss;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -529,7 +529,7 @@ void __cfg80211_roamed(struct wireless_dev *wdev, const u8 *bssid,
                             req_ie, req_ie_len, resp_ie, resp_ie_len,
                             GFP_KERNEL);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (req_ie) {
                 memset(&wrqu, 0, sizeof(wrqu));
                 wrqu.data.length = req_ie_len;
@@ -590,7 +590,7 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         int i;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -648,7 +648,7 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
                 for (i = 0; i < 6; i++)
                         rdev->ops->del_key(wdev->wiphy, dev, i, NULL);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         memset(&wrqu, 0, sizeof(wrqu));
         wrqu.ap_addr.sa_family = ARPHRD_ETHER;
         wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
diff --git a/net/wireless/wext.c b/net/wireless/wext-core.c
index 60fe57761ca9..a4e5ddc8d4f5 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext-core.c
@@ -1,112 +1,28 @@
 /*
- * This file implement the Wireless Extensions APIs.
+ * This file implement the Wireless Extensions core API.
  *
  * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
  * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
+ * Copyright    2009 Johannes Berg <johannes@sipsolutions.net>
  *
  * (As all part of the Linux kernel, this file is GPL)
  */
-
-/************************** DOCUMENTATION **************************/
-/*
- * API definition :
- * --------------
- * See <linux/wireless.h> for details of the APIs and the rest.
- *
- * History :
- * -------
- *
- * v1 - 5.12.01 - Jean II
- *      o Created this file.
- *
- * v2 - 13.12.01 - Jean II
- *      o Move /proc/net/wireless stuff from net/core/dev.c to here
- *      o Make Wireless Extension IOCTLs go through here
- *      o Added iw_handler handling ;-)
- *      o Added standard ioctl description
- *      o Initial dumb commit strategy based on orinoco.c
- *
- * v3 - 19.12.01 - Jean II
- *      o Make sure we don't go out of standard_ioctl[] in ioctl_standard_call
- *      o Add event dispatcher function
- *      o Add event description
- *      o Propagate events as rtnetlink IFLA_WIRELESS option
- *      o Generate event on selected SET requests
- *
- * v4 - 18.04.02 - Jean II
- *      o Fix stupid off by one in iw_ioctl_description : IW_ESSID_MAX_SIZE + 1
- *
- * v5 - 21.06.02 - Jean II
- *      o Add IW_PRIV_TYPE_ADDR in priv_type_size (+cleanup)
- *      o Reshuffle IW_HEADER_TYPE_XXX to map IW_PRIV_TYPE_XXX changes
- *      o Add IWEVCUSTOM for driver specific event/scanning token
- *      o Turn on WE_STRICT_WRITE by default + kernel warning
- *      o Fix WE_STRICT_WRITE in ioctl_export_private() (32 => iw_num)
- *      o Fix off-by-one in test (extra_size <= IFNAMSIZ)
- *
- * v6 - 9.01.03 - Jean II
- *      o Add common spy support : iw_handler_set_spy(), wireless_spy_update()
- *      o Add enhanced spy support : iw_handler_set_thrspy() and event.
- *      o Add WIRELESS_EXT version display in /proc/net/wireless
- *
- * v6 - 18.06.04 - Jean II
- *      o Change get_spydata() method for added safety
- *      o Remove spy #ifdef, they are always on -> cleaner code
- *      o Allow any size GET request if user specifies length > max
- *              and if request has IW_DESCR_FLAG_NOMAX flag or is SIOCGIWPRIV
- *      o Start migrating get_wireless_stats to struct iw_handler_def
- *      o Add wmb() in iw_handler_set_spy() for non-coherent archs/cpus
- * Based on patch from Pavel Roskin <proski@gnu.org> :
- *      o Fix kernel data leak to user space in private handler handling
- *
- * v7 - 18.3.05 - Jean II
- *      o Remove (struct iw_point *)->pointer from events and streams
- *      o Remove spy_offset from struct iw_handler_def
- *      o Start deprecating dev->get_wireless_stats, output a warning
- *      o If IW_QUAL_DBM is set, show dBm values in /proc/net/wireless
- *      o Don't lose INVALID/DBM flags when clearing UPDATED flags (iwstats)
- *
- * v8 - 17.02.06 - Jean II
- *      o RtNetlink requests support (SET/GET)
- *
- * v8b - 03.08.06 - Herbert Xu
- *      o Fix Wireless Event locking issues.
- *
- * v9 - 14.3.06 - Jean II
- *      o Change length in ESSID and NICK to strlen() instead of strlen()+1
- *      o Make standard_ioctl_num and standard_event_num unsigned
- *      o Remove (struct net_device *)->get_wireless_stats()
- *
- * v10 - 16.3.07 - Jean II
- *      o Prevent leaking of kernel space in stream on 64 bits.
- */
-
-/***************************** INCLUDES *****************************/
-
-#include <linux/module.h>
-#include <linux/types.h>                /* off_t */
-#include <linux/netdevice.h>            /* struct ifreq, dev_get_by_name() */
-#include <linux/proc_fs.h>
-#include <linux/rtnetlink.h>            /* rtnetlink stuff */
-#include <linux/seq_file.h>
-#include <linux/init.h>                 /* for __init */
-#include <linux/if_arp.h>               /* ARPHRD_ETHER */
-#include <linux/etherdevice.h>          /* compare_ether_addr */
-#include <linux/interrupt.h>
-#include <net/net_namespace.h>
-
-#include <linux/wireless.h>             /* Pretty obvious */
-#include <net/iw_handler.h>             /* New driver API */
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/rtnetlink.h>
+#include <linux/wireless.h>
+#include <linux/uaccess.h>
+#include <net/cfg80211.h>
+#include <net/iw_handler.h>
 #include <net/netlink.h>
 #include <net/wext.h>
+#include <net/net_namespace.h>
+
+typedef int (*wext_ioctl_func)(struct net_device *, struct iwreq *,
+                               unsigned int, struct iw_request_info *,
+                               iw_handler);
 
-#include <asm/uaccess.h>                /* copy_to_user() */
 
-/************************* GLOBAL VARIABLES *************************/
-/*
- * You should not use global variables, because of re-entrancy.
- * On our case, it's only const, so it's OK...
- */
 /*
  * Meta-data about all the standard Wireless Extension request we
  * know about.
@@ -390,18 +306,6 @@ static const struct iw_ioctl_description standard_event[] = {
 };
 static const unsigned standard_event_num = ARRAY_SIZE(standard_event);
 
-/* Size (in bytes) of the various private data types */
-static const char iw_priv_type_size[] = {
-        0,                              /* IW_PRIV_TYPE_NONE */
-        1,                              /* IW_PRIV_TYPE_BYTE */
-        1,                              /* IW_PRIV_TYPE_CHAR */
-        0,                              /* Not defined */
-        sizeof(__u32),                  /* IW_PRIV_TYPE_INT */
-        sizeof(struct iw_freq),         /* IW_PRIV_TYPE_FLOAT */
-        sizeof(struct sockaddr),        /* IW_PRIV_TYPE_ADDR */
-        0,                              /* Not defined */
-};
-
 /* Size (in bytes) of various events */
 static const int event_type_size[] = {
         IW_EV_LCP_LEN,                  /* IW_HEADER_TYPE_NULL */
@@ -433,323 +337,346 @@ static const int compat_event_type_size[] = {
 };
 #endif
 
-/************************ COMMON SUBROUTINES ************************/
-/*
- * Stuff that may be used in various place or doesn't fit in one
- * of the section below.
- */
-
-/* ---------------------------------------------------------------- */
-/*
- * Return the driver handler associated with a specific Wireless Extension.
- */
-static iw_handler get_handler(struct net_device *dev, unsigned int cmd)
-{
-        /* Don't "optimise" the following variable, it will crash */
-        unsigned int    index;          /* *MUST* be unsigned */
 
-        /* Check if we have some wireless handlers defined */
-        if (dev->wireless_handlers == NULL)
-                return NULL;
-
-        /* Try as a standard command */
-        index = cmd - SIOCIWFIRST;
-        if (index < dev->wireless_handlers->num_standard)
-                return dev->wireless_handlers->standard[index];
-
-        /* Try as a private command */
-        index = cmd - SIOCIWFIRSTPRIV;
-        if (index < dev->wireless_handlers->num_private)
-                return dev->wireless_handlers->private[index];
+/* IW event code */
 
-        /* Not found */
-        return NULL;
-}
-
-/* ---------------------------------------------------------------- */
-/*
- * Get statistics out of the driver
- */
-struct iw_statistics *get_wireless_stats(struct net_device *dev)
+static int __net_init wext_pernet_init(struct net *net)
 {
-        /* New location */
-        if ((dev->wireless_handlers != NULL) &&
-           (dev->wireless_handlers->get_wireless_stats != NULL))
-                return dev->wireless_handlers->get_wireless_stats(dev);
-
-        /* Not found */
-        return NULL;
+        skb_queue_head_init(&net->wext_nlevents);
+        return 0;
 }
 
-/* ---------------------------------------------------------------- */
-/*
- * Call the commit handler in the driver
- * (if exist and if conditions are right)
- *
- * Note : our current commit strategy is currently pretty dumb,
- * but we will be able to improve on that...
- * The goal is to try to agreagate as many changes as possible
- * before doing the commit. Drivers that will define a commit handler
- * are usually those that need a reset after changing parameters, so
- * we want to minimise the number of reset.
- * A cool idea is to use a timer : at each "set" command, we re-set the
- * timer, when the timer eventually fires, we call the driver.
- * Hopefully, more on that later.
- *
- * Also, I'm waiting to see how many people will complain about the
- * netif_running(dev) test. I'm open on that one...
- * Hopefully, the driver will remember to do a commit in "open()" ;-)
- */
-static int call_commit_handler(struct net_device *dev)
+static void __net_exit wext_pernet_exit(struct net *net)
 {
-        if ((netif_running(dev)) &&
-           (dev->wireless_handlers->standard[0] != NULL))
-                /* Call the commit handler on the driver */
-                return dev->wireless_handlers->standard[0](dev, NULL,
-                                                           NULL, NULL);
-        else
-                return 0;               /* Command completed successfully */
+        skb_queue_purge(&net->wext_nlevents);
 }
 
-/* ---------------------------------------------------------------- */
-/*
- * Calculate size of private arguments
- */
-static int get_priv_size(__u16 args)
-{
-        int     num = args & IW_PRIV_SIZE_MASK;
-        int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
+static struct pernet_operations wext_pernet_ops = {
+        .init = wext_pernet_init,
+        .exit = wext_pernet_exit,
+};
 
-        return num * iw_priv_type_size[type];
+static int __init wireless_nlevent_init(void)
+{
+        return register_pernet_subsys(&wext_pernet_ops);
 }
 
-/* ---------------------------------------------------------------- */
-/*
- * Re-calculate the size of private arguments
- */
-static int adjust_priv_size(__u16 args, struct iw_point *iwp)
+subsys_initcall(wireless_nlevent_init);
+
+/* Process events generated by the wireless layer or the driver. */
+static void wireless_nlevent_process(struct work_struct *work)
 {
-        int     num = iwp->length;
-        int     max = args & IW_PRIV_SIZE_MASK;
-        int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
+        struct sk_buff *skb;
+        struct net *net;
 
-        /* Make sure the driver doesn't goof up */
-        if (max < num)
-                num = max;
+        rtnl_lock();
+
+        for_each_net(net) {
+                while ((skb = skb_dequeue(&net->wext_nlevents)))
+                        rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
+                                    GFP_KERNEL);
+        }
 
-        return num * iw_priv_type_size[type];
+        rtnl_unlock();
 }
 
-/* ---------------------------------------------------------------- */
-/*
- * Standard Wireless Handler : get wireless stats
- *      Allow programatic access to /proc/net/wireless even if /proc
- *      doesn't exist... Also more efficient...
- */
-static int iw_handler_get_iwstats(struct net_device *           dev,
-                                  struct iw_request_info *      info,
-                                  union iwreq_data *            wrqu,
-                                  char *                        extra)
+static DECLARE_WORK(wireless_nlevent_work, wireless_nlevent_process);
+
+static struct nlmsghdr *rtnetlink_ifinfo_prep(struct net_device *dev,
+                                              struct sk_buff *skb)
 {
-        /* Get stats from the driver */
-        struct iw_statistics *stats;
+        struct ifinfomsg *r;
+        struct nlmsghdr  *nlh;
 
-        stats = get_wireless_stats(dev);
-        if (stats) {
-                /* Copy statistics to extra */
-                memcpy(extra, stats, sizeof(struct iw_statistics));
-                wrqu->data.length = sizeof(struct iw_statistics);
+        nlh = nlmsg_put(skb, 0, 0, RTM_NEWLINK, sizeof(*r), 0);
+        if (!nlh)
+                return NULL;
 
-                /* Check if we need to clear the updated flag */
-                if (wrqu->data.flags != 0)
-                        stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
-                return 0;
-        } else
-                return -EOPNOTSUPP;
+        r = nlmsg_data(nlh);
+        r->ifi_family = AF_UNSPEC;
+        r->__ifi_pad = 0;
+        r->ifi_type = dev->type;
+        r->ifi_index = dev->ifindex;
+        r->ifi_flags = dev_get_flags(dev);
+        r->ifi_change = 0;      /* Wireless changes don't affect those flags */
+
+        NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
+
+        return nlh;
+ nla_put_failure:
+        nlmsg_cancel(skb, nlh);
+        return NULL;
 }
 
-/* ---------------------------------------------------------------- */
+
 /*
- * Standard Wireless Handler : get iwpriv definitions
- * Export the driver private handler definition
- * They will be picked up by tools like iwpriv...
+ * Main event dispatcher. Called from other parts and drivers.
+ * Send the event on the appropriate channels.
+ * May be called from interrupt context.
  */
-static int iw_handler_get_private(struct net_device *           dev,
-                                  struct iw_request_info *      info,
-                                  union iwreq_data *            wrqu,
-                                  char *                        extra)
+void wireless_send_event(struct net_device *    dev,
+                         unsigned int           cmd,
+                         union iwreq_data *     wrqu,
+                         const char *           extra)
 {
-        /* Check if the driver has something to export */
-        if ((dev->wireless_handlers->num_private_args == 0) ||
-           (dev->wireless_handlers->private_args == NULL))
-                return -EOPNOTSUPP;
+        const struct iw_ioctl_description *     descr = NULL;
+        int extra_len = 0;
+        struct iw_event  *event;                /* Mallocated whole event */
+        int event_len;                          /* Its size */
+        int hdr_len;                            /* Size of the event header */
+        int wrqu_off = 0;                       /* Offset in wrqu */
+        /* Don't "optimise" the following variable, it will crash */
+        unsigned        cmd_index;              /* *MUST* be unsigned */
+        struct sk_buff *skb;
+        struct nlmsghdr *nlh;
+        struct nlattr *nla;
+#ifdef CONFIG_COMPAT
+        struct __compat_iw_event *compat_event;
+        struct compat_iw_point compat_wrqu;
+        struct sk_buff *compskb;
+#endif
 
-        /* Check if there is enough buffer up there */
-        if (wrqu->data.length < dev->wireless_handlers->num_private_args) {
-                /* User space can't know in advance how large the buffer
-                 * needs to be. Give it a hint, so that we can support
-                 * any size buffer we want somewhat efficiently... */
-                wrqu->data.length = dev->wireless_handlers->num_private_args;
-                return -E2BIG;
+        /*
+         * Nothing in the kernel sends scan events with data, be safe.
+         * This is necessary because we cannot fix up scan event data
+         * for compat, due to being contained in 'extra', but normally
+         * applications are required to retrieve the scan data anyway
+         * and no data is included in the event, this codifies that
+         * practice.
+         */
+        if (WARN_ON(cmd == SIOCGIWSCAN && extra))
+                extra = NULL;
+
+        /* Get the description of the Event */
+        if (cmd <= SIOCIWLAST) {
+                cmd_index = cmd - SIOCIWFIRST;
+                if (cmd_index < standard_ioctl_num)
+                        descr = &(standard_ioctl[cmd_index]);
+        } else {
+                cmd_index = cmd - IWEVFIRST;
+                if (cmd_index < standard_event_num)
+                        descr = &(standard_event[cmd_index]);
+        }
+        /* Don't accept unknown events */
+        if (descr == NULL) {
+                /* Note : we don't return an error to the driver, because
+                 * the driver would not know what to do about it. It can't
+                 * return an error to the user, because the event is not
+                 * initiated by a user request.
+                 * The best the driver could do is to log an error message.
+                 * We will do it ourselves instead...
+                 */
+                printk(KERN_ERR "%s (WE) : Invalid/Unknown Wireless Event (0x%04X)\n",
+                       dev->name, cmd);
+                return;
         }
 
-        /* Set the number of available ioctls. */
-        wrqu->data.length = dev->wireless_handlers->num_private_args;
+        /* Check extra parameters and set extra_len */
+        if (descr->header_type == IW_HEADER_TYPE_POINT) {
+                /* Check if number of token fits within bounds */
+                if (wrqu->data.length > descr->max_tokens) {
+                        printk(KERN_ERR "%s (WE) : Wireless Event too big (%d)\n", dev->name, wrqu->data.length);
+                        return;
+                }
+                if (wrqu->data.length < descr->min_tokens) {
+                        printk(KERN_ERR "%s (WE) : Wireless Event too small (%d)\n", dev->name, wrqu->data.length);
+                        return;
+                }
+                /* Calculate extra_len - extra is NULL for restricted events */
+                if (extra != NULL)
+                        extra_len = wrqu->data.length * descr->token_size;
+                /* Always at an offset in wrqu */
+                wrqu_off = IW_EV_POINT_OFF;
+        }
 
-        /* Copy structure to the user buffer. */
-        memcpy(extra, dev->wireless_handlers->private_args,
-               sizeof(struct iw_priv_args) * wrqu->data.length);
+        /* Total length of the event */
+        hdr_len = event_type_size[descr->header_type];
+        event_len = hdr_len + extra_len;
 
-        return 0;
-}
+        /*
+         * The problem for 64/32 bit.
+         *
+         * On 64-bit, a regular event is laid out as follows:
+         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
+         *      | event.len | event.cmd |     p a d d i n g     |
+         *      | wrqu data ... (with the correct size)         |
+         *
+         * This padding exists because we manipulate event->u,
+         * and 'event' is not packed.
+         *
+         * An iw_point event is laid out like this instead:
+         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
+         *      | event.len | event.cmd |     p a d d i n g     |
+         *      | iwpnt.len | iwpnt.flg |     p a d d i n g     |
+         *      | extra data  ...
+         *
+         * The second padding exists because struct iw_point is extended,
+         * but this depends on the platform...
+         *
+         * On 32-bit, all the padding shouldn't be there.
+         */
 
+        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        if (!skb)
+                return;
 
-/******************** /proc/net/wireless SUPPORT ********************/
-/*
- * The /proc/net/wireless file is a human readable user-space interface
- * exporting various wireless specific statistics from the wireless devices.
- * This is the most popular part of the Wireless Extensions ;-)
- *
- * This interface is a pure clone of /proc/net/dev (in net/core/dev.c).
- * The content of the file is basically the content of "struct iw_statistics".
- */
+        /* Send via the RtNetlink event channel */
+        nlh = rtnetlink_ifinfo_prep(dev, skb);
+        if (WARN_ON(!nlh)) {
+                kfree_skb(skb);
+                return;
+        }
 
-#ifdef CONFIG_PROC_FS
+        /* Add the wireless events in the netlink packet */
+        nla = nla_reserve(skb, IFLA_WIRELESS, event_len);
+        if (!nla) {
+                kfree_skb(skb);
+                return;
+        }
+        event = nla_data(nla);
 
-/* ---------------------------------------------------------------- */
-/*
- * Print one entry (line) of /proc/net/wireless
- */
-static void wireless_seq_printf_stats(struct seq_file *seq,
-                                      struct net_device *dev)
-{
-        /* Get stats from the driver */
-        struct iw_statistics *stats = get_wireless_stats(dev);
-        static struct iw_statistics nullstats = {};
+        /* Fill event - first clear to avoid data leaking */
+        memset(event, 0, hdr_len);
+        event->len = event_len;
+        event->cmd = cmd;
+        memcpy(&event->u, ((char *) wrqu) + wrqu_off, hdr_len - IW_EV_LCP_LEN);
+        if (extra_len)
+                memcpy(((char *) event) + hdr_len, extra, extra_len);
 
-        /* show device if it's wireless regardless of current stats */
-        if (!stats && dev->wireless_handlers)
-                stats = &nullstats;
+        nlmsg_end(skb, nlh);
+#ifdef CONFIG_COMPAT
+        hdr_len = compat_event_type_size[descr->header_type];
+        event_len = hdr_len + extra_len;
 
-        if (stats) {
-                seq_printf(seq, "%6s: %04x  %3d%c  %3d%c  %3d%c  %6d %6d %6d "
-                                "%6d %6d   %6d\n",
-                           dev->name, stats->status, stats->qual.qual,
-                           stats->qual.updated & IW_QUAL_QUAL_UPDATED
-                           ? '.' : ' ',
-                           ((__s32) stats->qual.level) -
-                           ((stats->qual.updated & IW_QUAL_DBM) ? 0x100 : 0),
-                           stats->qual.updated & IW_QUAL_LEVEL_UPDATED
-                           ? '.' : ' ',
-                           ((__s32) stats->qual.noise) -
-                           ((stats->qual.updated & IW_QUAL_DBM) ? 0x100 : 0),
-                           stats->qual.updated & IW_QUAL_NOISE_UPDATED
-                           ? '.' : ' ',
-                           stats->discard.nwid, stats->discard.code,
-                           stats->discard.fragment, stats->discard.retries,
-                           stats->discard.misc, stats->miss.beacon);
-
-                if (stats != &nullstats)
-                        stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
+        compskb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        if (!compskb) {
+                kfree_skb(skb);
+                return;
         }
-}
 
-/* ---------------------------------------------------------------- */
-/*
- * Print info for /proc/net/wireless (print all entries)
- */
-static int wireless_dev_seq_show(struct seq_file *seq, void *v)
-{
-        might_sleep();
-
-        if (v == SEQ_START_TOKEN)
-                seq_printf(seq, "Inter-| sta-|   Quality        |   Discarded "
-                                "packets               | Missed | WE\n"
-                                " face | tus | link level noise |  nwid  "
-                                "crypt   frag  retry   misc | beacon | %d\n",
-                           WIRELESS_EXT);
-        else
-                wireless_seq_printf_stats(seq, v);
-        return 0;
+        /* Send via the RtNetlink event channel */
+        nlh = rtnetlink_ifinfo_prep(dev, compskb);
+        if (WARN_ON(!nlh)) {
+                kfree_skb(skb);
+                kfree_skb(compskb);
+                return;
+        }
+
+        /* Add the wireless events in the netlink packet */
+        nla = nla_reserve(compskb, IFLA_WIRELESS, event_len);
+        if (!nla) {
+                kfree_skb(skb);
+                kfree_skb(compskb);
+                return;
+        }
+        compat_event = nla_data(nla);
+
+        compat_event->len = event_len;
+        compat_event->cmd = cmd;
+        if (descr->header_type == IW_HEADER_TYPE_POINT) {
+                compat_wrqu.length = wrqu->data.length;
+                compat_wrqu.flags = wrqu->data.flags;
+                memcpy(&compat_event->pointer,
+                        ((char *) &compat_wrqu) + IW_EV_COMPAT_POINT_OFF,
+                        hdr_len - IW_EV_COMPAT_LCP_LEN);
+                if (extra_len)
+                        memcpy(((char *) compat_event) + hdr_len,
+                                extra, extra_len);
+        } else {
+                /* extra_len must be zero, so no if (extra) needed */
+                memcpy(&compat_event->pointer, wrqu,
+                        hdr_len - IW_EV_COMPAT_LCP_LEN);
+        }
+
+        nlmsg_end(compskb, nlh);
+
+        skb_shinfo(skb)->frag_list = compskb;
+#endif
+        skb_queue_tail(&dev_net(dev)->wext_nlevents, skb);
+        schedule_work(&wireless_nlevent_work);
 }
+EXPORT_SYMBOL(wireless_send_event);
+
+
+
+/* IW handlers */
 
-static void *wireless_dev_seq_start(struct seq_file *seq, loff_t *pos)
+struct iw_statistics *get_wireless_stats(struct net_device *dev)
 {
-        struct net *net = seq_file_net(seq);
-        loff_t off;
-        struct net_device *dev;
+#ifdef CONFIG_WIRELESS_EXT
+        if ((dev->wireless_handlers != NULL) &&
+           (dev->wireless_handlers->get_wireless_stats != NULL))
+                return dev->wireless_handlers->get_wireless_stats(dev);
+#endif
 
-        rtnl_lock();
-        if (!*pos)
-                return SEQ_START_TOKEN;
+#ifdef CONFIG_CFG80211_WEXT
+        if (dev->ieee80211_ptr && dev->ieee80211_ptr &&
+            dev->ieee80211_ptr->wiphy &&
+            dev->ieee80211_ptr->wiphy->wext &&
+            dev->ieee80211_ptr->wiphy->wext->get_wireless_stats)
+                return dev->ieee80211_ptr->wiphy->wext->get_wireless_stats(dev);
+#endif
 
-        off = 1;
-        for_each_netdev(net, dev)
-                if (off++ == *pos)
-                        return dev;
+        /* not found */
         return NULL;
 }
 
-static void *wireless_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static int iw_handler_get_iwstats(struct net_device *           dev,
+                                  struct iw_request_info *      info,
+                                  union iwreq_data *            wrqu,
+                                  char *                        extra)
 {
-        struct net *net = seq_file_net(seq);
+        /* Get stats from the driver */
+        struct iw_statistics *stats;
 
-        ++*pos;
+        stats = get_wireless_stats(dev);
+        if (stats) {
+                /* Copy statistics to extra */
+                memcpy(extra, stats, sizeof(struct iw_statistics));
+                wrqu->data.length = sizeof(struct iw_statistics);
 
-        return v == SEQ_START_TOKEN ?
-                first_net_device(net) : next_net_device(v);
+                /* Check if we need to clear the updated flag */
+                if (wrqu->data.flags != 0)
+                        stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
+                return 0;
+        } else
+                return -EOPNOTSUPP;
 }
 
-static void wireless_dev_seq_stop(struct seq_file *seq, void *v)
+static iw_handler get_handler(struct net_device *dev, unsigned int cmd)
 {
-        rtnl_unlock();
-}
-
-static const struct seq_operations wireless_seq_ops = {
-        .start = wireless_dev_seq_start,
-        .next  = wireless_dev_seq_next,
-        .stop  = wireless_dev_seq_stop,
-        .show  = wireless_dev_seq_show,
-};
+        /* Don't "optimise" the following variable, it will crash */
+        unsigned int    index;          /* *MUST* be unsigned */
+        const struct iw_handler_def *handlers = NULL;
 
-static int seq_open_wireless(struct inode *inode, struct file *file)
-{
-        return seq_open_net(inode, file, &wireless_seq_ops,
-                            sizeof(struct seq_net_private));
-}
+#ifdef CONFIG_CFG80211_WEXT
+        if (dev->ieee80211_ptr && dev->ieee80211_ptr->wiphy)
+                handlers = dev->ieee80211_ptr->wiphy->wext;
+#endif
+#ifdef CONFIG_WIRELESS_EXT
+        if (dev->wireless_handlers)
+                handlers = dev->wireless_handlers;
+#endif
 
-static const struct file_operations wireless_seq_fops = {
-        .owner   = THIS_MODULE,
-        .open    = seq_open_wireless,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = seq_release_net,
-};
+        if (!handlers)
+                return NULL;
 
-int wext_proc_init(struct net *net)
-{
-        /* Create /proc/net/wireless entry */
-        if (!proc_net_fops_create(net, "wireless", S_IRUGO, &wireless_seq_fops))
-                return -ENOMEM;
+        /* Try as a standard command */
+        index = cmd - SIOCIWFIRST;
+        if (index < handlers->num_standard)
+                return handlers->standard[index];
 
-        return 0;
-}
+#ifdef CONFIG_WEXT_PRIV
+        /* Try as a private command */
+        index = cmd - SIOCIWFIRSTPRIV;
+        if (index < handlers->num_private)
+                return handlers->private[index];
+#endif
 
-void wext_proc_exit(struct net *net)
-{
-        proc_net_remove(net, "wireless");
+        /* Not found */
+        return NULL;
 }
-#endif  /* CONFIG_PROC_FS */
 
-/************************** IOCTL SUPPORT **************************/
-/*
- * The original user space API to configure all those Wireless Extensions
- * is through IOCTLs.
- * In there, we check if we need to call the new driver API (iw_handler)
- * or just call the driver ioctl handler.
- */
-
-/* ---------------------------------------------------------------- */
 static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                                    const struct iw_ioctl_description *descr,
                                    iw_handler handler, struct net_device *dev,
@@ -893,188 +820,39 @@ out:
 }
 
 /*
- * Wrapper to call a standard Wireless Extension handler.
- * We do various checks and also take care of moving data between
- * user space and kernel space.
- */
-static int ioctl_standard_call(struct net_device *      dev,
-                               struct iwreq             *iwr,
-                               unsigned int             cmd,
-                               struct iw_request_info   *info,
-                               iw_handler               handler)
-{
-        const struct iw_ioctl_description *     descr;
-        int                                     ret = -EINVAL;
-
-        /* Get the description of the IOCTL */
-        if ((cmd - SIOCIWFIRST) >= standard_ioctl_num)
-                return -EOPNOTSUPP;
-        descr = &(standard_ioctl[cmd - SIOCIWFIRST]);
-
-        /* Check if we have a pointer to user space data or not */
-        if (descr->header_type != IW_HEADER_TYPE_POINT) {
-
-                /* No extra arguments. Trivial to handle */
-                ret = handler(dev, info, &(iwr->u), NULL);
-
-                /* Generate an event to notify listeners of the change */
-                if ((descr->flags & IW_DESCR_FLAG_EVENT) &&
-                   ((ret == 0) || (ret == -EIWCOMMIT)))
-                        wireless_send_event(dev, cmd, &(iwr->u), NULL);
-        } else {
-                ret = ioctl_standard_iw_point(&iwr->u.data, cmd, descr,
-                                              handler, dev, info);
-        }
-
-        /* Call commit handler if needed and defined */
-        if (ret == -EIWCOMMIT)
-                ret = call_commit_handler(dev);
-
-        /* Here, we will generate the appropriate event if needed */
-
-        return ret;
-}
-
-/* ---------------------------------------------------------------- */
-/*
- * Wrapper to call a private Wireless Extension handler.
- * We do various checks and also take care of moving data between
- * user space and kernel space.
- * It's not as nice and slimline as the standard wrapper. The cause
- * is struct iw_priv_args, which was not really designed for the
- * job we are going here.
+ * Call the commit handler in the driver
+ * (if exist and if conditions are right)
+ *
+ * Note : our current commit strategy is currently pretty dumb,
+ * but we will be able to improve on that...
+ * The goal is to try to agreagate as many changes as possible
+ * before doing the commit. Drivers that will define a commit handler
+ * are usually those that need a reset after changing parameters, so
+ * we want to minimise the number of reset.
+ * A cool idea is to use a timer : at each "set" command, we re-set the
+ * timer, when the timer eventually fires, we call the driver.
+ * Hopefully, more on that later.
  *
- * IMPORTANT : This function prevent to set and get data on the same
- * IOCTL and enforce the SET/GET convention. Not doing it would be
- * far too hairy...
- * If you need to set and get data at the same time, please don't use
- * a iw_handler but process it in your ioctl handler (i.e. use the
- * old driver API).
+ * Also, I'm waiting to see how many people will complain about the
+ * netif_running(dev) test. I'm open on that one...
+ * Hopefully, the driver will remember to do a commit in "open()" ;-)
  */
-static int get_priv_descr_and_size(struct net_device *dev, unsigned int cmd,
-                                   const struct iw_priv_args **descrp)
-{
-        const struct iw_priv_args *descr;
-        int i, extra_size;
-
-        descr = NULL;
-        for (i = 0; i < dev->wireless_handlers->num_private_args; i++) {
-                if (cmd == dev->wireless_handlers->private_args[i].cmd) {
-                        descr = &dev->wireless_handlers->private_args[i];
-                        break;
-                }
-        }
-
-        extra_size = 0;
-        if (descr) {
-                if (IW_IS_SET(cmd)) {
-                        int     offset = 0;     /* For sub-ioctls */
-                        /* Check for sub-ioctl handler */
-                        if (descr->name[0] == '\0')
-                                /* Reserve one int for sub-ioctl index */
-                                offset = sizeof(__u32);
-
-                        /* Size of set arguments */
-                        extra_size = get_priv_size(descr->set_args);
-
-                        /* Does it fits in iwr ? */
-                        if ((descr->set_args & IW_PRIV_SIZE_FIXED) &&
-                           ((extra_size + offset) <= IFNAMSIZ))
-                                extra_size = 0;
-                } else {
-                        /* Size of get arguments */
-                        extra_size = get_priv_size(descr->get_args);
-
-                        /* Does it fits in iwr ? */
-                        if ((descr->get_args & IW_PRIV_SIZE_FIXED) &&
-                           (extra_size <= IFNAMSIZ))
-                                extra_size = 0;
-                }
-        }
-        *descrp = descr;
-        return extra_size;
-}
-
-static int ioctl_private_iw_point(struct iw_point *iwp, unsigned int cmd,
-                                  const struct iw_priv_args *descr,
-                                  iw_handler handler, struct net_device *dev,
-                                  struct iw_request_info *info, int extra_size)
-{
-        char *extra;
-        int err;
-
-        /* Check what user space is giving us */
-        if (IW_IS_SET(cmd)) {
-                if (!iwp->pointer && iwp->length != 0)
-                        return -EFAULT;
-
-                if (iwp->length > (descr->set_args & IW_PRIV_SIZE_MASK))
-                        return -E2BIG;
-        } else if (!iwp->pointer)
-                return -EFAULT;
-
-        extra = kmalloc(extra_size, GFP_KERNEL);
-        if (!extra)
-                return -ENOMEM;
-
-        /* If it is a SET, get all the extra data in here */
-        if (IW_IS_SET(cmd) && (iwp->length != 0)) {
-                if (copy_from_user(extra, iwp->pointer, extra_size)) {
-                        err = -EFAULT;
-                        goto out;
-                }
-        }
-
-        /* Call the handler */
-        err = handler(dev, info, (union iwreq_data *) iwp, extra);
-
-        /* If we have something to return to the user */
-        if (!err && IW_IS_GET(cmd)) {
-                /* Adjust for the actual length if it's variable,
-                 * avoid leaking kernel bits outside.
-                 */
-                if (!(descr->get_args & IW_PRIV_SIZE_FIXED))
-                        extra_size = adjust_priv_size(descr->get_args, iwp);
-
-                if (copy_to_user(iwp->pointer, extra, extra_size))
-                        err =  -EFAULT;
-        }
-
-out:
-        kfree(extra);
-        return err;
-}
-
-static int ioctl_private_call(struct net_device *dev, struct iwreq *iwr,
-                              unsigned int cmd, struct iw_request_info *info,
-                              iw_handler handler)
+int call_commit_handler(struct net_device *dev)
 {
-        int extra_size = 0, ret = -EINVAL;
-        const struct iw_priv_args *descr;
-
-        extra_size = get_priv_descr_and_size(dev, cmd, &descr);
-
-        /* Check if we have a pointer to user space data or not. */
-        if (extra_size == 0) {
-                /* No extra arguments. Trivial to handle */
-                ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
-        } else {
-                ret = ioctl_private_iw_point(&iwr->u.data, cmd, descr,
-                                             handler, dev, info, extra_size);
-        }
-
-        /* Call commit handler if needed and defined */
-        if (ret == -EIWCOMMIT)
-                ret = call_commit_handler(dev);
-
-        return ret;
+#ifdef CONFIG_WIRELESS_EXT
+        if ((netif_running(dev)) &&
+           (dev->wireless_handlers->standard[0] != NULL))
+                /* Call the commit handler on the driver */
+                return dev->wireless_handlers->standard[0](dev, NULL,
+                                                           NULL, NULL);
+        else
+                return 0;               /* Command completed successfully */
+#else
+        /* cfg80211 has no commit */
+        return 0;
+#endif
 }
 
-/* ---------------------------------------------------------------- */
-typedef int (*wext_ioctl_func)(struct net_device *, struct iwreq *,
-                               unsigned int, struct iw_request_info *,
-                               iw_handler);
-
 /*
  * Main IOCTl dispatcher.
  * Check the type of IOCTL and call the appropriate wrapper...
@@ -1103,9 +881,11 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
                 return standard(dev, iwr, cmd, info,
                                 &iw_handler_get_iwstats);
 
+#ifdef CONFIG_WEXT_PRIV
         if (cmd == SIOCGIWPRIV && dev->wireless_handlers)
                 return standard(dev, iwr, cmd, info,
-                                &iw_handler_get_private);
+                                iw_handler_get_private);
+#endif
 
         /* Basic check */
         if (!netif_device_present(dev))
@@ -1117,7 +897,7 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
                 /* Standard and private are not the same */
                 if (cmd < SIOCIWFIRSTPRIV)
                         return standard(dev, iwr, cmd, info, handler);
-                else
+                else if (private)
                         return private(dev, iwr, cmd, info, handler);
         }
         /* Old driver API : call driver ioctl handler */
@@ -1157,6 +937,50 @@ static int wext_ioctl_dispatch(struct net *net, struct ifreq *ifr,
         return ret;
 }
 
+/*
+ * Wrapper to call a standard Wireless Extension handler.
+ * We do various checks and also take care of moving data between
+ * user space and kernel space.
+ */
+static int ioctl_standard_call(struct net_device *      dev,
+                               struct iwreq             *iwr,
+                               unsigned int             cmd,
+                               struct iw_request_info   *info,
+                               iw_handler               handler)
+{
+        const struct iw_ioctl_description *     descr;
+        int                                     ret = -EINVAL;
+
+        /* Get the description of the IOCTL */
+        if ((cmd - SIOCIWFIRST) >= standard_ioctl_num)
+                return -EOPNOTSUPP;
+        descr = &(standard_ioctl[cmd - SIOCIWFIRST]);
+
+        /* Check if we have a pointer to user space data or not */
+        if (descr->header_type != IW_HEADER_TYPE_POINT) {
+
+                /* No extra arguments. Trivial to handle */
+                ret = handler(dev, info, &(iwr->u), NULL);
+
+                /* Generate an event to notify listeners of the change */
+                if ((descr->flags & IW_DESCR_FLAG_EVENT) &&
+                   ((ret == 0) || (ret == -EIWCOMMIT)))
+                        wireless_send_event(dev, cmd, &(iwr->u), NULL);
+        } else {
+                ret = ioctl_standard_iw_point(&iwr->u.data, cmd, descr,
+                                              handler, dev, info);
+        }
+
+        /* Call commit handler if needed and defined */
+        if (ret == -EIWCOMMIT)
+                ret = call_commit_handler(dev);
+
+        /* Here, we will generate the appropriate event if needed */
+
+        return ret;
+}
+
+
 int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,
                       void __user *arg)
 {
@@ -1205,43 +1029,6 @@ static int compat_standard_call(struct net_device	*dev,
         return err;
 }
 
-static int compat_private_call(struct net_device *dev, struct iwreq *iwr,
-                               unsigned int cmd, struct iw_request_info *info,
-                               iw_handler handler)
-{
-        const struct iw_priv_args *descr;
-        int ret, extra_size;
-
-        extra_size = get_priv_descr_and_size(dev, cmd, &descr);
-
-        /* Check if we have a pointer to user space data or not. */
-        if (extra_size == 0) {
-                /* No extra arguments. Trivial to handle */
-                ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
-        } else {
-                struct compat_iw_point *iwp_compat;
-                struct iw_point iwp;
-
-                iwp_compat = (struct compat_iw_point *) &iwr->u.data;
-                iwp.pointer = compat_ptr(iwp_compat->pointer);
-                iwp.length = iwp_compat->length;
-                iwp.flags = iwp_compat->flags;
-
-                ret = ioctl_private_iw_point(&iwp, cmd, descr,
-                                             handler, dev, info, extra_size);
-
-                iwp_compat->pointer = ptr_to_compat(iwp.pointer);
-                iwp_compat->length = iwp.length;
-                iwp_compat->flags = iwp.flags;
-        }
-
-        /* Call commit handler if needed and defined */
-        if (ret == -EIWCOMMIT)
-                ret = call_commit_handler(dev);
-
-        return ret;
-}
-
 int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
                              unsigned long arg)
 {
@@ -1274,502 +1061,3 @@ int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
         return ret;
 }
 #endif
-
-static int __net_init wext_pernet_init(struct net *net)
-{
-        skb_queue_head_init(&net->wext_nlevents);
-        return 0;
-}
-
-static void __net_exit wext_pernet_exit(struct net *net)
-{
-        skb_queue_purge(&net->wext_nlevents);
-}
-
-static struct pernet_operations wext_pernet_ops = {
-        .init = wext_pernet_init,
-        .exit = wext_pernet_exit,
-};
-
-static int __init wireless_nlevent_init(void)
-{
-        return register_pernet_subsys(&wext_pernet_ops);
-}
-
-subsys_initcall(wireless_nlevent_init);
-
-/* Process events generated by the wireless layer or the driver. */
-static void wireless_nlevent_process(struct work_struct *work)
-{
-        struct sk_buff *skb;
-        struct net *net;
-
-        rtnl_lock();
-
-        for_each_net(net) {
-                while ((skb = skb_dequeue(&net->wext_nlevents)))
-                        rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL,
-                                    GFP_KERNEL);
-        }
-
-        rtnl_unlock();
-}
-
-static DECLARE_WORK(wireless_nlevent_work, wireless_nlevent_process);
-
-static struct nlmsghdr *rtnetlink_ifinfo_prep(struct net_device *dev,
-                                              struct sk_buff *skb)
-{
-        struct ifinfomsg *r;
-        struct nlmsghdr  *nlh;
-
-        nlh = nlmsg_put(skb, 0, 0, RTM_NEWLINK, sizeof(*r), 0);
-        if (!nlh)
-                return NULL;
-
-        r = nlmsg_data(nlh);
-        r->ifi_family = AF_UNSPEC;
-        r->__ifi_pad = 0;
-        r->ifi_type = dev->type;
-        r->ifi_index = dev->ifindex;
-        r->ifi_flags = dev_get_flags(dev);
-        r->ifi_change = 0;      /* Wireless changes don't affect those flags */
-
-        NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
-
-        return nlh;
- nla_put_failure:
-        nlmsg_cancel(skb, nlh);
-        return NULL;
-}
-
-
-/*
- * Main event dispatcher. Called from other parts and drivers.
- * Send the event on the appropriate channels.
- * May be called from interrupt context.
- */
-void wireless_send_event(struct net_device *    dev,
-                         unsigned int           cmd,
-                         union iwreq_data *     wrqu,
-                         const char *           extra)
-{
-        const struct iw_ioctl_description *     descr = NULL;
-        int extra_len = 0;
-        struct iw_event  *event;                /* Mallocated whole event */
-        int event_len;                          /* Its size */
-        int hdr_len;                            /* Size of the event header */
-        int wrqu_off = 0;                       /* Offset in wrqu */
-        /* Don't "optimise" the following variable, it will crash */
-        unsigned        cmd_index;              /* *MUST* be unsigned */
-        struct sk_buff *skb;
-        struct nlmsghdr *nlh;
-        struct nlattr *nla;
-#ifdef CONFIG_COMPAT
-        struct __compat_iw_event *compat_event;
-        struct compat_iw_point compat_wrqu;
-        struct sk_buff *compskb;
-#endif
-
-        /*
-         * Nothing in the kernel sends scan events with data, be safe.
-         * This is necessary because we cannot fix up scan event data
-         * for compat, due to being contained in 'extra', but normally
-         * applications are required to retrieve the scan data anyway
-         * and no data is included in the event, this codifies that
-         * practice.
-         */
-        if (WARN_ON(cmd == SIOCGIWSCAN && extra))
-                extra = NULL;
-
-        /* Get the description of the Event */
-        if (cmd <= SIOCIWLAST) {
-                cmd_index = cmd - SIOCIWFIRST;
-                if (cmd_index < standard_ioctl_num)
-                        descr = &(standard_ioctl[cmd_index]);
-        } else {
-                cmd_index = cmd - IWEVFIRST;
-                if (cmd_index < standard_event_num)
-                        descr = &(standard_event[cmd_index]);
-        }
-        /* Don't accept unknown events */
-        if (descr == NULL) {
-                /* Note : we don't return an error to the driver, because
-                 * the driver would not know what to do about it. It can't
-                 * return an error to the user, because the event is not
-                 * initiated by a user request.
-                 * The best the driver could do is to log an error message.
-                 * We will do it ourselves instead...
-                 */
-                printk(KERN_ERR "%s (WE) : Invalid/Unknown Wireless Event (0x%04X)\n",
-                       dev->name, cmd);
-                return;
-        }
-
-        /* Check extra parameters and set extra_len */
-        if (descr->header_type == IW_HEADER_TYPE_POINT) {
-                /* Check if number of token fits within bounds */
-                if (wrqu->data.length > descr->max_tokens) {
-                        printk(KERN_ERR "%s (WE) : Wireless Event too big (%d)\n", dev->name, wrqu->data.length);
-                        return;
-                }
-                if (wrqu->data.length < descr->min_tokens) {
-                        printk(KERN_ERR "%s (WE) : Wireless Event too small (%d)\n", dev->name, wrqu->data.length);
-                        return;
-                }
-                /* Calculate extra_len - extra is NULL for restricted events */
-                if (extra != NULL)
-                        extra_len = wrqu->data.length * descr->token_size;
-                /* Always at an offset in wrqu */
-                wrqu_off = IW_EV_POINT_OFF;
-        }
-
-        /* Total length of the event */
-        hdr_len = event_type_size[descr->header_type];
-        event_len = hdr_len + extra_len;
-
-        /*
-         * The problem for 64/32 bit.
-         *
-         * On 64-bit, a regular event is laid out as follows:
-         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
-         *      | event.len | event.cmd |     p a d d i n g     |
-         *      | wrqu data ... (with the correct size)         |
-         *
-         * This padding exists because we manipulate event->u,
-         * and 'event' is not packed.
-         *
-         * An iw_point event is laid out like this instead:
-         *      |  0  |  1  |  2  |  3  |  4  |  5  |  6  |  7  |
-         *      | event.len | event.cmd |     p a d d i n g     |
-         *      | iwpnt.len | iwpnt.flg |     p a d d i n g     |
-         *      | extra data  ...
-         *
-         * The second padding exists because struct iw_point is extended,
-         * but this depends on the platform...
-         *
-         * On 32-bit, all the padding shouldn't be there.
-         */
-
-        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
-        if (!skb)
-                return;
-
-        /* Send via the RtNetlink event channel */
-        nlh = rtnetlink_ifinfo_prep(dev, skb);
-        if (WARN_ON(!nlh)) {
-                kfree_skb(skb);
-                return;
-        }
-
-        /* Add the wireless events in the netlink packet */
-        nla = nla_reserve(skb, IFLA_WIRELESS, event_len);
-        if (!nla) {
-                kfree_skb(skb);
-                return;
-        }
-        event = nla_data(nla);
-
-        /* Fill event - first clear to avoid data leaking */
-        memset(event, 0, hdr_len);
-        event->len = event_len;
-        event->cmd = cmd;
-        memcpy(&event->u, ((char *) wrqu) + wrqu_off, hdr_len - IW_EV_LCP_LEN);
-        if (extra_len)
-                memcpy(((char *) event) + hdr_len, extra, extra_len);
-
-        nlmsg_end(skb, nlh);
-#ifdef CONFIG_COMPAT
-        hdr_len = compat_event_type_size[descr->header_type];
-        event_len = hdr_len + extra_len;
-
-        compskb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
-        if (!compskb) {
-                kfree_skb(skb);
-                return;
-        }
-
-        /* Send via the RtNetlink event channel */
-        nlh = rtnetlink_ifinfo_prep(dev, compskb);
-        if (WARN_ON(!nlh)) {
-                kfree_skb(skb);
-                kfree_skb(compskb);
-                return;
-        }
-
-        /* Add the wireless events in the netlink packet */
-        nla = nla_reserve(compskb, IFLA_WIRELESS, event_len);
-        if (!nla) {
-                kfree_skb(skb);
-                kfree_skb(compskb);
-                return;
-        }
-        compat_event = nla_data(nla);
-
-        compat_event->len = event_len;
-        compat_event->cmd = cmd;
-        if (descr->header_type == IW_HEADER_TYPE_POINT) {
-                compat_wrqu.length = wrqu->data.length;
-                compat_wrqu.flags = wrqu->data.flags;
-                memcpy(&compat_event->pointer,
-                        ((char *) &compat_wrqu) + IW_EV_COMPAT_POINT_OFF,
-                        hdr_len - IW_EV_COMPAT_LCP_LEN);
-                if (extra_len)
-                        memcpy(((char *) compat_event) + hdr_len,
-                                extra, extra_len);
-        } else {
-                /* extra_len must be zero, so no if (extra) needed */
-                memcpy(&compat_event->pointer, wrqu,
-                        hdr_len - IW_EV_COMPAT_LCP_LEN);
-        }
-
-        nlmsg_end(compskb, nlh);
-
-        skb_shinfo(skb)->frag_list = compskb;
-#endif
-        skb_queue_tail(&dev_net(dev)->wext_nlevents, skb);
-        schedule_work(&wireless_nlevent_work);
-}
-EXPORT_SYMBOL(wireless_send_event);
-
-/********************** ENHANCED IWSPY SUPPORT **********************/
-/*
- * In the old days, the driver was handling spy support all by itself.
- * Now, the driver can delegate this task to Wireless Extensions.
- * It needs to use those standard spy iw_handler in struct iw_handler_def,
- * push data to us via wireless_spy_update() and include struct iw_spy_data
- * in its private part (and export it in net_device->wireless_data->spy_data).
- * One of the main advantage of centralising spy support here is that
- * it becomes much easier to improve and extend it without having to touch
- * the drivers. One example is the addition of the Spy-Threshold events.
- */
-
-/* ---------------------------------------------------------------- */
-/*
- * Return the pointer to the spy data in the driver.
- * Because this is called on the Rx path via wireless_spy_update(),
- * we want it to be efficient...
- */
-static inline struct iw_spy_data *get_spydata(struct net_device *dev)
-{
-        /* This is the new way */
-        if (dev->wireless_data)
-                return dev->wireless_data->spy_data;
-        return NULL;
-}
-
-/*------------------------------------------------------------------*/
-/*
- * Standard Wireless Handler : set Spy List
- */
-int iw_handler_set_spy(struct net_device *      dev,
-                       struct iw_request_info * info,
-                       union iwreq_data *       wrqu,
-                       char *                   extra)
-{
-        struct iw_spy_data *    spydata = get_spydata(dev);
-        struct sockaddr *       address = (struct sockaddr *) extra;
-
-        /* Make sure driver is not buggy or using the old API */
-        if (!spydata)
-                return -EOPNOTSUPP;
-
-        /* Disable spy collection while we copy the addresses.
-         * While we copy addresses, any call to wireless_spy_update()
-         * will NOP. This is OK, as anyway the addresses are changing. */
-        spydata->spy_number = 0;
-
-        /* We want to operate without locking, because wireless_spy_update()
-         * most likely will happen in the interrupt handler, and therefore
-         * have its own locking constraints and needs performance.
-         * The rtnl_lock() make sure we don't race with the other iw_handlers.
-         * This make sure wireless_spy_update() "see" that the spy list
-         * is temporarily disabled. */
-        smp_wmb();
-
-        /* Are there are addresses to copy? */
-        if (wrqu->data.length > 0) {
-                int i;
-
-                /* Copy addresses */
-                for (i = 0; i < wrqu->data.length; i++)
-                        memcpy(spydata->spy_address[i], address[i].sa_data,
-                               ETH_ALEN);
-                /* Reset stats */
-                memset(spydata->spy_stat, 0,
-                       sizeof(struct iw_quality) * IW_MAX_SPY);
-        }
-
-        /* Make sure above is updated before re-enabling */
-        smp_wmb();
-
-        /* Enable addresses */
-        spydata->spy_number = wrqu->data.length;
-
-        return 0;
-}
-EXPORT_SYMBOL(iw_handler_set_spy);
-
-/*------------------------------------------------------------------*/
-/*
- * Standard Wireless Handler : get Spy List
- */
-int iw_handler_get_spy(struct net_device *      dev,
-                       struct iw_request_info * info,
-                       union iwreq_data *       wrqu,
-                       char *                   extra)
-{
-        struct iw_spy_data *    spydata = get_spydata(dev);
-        struct sockaddr *       address = (struct sockaddr *) extra;
-        int                     i;
-
-        /* Make sure driver is not buggy or using the old API */
-        if (!spydata)
-                return -EOPNOTSUPP;
-
-        wrqu->data.length = spydata->spy_number;
-
-        /* Copy addresses. */
-        for (i = 0; i < spydata->spy_number; i++)       {
-                memcpy(address[i].sa_data, spydata->spy_address[i], ETH_ALEN);
-                address[i].sa_family = AF_UNIX;
-        }
-        /* Copy stats to the user buffer (just after). */
-        if (spydata->spy_number > 0)
-                memcpy(extra  + (sizeof(struct sockaddr) *spydata->spy_number),
-                       spydata->spy_stat,
-                       sizeof(struct iw_quality) * spydata->spy_number);
-        /* Reset updated flags. */
-        for (i = 0; i < spydata->spy_number; i++)
-                spydata->spy_stat[i].updated &= ~IW_QUAL_ALL_UPDATED;
-        return 0;
-}
-EXPORT_SYMBOL(iw_handler_get_spy);
-
-/*------------------------------------------------------------------*/
-/*
- * Standard Wireless Handler : set spy threshold
- */
-int iw_handler_set_thrspy(struct net_device *   dev,
-                          struct iw_request_info *info,
-                          union iwreq_data *    wrqu,
-                          char *                extra)
-{
-        struct iw_spy_data *    spydata = get_spydata(dev);
-        struct iw_thrspy *      threshold = (struct iw_thrspy *) extra;
-
-        /* Make sure driver is not buggy or using the old API */
-        if (!spydata)
-                return -EOPNOTSUPP;
-
-        /* Just do it */
-        memcpy(&(spydata->spy_thr_low), &(threshold->low),
-               2 * sizeof(struct iw_quality));
-
-        /* Clear flag */
-        memset(spydata->spy_thr_under, '\0', sizeof(spydata->spy_thr_under));
-
-        return 0;
-}
-EXPORT_SYMBOL(iw_handler_set_thrspy);
-
-/*------------------------------------------------------------------*/
-/*
- * Standard Wireless Handler : get spy threshold
- */
-int iw_handler_get_thrspy(struct net_device *   dev,
-                          struct iw_request_info *info,
-                          union iwreq_data *    wrqu,
-                          char *                extra)
-{
-        struct iw_spy_data *    spydata = get_spydata(dev);
-        struct iw_thrspy *      threshold = (struct iw_thrspy *) extra;
-
-        /* Make sure driver is not buggy or using the old API */
-        if (!spydata)
-                return -EOPNOTSUPP;
-
-        /* Just do it */
-        memcpy(&(threshold->low), &(spydata->spy_thr_low),
-               2 * sizeof(struct iw_quality));
-
-        return 0;
-}
-EXPORT_SYMBOL(iw_handler_get_thrspy);
-
-/*------------------------------------------------------------------*/
-/*
- * Prepare and send a Spy Threshold event
- */
-static void iw_send_thrspy_event(struct net_device *    dev,
-                                 struct iw_spy_data *   spydata,
-                                 unsigned char *        address,
-                                 struct iw_quality *    wstats)
-{
-        union iwreq_data        wrqu;
-        struct iw_thrspy        threshold;
-
-        /* Init */
-        wrqu.data.length = 1;
-        wrqu.data.flags = 0;
-        /* Copy address */
-        memcpy(threshold.addr.sa_data, address, ETH_ALEN);
-        threshold.addr.sa_family = ARPHRD_ETHER;
-        /* Copy stats */
-        memcpy(&(threshold.qual), wstats, sizeof(struct iw_quality));
-        /* Copy also thresholds */
-        memcpy(&(threshold.low), &(spydata->spy_thr_low),
-               2 * sizeof(struct iw_quality));
-
-        /* Send event to user space */
-        wireless_send_event(dev, SIOCGIWTHRSPY, &wrqu, (char *) &threshold);
-}
-
-/* ---------------------------------------------------------------- */
-/*
- * Call for the driver to update the spy data.
- * For now, the spy data is a simple array. As the size of the array is
- * small, this is good enough. If we wanted to support larger number of
- * spy addresses, we should use something more efficient...
- */
-void wireless_spy_update(struct net_device *    dev,
-                         unsigned char *        address,
-                         struct iw_quality *    wstats)
-{
-        struct iw_spy_data *    spydata = get_spydata(dev);
-        int                     i;
-        int                     match = -1;
-
-        /* Make sure driver is not buggy or using the old API */
-        if (!spydata)
-                return;
-
-        /* Update all records that match */
-        for (i = 0; i < spydata->spy_number; i++)
-                if (!compare_ether_addr(address, spydata->spy_address[i])) {
-                        memcpy(&(spydata->spy_stat[i]), wstats,
-                               sizeof(struct iw_quality));
-                        match = i;
-                }
-
-        /* Generate an event if we cross the spy threshold.
-         * To avoid event storms, we have a simple hysteresis : we generate
-         * event only when we go under the low threshold or above the
-         * high threshold. */
-        if (match >= 0) {
-                if (spydata->spy_thr_under[match]) {
-                        if (wstats->level > spydata->spy_thr_high.level) {
-                                spydata->spy_thr_under[match] = 0;
-                                iw_send_thrspy_event(dev, spydata,
-                                                     address, wstats);
-                        }
-                } else {
-                        if (wstats->level < spydata->spy_thr_low.level) {
-                                spydata->spy_thr_under[match] = 1;
-                                iw_send_thrspy_event(dev, spydata,
-                                                     address, wstats);
-                        }
-                }
-        }
-}
-EXPORT_SYMBOL(wireless_spy_update);
diff --git a/net/wireless/wext-priv.c b/net/wireless/wext-priv.c
new file mode 100644
index 000000000000..a3c2277de9e5
--- /dev/null
+++ b/net/wireless/wext-priv.c
@@ -0,0 +1,248 @@
+/*
+ * This file implement the Wireless Extensions priv API.
+ *
+ * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
+ * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
+ * Copyright    2009 Johannes Berg <johannes@sipsolutions.net>
+ *
+ * (As all part of the Linux kernel, this file is GPL)
+ */
+#include <linux/wireless.h>
+#include <linux/netdevice.h>
+#include <net/iw_handler.h>
+#include <net/wext.h>
+
+int iw_handler_get_private(struct net_device *          dev,
+                           struct iw_request_info *     info,
+                           union iwreq_data *           wrqu,
+                           char *                       extra)
+{
+        /* Check if the driver has something to export */
+        if ((dev->wireless_handlers->num_private_args == 0) ||
+           (dev->wireless_handlers->private_args == NULL))
+                return -EOPNOTSUPP;
+
+        /* Check if there is enough buffer up there */
+        if (wrqu->data.length < dev->wireless_handlers->num_private_args) {
+                /* User space can't know in advance how large the buffer
+                 * needs to be. Give it a hint, so that we can support
+                 * any size buffer we want somewhat efficiently... */
+                wrqu->data.length = dev->wireless_handlers->num_private_args;
+                return -E2BIG;
+        }
+
+        /* Set the number of available ioctls. */
+        wrqu->data.length = dev->wireless_handlers->num_private_args;
+
+        /* Copy structure to the user buffer. */
+        memcpy(extra, dev->wireless_handlers->private_args,
+               sizeof(struct iw_priv_args) * wrqu->data.length);
+
+        return 0;
+}
+
+/* Size (in bytes) of the various private data types */
+static const char iw_priv_type_size[] = {
+        0,                              /* IW_PRIV_TYPE_NONE */
+        1,                              /* IW_PRIV_TYPE_BYTE */
+        1,                              /* IW_PRIV_TYPE_CHAR */
+        0,                              /* Not defined */
+        sizeof(__u32),                  /* IW_PRIV_TYPE_INT */
+        sizeof(struct iw_freq),         /* IW_PRIV_TYPE_FLOAT */
+        sizeof(struct sockaddr),        /* IW_PRIV_TYPE_ADDR */
+        0,                              /* Not defined */
+};
+
+static int get_priv_size(__u16 args)
+{
+        int     num = args & IW_PRIV_SIZE_MASK;
+        int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
+
+        return num * iw_priv_type_size[type];
+}
+
+static int adjust_priv_size(__u16 args, struct iw_point *iwp)
+{
+        int     num = iwp->length;
+        int     max = args & IW_PRIV_SIZE_MASK;
+        int     type = (args & IW_PRIV_TYPE_MASK) >> 12;
+
+        /* Make sure the driver doesn't goof up */
+        if (max < num)
+                num = max;
+
+        return num * iw_priv_type_size[type];
+}
+
+/*
+ * Wrapper to call a private Wireless Extension handler.
+ * We do various checks and also take care of moving data between
+ * user space and kernel space.
+ * It's not as nice and slimline as the standard wrapper. The cause
+ * is struct iw_priv_args, which was not really designed for the
+ * job we are going here.
+ *
+ * IMPORTANT : This function prevent to set and get data on the same
+ * IOCTL and enforce the SET/GET convention. Not doing it would be
+ * far too hairy...
+ * If you need to set and get data at the same time, please don't use
+ * a iw_handler but process it in your ioctl handler (i.e. use the
+ * old driver API).
+ */
+static int get_priv_descr_and_size(struct net_device *dev, unsigned int cmd,
+                                   const struct iw_priv_args **descrp)
+{
+        const struct iw_priv_args *descr;
+        int i, extra_size;
+
+        descr = NULL;
+        for (i = 0; i < dev->wireless_handlers->num_private_args; i++) {
+                if (cmd == dev->wireless_handlers->private_args[i].cmd) {
+                        descr = &dev->wireless_handlers->private_args[i];
+                        break;
+                }
+        }
+
+        extra_size = 0;
+        if (descr) {
+                if (IW_IS_SET(cmd)) {
+                        int     offset = 0;     /* For sub-ioctls */
+                        /* Check for sub-ioctl handler */
+                        if (descr->name[0] == '\0')
+                                /* Reserve one int for sub-ioctl index */
+                                offset = sizeof(__u32);
+
+                        /* Size of set arguments */
+                        extra_size = get_priv_size(descr->set_args);
+
+                        /* Does it fits in iwr ? */
+                        if ((descr->set_args & IW_PRIV_SIZE_FIXED) &&
+                           ((extra_size + offset) <= IFNAMSIZ))
+                                extra_size = 0;
+                } else {
+                        /* Size of get arguments */
+                        extra_size = get_priv_size(descr->get_args);
+
+                        /* Does it fits in iwr ? */
+                        if ((descr->get_args & IW_PRIV_SIZE_FIXED) &&
+                           (extra_size <= IFNAMSIZ))
+                                extra_size = 0;
+                }
+        }
+        *descrp = descr;
+        return extra_size;
+}
+
+static int ioctl_private_iw_point(struct iw_point *iwp, unsigned int cmd,
+                                  const struct iw_priv_args *descr,
+                                  iw_handler handler, struct net_device *dev,
+                                  struct iw_request_info *info, int extra_size)
+{
+        char *extra;
+        int err;
+
+        /* Check what user space is giving us */
+        if (IW_IS_SET(cmd)) {
+                if (!iwp->pointer && iwp->length != 0)
+                        return -EFAULT;
+
+                if (iwp->length > (descr->set_args & IW_PRIV_SIZE_MASK))
+                        return -E2BIG;
+        } else if (!iwp->pointer)
+                return -EFAULT;
+
+        extra = kmalloc(extra_size, GFP_KERNEL);
+        if (!extra)
+                return -ENOMEM;
+
+        /* If it is a SET, get all the extra data in here */
+        if (IW_IS_SET(cmd) && (iwp->length != 0)) {
+                if (copy_from_user(extra, iwp->pointer, extra_size)) {
+                        err = -EFAULT;
+                        goto out;
+                }
+        }
+
+        /* Call the handler */
+        err = handler(dev, info, (union iwreq_data *) iwp, extra);
+
+        /* If we have something to return to the user */
+        if (!err && IW_IS_GET(cmd)) {
+                /* Adjust for the actual length if it's variable,
+                 * avoid leaking kernel bits outside.
+                 */
+                if (!(descr->get_args & IW_PRIV_SIZE_FIXED))
+                        extra_size = adjust_priv_size(descr->get_args, iwp);
+
+                if (copy_to_user(iwp->pointer, extra, extra_size))
+                        err =  -EFAULT;
+        }
+
+out:
+        kfree(extra);
+        return err;
+}
+
+int ioctl_private_call(struct net_device *dev, struct iwreq *iwr,
+                       unsigned int cmd, struct iw_request_info *info,
+                       iw_handler handler)
+{
+        int extra_size = 0, ret = -EINVAL;
+        const struct iw_priv_args *descr;
+
+        extra_size = get_priv_descr_and_size(dev, cmd, &descr);
+
+        /* Check if we have a pointer to user space data or not. */
+        if (extra_size == 0) {
+                /* No extra arguments. Trivial to handle */
+                ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
+        } else {
+                ret = ioctl_private_iw_point(&iwr->u.data, cmd, descr,
+                                             handler, dev, info, extra_size);
+        }
+
+        /* Call commit handler if needed and defined */
+        if (ret == -EIWCOMMIT)
+                ret = call_commit_handler(dev);
+
+        return ret;
+}
+
+#ifdef CONFIG_COMPAT
+int compat_private_call(struct net_device *dev, struct iwreq *iwr,
+                        unsigned int cmd, struct iw_request_info *info,
+                        iw_handler handler)
+{
+        const struct iw_priv_args *descr;
+        int ret, extra_size;
+
+        extra_size = get_priv_descr_and_size(dev, cmd, &descr);
+
+        /* Check if we have a pointer to user space data or not. */
+        if (extra_size == 0) {
+                /* No extra arguments. Trivial to handle */
+                ret = handler(dev, info, &(iwr->u), (char *) &(iwr->u));
+        } else {
+                struct compat_iw_point *iwp_compat;
+                struct iw_point iwp;
+
+                iwp_compat = (struct compat_iw_point *) &iwr->u.data;
+                iwp.pointer = compat_ptr(iwp_compat->pointer);
+                iwp.length = iwp_compat->length;
+                iwp.flags = iwp_compat->flags;
+
+                ret = ioctl_private_iw_point(&iwp, cmd, descr,
+                                             handler, dev, info, extra_size);
+
+                iwp_compat->pointer = ptr_to_compat(iwp.pointer);
+                iwp_compat->length = iwp.length;
+                iwp_compat->flags = iwp.flags;
+        }
+
+        /* Call commit handler if needed and defined */
+        if (ret == -EIWCOMMIT)
+                ret = call_commit_handler(dev);
+
+        return ret;
+}
+#endif
diff --git a/net/wireless/wext-proc.c b/net/wireless/wext-proc.c
new file mode 100644
index 000000000000..273a7f77c834
--- /dev/null
+++ b/net/wireless/wext-proc.c
@@ -0,0 +1,155 @@
+/*
+ * This file implement the Wireless Extensions proc API.
+ *
+ * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
+ * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
+ *
+ * (As all part of the Linux kernel, this file is GPL)
+ */
+
+/*
+ * The /proc/net/wireless file is a human readable user-space interface
+ * exporting various wireless specific statistics from the wireless devices.
+ * This is the most popular part of the Wireless Extensions ;-)
+ *
+ * This interface is a pure clone of /proc/net/dev (in net/core/dev.c).
+ * The content of the file is basically the content of "struct iw_statistics".
+ */
+
+#include <linux/module.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <linux/wireless.h>
+#include <linux/netdevice.h>
+#include <linux/rtnetlink.h>
+#include <net/iw_handler.h>
+#include <net/wext.h>
+
+
+static void wireless_seq_printf_stats(struct seq_file *seq,
+                                      struct net_device *dev)
+{
+        /* Get stats from the driver */
+        struct iw_statistics *stats = get_wireless_stats(dev);
+        static struct iw_statistics nullstats = {};
+
+        /* show device if it's wireless regardless of current stats */
+        if (!stats) {
+#ifdef CONFIG_WIRELESS_EXT
+                if (dev->wireless_handlers)
+                        stats = &nullstats;
+#endif
+#ifdef CONFIG_CFG80211
+                if (dev->ieee80211_ptr)
+                        stats = &nullstats;
+#endif
+        }
+
+        if (stats) {
+                seq_printf(seq, "%6s: %04x  %3d%c  %3d%c  %3d%c  %6d %6d %6d "
+                                "%6d %6d   %6d\n",
+                           dev->name, stats->status, stats->qual.qual,
+                           stats->qual.updated & IW_QUAL_QUAL_UPDATED
+                           ? '.' : ' ',
+                           ((__s32) stats->qual.level) -
+                           ((stats->qual.updated & IW_QUAL_DBM) ? 0x100 : 0),
+                           stats->qual.updated & IW_QUAL_LEVEL_UPDATED
+                           ? '.' : ' ',
+                           ((__s32) stats->qual.noise) -
+                           ((stats->qual.updated & IW_QUAL_DBM) ? 0x100 : 0),
+                           stats->qual.updated & IW_QUAL_NOISE_UPDATED
+                           ? '.' : ' ',
+                           stats->discard.nwid, stats->discard.code,
+                           stats->discard.fragment, stats->discard.retries,
+                           stats->discard.misc, stats->miss.beacon);
+
+                if (stats != &nullstats)
+                        stats->qual.updated &= ~IW_QUAL_ALL_UPDATED;
+        }
+}
+
+/* ---------------------------------------------------------------- */
+/*
+ * Print info for /proc/net/wireless (print all entries)
+ */
+static int wireless_dev_seq_show(struct seq_file *seq, void *v)
+{
+        might_sleep();
+
+        if (v == SEQ_START_TOKEN)
+                seq_printf(seq, "Inter-| sta-|   Quality        |   Discarded "
+                                "packets               | Missed | WE\n"
+                                " face | tus | link level noise |  nwid  "
+                                "crypt   frag  retry   misc | beacon | %d\n",
+                           WIRELESS_EXT);
+        else
+                wireless_seq_printf_stats(seq, v);
+        return 0;
+}
+
+static void *wireless_dev_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        struct net *net = seq_file_net(seq);
+        loff_t off;
+        struct net_device *dev;
+
+        rtnl_lock();
+        if (!*pos)
+                return SEQ_START_TOKEN;
+
+        off = 1;
+        for_each_netdev(net, dev)
+                if (off++ == *pos)
+                        return dev;
+        return NULL;
+}
+
+static void *wireless_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        struct net *net = seq_file_net(seq);
+
+        ++*pos;
+
+        return v == SEQ_START_TOKEN ?
+                first_net_device(net) : next_net_device(v);
+}
+
+static void wireless_dev_seq_stop(struct seq_file *seq, void *v)
+{
+        rtnl_unlock();
+}
+
+static const struct seq_operations wireless_seq_ops = {
+        .start = wireless_dev_seq_start,
+        .next  = wireless_dev_seq_next,
+        .stop  = wireless_dev_seq_stop,
+        .show  = wireless_dev_seq_show,
+};
+
+static int seq_open_wireless(struct inode *inode, struct file *file)
+{
+        return seq_open_net(inode, file, &wireless_seq_ops,
+                            sizeof(struct seq_net_private));
+}
+
+static const struct file_operations wireless_seq_fops = {
+        .owner   = THIS_MODULE,
+        .open    = seq_open_wireless,
+        .read    = seq_read,
+        .llseek  = seq_lseek,
+        .release = seq_release_net,
+};
+
+int wext_proc_init(struct net *net)
+{
+        /* Create /proc/net/wireless entry */
+        if (!proc_net_fops_create(net, "wireless", S_IRUGO, &wireless_seq_fops))
+                return -ENOMEM;
+
+        return 0;
+}
+
+void wext_proc_exit(struct net *net)
+{
+        proc_net_remove(net, "wireless");
+}
diff --git a/net/wireless/wext-spy.c b/net/wireless/wext-spy.c
new file mode 100644
index 000000000000..6dcfe65a2d1a
--- /dev/null
+++ b/net/wireless/wext-spy.c
@@ -0,0 +1,231 @@
+/*
+ * This file implement the Wireless Extensions spy API.
+ *
+ * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
+ * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
+ *
+ * (As all part of the Linux kernel, this file is GPL)
+ */
+
+#include <linux/wireless.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <net/iw_handler.h>
+#include <net/arp.h>
+#include <net/wext.h>
+
+static inline struct iw_spy_data *get_spydata(struct net_device *dev)
+{
+        /* This is the new way */
+        if (dev->wireless_data)
+                return dev->wireless_data->spy_data;
+        return NULL;
+}
+
+int iw_handler_set_spy(struct net_device *      dev,
+                       struct iw_request_info * info,
+                       union iwreq_data *       wrqu,
+                       char *                   extra)
+{
+        struct iw_spy_data *    spydata = get_spydata(dev);
+        struct sockaddr *       address = (struct sockaddr *) extra;
+
+        /* Make sure driver is not buggy or using the old API */
+        if (!spydata)
+                return -EOPNOTSUPP;
+
+        /* Disable spy collection while we copy the addresses.
+         * While we copy addresses, any call to wireless_spy_update()
+         * will NOP. This is OK, as anyway the addresses are changing. */
+        spydata->spy_number = 0;
+
+        /* We want to operate without locking, because wireless_spy_update()
+         * most likely will happen in the interrupt handler, and therefore
+         * have its own locking constraints and needs performance.
+         * The rtnl_lock() make sure we don't race with the other iw_handlers.
+         * This make sure wireless_spy_update() "see" that the spy list
+         * is temporarily disabled. */
+        smp_wmb();
+
+        /* Are there are addresses to copy? */
+        if (wrqu->data.length > 0) {
+                int i;
+
+                /* Copy addresses */
+                for (i = 0; i < wrqu->data.length; i++)
+                        memcpy(spydata->spy_address[i], address[i].sa_data,
+                               ETH_ALEN);
+                /* Reset stats */
+                memset(spydata->spy_stat, 0,
+                       sizeof(struct iw_quality) * IW_MAX_SPY);
+        }
+
+        /* Make sure above is updated before re-enabling */
+        smp_wmb();
+
+        /* Enable addresses */
+        spydata->spy_number = wrqu->data.length;
+
+        return 0;
+}
+EXPORT_SYMBOL(iw_handler_set_spy);
+
+int iw_handler_get_spy(struct net_device *      dev,
+                       struct iw_request_info * info,
+                       union iwreq_data *       wrqu,
+                       char *                   extra)
+{
+        struct iw_spy_data *    spydata = get_spydata(dev);
+        struct sockaddr *       address = (struct sockaddr *) extra;
+        int                     i;
+
+        /* Make sure driver is not buggy or using the old API */
+        if (!spydata)
+                return -EOPNOTSUPP;
+
+        wrqu->data.length = spydata->spy_number;
+
+        /* Copy addresses. */
+        for (i = 0; i < spydata->spy_number; i++)       {
+                memcpy(address[i].sa_data, spydata->spy_address[i], ETH_ALEN);
+                address[i].sa_family = AF_UNIX;
+        }
+        /* Copy stats to the user buffer (just after). */
+        if (spydata->spy_number > 0)
+                memcpy(extra  + (sizeof(struct sockaddr) *spydata->spy_number),
+                       spydata->spy_stat,
+                       sizeof(struct iw_quality) * spydata->spy_number);
+        /* Reset updated flags. */
+        for (i = 0; i < spydata->spy_number; i++)
+                spydata->spy_stat[i].updated &= ~IW_QUAL_ALL_UPDATED;
+        return 0;
+}
+EXPORT_SYMBOL(iw_handler_get_spy);
+
+/*------------------------------------------------------------------*/
+/*
+ * Standard Wireless Handler : set spy threshold
+ */
+int iw_handler_set_thrspy(struct net_device *   dev,
+                          struct iw_request_info *info,
+                          union iwreq_data *    wrqu,
+                          char *                extra)
+{
+        struct iw_spy_data *    spydata = get_spydata(dev);
+        struct iw_thrspy *      threshold = (struct iw_thrspy *) extra;
+
+        /* Make sure driver is not buggy or using the old API */
+        if (!spydata)
+                return -EOPNOTSUPP;
+
+        /* Just do it */
+        memcpy(&(spydata->spy_thr_low), &(threshold->low),
+               2 * sizeof(struct iw_quality));
+
+        /* Clear flag */
+        memset(spydata->spy_thr_under, '\0', sizeof(spydata->spy_thr_under));
+
+        return 0;
+}
+EXPORT_SYMBOL(iw_handler_set_thrspy);
+
+/*------------------------------------------------------------------*/
+/*
+ * Standard Wireless Handler : get spy threshold
+ */
+int iw_handler_get_thrspy(struct net_device *   dev,
+                          struct iw_request_info *info,
+                          union iwreq_data *    wrqu,
+                          char *                extra)
+{
+        struct iw_spy_data *    spydata = get_spydata(dev);
+        struct iw_thrspy *      threshold = (struct iw_thrspy *) extra;
+
+        /* Make sure driver is not buggy or using the old API */
+        if (!spydata)
+                return -EOPNOTSUPP;
+
+        /* Just do it */
+        memcpy(&(threshold->low), &(spydata->spy_thr_low),
+               2 * sizeof(struct iw_quality));
+
+        return 0;
+}
+EXPORT_SYMBOL(iw_handler_get_thrspy);
+
+/*------------------------------------------------------------------*/
+/*
+ * Prepare and send a Spy Threshold event
+ */
+static void iw_send_thrspy_event(struct net_device *    dev,
+                                 struct iw_spy_data *   spydata,
+                                 unsigned char *        address,
+                                 struct iw_quality *    wstats)
+{
+        union iwreq_data        wrqu;
+        struct iw_thrspy        threshold;
+
+        /* Init */
+        wrqu.data.length = 1;
+        wrqu.data.flags = 0;
+        /* Copy address */
+        memcpy(threshold.addr.sa_data, address, ETH_ALEN);
+        threshold.addr.sa_family = ARPHRD_ETHER;
+        /* Copy stats */
+        memcpy(&(threshold.qual), wstats, sizeof(struct iw_quality));
+        /* Copy also thresholds */
+        memcpy(&(threshold.low), &(spydata->spy_thr_low),
+               2 * sizeof(struct iw_quality));
+
+        /* Send event to user space */
+        wireless_send_event(dev, SIOCGIWTHRSPY, &wrqu, (char *) &threshold);
+}
+
+/* ---------------------------------------------------------------- */
+/*
+ * Call for the driver to update the spy data.
+ * For now, the spy data is a simple array. As the size of the array is
+ * small, this is good enough. If we wanted to support larger number of
+ * spy addresses, we should use something more efficient...
+ */
+void wireless_spy_update(struct net_device *    dev,
+                         unsigned char *        address,
+                         struct iw_quality *    wstats)
+{
+        struct iw_spy_data *    spydata = get_spydata(dev);
+        int                     i;
+        int                     match = -1;
+
+        /* Make sure driver is not buggy or using the old API */
+        if (!spydata)
+                return;
+
+        /* Update all records that match */
+        for (i = 0; i < spydata->spy_number; i++)
+                if (!compare_ether_addr(address, spydata->spy_address[i])) {
+                        memcpy(&(spydata->spy_stat[i]), wstats,
+                               sizeof(struct iw_quality));
+                        match = i;
+                }
+
+        /* Generate an event if we cross the spy threshold.
+         * To avoid event storms, we have a simple hysteresis : we generate
+         * event only when we go under the low threshold or above the
+         * high threshold. */
+        if (match >= 0) {
+                if (spydata->spy_thr_under[match]) {
+                        if (wstats->level > spydata->spy_thr_high.level) {
+                                spydata->spy_thr_under[match] = 0;
+                                iw_send_thrspy_event(dev, spydata,
+                                                     address, wstats);
+                        }
+                } else {
+                        if (wstats->level < spydata->spy_thr_low.level) {
+                                spydata->spy_thr_under[match] = 1;
+                                iw_send_thrspy_event(dev, spydata,
+                                                     address, wstats);
+                        }
+                }
+        }
+}
+EXPORT_SYMBOL(wireless_spy_update);
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 7fa9c7ad3d3b..e19d811788a5 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1363,7 +1363,7 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                             facilities.throughput > 0xDD)
                                 break;
                         if (facilities.reverse &&
-                                (facilities.reverse | 0x81)!= 0x81)
+                                (facilities.reverse & 0x81) != 0x81)
                                 break;
                         x25->facilities = facilities;
                         rc = 0;
@@ -1476,7 +1476,7 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         return rc;
 }
 
-static struct net_proto_family x25_family_ops = {
+static const struct net_proto_family x25_family_ops = {
         .family =       AF_X25,
         .create =       x25_create,
         .owner  =       THIS_MODULE,
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 7d7c3abf38b5..96d922783547 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -114,7 +114,7 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                         /*
                          *      Copy any Call User Data.
                          */
-                        if (skb->len >= 0) {
+                        if (skb->len > 0) {
                                 skb_copy_from_linear_data(skb,
                                               x25->calluserdata.cuddata,
                                               skb->len);
diff --git a/net/x25/x25_route.c b/net/x25/x25_route.c
index 2c999ccf504a..66961ea28c91 100644
--- a/net/x25/x25_route.c
+++ b/net/x25/x25_route.c
@@ -190,7 +190,7 @@ int x25_route_ioctl(unsigned int cmd, void __user *arg)
                 goto out;
 
         rc = -EINVAL;
-        if (rt.sigdigits < 0 || rt.sigdigits > 15)
+        if (rt.sigdigits > 15)
                 goto out;
 
         dev = x25_dev_get(rt.device);
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index faf54c6bf96b..b39341072aa6 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -689,84 +689,6 @@ int xfrm_count_enc_supported(void)
 }
 EXPORT_SYMBOL_GPL(xfrm_count_enc_supported);
 
-/* Move to common area: it is shared with AH. */
-
-int skb_icv_walk(const struct sk_buff *skb, struct hash_desc *desc,
-                 int offset, int len, icv_update_fn_t icv_update)
-{
-        int start = skb_headlen(skb);
-        int i, copy = start - offset;
-        struct sk_buff *frag_iter;
-        struct scatterlist sg;
-        int err;
-
-        /* Checksum header. */
-        if (copy > 0) {
-                if (copy > len)
-                        copy = len;
-
-                sg_init_one(&sg, skb->data + offset, copy);
-
-                err = icv_update(desc, &sg, copy);
-                if (unlikely(err))
-                        return err;
-
-                if ((len -= copy) == 0)
-                        return 0;
-                offset += copy;
-        }
-
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-                int end;
-
-                WARN_ON(start > offset + len);
-
-                end = start + skb_shinfo(skb)->frags[i].size;
-                if ((copy = end - offset) > 0) {
-                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-
-                        if (copy > len)
-                                copy = len;
-
-                        sg_init_table(&sg, 1);
-                        sg_set_page(&sg, frag->page, copy,
-                                    frag->page_offset + offset-start);
-
-                        err = icv_update(desc, &sg, copy);
-                        if (unlikely(err))
-                                return err;
-
-                        if (!(len -= copy))
-                                return 0;
-                        offset += copy;
-                }
-                start = end;
-        }
-
-        skb_walk_frags(skb, frag_iter) {
-                int end;
-
-                WARN_ON(start > offset + len);
-
-                end = start + frag_iter->len;
-                if ((copy = end - offset) > 0) {
-                        if (copy > len)
-                                copy = len;
-                        err = skb_icv_walk(frag_iter, desc, offset-start,
-                                           copy, icv_update);
-                        if (unlikely(err))
-                                return err;
-                        if ((len -= copy) == 0)
-                                return 0;
-                        offset += copy;
-                }
-                start = end;
-        }
-        BUG_ON(len);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(skb_icv_walk);
-
 #if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
 
 void *pskb_put(struct sk_buff *skb, struct sk_buff *tail, int len)