160 files changed, 2948 insertions, 1952 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 3fe4fc86055f..1037748c14db 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -747,6 +747,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg)
                 vlan_dev_set_ingress_priority(dev,
                                               args.u.skb_priority,
                                               args.vlan_qos);
+                err = 0;
                 break;
 
         case SET_VLAN_EGRESS_PRIORITY_CMD:
diff --git a/net/9p/Kconfig b/net/9p/Kconfig
index 71bc110aebf8..bafc50c9e6ff 100644
--- a/net/9p/Kconfig
+++ b/net/9p/Kconfig
@@ -23,6 +23,13 @@ config NET_9P_FD
           file descriptors.  TCP/IP is the default transport for 9p,
           so if you are going to use 9p, you'll likely want this.
 
+config NET_9P_VIRTIO
+        depends on NET_9P && EXPERIMENTAL && VIRTIO
+        tristate "9P Virtio Transport (Experimental)"
+        help
+          This builds support for a transports between
+          guest partitions and a host partition.
+
 config NET_9P_DEBUG
         bool "Debug information"
         depends on NET_9P
diff --git a/net/9p/Makefile b/net/9p/Makefile
index 5059bc06f8f3..d3abb246ccab 100644
--- a/net/9p/Makefile
+++ b/net/9p/Makefile
@@ -1,5 +1,6 @@
 obj-$(CONFIG_NET_9P) := 9pnet.o
 obj-$(CONFIG_NET_9P_FD) += 9pnet_fd.o
+obj-$(CONFIG_NET_9P_VIRTIO) += 9pnet_virtio.o
 
 9pnet-objs := \
         mod.o \
@@ -12,3 +13,6 @@ obj-$(CONFIG_NET_9P_FD) += 9pnet_fd.o
 
 9pnet_fd-objs := \
         trans_fd.o \
+
+9pnet_virtio-objs := \
+        trans_virtio.o \
diff --git a/net/9p/mod.c b/net/9p/mod.c
index 41d70f47375d..8f9763a9dc12 100644
--- a/net/9p/mod.c
+++ b/net/9p/mod.c
@@ -76,9 +76,9 @@ struct p9_trans_module *v9fs_match_trans(const substring_t *name)
         list_for_each(p, &v9fs_trans_list) {
                 t = list_entry(p, struct p9_trans_module, list);
                 if (strncmp(t->name, name->from, name->to-name->from) == 0)
-                        break;
+                        return t;
         }
-        return t;
+        return NULL;
 }
 EXPORT_SYMBOL(v9fs_match_trans);
 
diff --git a/net/9p/mux.c b/net/9p/mux.c
index f14014793bed..c9f0805048e4 100644
--- a/net/9p/mux.c
+++ b/net/9p/mux.c
@@ -222,8 +222,10 @@ static int p9_mux_poll_start(struct p9_conn *m)
         }
 
         if (i >= ARRAY_SIZE(p9_mux_poll_tasks)) {
-                if (vptlast == NULL)
+                if (vptlast == NULL) {
+                        mutex_unlock(&p9_mux_task_lock);
                         return -ENOMEM;
+                }
 
                 P9_DPRINTK(P9_DEBUG_MUX, "put in proc %d\n", i);
                 list_add(&m->mux_list, &vptlast->mux_list);
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 30269a4ff22a..62332ed9da4a 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -62,13 +62,14 @@ struct p9_trans_fd {
 
 enum {
         /* Options that take integer arguments */
-        Opt_port, Opt_rfdno, Opt_wfdno,
+        Opt_port, Opt_rfdno, Opt_wfdno, Opt_err,
 };
 
 static match_table_t tokens = {
         {Opt_port, "port=%u"},
         {Opt_rfdno, "rfdno=%u"},
         {Opt_wfdno, "wfdno=%u"},
+        {Opt_err, NULL},
 };
 
 /**
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
new file mode 100644
index 000000000000..40b71a29fc3f
--- /dev/null
+++ b/net/9p/trans_virtio.c
@@ -0,0 +1,353 @@
+/*
+ * The Guest 9p transport driver
+ *
+ * This is a trivial pipe-based transport driver based on the lguest console
+ * code: we use lguest's DMA mechanism to send bytes out, and register a
+ * DMA buffer to receive bytes in.  It is assumed to be present and available
+ * from the very beginning of boot.
+ *
+ * This may be have been done by just instaniating another HVC console,
+ * but HVC's blocksize of 16 bytes is annoying and painful to performance.
+ *
+ * A more efficient transport could be built based on the virtio block driver
+ * but it requires some changes in the 9p transport model (which are in
+ * progress)
+ *
+ */
+/*
+ *  Copyright (C) 2007 Eric Van Hensbergen, IBM Corporation
+ *
+ *  Based on virtio console driver
+ *  Copyright (C) 2006, 2007 Rusty Russell, IBM Corporation
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2
+ *  as published by the Free Software Foundation.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to:
+ *  Free Software Foundation
+ *  51 Franklin Street, Fifth Floor
+ *  Boston, MA  02111-1301  USA
+ *
+ */
+
+#include <linux/in.h>
+#include <linux/module.h>
+#include <linux/net.h>
+#include <linux/ipv6.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/un.h>
+#include <linux/uaccess.h>
+#include <linux/inet.h>
+#include <linux/idr.h>
+#include <linux/file.h>
+#include <net/9p/9p.h>
+#include <linux/parser.h>
+#include <net/9p/transport.h>
+#include <linux/scatterlist.h>
+#include <linux/virtio.h>
+#include <linux/virtio_9p.h>
+
+/* a single mutex to manage channel initialization and attachment */
+static DECLARE_MUTEX(virtio_9p_lock);
+/* global which tracks highest initialized channel */
+static int chan_index;
+
+/* We keep all per-channel information in a structure.
+ * This structure is allocated within the devices dev->mem space.
+ * A pointer to the structure will get put in the transport private.
+ */
+static struct virtio_chan {
+        bool initialized;               /* channel is initialized */
+        bool inuse;                     /* channel is in use */
+
+        struct virtqueue *in_vq, *out_vq;
+        struct virtio_device *vdev;
+
+        /* This is our input buffer, and how much data is left in it. */
+        unsigned int in_len;
+        char *in, *inbuf;
+
+        wait_queue_head_t wq;           /* waitq for buffer */
+} channels[MAX_9P_CHAN];
+
+/* How many bytes left in this page. */
+static unsigned int rest_of_page(void *data)
+{
+        return PAGE_SIZE - ((unsigned long)data % PAGE_SIZE);
+}
+
+static int p9_virtio_write(struct p9_trans *trans, void *buf, int count)
+{
+        struct virtio_chan *chan = (struct virtio_chan *) trans->priv;
+        struct virtqueue *out_vq = chan->out_vq;
+        struct scatterlist sg[1];
+        unsigned int len;
+
+        P9_DPRINTK(P9_DEBUG_TRANS, "9p debug: virtio write (%d)\n", count);
+
+        /* keep it simple - make sure we don't overflow a page */
+        if (rest_of_page(buf) < count)
+                count = rest_of_page(buf);
+
+        sg_init_one(sg, buf, count);
+
+        /* add_buf wants a token to identify this buffer: we hand it any
+         * non-NULL pointer, since there's only ever one buffer. */
+        if (out_vq->vq_ops->add_buf(out_vq, sg, 1, 0, (void *)1) == 0) {
+                /* Tell Host to go! */
+                out_vq->vq_ops->kick(out_vq);
+                /* Chill out until it's done with the buffer. */
+                while (!out_vq->vq_ops->get_buf(out_vq, &len))
+                        cpu_relax();
+        }
+
+        P9_DPRINTK(P9_DEBUG_TRANS, "9p debug: virtio wrote (%d)\n", count);
+
+        /* We're expected to return the amount of data we wrote: all of it. */
+        return count;
+}
+
+/* Create a scatter-gather list representing our input buffer and put it in the
+ * queue. */
+static void add_inbuf(struct virtio_chan *chan)
+{
+        struct scatterlist sg[1];
+
+        sg_init_one(sg, chan->inbuf, PAGE_SIZE);
+
+        /* We should always be able to add one buffer to an empty queue. */
+        if (chan->in_vq->vq_ops->add_buf(chan->in_vq, sg, 0, 1, chan->inbuf))
+                BUG();
+        chan->in_vq->vq_ops->kick(chan->in_vq);
+}
+
+static int p9_virtio_read(struct p9_trans *trans, void *buf, int count)
+{
+        struct virtio_chan *chan = (struct virtio_chan *) trans->priv;
+        struct virtqueue *in_vq = chan->in_vq;
+
+        P9_DPRINTK(P9_DEBUG_TRANS, "9p debug: virtio read (%d)\n", count);
+
+        /* If we don't have an input queue yet, we can't get input. */
+        BUG_ON(!in_vq);
+
+        /* No buffer?  Try to get one. */
+        if (!chan->in_len) {
+                chan->in = in_vq->vq_ops->get_buf(in_vq, &chan->in_len);
+                if (!chan->in)
+                        return 0;
+        }
+
+        /* You want more than we have to give?  Well, try wanting less! */
+        if (chan->in_len < count)
+                count = chan->in_len;
+
+        /* Copy across to their buffer and increment offset. */
+        memcpy(buf, chan->in, count);
+        chan->in += count;
+        chan->in_len -= count;
+
+        /* Finished?  Re-register buffer so Host will use it again. */
+        if (chan->in_len == 0)
+                add_inbuf(chan);
+
+        P9_DPRINTK(P9_DEBUG_TRANS, "9p debug: virtio finished read (%d)\n",
+                                                                        count);
+
+        return count;
+}
+
+/* The poll function is used by 9p transports to determine if there
+ * is there is activity available on a particular channel.  In our case
+ * we use it to wait for a callback from the input routines.
+ */
+static unsigned int
+p9_virtio_poll(struct p9_trans *trans, struct poll_table_struct *pt)
+{
+        struct virtio_chan *chan = (struct virtio_chan *)trans->priv;
+        struct virtqueue *in_vq = chan->in_vq;
+        int ret = POLLOUT; /* we can always handle more output */
+
+        poll_wait(NULL, &chan->wq, pt);
+
+        /* No buffer?  Try to get one. */
+        if (!chan->in_len)
+                chan->in = in_vq->vq_ops->get_buf(in_vq, &chan->in_len);
+
+        if (chan->in_len)
+                ret |= POLLIN;
+
+        return ret;
+}
+
+static void p9_virtio_close(struct p9_trans *trans)
+{
+        struct virtio_chan *chan = trans->priv;
+
+        down(&virtio_9p_lock);
+        chan->inuse = false;
+        up(&virtio_9p_lock);
+
+        kfree(trans);
+}
+
+static bool p9_virtio_intr(struct virtqueue *q)
+{
+        struct virtio_chan *chan = q->vdev->priv;
+
+        P9_DPRINTK(P9_DEBUG_TRANS, "9p poll_wakeup: %p\n", &chan->wq);
+        wake_up_interruptible(&chan->wq);
+
+        return true;
+}
+
+static int p9_virtio_probe(struct virtio_device *dev)
+{
+        int err;
+        struct virtio_chan *chan;
+        int index;
+
+        down(&virtio_9p_lock);
+        index = chan_index++;
+        chan = &channels[index];
+        up(&virtio_9p_lock);
+
+        if (chan_index > MAX_9P_CHAN) {
+                printk(KERN_ERR "9p: virtio: Maximum channels exceeded\n");
+                BUG();
+        }
+
+        chan->vdev = dev;
+
+        /* This is the scratch page we use to receive console input */
+        chan->inbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+        if (!chan->inbuf) {
+                err = -ENOMEM;
+                goto fail;
+        }
+
+        /* Find the input queue. */
+        dev->priv = chan;
+        chan->in_vq = dev->config->find_vq(dev, p9_virtio_intr);
+        if (IS_ERR(chan->in_vq)) {
+                err = PTR_ERR(chan->in_vq);
+                goto free;
+        }
+
+        chan->out_vq = dev->config->find_vq(dev, NULL);
+        if (IS_ERR(chan->out_vq)) {
+                err = PTR_ERR(chan->out_vq);
+                goto free_in_vq;
+        }
+
+        init_waitqueue_head(&chan->wq);
+
+        /* Register the input buffer the first time. */
+        add_inbuf(chan);
+        chan->inuse = false;
+        chan->initialized = true;
+
+        return 0;
+
+free_in_vq:
+        dev->config->del_vq(chan->in_vq);
+free:
+        kfree(chan->inbuf);
+fail:
+        down(&virtio_9p_lock);
+        chan_index--;
+        up(&virtio_9p_lock);
+        return err;
+}
+
+/* This sets up a transport channel for 9p communication.  Right now
+ * we only match the first available channel, but eventually we couldlook up
+ * alternate channels by matching devname versus a virtio_config entry.
+ * We use a simple reference count mechanism to ensure that only a single
+ * mount has a channel open at a time. */
+static struct p9_trans *p9_virtio_create(const char *devname, char *args)
+{
+        struct p9_trans *trans;
+        int index = 0;
+        struct virtio_chan *chan = channels;
+
+        down(&virtio_9p_lock);
+        while (index < MAX_9P_CHAN) {
+                if (chan->initialized && !chan->inuse) {
+                        chan->inuse = true;
+                        break;
+                } else {
+                        index++;
+                        chan = &channels[index];
+                }
+        }
+        up(&virtio_9p_lock);
+
+        if (index >= MAX_9P_CHAN) {
+                printk(KERN_ERR "9p: virtio: couldn't find a free channel\n");
+                return NULL;
+        }
+
+        trans = kmalloc(sizeof(struct p9_trans), GFP_KERNEL);
+        if (!trans) {
+                printk(KERN_ERR "9p: couldn't allocate transport\n");
+                return ERR_PTR(-ENOMEM);
+        }
+
+        trans->write = p9_virtio_write;
+        trans->read = p9_virtio_read;
+        trans->close = p9_virtio_close;
+        trans->poll = p9_virtio_poll;
+        trans->priv = chan;
+
+        return trans;
+}
+
+#define VIRTIO_ID_9P 9
+
+static struct virtio_device_id id_table[] = {
+        { VIRTIO_ID_9P, VIRTIO_DEV_ANY_ID },
+        { 0 },
+};
+
+/* The standard "struct lguest_driver": */
+static struct virtio_driver p9_virtio_drv = {
+        .driver.name =  KBUILD_MODNAME,
+        .driver.owner = THIS_MODULE,
+        .id_table =     id_table,
+        .probe =        p9_virtio_probe,
+};
+
+static struct p9_trans_module p9_virtio_trans = {
+        .name = "virtio",
+        .create = p9_virtio_create,
+        .maxsize = PAGE_SIZE,
+        .def = 0,
+};
+
+/* The standard init function */
+static int __init p9_virtio_init(void)
+{
+        int count;
+
+        for (count = 0; count < MAX_9P_CHAN; count++)
+                channels[count].initialized = false;
+
+        v9fs_register_trans(&p9_virtio_trans);
+        return register_virtio_driver(&p9_virtio_drv);
+}
+
+module_init(p9_virtio_init);
+
+MODULE_DEVICE_TABLE(virtio, id_table);
+MODULE_AUTHOR("Eric Van Hensbergen <ericvh@gmail.com>");
+MODULE_DESCRIPTION("Virtio 9p Transport");
+MODULE_LICENSE("GPL");
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 7c0b5151d526..e0d37d6dc1f8 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1044,7 +1044,7 @@ static int atalk_create(struct net *net, struct socket *sock, int protocol)
         if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
                 goto out;
         rc = -ENOMEM;
-        sk = sk_alloc(net, PF_APPLETALK, GFP_KERNEL, &ddp_proto, 1);
+        sk = sk_alloc(net, PF_APPLETALK, GFP_KERNEL, &ddp_proto);
         if (!sk)
                 goto out;
         rc = 0;
diff --git a/net/atm/common.c b/net/atm/common.c
index e166d9e0ffd9..eba09a04f6bf 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -133,7 +133,7 @@ int vcc_create(struct net *net, struct socket *sock, int protocol, int family)
         sock->sk = NULL;
         if (sock->type == SOCK_STREAM)
                 return -EINVAL;
-        sk = sk_alloc(net, family, GFP_KERNEL, &vcc_proto, 1);
+        sk = sk_alloc(net, family, GFP_KERNEL, &vcc_proto);
         if (!sk)
                 return -ENOMEM;
         sock_init_data(sock, sk);
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 993e5c75e909..8378afd54b30 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -836,7 +836,8 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol)
                 return -ESOCKTNOSUPPORT;
         }
 
-        if ((sk = sk_alloc(net, PF_AX25, GFP_ATOMIC, &ax25_proto, 1)) == NULL)
+        sk = sk_alloc(net, PF_AX25, GFP_ATOMIC, &ax25_proto);
+        if (sk == NULL)
                 return -ENOMEM;
 
         ax25 = sk->sk_protinfo = ax25_create_cb();
@@ -861,7 +862,8 @@ struct sock *ax25_make_new(struct sock *osk, struct ax25_dev *ax25_dev)
         struct sock *sk;
         ax25_cb *ax25, *oax25;
 
-        if ((sk = sk_alloc(osk->sk_net, PF_AX25, GFP_ATOMIC, osk->sk_prot, 1)) == NULL)
+        sk = sk_alloc(osk->sk_net, PF_AX25, GFP_ATOMIC, osk->sk_prot);
+        if (sk == NULL)
                 return NULL;
 
         if ((ax25 = ax25_create_cb()) == NULL) {
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
index f718965f296c..9ebd3c64474d 100644
--- a/net/bluetooth/bnep/sock.c
+++ b/net/bluetooth/bnep/sock.c
@@ -213,7 +213,7 @@ static int bnep_sock_create(struct net *net, struct socket *sock, int protocol)
         if (sock->type != SOCK_RAW)
                 return -ESOCKTNOSUPPORT;
 
-        sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &bnep_proto, 1);
+        sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &bnep_proto);
         if (!sk)
                 return -ENOMEM;
 
diff --git a/net/bluetooth/cmtp/sock.c b/net/bluetooth/cmtp/sock.c
index cf700c20d11e..783edab12ce8 100644
--- a/net/bluetooth/cmtp/sock.c
+++ b/net/bluetooth/cmtp/sock.c
@@ -204,7 +204,7 @@ static int cmtp_sock_create(struct net *net, struct socket *sock, int protocol)
         if (sock->type != SOCK_RAW)
                 return -ESOCKTNOSUPPORT;
 
-        sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &cmtp_proto, 1);
+        sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &cmtp_proto);
         if (!sk)
                 return -ENOMEM;
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 5fdfc9a67d39..9483320f6dad 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -78,11 +78,11 @@ void hci_acl_connect(struct hci_conn *conn)
 
         cp.pkt_type = cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK);
         if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
-                cp.role_switch  = 0x01;
+                cp.role_switch = 0x01;
         else
-                cp.role_switch  = 0x00;
+                cp.role_switch = 0x00;
 
-        hci_send_cmd(hdev, OGF_LINK_CTL, OCF_CREATE_CONN, sizeof(cp), &cp);
+        hci_send_cmd(hdev, HCI_OP_CREATE_CONN, sizeof(cp), &cp);
 }
 
 static void hci_acl_connect_cancel(struct hci_conn *conn)
@@ -95,8 +95,7 @@ static void hci_acl_connect_cancel(struct hci_conn *conn)
                 return;
 
         bacpy(&cp.bdaddr, &conn->dst);
-        hci_send_cmd(conn->hdev, OGF_LINK_CTL,
-                                OCF_CREATE_CONN_CANCEL, sizeof(cp), &cp);
+        hci_send_cmd(conn->hdev, HCI_OP_CREATE_CONN_CANCEL, sizeof(cp), &cp);
 }
 
 void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
@@ -109,8 +108,7 @@ void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
 
         cp.handle = cpu_to_le16(conn->handle);
         cp.reason = reason;
-        hci_send_cmd(conn->hdev, OGF_LINK_CTL,
-                                OCF_DISCONNECT, sizeof(cp), &cp);
+        hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 }
 
 void hci_add_sco(struct hci_conn *conn, __u16 handle)
@@ -126,7 +124,29 @@ void hci_add_sco(struct hci_conn *conn, __u16 handle)
         cp.handle   = cpu_to_le16(handle);
         cp.pkt_type = cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);
 
-        hci_send_cmd(hdev, OGF_LINK_CTL, OCF_ADD_SCO, sizeof(cp), &cp);
+        hci_send_cmd(hdev, HCI_OP_ADD_SCO, sizeof(cp), &cp);
+}
+
+void hci_setup_sync(struct hci_conn *conn, __u16 handle)
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct hci_cp_setup_sync_conn cp;
+
+        BT_DBG("%p", conn);
+
+        conn->state = BT_CONNECT;
+        conn->out = 1;
+
+        cp.handle   = cpu_to_le16(handle);
+        cp.pkt_type = cpu_to_le16(hdev->esco_type);
+
+        cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
+        cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
+        cp.max_latency    = cpu_to_le16(0xffff);
+        cp.voice_setting  = cpu_to_le16(hdev->voice_setting);
+        cp.retrans_effort = 0xff;
+
+        hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
 }
 
 static void hci_conn_timeout(unsigned long arg)
@@ -143,7 +163,10 @@ static void hci_conn_timeout(unsigned long arg)
 
         switch (conn->state) {
         case BT_CONNECT:
-                hci_acl_connect_cancel(conn);
+                if (conn->type == ACL_LINK)
+                        hci_acl_connect_cancel(conn);
+                else
+                        hci_acl_disconn(conn, 0x13);
                 break;
         case BT_CONNECTED:
                 hci_acl_disconn(conn, 0x13);
@@ -330,8 +353,12 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst)
         hci_conn_hold(sco);
 
         if (acl->state == BT_CONNECTED &&
-                        (sco->state == BT_OPEN || sco->state == BT_CLOSED))
-                hci_add_sco(sco, acl->handle);
+                        (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
+                if (lmp_esco_capable(hdev))
+                        hci_setup_sync(sco, acl->handle);
+                else
+                        hci_add_sco(sco, acl->handle);
+        }
 
         return sco;
 }
@@ -348,7 +375,7 @@ int hci_conn_auth(struct hci_conn *conn)
         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
                 struct hci_cp_auth_requested cp;
                 cp.handle = cpu_to_le16(conn->handle);
-                hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_AUTH_REQUESTED, sizeof(cp), &cp);
+                hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
         }
         return 0;
 }
@@ -369,7 +396,7 @@ int hci_conn_encrypt(struct hci_conn *conn)
                 struct hci_cp_set_conn_encrypt cp;
                 cp.handle  = cpu_to_le16(conn->handle);
                 cp.encrypt = 1;
-                hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_SET_CONN_ENCRYPT, sizeof(cp), &cp);
+                hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), &cp);
         }
         return 0;
 }
@@ -383,7 +410,7 @@ int hci_conn_change_link_key(struct hci_conn *conn)
         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
                 struct hci_cp_change_conn_link_key cp;
                 cp.handle = cpu_to_le16(conn->handle);
-                hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_CHANGE_CONN_LINK_KEY, sizeof(cp), &cp);
+                hci_send_cmd(conn->hdev, HCI_OP_CHANGE_CONN_LINK_KEY, sizeof(cp), &cp);
         }
         return 0;
 }
@@ -401,7 +428,7 @@ int hci_conn_switch_role(struct hci_conn *conn, uint8_t role)
                 struct hci_cp_switch_role cp;
                 bacpy(&cp.bdaddr, &conn->dst);
                 cp.role = role;
-                hci_send_cmd(conn->hdev, OGF_LINK_POLICY, OCF_SWITCH_ROLE, sizeof(cp), &cp);
+                hci_send_cmd(conn->hdev, HCI_OP_SWITCH_ROLE, sizeof(cp), &cp);
         }
         return 0;
 }
@@ -423,8 +450,7 @@ void hci_conn_enter_active_mode(struct hci_conn *conn)
         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
                 struct hci_cp_exit_sniff_mode cp;
                 cp.handle = cpu_to_le16(conn->handle);
-                hci_send_cmd(hdev, OGF_LINK_POLICY,
-                                OCF_EXIT_SNIFF_MODE, sizeof(cp), &cp);
+                hci_send_cmd(hdev, HCI_OP_EXIT_SNIFF_MODE, sizeof(cp), &cp);
         }
 
 timer:
@@ -455,8 +481,7 @@ void hci_conn_enter_sniff_mode(struct hci_conn *conn)
                 cp.max_latency        = cpu_to_le16(0);
                 cp.min_remote_timeout = cpu_to_le16(0);
                 cp.min_local_timeout  = cpu_to_le16(0);
-                hci_send_cmd(hdev, OGF_LINK_POLICY,
-                                OCF_SNIFF_SUBRATE, sizeof(cp), &cp);
+                hci_send_cmd(hdev, HCI_OP_SNIFF_SUBRATE, sizeof(cp), &cp);
         }
 
         if (!test_and_set_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
@@ -466,8 +491,7 @@ void hci_conn_enter_sniff_mode(struct hci_conn *conn)
                 cp.min_interval = cpu_to_le16(hdev->sniff_min_interval);
                 cp.attempt      = cpu_to_le16(4);
                 cp.timeout      = cpu_to_le16(1);
-                hci_send_cmd(hdev, OGF_LINK_POLICY,
-                                OCF_SNIFF_MODE, sizeof(cp), &cp);
+                hci_send_cmd(hdev, HCI_OP_SNIFF_MODE, sizeof(cp), &cp);
         }
 }
 
@@ -493,6 +517,22 @@ void hci_conn_hash_flush(struct hci_dev *hdev)
         }
 }
 
+/* Check pending connect attempts */
+void hci_conn_check_pending(struct hci_dev *hdev)
+{
+        struct hci_conn *conn;
+
+        BT_DBG("hdev %s", hdev->name);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
+        if (conn)
+                hci_acl_connect(conn);
+
+        hci_dev_unlock(hdev);
+}
+
 int hci_get_conn_list(void __user *arg)
 {
         struct hci_conn_list_req req, *cl;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 18e3afc964df..372b0d3b75a8 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -176,7 +176,7 @@ static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
         BT_DBG("%s %ld", hdev->name, opt);
 
         /* Reset device */
-        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_RESET, 0, NULL);
+        hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 }
 
 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
@@ -202,16 +202,16 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
 
         /* Reset */
         if (test_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks))
-                        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_RESET, 0, NULL);
+                        hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 
         /* Read Local Supported Features */
-        hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_LOCAL_FEATURES, 0, NULL);
+        hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 
         /* Read Local Version */
-        hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_LOCAL_VERSION, 0, NULL);
+        hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 
         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
-        hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BUFFER_SIZE, 0, NULL);
+        hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
 
 #if 0
         /* Host buffer size */
@@ -221,29 +221,35 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
                 cp.sco_mtu = HCI_MAX_SCO_SIZE;
                 cp.acl_max_pkt = cpu_to_le16(0xffff);
                 cp.sco_max_pkt = cpu_to_le16(0xffff);
-                hci_send_cmd(hdev, OGF_HOST_CTL, OCF_HOST_BUFFER_SIZE, sizeof(cp), &cp);
+                hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
         }
 #endif
 
         /* Read BD Address */
-        hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BD_ADDR, 0, NULL);
+        hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
+
+        /* Read Class of Device */
+        hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
+
+        /* Read Local Name */
+        hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
 
         /* Read Voice Setting */
-        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_READ_VOICE_SETTING, 0, NULL);
+        hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
 
         /* Optional initialization */
 
         /* Clear Event Filters */
         flt_type = HCI_FLT_CLEAR_ALL;
-        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_SET_EVENT_FLT, 1, &flt_type);
+        hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 
         /* Page timeout ~20 secs */
         param = cpu_to_le16(0x8000);
-        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_PG_TIMEOUT, 2, &param);
+        hci_send_cmd(hdev, HCI_OP_WRITE_PG_TIMEOUT, 2, &param);
 
         /* Connection accept timeout ~20 secs */
         param = cpu_to_le16(0x7d00);
-        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_CA_TIMEOUT, 2, &param);
+        hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 }
 
 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
@@ -253,7 +259,7 @@ static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
         BT_DBG("%s %x", hdev->name, scan);
 
         /* Inquiry and Page scans */
-        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE, 1, &scan);
+        hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 }
 
 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
@@ -263,7 +269,7 @@ static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
         BT_DBG("%s %x", hdev->name, auth);
 
         /* Authentication */
-        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_AUTH_ENABLE, 1, &auth);
+        hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
 }
 
 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
@@ -273,7 +279,7 @@ static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
         BT_DBG("%s %x", hdev->name, encrypt);
 
         /* Authentication */
-        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_ENCRYPT_MODE, 1, &encrypt);
+        hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
 }
 
 /* Get HCI device by index.
@@ -384,7 +390,7 @@ static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
         memcpy(&cp.lap, &ir->lap, 3);
         cp.length  = ir->length;
         cp.num_rsp = ir->num_rsp;
-        hci_send_cmd(hdev, OGF_LINK_CTL, OCF_INQUIRY, sizeof(cp), &cp);
+        hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
 }
 
 int hci_inquiry(void __user *arg)
@@ -1111,13 +1117,13 @@ static int hci_send_frame(struct sk_buff *skb)
 }
 
 /* Send HCI command */
-int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *param)
+int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
 {
         int len = HCI_COMMAND_HDR_SIZE + plen;
         struct hci_command_hdr *hdr;
         struct sk_buff *skb;
 
-        BT_DBG("%s ogf 0x%x ocf 0x%x plen %d", hdev->name, ogf, ocf, plen);
+        BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
 
         skb = bt_skb_alloc(len, GFP_ATOMIC);
         if (!skb) {
@@ -1126,7 +1132,7 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *p
         }
 
         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
-        hdr->opcode = cpu_to_le16(hci_opcode_pack(ogf, ocf));
+        hdr->opcode = cpu_to_le16(opcode);
         hdr->plen   = plen;
 
         if (plen)
@@ -1143,7 +1149,7 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *p
 }
 
 /* Get data from the previously sent command */
-void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 ogf, __u16 ocf)
+void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
 {
         struct hci_command_hdr *hdr;
 
@@ -1152,10 +1158,10 @@ void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 ogf, __u16 ocf)
 
         hdr = (void *) hdev->sent_cmd->data;
 
-        if (hdr->opcode != cpu_to_le16(hci_opcode_pack(ogf, ocf)))
+        if (hdr->opcode != cpu_to_le16(opcode))
                 return NULL;
 
-        BT_DBG("%s ogf 0x%x ocf 0x%x", hdev->name, ogf, ocf);
+        BT_DBG("%s opcode 0x%x", hdev->name, opcode);
 
         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
 }
@@ -1355,6 +1361,26 @@ static inline void hci_sched_sco(struct hci_dev *hdev)
         }
 }
 
+static inline void hci_sched_esco(struct hci_dev *hdev)
+{
+        struct hci_conn *conn;
+        struct sk_buff *skb;
+        int quote;
+
+        BT_DBG("%s", hdev->name);
+
+        while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
+                while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
+                        BT_DBG("skb %p len %d", skb, skb->len);
+                        hci_send_frame(skb);
+
+                        conn->sent++;
+                        if (conn->sent == ~0)
+                                conn->sent = 0;
+                }
+        }
+}
+
 static void hci_tx_task(unsigned long arg)
 {
         struct hci_dev *hdev = (struct hci_dev *) arg;
@@ -1370,6 +1396,8 @@ static void hci_tx_task(unsigned long arg)
 
         hci_sched_sco(hdev);
 
+        hci_sched_esco(hdev);
+
         /* Send next queued raw (unknown type) packet */
         while ((skb = skb_dequeue(&hdev->raw_q)))
                 hci_send_frame(skb);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 4baea1e38652..46df2e403df8 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -52,234 +52,273 @@
 
 /* Handle HCI Event packets */
 
-/* Command Complete OGF LINK_CTL  */
-static void hci_cc_link_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
+static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        __u8 status;
-        struct hci_conn *pend;
+        __u8 status = *((__u8 *) skb->data);
 
-        BT_DBG("%s ocf 0x%x", hdev->name, ocf);
+        BT_DBG("%s status 0x%x", hdev->name, status);
 
-        switch (ocf) {
-        case OCF_INQUIRY_CANCEL:
-        case OCF_EXIT_PERIODIC_INQ:
-                status = *((__u8 *) skb->data);
+        if (status)
+                return;
 
-                if (status) {
-                        BT_DBG("%s Inquiry cancel error: status 0x%x", hdev->name, status);
-                } else {
-                        clear_bit(HCI_INQUIRY, &hdev->flags);
-                        hci_req_complete(hdev, status);
-                }
+        clear_bit(HCI_INQUIRY, &hdev->flags);
 
-                hci_dev_lock(hdev);
+        hci_req_complete(hdev, status);
 
-                pend = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
-                if (pend)
-                        hci_acl_connect(pend);
+        hci_conn_check_pending(hdev);
+}
 
-                hci_dev_unlock(hdev);
+static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
 
-                break;
+        BT_DBG("%s status 0x%x", hdev->name, status);
 
-        default:
-                BT_DBG("%s Command complete: ogf LINK_CTL ocf %x", hdev->name, ocf);
-                break;
+        if (status)
+                return;
+
+        clear_bit(HCI_INQUIRY, &hdev->flags);
+
+        hci_conn_check_pending(hdev);
+}
+
+static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        BT_DBG("%s", hdev->name);
+}
+
+static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_role_discovery *rp = (void *) skb->data;
+        struct hci_conn *conn;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (rp->status)
+                return;
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
+        if (conn) {
+                if (rp->role)
+                        conn->link_mode &= ~HCI_LM_MASTER;
+                else
+                        conn->link_mode |= HCI_LM_MASTER;
         }
+
+        hci_dev_unlock(hdev);
 }
 
-/* Command Complete OGF LINK_POLICY  */
-static void hci_cc_link_policy(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
+static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 {
+        struct hci_rp_write_link_policy *rp = (void *) skb->data;
         struct hci_conn *conn;
-        struct hci_rp_role_discovery *rd;
-        struct hci_rp_write_link_policy *lp;
         void *sent;
 
-        BT_DBG("%s ocf 0x%x", hdev->name, ocf);
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
 
-        switch (ocf) {
-        case OCF_ROLE_DISCOVERY:
-                rd = (void *) skb->data;
+        if (rp->status)
+                return;
 
-                if (rd->status)
-                        break;
+        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
+        if (!sent)
+                return;
 
-                hci_dev_lock(hdev);
+        hci_dev_lock(hdev);
 
-                conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rd->handle));
-                if (conn) {
-                        if (rd->role)
-                                conn->link_mode &= ~HCI_LM_MASTER;
-                        else
-                                conn->link_mode |= HCI_LM_MASTER;
-                }
+        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
+        if (conn) {
+                __le16 policy = get_unaligned((__le16 *) (sent + 2));
+                conn->link_policy = __le16_to_cpu(policy);
+        }
 
-                hci_dev_unlock(hdev);
-                break;
+        hci_dev_unlock(hdev);
+}
 
-        case OCF_WRITE_LINK_POLICY:
-                sent = hci_sent_cmd_data(hdev, OGF_LINK_POLICY, OCF_WRITE_LINK_POLICY);
-                if (!sent)
-                        break;
+static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
 
-                lp = (struct hci_rp_write_link_policy *) skb->data;
+        BT_DBG("%s status 0x%x", hdev->name, status);
 
-                if (lp->status)
-                        break;
+        hci_req_complete(hdev, status);
+}
 
-                hci_dev_lock(hdev);
+static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
+        void *sent;
 
-                conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(lp->handle));
-                if (conn) {
-                        __le16 policy = get_unaligned((__le16 *) (sent + 2));
-                        conn->link_policy = __le16_to_cpu(policy);
-                }
+        BT_DBG("%s status 0x%x", hdev->name, status);
 
-                hci_dev_unlock(hdev);
-                break;
+        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
+        if (!sent)
+                return;
 
-        default:
-                BT_DBG("%s: Command complete: ogf LINK_POLICY ocf %x",
-                                hdev->name, ocf);
-                break;
+        if (!status)
+                memcpy(hdev->dev_name, sent, 248);
+}
+
+static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_read_local_name *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (rp->status)
+                return;
+
+        memcpy(hdev->dev_name, rp->name, 248);
+}
+
+static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
+        void *sent;
+
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
+        if (!sent)
+                return;
+
+        if (!status) {
+                __u8 param = *((__u8 *) sent);
+
+                if (param == AUTH_ENABLED)
+                        set_bit(HCI_AUTH, &hdev->flags);
+                else
+                        clear_bit(HCI_AUTH, &hdev->flags);
         }
+
+        hci_req_complete(hdev, status);
 }
 
-/* Command Complete OGF HOST_CTL  */
-static void hci_cc_host_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
+static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        __u8 status, param;
-        __u16 setting;
-        struct hci_rp_read_voice_setting *vs;
+        __u8 status = *((__u8 *) skb->data);
         void *sent;
 
-        BT_DBG("%s ocf 0x%x", hdev->name, ocf);
+        BT_DBG("%s status 0x%x", hdev->name, status);
 
-        switch (ocf) {
-        case OCF_RESET:
-                status = *((__u8 *) skb->data);
-                hci_req_complete(hdev, status);
-                break;
+        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
+        if (!sent)
+                return;
 
-        case OCF_SET_EVENT_FLT:
-                status = *((__u8 *) skb->data);
-                if (status) {
-                        BT_DBG("%s SET_EVENT_FLT failed %d", hdev->name, status);
-                } else {
-                        BT_DBG("%s SET_EVENT_FLT succeseful", hdev->name);
-                }
-                break;
+        if (!status) {
+                __u8 param = *((__u8 *) sent);
 
-        case OCF_WRITE_AUTH_ENABLE:
-                sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_AUTH_ENABLE);
-                if (!sent)
-                        break;
+                if (param)
+                        set_bit(HCI_ENCRYPT, &hdev->flags);
+                else
+                        clear_bit(HCI_ENCRYPT, &hdev->flags);
+        }
 
-                status = *((__u8 *) skb->data);
-                param  = *((__u8 *) sent);
+        hci_req_complete(hdev, status);
+}
 
-                if (!status) {
-                        if (param == AUTH_ENABLED)
-                                set_bit(HCI_AUTH, &hdev->flags);
-                        else
-                                clear_bit(HCI_AUTH, &hdev->flags);
-                }
-                hci_req_complete(hdev, status);
-                break;
+static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
+        void *sent;
 
-        case OCF_WRITE_ENCRYPT_MODE:
-                sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_ENCRYPT_MODE);
-                if (!sent)
-                        break;
+        BT_DBG("%s status 0x%x", hdev->name, status);
 
-                status = *((__u8 *) skb->data);
-                param  = *((__u8 *) sent);
+        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
+        if (!sent)
+                return;
 
-                if (!status) {
-                        if (param)
-                                set_bit(HCI_ENCRYPT, &hdev->flags);
-                        else
-                                clear_bit(HCI_ENCRYPT, &hdev->flags);
-                }
-                hci_req_complete(hdev, status);
-                break;
+        if (!status) {
+                __u8 param = *((__u8 *) sent);
 
-        case OCF_WRITE_CA_TIMEOUT:
-                status = *((__u8 *) skb->data);
-                if (status) {
-                        BT_DBG("%s OCF_WRITE_CA_TIMEOUT failed %d", hdev->name, status);
-                } else {
-                        BT_DBG("%s OCF_WRITE_CA_TIMEOUT succeseful", hdev->name);
-                }
-                break;
+                clear_bit(HCI_PSCAN, &hdev->flags);
+                clear_bit(HCI_ISCAN, &hdev->flags);
 
-        case OCF_WRITE_PG_TIMEOUT:
-                status = *((__u8 *) skb->data);
-                if (status) {
-                        BT_DBG("%s OCF_WRITE_PG_TIMEOUT failed %d", hdev->name, status);
-                } else {
-                        BT_DBG("%s: OCF_WRITE_PG_TIMEOUT succeseful", hdev->name);
-                }
-                break;
+                if (param & SCAN_INQUIRY)
+                        set_bit(HCI_ISCAN, &hdev->flags);
 
-        case OCF_WRITE_SCAN_ENABLE:
-                sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE);
-                if (!sent)
-                        break;
+                if (param & SCAN_PAGE)
+                        set_bit(HCI_PSCAN, &hdev->flags);
+        }
 
-                status = *((__u8 *) skb->data);
-                param  = *((__u8 *) sent);
+        hci_req_complete(hdev, status);
+}
 
-                BT_DBG("param 0x%x", param);
+static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 
-                if (!status) {
-                        clear_bit(HCI_PSCAN, &hdev->flags);
-                        clear_bit(HCI_ISCAN, &hdev->flags);
-                        if (param & SCAN_INQUIRY)
-                                set_bit(HCI_ISCAN, &hdev->flags);
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
 
-                        if (param & SCAN_PAGE)
-                                set_bit(HCI_PSCAN, &hdev->flags);
-                }
-                hci_req_complete(hdev, status);
-                break;
+        if (rp->status)
+                return;
 
-        case OCF_READ_VOICE_SETTING:
-                vs = (struct hci_rp_read_voice_setting *) skb->data;
+        memcpy(hdev->dev_class, rp->dev_class, 3);
 
-                if (vs->status) {
-                        BT_DBG("%s READ_VOICE_SETTING failed %d", hdev->name, vs->status);
-                        break;
-                }
+        BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
+                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
+}
 
-                setting = __le16_to_cpu(vs->voice_setting);
+static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
+        void *sent;
 
-                if (hdev->voice_setting != setting ) {
-                        hdev->voice_setting = setting;
+        BT_DBG("%s status 0x%x", hdev->name, status);
 
-                        BT_DBG("%s: voice setting 0x%04x", hdev->name, setting);
+        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
+        if (!sent)
+                return;
 
-                        if (hdev->notify) {
-                                tasklet_disable(&hdev->tx_task);
-                                hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
-                                tasklet_enable(&hdev->tx_task);
-                        }
-                }
-                break;
+        if (!status)
+                memcpy(hdev->dev_class, sent, 3);
+}
 
-        case OCF_WRITE_VOICE_SETTING:
-                sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_VOICE_SETTING);
-                if (!sent)
-                        break;
+static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_read_voice_setting *rp = (void *) skb->data;
+        __u16 setting;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (rp->status)
+                return;
+
+        setting = __le16_to_cpu(rp->voice_setting);
+
+        if (hdev->voice_setting == setting )
+                return;
+
+        hdev->voice_setting = setting;
 
-                status = *((__u8 *) skb->data);
-                setting = __le16_to_cpu(get_unaligned((__le16 *) sent));
+        BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 
-                if (!status && hdev->voice_setting != setting) {
+        if (hdev->notify) {
+                tasklet_disable(&hdev->tx_task);
+                hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
+                tasklet_enable(&hdev->tx_task);
+        }
+}
+
+static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
+        void *sent;
+
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
+        if (!sent)
+                return;
+
+        if (!status) {
+                __u16 setting = __le16_to_cpu(get_unaligned((__le16 *) sent));
+
+                if (hdev->voice_setting != setting) {
                         hdev->voice_setting = setting;
 
-                        BT_DBG("%s: voice setting 0x%04x", hdev->name, setting);
+                        BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 
                         if (hdev->notify) {
                                 tasklet_disable(&hdev->tx_task);
@@ -287,143 +326,153 @@ static void hci_cc_host_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb
                                 tasklet_enable(&hdev->tx_task);
                         }
                 }
-                hci_req_complete(hdev, status);
-                break;
-
-        case OCF_HOST_BUFFER_SIZE:
-                status = *((__u8 *) skb->data);
-                if (status) {
-                        BT_DBG("%s OCF_BUFFER_SIZE failed %d", hdev->name, status);
-                        hci_req_complete(hdev, status);
-                }
-                break;
-
-        default:
-                BT_DBG("%s Command complete: ogf HOST_CTL ocf %x", hdev->name, ocf);
-                break;
         }
 }
 
-/* Command Complete OGF INFO_PARAM  */
-static void hci_cc_info_param(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
+static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_rp_read_loc_version *lv;
-        struct hci_rp_read_local_features *lf;
-        struct hci_rp_read_buffer_size *bs;
-        struct hci_rp_read_bd_addr *ba;
+        __u8 status = *((__u8 *) skb->data);
 
-        BT_DBG("%s ocf 0x%x", hdev->name, ocf);
+        BT_DBG("%s status 0x%x", hdev->name, status);
 
-        switch (ocf) {
-        case OCF_READ_LOCAL_VERSION:
-                lv = (struct hci_rp_read_loc_version *) skb->data;
+        hci_req_complete(hdev, status);
+}
 
-                if (lv->status) {
-                        BT_DBG("%s READ_LOCAL_VERSION failed %d", hdev->name, lf->status);
-                        break;
-                }
+static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_read_local_version *rp = (void *) skb->data;
 
-                hdev->hci_ver = lv->hci_ver;
-                hdev->hci_rev = btohs(lv->hci_rev);
-                hdev->manufacturer = btohs(lv->manufacturer);
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
 
-                BT_DBG("%s: manufacturer %d hci_ver %d hci_rev %d", hdev->name,
-                                hdev->manufacturer, hdev->hci_ver, hdev->hci_rev);
+        if (rp->status)
+                return;
 
-                break;
+        hdev->hci_ver = rp->hci_ver;
+        hdev->hci_rev = btohs(rp->hci_rev);
+        hdev->manufacturer = btohs(rp->manufacturer);
 
-        case OCF_READ_LOCAL_FEATURES:
-                lf = (struct hci_rp_read_local_features *) skb->data;
+        BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
+                                        hdev->manufacturer,
+                                        hdev->hci_ver, hdev->hci_rev);
+}
 
-                if (lf->status) {
-                        BT_DBG("%s READ_LOCAL_FEATURES failed %d", hdev->name, lf->status);
-                        break;
-                }
+static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_read_local_commands *rp = (void *) skb->data;
 
-                memcpy(hdev->features, lf->features, sizeof(hdev->features));
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
 
-                /* Adjust default settings according to features
-                 * supported by device. */
-                if (hdev->features[0] & LMP_3SLOT)
-                        hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
+        if (rp->status)
+                return;
 
-                if (hdev->features[0] & LMP_5SLOT)
-                        hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
+        memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
+}
 
-                if (hdev->features[1] & LMP_HV2) {
-                        hdev->pkt_type  |= (HCI_HV2);
-                        hdev->esco_type |= (ESCO_HV2);
-                }
+static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_read_local_features *rp = (void *) skb->data;
 
-                if (hdev->features[1] & LMP_HV3) {
-                        hdev->pkt_type  |= (HCI_HV3);
-                        hdev->esco_type |= (ESCO_HV3);
-                }
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
 
-                if (hdev->features[3] & LMP_ESCO)
-                        hdev->esco_type |= (ESCO_EV3);
+        if (rp->status)
+                return;
 
-                if (hdev->features[4] & LMP_EV4)
-                        hdev->esco_type |= (ESCO_EV4);
+        memcpy(hdev->features, rp->features, 8);
 
-                if (hdev->features[4] & LMP_EV5)
-                        hdev->esco_type |= (ESCO_EV5);
+        /* Adjust default settings according to features
+         * supported by device. */
 
-                BT_DBG("%s: features 0x%x 0x%x 0x%x", hdev->name,
-                                lf->features[0], lf->features[1], lf->features[2]);
+        if (hdev->features[0] & LMP_3SLOT)
+                hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 
-                break;
+        if (hdev->features[0] & LMP_5SLOT)
+                hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 
-        case OCF_READ_BUFFER_SIZE:
-                bs = (struct hci_rp_read_buffer_size *) skb->data;
+        if (hdev->features[1] & LMP_HV2) {
+                hdev->pkt_type  |= (HCI_HV2);
+                hdev->esco_type |= (ESCO_HV2);
+        }
 
-                if (bs->status) {
-                        BT_DBG("%s READ_BUFFER_SIZE failed %d", hdev->name, bs->status);
-                        hci_req_complete(hdev, bs->status);
-                        break;
-                }
+        if (hdev->features[1] & LMP_HV3) {
+                hdev->pkt_type  |= (HCI_HV3);
+                hdev->esco_type |= (ESCO_HV3);
+        }
 
-                hdev->acl_mtu  = __le16_to_cpu(bs->acl_mtu);
-                hdev->sco_mtu  = bs->sco_mtu;
-                hdev->acl_pkts = __le16_to_cpu(bs->acl_max_pkt);
-                hdev->sco_pkts = __le16_to_cpu(bs->sco_max_pkt);
+        if (hdev->features[3] & LMP_ESCO)
+                hdev->esco_type |= (ESCO_EV3);
 
-                if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
-                        hdev->sco_mtu  = 64;
-                        hdev->sco_pkts = 8;
-                }
+        if (hdev->features[4] & LMP_EV4)
+                hdev->esco_type |= (ESCO_EV4);
 
-                hdev->acl_cnt = hdev->acl_pkts;
-                hdev->sco_cnt = hdev->sco_pkts;
+        if (hdev->features[4] & LMP_EV5)
+                hdev->esco_type |= (ESCO_EV5);
 
-                BT_DBG("%s mtu: acl %d, sco %d max_pkt: acl %d, sco %d", hdev->name,
-                        hdev->acl_mtu, hdev->sco_mtu, hdev->acl_pkts, hdev->sco_pkts);
-                break;
+        BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
+                                        hdev->features[0], hdev->features[1],
+                                        hdev->features[2], hdev->features[3],
+                                        hdev->features[4], hdev->features[5],
+                                        hdev->features[6], hdev->features[7]);
+}
 
-        case OCF_READ_BD_ADDR:
-                ba = (struct hci_rp_read_bd_addr *) skb->data;
+static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 
-                if (!ba->status) {
-                        bacpy(&hdev->bdaddr, &ba->bdaddr);
-                } else {
-                        BT_DBG("%s: READ_BD_ADDR failed %d", hdev->name, ba->status);
-                }
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
 
-                hci_req_complete(hdev, ba->status);
-                break;
+        if (rp->status)
+                return;
 
-        default:
-                BT_DBG("%s Command complete: ogf INFO_PARAM ocf %x", hdev->name, ocf);
-                break;
+        hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
+        hdev->sco_mtu  = rp->sco_mtu;
+        hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
+        hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
+
+        if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
+                hdev->sco_mtu  = 64;
+                hdev->sco_pkts = 8;
         }
+
+        hdev->acl_cnt = hdev->acl_pkts;
+        hdev->sco_cnt = hdev->sco_pkts;
+
+        BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
+                                        hdev->acl_mtu, hdev->acl_pkts,
+                                        hdev->sco_mtu, hdev->sco_pkts);
+}
+
+static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_read_bd_addr *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (!rp->status)
+                bacpy(&hdev->bdaddr, &rp->bdaddr);
+
+        hci_req_complete(hdev, rp->status);
+}
+
+static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
+{
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        if (status) {
+                hci_req_complete(hdev, status);
+
+                hci_conn_check_pending(hdev);
+        } else
+                set_bit(HCI_INQUIRY, &hdev->flags);
 }
 
-/* Command Status OGF LINK_CTL  */
 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
 {
+        struct hci_cp_create_conn *cp;
         struct hci_conn *conn;
-        struct hci_cp_create_conn *cp = hci_sent_cmd_data(hdev, OGF_LINK_CTL, OCF_CREATE_CONN);
 
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
         if (!cp)
                 return;
 
@@ -431,8 +480,7 @@ static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
 
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 
-        BT_DBG("%s status 0x%x bdaddr %s conn %p", hdev->name,
-                        status, batostr(&cp->bdaddr), conn);
+        BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
 
         if (status) {
                 if (conn && conn->state == BT_CONNECT) {
@@ -457,234 +505,138 @@ static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
         hci_dev_unlock(hdev);
 }
 
-static void hci_cs_link_ctl(struct hci_dev *hdev, __u16 ocf, __u8 status)
+static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
 {
-        BT_DBG("%s ocf 0x%x", hdev->name, ocf);
+        struct hci_cp_add_sco *cp;
+        struct hci_conn *acl, *sco;
+        __u16 handle;
 
-        switch (ocf) {
-        case OCF_CREATE_CONN:
-                hci_cs_create_conn(hdev, status);
-                break;
-
-        case OCF_ADD_SCO:
-                if (status) {
-                        struct hci_conn *acl, *sco;
-                        struct hci_cp_add_sco *cp = hci_sent_cmd_data(hdev, OGF_LINK_CTL, OCF_ADD_SCO);
-                        __u16 handle;
-
-                        if (!cp)
-                                break;
+        BT_DBG("%s status 0x%x", hdev->name, status);
 
-                        handle = __le16_to_cpu(cp->handle);
-
-                        BT_DBG("%s Add SCO error: handle %d status 0x%x", hdev->name, handle, status);
+        if (!status)
+                return;
 
-                        hci_dev_lock(hdev);
+        cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
+        if (!cp)
+                return;
 
-                        acl = hci_conn_hash_lookup_handle(hdev, handle);
-                        if (acl && (sco = acl->link)) {
-                                sco->state = BT_CLOSED;
+        handle = __le16_to_cpu(cp->handle);
 
-                                hci_proto_connect_cfm(sco, status);
-                                hci_conn_del(sco);
-                        }
+        BT_DBG("%s handle %d", hdev->name, handle);
 
-                        hci_dev_unlock(hdev);
-                }
-                break;
+        hci_dev_lock(hdev);
 
-        case OCF_INQUIRY:
-                if (status) {
-                        BT_DBG("%s Inquiry error: status 0x%x", hdev->name, status);
-                        hci_req_complete(hdev, status);
-                } else {
-                        set_bit(HCI_INQUIRY, &hdev->flags);
-                }
-                break;
+        acl = hci_conn_hash_lookup_handle(hdev, handle);
+        if (acl && (sco = acl->link)) {
+                sco->state = BT_CLOSED;
 
-        default:
-                BT_DBG("%s Command status: ogf LINK_CTL ocf %x status %d",
-                        hdev->name, ocf, status);
-                break;
+                hci_proto_connect_cfm(sco, status);
+                hci_conn_del(sco);
         }
+
+        hci_dev_unlock(hdev);
 }
 
-/* Command Status OGF LINK_POLICY */
-static void hci_cs_link_policy(struct hci_dev *hdev, __u16 ocf, __u8 status)
+static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
 {
-        BT_DBG("%s ocf 0x%x", hdev->name, ocf);
-
-        switch (ocf) {
-        case OCF_SNIFF_MODE:
-                if (status) {
-                        struct hci_conn *conn;
-                        struct hci_cp_sniff_mode *cp = hci_sent_cmd_data(hdev, OGF_LINK_POLICY, OCF_SNIFF_MODE);
+        BT_DBG("%s status 0x%x", hdev->name, status);
+}
 
-                        if (!cp)
-                                break;
+static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
+{
+        struct hci_cp_setup_sync_conn *cp;
+        struct hci_conn *acl, *sco;
+        __u16 handle;
 
-                        hci_dev_lock(hdev);
+        BT_DBG("%s status 0x%x", hdev->name, status);
 
-                        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
-                        if (conn) {
-                                clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
-                        }
-
-                        hci_dev_unlock(hdev);
-                }
-                break;
+        if (!status)
+                return;
 
-        case OCF_EXIT_SNIFF_MODE:
-                if (status) {
-                        struct hci_conn *conn;
-                        struct hci_cp_exit_sniff_mode *cp = hci_sent_cmd_data(hdev, OGF_LINK_POLICY, OCF_EXIT_SNIFF_MODE);
+        cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
+        if (!cp)
+                return;
 
-                        if (!cp)
-                                break;
+        handle = __le16_to_cpu(cp->handle);
 
-                        hci_dev_lock(hdev);
+        BT_DBG("%s handle %d", hdev->name, handle);
 
-                        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
-                        if (conn) {
-                                clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
-                        }
+        hci_dev_lock(hdev);
 
-                        hci_dev_unlock(hdev);
-                }
-                break;
+        acl = hci_conn_hash_lookup_handle(hdev, handle);
+        if (acl && (sco = acl->link)) {
+                sco->state = BT_CLOSED;
 
-        default:
-                BT_DBG("%s Command status: ogf LINK_POLICY ocf %x", hdev->name, ocf);
-                break;
+                hci_proto_connect_cfm(sco, status);
+                hci_conn_del(sco);
         }
-}
 
-/* Command Status OGF HOST_CTL */
-static void hci_cs_host_ctl(struct hci_dev *hdev, __u16 ocf, __u8 status)
-{
-        BT_DBG("%s ocf 0x%x", hdev->name, ocf);
-
-        switch (ocf) {
-        default:
-                BT_DBG("%s Command status: ogf HOST_CTL ocf %x", hdev->name, ocf);
-                break;
-        }
+        hci_dev_unlock(hdev);
 }
 
-/* Command Status OGF INFO_PARAM  */
-static void hci_cs_info_param(struct hci_dev *hdev, __u16 ocf, __u8 status)
+static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
 {
-        BT_DBG("%s: hci_cs_info_param: ocf 0x%x", hdev->name, ocf);
-
-        switch (ocf) {
-        default:
-                BT_DBG("%s Command status: ogf INFO_PARAM ocf %x", hdev->name, ocf);
-                break;
-        }
-}
+        struct hci_cp_sniff_mode *cp;
+        struct hci_conn *conn;
 
-/* Inquiry Complete */
-static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        __u8 status = *((__u8 *) skb->data);
-        struct hci_conn *pend;
+        BT_DBG("%s status 0x%x", hdev->name, status);
 
-        BT_DBG("%s status %d", hdev->name, status);
+        if (!status)
+                return;
 
-        clear_bit(HCI_INQUIRY, &hdev->flags);
-        hci_req_complete(hdev, status);
+        cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
+        if (!cp)
+                return;
 
         hci_dev_lock(hdev);
 
-        pend = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
-        if (pend)
-                hci_acl_connect(pend);
+        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
+        if (conn)
+                clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
 
         hci_dev_unlock(hdev);
 }
 
-/* Inquiry Result */
-static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
 {
-        struct inquiry_data data;
-        struct inquiry_info *info = (struct inquiry_info *) (skb->data + 1);
-        int num_rsp = *((__u8 *) skb->data);
+        struct hci_cp_exit_sniff_mode *cp;
+        struct hci_conn *conn;
 
-        BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
+        BT_DBG("%s status 0x%x", hdev->name, status);
 
-        if (!num_rsp)
+        if (!status)
+                return;
+
+        cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
+        if (!cp)
                 return;
 
         hci_dev_lock(hdev);
 
-        for (; num_rsp; num_rsp--) {
-                bacpy(&data.bdaddr, &info->bdaddr);
-                data.pscan_rep_mode     = info->pscan_rep_mode;
-                data.pscan_period_mode  = info->pscan_period_mode;
-                data.pscan_mode         = info->pscan_mode;
-                memcpy(data.dev_class, info->dev_class, 3);
-                data.clock_offset       = info->clock_offset;
-                data.rssi               = 0x00;
-                info++;
-                hci_inquiry_cache_update(hdev, &data);
-        }
+        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
+        if (conn)
+                clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
 
         hci_dev_unlock(hdev);
 }
 
-/* Inquiry Result With RSSI */
-static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct inquiry_data data;
-        int num_rsp = *((__u8 *) skb->data);
-
-        BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
-
-        if (!num_rsp)
-                return;
-
-        hci_dev_lock(hdev);
+        __u8 status = *((__u8 *) skb->data);
 
-        if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
-                struct inquiry_info_with_rssi_and_pscan_mode *info =
-                        (struct inquiry_info_with_rssi_and_pscan_mode *) (skb->data + 1);
+        BT_DBG("%s status %d", hdev->name, status);
 
-                for (; num_rsp; num_rsp--) {
-                        bacpy(&data.bdaddr, &info->bdaddr);
-                        data.pscan_rep_mode     = info->pscan_rep_mode;
-                        data.pscan_period_mode  = info->pscan_period_mode;
-                        data.pscan_mode         = info->pscan_mode;
-                        memcpy(data.dev_class, info->dev_class, 3);
-                        data.clock_offset       = info->clock_offset;
-                        data.rssi               = info->rssi;
-                        info++;
-                        hci_inquiry_cache_update(hdev, &data);
-                }
-        } else {
-                struct inquiry_info_with_rssi *info =
-                        (struct inquiry_info_with_rssi *) (skb->data + 1);
+        clear_bit(HCI_INQUIRY, &hdev->flags);
 
-                for (; num_rsp; num_rsp--) {
-                        bacpy(&data.bdaddr, &info->bdaddr);
-                        data.pscan_rep_mode     = info->pscan_rep_mode;
-                        data.pscan_period_mode  = info->pscan_period_mode;
-                        data.pscan_mode         = 0x00;
-                        memcpy(data.dev_class, info->dev_class, 3);
-                        data.clock_offset       = info->clock_offset;
-                        data.rssi               = info->rssi;
-                        info++;
-                        hci_inquiry_cache_update(hdev, &data);
-                }
-        }
+        hci_req_complete(hdev, status);
 
-        hci_dev_unlock(hdev);
+        hci_conn_check_pending(hdev);
 }
 
-/* Extended Inquiry Result */
-static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct inquiry_data data;
-        struct extended_inquiry_info *info = (struct extended_inquiry_info *) (skb->data + 1);
+        struct inquiry_info *info = (void *) (skb->data + 1);
         int num_rsp = *((__u8 *) skb->data);
 
         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
@@ -696,12 +648,12 @@ static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct
 
         for (; num_rsp; num_rsp--) {
                 bacpy(&data.bdaddr, &info->bdaddr);
-                data.pscan_rep_mode     = info->pscan_rep_mode;
-                data.pscan_period_mode  = info->pscan_period_mode;
-                data.pscan_mode         = 0x00;
+                data.pscan_rep_mode     = info->pscan_rep_mode;
+                data.pscan_period_mode  = info->pscan_period_mode;
+                data.pscan_mode         = info->pscan_mode;
                 memcpy(data.dev_class, info->dev_class, 3);
-                data.clock_offset       = info->clock_offset;
-                data.rssi               = info->rssi;
+                data.clock_offset       = info->clock_offset;
+                data.rssi               = 0x00;
                 info++;
                 hci_inquiry_cache_update(hdev, &data);
         }
@@ -709,70 +661,18 @@ static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct
         hci_dev_unlock(hdev);
 }
 
-/* Connect Request */
-static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        struct hci_ev_conn_request *ev = (struct hci_ev_conn_request *) skb->data;
-        int mask = hdev->link_mode;
-
-        BT_DBG("%s Connection request: %s type 0x%x", hdev->name,
-                        batostr(&ev->bdaddr), ev->link_type);
-
-        mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
-
-        if (mask & HCI_LM_ACCEPT) {
-                /* Connection accepted */
-                struct hci_conn *conn;
-                struct hci_cp_accept_conn_req cp;
-
-                hci_dev_lock(hdev);
-                conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
-                if (!conn) {
-                        if (!(conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr))) {
-                                BT_ERR("No memmory for new connection");
-                                hci_dev_unlock(hdev);
-                                return;
-                        }
-                }
-                memcpy(conn->dev_class, ev->dev_class, 3);
-                conn->state = BT_CONNECT;
-                hci_dev_unlock(hdev);
-
-                bacpy(&cp.bdaddr, &ev->bdaddr);
-
-                if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
-                        cp.role = 0x00; /* Become master */
-                else
-                        cp.role = 0x01; /* Remain slave */
-
-                hci_send_cmd(hdev, OGF_LINK_CTL,
-                                OCF_ACCEPT_CONN_REQ, sizeof(cp), &cp);
-        } else {
-                /* Connection rejected */
-                struct hci_cp_reject_conn_req cp;
-
-                bacpy(&cp.bdaddr, &ev->bdaddr);
-                cp.reason = 0x0f;
-                hci_send_cmd(hdev, OGF_LINK_CTL,
-                                OCF_REJECT_CONN_REQ, sizeof(cp), &cp);
-        }
-}
-
-/* Connect Complete */
 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_ev_conn_complete *ev = (struct hci_ev_conn_complete *) skb->data;
-        struct hci_conn *conn, *pend;
+        struct hci_ev_conn_complete *ev = (void *) skb->data;
+        struct hci_conn *conn;
 
         BT_DBG("%s", hdev->name);
 
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
-        if (!conn) {
-                hci_dev_unlock(hdev);
-                return;
-        }
+        if (!conn)
+                goto unlock;
 
         if (!ev->status) {
                 conn->handle = __le16_to_cpu(ev->handle);
@@ -788,8 +688,7 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                 if (conn->type == ACL_LINK) {
                         struct hci_cp_read_remote_features cp;
                         cp.handle = ev->handle;
-                        hci_send_cmd(hdev, OGF_LINK_CTL,
-                                OCF_READ_REMOTE_FEATURES, sizeof(cp), &cp);
+                        hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES, sizeof(cp), &cp);
                 }
 
                 /* Set link policy */
@@ -797,8 +696,7 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                         struct hci_cp_write_link_policy cp;
                         cp.handle = ev->handle;
                         cp.policy = cpu_to_le16(hdev->link_policy);
-                        hci_send_cmd(hdev, OGF_LINK_POLICY,
-                                OCF_WRITE_LINK_POLICY, sizeof(cp), &cp);
+                        hci_send_cmd(hdev, HCI_OP_WRITE_LINK_POLICY, sizeof(cp), &cp);
                 }
 
                 /* Set packet type for incoming connection */
@@ -809,8 +707,7 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                                 cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK):
                                 cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);
 
-                        hci_send_cmd(hdev, OGF_LINK_CTL,
-                                OCF_CHANGE_CONN_PTYPE, sizeof(cp), &cp);
+                        hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp), &cp);
                 } else {
                         /* Update disconnect timer */
                         hci_conn_hold(conn);
@@ -822,9 +719,12 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
         if (conn->type == ACL_LINK) {
                 struct hci_conn *sco = conn->link;
                 if (sco) {
-                        if (!ev->status)
-                                hci_add_sco(sco, conn->handle);
-                        else {
+                        if (!ev->status) {
+                                if (lmp_esco_capable(hdev))
+                                        hci_setup_sync(sco, conn->handle);
+                                else
+                                        hci_add_sco(sco, conn->handle);
+                        } else {
                                 hci_proto_connect_cfm(sco, ev->status);
                                 hci_conn_del(sco);
                         }
@@ -835,136 +735,104 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
         if (ev->status)
                 hci_conn_del(conn);
 
-        pend = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
-        if (pend)
-                hci_acl_connect(pend);
-
+unlock:
         hci_dev_unlock(hdev);
-}
-
-/* Disconnect Complete */
-static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        struct hci_ev_disconn_complete *ev = (struct hci_ev_disconn_complete *) skb->data;
-        struct hci_conn *conn;
-
-        BT_DBG("%s status %d", hdev->name, ev->status);
-
-        if (ev->status)
-                return;
 
-        hci_dev_lock(hdev);
-
-        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
-        if (conn) {
-                conn->state = BT_CLOSED;
-                hci_proto_disconn_ind(conn, ev->reason);
-                hci_conn_del(conn);
-        }
-
-        hci_dev_unlock(hdev);
+        hci_conn_check_pending(hdev);
 }
 
-/* Number of completed packets */
-static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_ev_num_comp_pkts *ev = (struct hci_ev_num_comp_pkts *) skb->data;
-        __le16 *ptr;
-        int i;
-
-        skb_pull(skb, sizeof(*ev));
-
-        BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
+        struct hci_ev_conn_request *ev = (void *) skb->data;
+        int mask = hdev->link_mode;
 
-        if (skb->len < ev->num_hndl * 4) {
-                BT_DBG("%s bad parameters", hdev->name);
-                return;
-        }
+        BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
+                                        batostr(&ev->bdaddr), ev->link_type);
 
-        tasklet_disable(&hdev->tx_task);
+        mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
 
-        for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
+        if (mask & HCI_LM_ACCEPT) {
+                /* Connection accepted */
                 struct hci_conn *conn;
-                __u16  handle, count;
-
-                handle = __le16_to_cpu(get_unaligned(ptr++));
-                count  = __le16_to_cpu(get_unaligned(ptr++));
 
-                conn = hci_conn_hash_lookup_handle(hdev, handle);
-                if (conn) {
-                        conn->sent -= count;
+                hci_dev_lock(hdev);
 
-                        if (conn->type == ACL_LINK) {
-                                if ((hdev->acl_cnt += count) > hdev->acl_pkts)
-                                        hdev->acl_cnt = hdev->acl_pkts;
-                        } else {
-                                if ((hdev->sco_cnt += count) > hdev->sco_pkts)
-                                        hdev->sco_cnt = hdev->sco_pkts;
+                conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
+                if (!conn) {
+                        if (!(conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr))) {
+                                BT_ERR("No memmory for new connection");
+                                hci_dev_unlock(hdev);
+                                return;
                         }
                 }
-        }
-        hci_sched_tx(hdev);
 
-        tasklet_enable(&hdev->tx_task);
-}
+                memcpy(conn->dev_class, ev->dev_class, 3);
+                conn->state = BT_CONNECT;
 
-/* Role Change */
-static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
-{
-        struct hci_ev_role_change *ev = (struct hci_ev_role_change *) skb->data;
-        struct hci_conn *conn;
+                hci_dev_unlock(hdev);
 
-        BT_DBG("%s status %d", hdev->name, ev->status);
+                if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
+                        struct hci_cp_accept_conn_req cp;
 
-        hci_dev_lock(hdev);
+                        bacpy(&cp.bdaddr, &ev->bdaddr);
 
-        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
-        if (conn) {
-                if (!ev->status) {
-                        if (ev->role)
-                                conn->link_mode &= ~HCI_LM_MASTER;
+                        if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
+                                cp.role = 0x00; /* Become master */
                         else
-                                conn->link_mode |= HCI_LM_MASTER;
-                }
+                                cp.role = 0x01; /* Remain slave */
 
-                clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
+                        hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
+                                                        sizeof(cp), &cp);
+                } else {
+                        struct hci_cp_accept_sync_conn_req cp;
 
-                hci_role_switch_cfm(conn, ev->status, ev->role);
-        }
+                        bacpy(&cp.bdaddr, &ev->bdaddr);
+                        cp.pkt_type = cpu_to_le16(hdev->esco_type);
 
-        hci_dev_unlock(hdev);
+                        cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
+                        cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
+                        cp.max_latency    = cpu_to_le16(0xffff);
+                        cp.content_format = cpu_to_le16(hdev->voice_setting);
+                        cp.retrans_effort = 0xff;
+
+                        hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
+                                                        sizeof(cp), &cp);
+                }
+        } else {
+                /* Connection rejected */
+                struct hci_cp_reject_conn_req cp;
+
+                bacpy(&cp.bdaddr, &ev->bdaddr);
+                cp.reason = 0x0f;
+                hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
+        }
 }
 
-/* Mode Change */
-static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_ev_mode_change *ev = (struct hci_ev_mode_change *) skb->data;
+        struct hci_ev_disconn_complete *ev = (void *) skb->data;
         struct hci_conn *conn;
 
         BT_DBG("%s status %d", hdev->name, ev->status);
 
+        if (ev->status)
+                return;
+
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
         if (conn) {
-                conn->mode = ev->mode;
-                conn->interval = __le16_to_cpu(ev->interval);
-
-                if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
-                        if (conn->mode == HCI_CM_ACTIVE)
-                                conn->power_save = 1;
-                        else
-                                conn->power_save = 0;
-                }
+                conn->state = BT_CLOSED;
+                hci_proto_disconn_ind(conn, ev->reason);
+                hci_conn_del(conn);
         }
 
         hci_dev_unlock(hdev);
 }
 
-/* Authentication Complete */
 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_ev_auth_complete *ev = (struct hci_ev_auth_complete *) skb->data;
+        struct hci_ev_auth_complete *ev = (void *) skb->data;
         struct hci_conn *conn;
 
         BT_DBG("%s status %d", hdev->name, ev->status);
@@ -985,8 +853,8 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                                 struct hci_cp_set_conn_encrypt cp;
                                 cp.handle  = cpu_to_le16(conn->handle);
                                 cp.encrypt = 1;
-                                hci_send_cmd(conn->hdev, OGF_LINK_CTL,
-                                        OCF_SET_CONN_ENCRYPT, sizeof(cp), &cp);
+                                hci_send_cmd(conn->hdev,
+                                        HCI_OP_SET_CONN_ENCRYPT, sizeof(cp), &cp);
                         } else {
                                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
                                 hci_encrypt_cfm(conn, ev->status, 0x00);
@@ -997,10 +865,16 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
         hci_dev_unlock(hdev);
 }
 
-/* Encryption Change */
+static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        BT_DBG("%s", hdev->name);
+
+        hci_conn_check_pending(hdev);
+}
+
 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_ev_encrypt_change *ev = (struct hci_ev_encrypt_change *) skb->data;
+        struct hci_ev_encrypt_change *ev = (void *) skb->data;
         struct hci_conn *conn;
 
         BT_DBG("%s status %d", hdev->name, ev->status);
@@ -1024,10 +898,9 @@ static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *
         hci_dev_unlock(hdev);
 }
 
-/* Change Connection Link Key Complete */
-static inline void hci_change_conn_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_ev_change_conn_link_key_complete *ev = (struct hci_ev_change_conn_link_key_complete *) skb->data;
+        struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
         struct hci_conn *conn;
 
         BT_DBG("%s status %d", hdev->name, ev->status);
@@ -1047,25 +920,263 @@ static inline void hci_change_conn_link_key_complete_evt(struct hci_dev *hdev, s
         hci_dev_unlock(hdev);
 }
 
-/* Pin Code Request*/
-static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
+        struct hci_ev_remote_features *ev = (void *) skb->data;
+        struct hci_conn *conn;
+
+        BT_DBG("%s status %d", hdev->name, ev->status);
+
+        if (ev->status)
+                return;
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
+        if (conn)
+                memcpy(conn->features, ev->features, 8);
+
+        hci_dev_unlock(hdev);
 }
 
-/* Link Key Request */
-static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
+        BT_DBG("%s", hdev->name);
 }
 
-/* Link Key Notification */
-static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
+        BT_DBG("%s", hdev->name);
 }
 
-/* Remote Features */
-static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
+static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_ev_remote_features *ev = (struct hci_ev_remote_features *) skb->data;
+        struct hci_ev_cmd_complete *ev = (void *) skb->data;
+        __u16 opcode;
+
+        skb_pull(skb, sizeof(*ev));
+
+        opcode = __le16_to_cpu(ev->opcode);
+
+        switch (opcode) {
+        case HCI_OP_INQUIRY_CANCEL:
+                hci_cc_inquiry_cancel(hdev, skb);
+                break;
+
+        case HCI_OP_EXIT_PERIODIC_INQ:
+                hci_cc_exit_periodic_inq(hdev, skb);
+                break;
+
+        case HCI_OP_REMOTE_NAME_REQ_CANCEL:
+                hci_cc_remote_name_req_cancel(hdev, skb);
+                break;
+
+        case HCI_OP_ROLE_DISCOVERY:
+                hci_cc_role_discovery(hdev, skb);
+                break;
+
+        case HCI_OP_WRITE_LINK_POLICY:
+                hci_cc_write_link_policy(hdev, skb);
+                break;
+
+        case HCI_OP_RESET:
+                hci_cc_reset(hdev, skb);
+                break;
+
+        case HCI_OP_WRITE_LOCAL_NAME:
+                hci_cc_write_local_name(hdev, skb);
+                break;
+
+        case HCI_OP_READ_LOCAL_NAME:
+                hci_cc_read_local_name(hdev, skb);
+                break;
+
+        case HCI_OP_WRITE_AUTH_ENABLE:
+                hci_cc_write_auth_enable(hdev, skb);
+                break;
+
+        case HCI_OP_WRITE_ENCRYPT_MODE:
+                hci_cc_write_encrypt_mode(hdev, skb);
+                break;
+
+        case HCI_OP_WRITE_SCAN_ENABLE:
+                hci_cc_write_scan_enable(hdev, skb);
+                break;
+
+        case HCI_OP_READ_CLASS_OF_DEV:
+                hci_cc_read_class_of_dev(hdev, skb);
+                break;
+
+        case HCI_OP_WRITE_CLASS_OF_DEV:
+                hci_cc_write_class_of_dev(hdev, skb);
+                break;
+
+        case HCI_OP_READ_VOICE_SETTING:
+                hci_cc_read_voice_setting(hdev, skb);
+                break;
+
+        case HCI_OP_WRITE_VOICE_SETTING:
+                hci_cc_write_voice_setting(hdev, skb);
+                break;
+
+        case HCI_OP_HOST_BUFFER_SIZE:
+                hci_cc_host_buffer_size(hdev, skb);
+                break;
+
+        case HCI_OP_READ_LOCAL_VERSION:
+                hci_cc_read_local_version(hdev, skb);
+                break;
+
+        case HCI_OP_READ_LOCAL_COMMANDS:
+                hci_cc_read_local_commands(hdev, skb);
+                break;
+
+        case HCI_OP_READ_LOCAL_FEATURES:
+                hci_cc_read_local_features(hdev, skb);
+                break;
+
+        case HCI_OP_READ_BUFFER_SIZE:
+                hci_cc_read_buffer_size(hdev, skb);
+                break;
+
+        case HCI_OP_READ_BD_ADDR:
+                hci_cc_read_bd_addr(hdev, skb);
+                break;
+
+        default:
+                BT_DBG("%s opcode 0x%x", hdev->name, opcode);
+                break;
+        }
+
+        if (ev->ncmd) {
+                atomic_set(&hdev->cmd_cnt, 1);
+                if (!skb_queue_empty(&hdev->cmd_q))
+                        hci_sched_cmd(hdev);
+        }
+}
+
+static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_cmd_status *ev = (void *) skb->data;
+        __u16 opcode;
+
+        skb_pull(skb, sizeof(*ev));
+
+        opcode = __le16_to_cpu(ev->opcode);
+
+        switch (opcode) {
+        case HCI_OP_INQUIRY:
+                hci_cs_inquiry(hdev, ev->status);
+                break;
+
+        case HCI_OP_CREATE_CONN:
+                hci_cs_create_conn(hdev, ev->status);
+                break;
+
+        case HCI_OP_ADD_SCO:
+                hci_cs_add_sco(hdev, ev->status);
+                break;
+
+        case HCI_OP_REMOTE_NAME_REQ:
+                hci_cs_remote_name_req(hdev, ev->status);
+                break;
+
+        case HCI_OP_SETUP_SYNC_CONN:
+                hci_cs_setup_sync_conn(hdev, ev->status);
+                break;
+
+        case HCI_OP_SNIFF_MODE:
+                hci_cs_sniff_mode(hdev, ev->status);
+                break;
+
+        case HCI_OP_EXIT_SNIFF_MODE:
+                hci_cs_exit_sniff_mode(hdev, ev->status);
+                break;
+
+        default:
+                BT_DBG("%s opcode 0x%x", hdev->name, opcode);
+                break;
+        }
+
+        if (ev->ncmd) {
+                atomic_set(&hdev->cmd_cnt, 1);
+                if (!skb_queue_empty(&hdev->cmd_q))
+                        hci_sched_cmd(hdev);
+        }
+}
+
+static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_role_change *ev = (void *) skb->data;
+        struct hci_conn *conn;
+
+        BT_DBG("%s status %d", hdev->name, ev->status);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+        if (conn) {
+                if (!ev->status) {
+                        if (ev->role)
+                                conn->link_mode &= ~HCI_LM_MASTER;
+                        else
+                                conn->link_mode |= HCI_LM_MASTER;
+                }
+
+                clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
+
+                hci_role_switch_cfm(conn, ev->status, ev->role);
+        }
+
+        hci_dev_unlock(hdev);
+}
+
+static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
+        __le16 *ptr;
+        int i;
+
+        skb_pull(skb, sizeof(*ev));
+
+        BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
+
+        if (skb->len < ev->num_hndl * 4) {
+                BT_DBG("%s bad parameters", hdev->name);
+                return;
+        }
+
+        tasklet_disable(&hdev->tx_task);
+
+        for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
+                struct hci_conn *conn;
+                __u16  handle, count;
+
+                handle = __le16_to_cpu(get_unaligned(ptr++));
+                count  = __le16_to_cpu(get_unaligned(ptr++));
+
+                conn = hci_conn_hash_lookup_handle(hdev, handle);
+                if (conn) {
+                        conn->sent -= count;
+
+                        if (conn->type == ACL_LINK) {
+                                if ((hdev->acl_cnt += count) > hdev->acl_pkts)
+                                        hdev->acl_cnt = hdev->acl_pkts;
+                        } else {
+                                if ((hdev->sco_cnt += count) > hdev->sco_pkts)
+                                        hdev->sco_cnt = hdev->sco_pkts;
+                        }
+                }
+        }
+
+        hci_sched_tx(hdev);
+
+        tasklet_enable(&hdev->tx_task);
+}
+
+static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_mode_change *ev = (void *) skb->data;
         struct hci_conn *conn;
 
         BT_DBG("%s status %d", hdev->name, ev->status);
@@ -1073,17 +1184,39 @@ static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
-        if (conn && !ev->status) {
-                memcpy(conn->features, ev->features, sizeof(conn->features));
+        if (conn) {
+                conn->mode = ev->mode;
+                conn->interval = __le16_to_cpu(ev->interval);
+
+                if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
+                        if (conn->mode == HCI_CM_ACTIVE)
+                                conn->power_save = 1;
+                        else
+                                conn->power_save = 0;
+                }
         }
 
         hci_dev_unlock(hdev);
 }
 
-/* Clock Offset */
+static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        BT_DBG("%s", hdev->name);
+}
+
+static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        BT_DBG("%s", hdev->name);
+}
+
+static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        BT_DBG("%s", hdev->name);
+}
+
 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_ev_clock_offset *ev = (struct hci_ev_clock_offset *) skb->data;
+        struct hci_ev_clock_offset *ev = (void *) skb->data;
         struct hci_conn *conn;
 
         BT_DBG("%s status %d", hdev->name, ev->status);
@@ -1103,10 +1236,9 @@ static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *sk
         hci_dev_unlock(hdev);
 }
 
-/* Page Scan Repetition Mode */
 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_ev_pscan_rep_mode *ev = (struct hci_ev_pscan_rep_mode *) skb->data;
+        struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
         struct inquiry_entry *ie;
 
         BT_DBG("%s", hdev->name);
@@ -1121,10 +1253,91 @@ static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *
         hci_dev_unlock(hdev);
 }
 
-/* Sniff Subrate */
+static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct inquiry_data data;
+        int num_rsp = *((__u8 *) skb->data);
+
+        BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
+
+        if (!num_rsp)
+                return;
+
+        hci_dev_lock(hdev);
+
+        if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
+                struct inquiry_info_with_rssi_and_pscan_mode *info = (void *) (skb->data + 1);
+
+                for (; num_rsp; num_rsp--) {
+                        bacpy(&data.bdaddr, &info->bdaddr);
+                        data.pscan_rep_mode     = info->pscan_rep_mode;
+                        data.pscan_period_mode  = info->pscan_period_mode;
+                        data.pscan_mode         = info->pscan_mode;
+                        memcpy(data.dev_class, info->dev_class, 3);
+                        data.clock_offset       = info->clock_offset;
+                        data.rssi               = info->rssi;
+                        info++;
+                        hci_inquiry_cache_update(hdev, &data);
+                }
+        } else {
+                struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
+
+                for (; num_rsp; num_rsp--) {
+                        bacpy(&data.bdaddr, &info->bdaddr);
+                        data.pscan_rep_mode     = info->pscan_rep_mode;
+                        data.pscan_period_mode  = info->pscan_period_mode;
+                        data.pscan_mode         = 0x00;
+                        memcpy(data.dev_class, info->dev_class, 3);
+                        data.clock_offset       = info->clock_offset;
+                        data.rssi               = info->rssi;
+                        info++;
+                        hci_inquiry_cache_update(hdev, &data);
+                }
+        }
+
+        hci_dev_unlock(hdev);
+}
+
+static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        BT_DBG("%s", hdev->name);
+}
+
+static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
+        struct hci_conn *conn;
+
+        BT_DBG("%s status %d", hdev->name, ev->status);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
+        if (!conn)
+                goto unlock;
+
+        if (!ev->status) {
+                conn->handle = __le16_to_cpu(ev->handle);
+                conn->state  = BT_CONNECTED;
+        } else
+                conn->state = BT_CLOSED;
+
+        hci_proto_connect_cfm(conn, ev->status);
+        if (ev->status)
+                hci_conn_del(conn);
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
+static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        BT_DBG("%s", hdev->name);
+}
+
 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_ev_sniff_subrate *ev = (struct hci_ev_sniff_subrate *) skb->data;
+        struct hci_ev_sniff_subrate *ev = (void *) skb->data;
         struct hci_conn *conn;
 
         BT_DBG("%s status %d", hdev->name, ev->status);
@@ -1138,22 +1351,42 @@ static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *s
         hci_dev_unlock(hdev);
 }
 
-void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
+static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        struct hci_event_hdr *hdr = (struct hci_event_hdr *) skb->data;
-        struct hci_ev_cmd_complete *ec;
-        struct hci_ev_cmd_status *cs;
-        u16 opcode, ocf, ogf;
+        struct inquiry_data data;
+        struct extended_inquiry_info *info = (void *) (skb->data + 1);
+        int num_rsp = *((__u8 *) skb->data);
 
-        skb_pull(skb, HCI_EVENT_HDR_SIZE);
+        BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
 
-        BT_DBG("%s evt 0x%x", hdev->name, hdr->evt);
+        if (!num_rsp)
+                return;
 
-        switch (hdr->evt) {
-        case HCI_EV_NUM_COMP_PKTS:
-                hci_num_comp_pkts_evt(hdev, skb);
-                break;
+        hci_dev_lock(hdev);
+
+        for (; num_rsp; num_rsp--) {
+                bacpy(&data.bdaddr, &info->bdaddr);
+                data.pscan_rep_mode     = info->pscan_rep_mode;
+                data.pscan_period_mode  = info->pscan_period_mode;
+                data.pscan_mode         = 0x00;
+                memcpy(data.dev_class, info->dev_class, 3);
+                data.clock_offset       = info->clock_offset;
+                data.rssi               = info->rssi;
+                info++;
+                hci_inquiry_cache_update(hdev, &data);
+        }
 
+        hci_dev_unlock(hdev);
+}
+
+void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_event_hdr *hdr = (void *) skb->data;
+        __u8 event = hdr->evt;
+
+        skb_pull(skb, HCI_EVENT_HDR_SIZE);
+
+        switch (event) {
         case HCI_EV_INQUIRY_COMPLETE:
                 hci_inquiry_complete_evt(hdev, skb);
                 break;
@@ -1162,44 +1395,64 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_inquiry_result_evt(hdev, skb);
                 break;
 
-        case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
-                hci_inquiry_result_with_rssi_evt(hdev, skb);
-                break;
-
-        case HCI_EV_EXTENDED_INQUIRY_RESULT:
-                hci_extended_inquiry_result_evt(hdev, skb);
+        case HCI_EV_CONN_COMPLETE:
+                hci_conn_complete_evt(hdev, skb);
                 break;
 
         case HCI_EV_CONN_REQUEST:
                 hci_conn_request_evt(hdev, skb);
                 break;
 
-        case HCI_EV_CONN_COMPLETE:
-                hci_conn_complete_evt(hdev, skb);
-                break;
-
         case HCI_EV_DISCONN_COMPLETE:
                 hci_disconn_complete_evt(hdev, skb);
                 break;
 
-        case HCI_EV_ROLE_CHANGE:
-                hci_role_change_evt(hdev, skb);
-                break;
-
-        case HCI_EV_MODE_CHANGE:
-                hci_mode_change_evt(hdev, skb);
-                break;
-
         case HCI_EV_AUTH_COMPLETE:
                 hci_auth_complete_evt(hdev, skb);
                 break;
 
+        case HCI_EV_REMOTE_NAME:
+                hci_remote_name_evt(hdev, skb);
+                break;
+
         case HCI_EV_ENCRYPT_CHANGE:
                 hci_encrypt_change_evt(hdev, skb);
                 break;
 
-        case HCI_EV_CHANGE_CONN_LINK_KEY_COMPLETE:
-                hci_change_conn_link_key_complete_evt(hdev, skb);
+        case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
+                hci_change_link_key_complete_evt(hdev, skb);
+                break;
+
+        case HCI_EV_REMOTE_FEATURES:
+                hci_remote_features_evt(hdev, skb);
+                break;
+
+        case HCI_EV_REMOTE_VERSION:
+                hci_remote_version_evt(hdev, skb);
+                break;
+
+        case HCI_EV_QOS_SETUP_COMPLETE:
+                hci_qos_setup_complete_evt(hdev, skb);
+                break;
+
+        case HCI_EV_CMD_COMPLETE:
+                hci_cmd_complete_evt(hdev, skb);
+                break;
+
+        case HCI_EV_CMD_STATUS:
+                hci_cmd_status_evt(hdev, skb);
+                break;
+
+        case HCI_EV_ROLE_CHANGE:
+                hci_role_change_evt(hdev, skb);
+                break;
+
+        case HCI_EV_NUM_COMP_PKTS:
+                hci_num_comp_pkts_evt(hdev, skb);
+                break;
+
+        case HCI_EV_MODE_CHANGE:
+                hci_mode_change_evt(hdev, skb);
                 break;
 
         case HCI_EV_PIN_CODE_REQ:
@@ -1214,10 +1467,6 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_link_key_notify_evt(hdev, skb);
                 break;
 
-        case HCI_EV_REMOTE_FEATURES:
-                hci_remote_features_evt(hdev, skb);
-                break;
-
         case HCI_EV_CLOCK_OFFSET:
                 hci_clock_offset_evt(hdev, skb);
                 break;
@@ -1226,82 +1475,32 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_pscan_rep_mode_evt(hdev, skb);
                 break;
 
-        case HCI_EV_SNIFF_SUBRATE:
-                hci_sniff_subrate_evt(hdev, skb);
+        case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
+                hci_inquiry_result_with_rssi_evt(hdev, skb);
                 break;
 
-        case HCI_EV_CMD_STATUS:
-                cs = (struct hci_ev_cmd_status *) skb->data;
-                skb_pull(skb, sizeof(cs));
-
-                opcode = __le16_to_cpu(cs->opcode);
-                ogf = hci_opcode_ogf(opcode);
-                ocf = hci_opcode_ocf(opcode);
-
-                switch (ogf) {
-                case OGF_INFO_PARAM:
-                        hci_cs_info_param(hdev, ocf, cs->status);
-                        break;
-
-                case OGF_HOST_CTL:
-                        hci_cs_host_ctl(hdev, ocf, cs->status);
-                        break;
-
-                case OGF_LINK_CTL:
-                        hci_cs_link_ctl(hdev, ocf, cs->status);
-                        break;
-
-                case OGF_LINK_POLICY:
-                        hci_cs_link_policy(hdev, ocf, cs->status);
-                        break;
-
-                default:
-                        BT_DBG("%s Command Status OGF %x", hdev->name, ogf);
-                        break;
-                }
-
-                if (cs->ncmd) {
-                        atomic_set(&hdev->cmd_cnt, 1);
-                        if (!skb_queue_empty(&hdev->cmd_q))
-                                hci_sched_cmd(hdev);
-                }
+        case HCI_EV_REMOTE_EXT_FEATURES:
+                hci_remote_ext_features_evt(hdev, skb);
                 break;
 
-        case HCI_EV_CMD_COMPLETE:
-                ec = (struct hci_ev_cmd_complete *) skb->data;
-                skb_pull(skb, sizeof(*ec));
-
-                opcode = __le16_to_cpu(ec->opcode);
-                ogf = hci_opcode_ogf(opcode);
-                ocf = hci_opcode_ocf(opcode);
-
-                switch (ogf) {
-                case OGF_INFO_PARAM:
-                        hci_cc_info_param(hdev, ocf, skb);
-                        break;
-
-                case OGF_HOST_CTL:
-                        hci_cc_host_ctl(hdev, ocf, skb);
-                        break;
+        case HCI_EV_SYNC_CONN_COMPLETE:
+                hci_sync_conn_complete_evt(hdev, skb);
+                break;
 
-                case OGF_LINK_CTL:
-                        hci_cc_link_ctl(hdev, ocf, skb);
-                        break;
+        case HCI_EV_SYNC_CONN_CHANGED:
+                hci_sync_conn_changed_evt(hdev, skb);
+                break;
 
-                case OGF_LINK_POLICY:
-                        hci_cc_link_policy(hdev, ocf, skb);
-                        break;
+        case HCI_EV_SNIFF_SUBRATE:
+                hci_sniff_subrate_evt(hdev, skb);
+                break;
 
-                default:
-                        BT_DBG("%s Command Completed OGF %x", hdev->name, ogf);
-                        break;
-                }
+        case HCI_EV_EXTENDED_INQUIRY_RESULT:
+                hci_extended_inquiry_result_evt(hdev, skb);
+                break;
 
-                if (ec->ncmd) {
-                        atomic_set(&hdev->cmd_cnt, 1);
-                        if (!skb_queue_empty(&hdev->cmd_q))
-                                hci_sched_cmd(hdev);
-                }
+        default:
+                BT_DBG("%s event 0x%x", hdev->name, event);
                 break;
         }
 
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 43dd6373bff9..14991323c273 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -451,7 +451,7 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                         goto drop;
                 }
 
-                if (test_bit(HCI_RAW, &hdev->flags) || (ogf == OGF_VENDOR_CMD)) {
+                if (test_bit(HCI_RAW, &hdev->flags) || (ogf == 0x3f)) {
                         skb_queue_tail(&hdev->raw_q, skb);
                         hci_sched_tx(hdev);
                 } else {
@@ -645,7 +645,7 @@ static int hci_sock_create(struct net *net, struct socket *sock, int protocol)
 
         sock->ops = &hci_sock_ops;
 
-        sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto, 1);
+        sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto);
         if (!sk)
                 return -ENOMEM;
 
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 25835403d659..cef1e3e1881c 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -41,6 +41,26 @@ static ssize_t show_type(struct device *dev, struct device_attribute *attr, char
         return sprintf(buf, "%s\n", typetostr(hdev->type));
 }
 
+static ssize_t show_name(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct hci_dev *hdev = dev_get_drvdata(dev);
+        char name[249];
+        int i;
+
+        for (i = 0; i < 248; i++)
+                name[i] = hdev->dev_name[i];
+
+        name[248] = '\0';
+        return sprintf(buf, "%s\n", name);
+}
+
+static ssize_t show_class(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct hci_dev *hdev = dev_get_drvdata(dev);
+        return sprintf(buf, "0x%.2x%.2x%.2x\n",
+                        hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
+}
+
 static ssize_t show_address(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
@@ -49,6 +69,17 @@ static ssize_t show_address(struct device *dev, struct device_attribute *attr, c
         return sprintf(buf, "%s\n", batostr(&bdaddr));
 }
 
+static ssize_t show_features(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct hci_dev *hdev = dev_get_drvdata(dev);
+
+        return sprintf(buf, "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
+                                hdev->features[0], hdev->features[1],
+                                hdev->features[2], hdev->features[3],
+                                hdev->features[4], hdev->features[5],
+                                hdev->features[6], hdev->features[7]);
+}
+
 static ssize_t show_manufacturer(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
@@ -170,7 +201,10 @@ static ssize_t store_sniff_min_interval(struct device *dev, struct device_attrib
 }
 
 static DEVICE_ATTR(type, S_IRUGO, show_type, NULL);
+static DEVICE_ATTR(name, S_IRUGO, show_name, NULL);
+static DEVICE_ATTR(class, S_IRUGO, show_class, NULL);
 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
+static DEVICE_ATTR(features, S_IRUGO, show_features, NULL);
 static DEVICE_ATTR(manufacturer, S_IRUGO, show_manufacturer, NULL);
 static DEVICE_ATTR(hci_version, S_IRUGO, show_hci_version, NULL);
 static DEVICE_ATTR(hci_revision, S_IRUGO, show_hci_revision, NULL);
@@ -185,7 +219,10 @@ static DEVICE_ATTR(sniff_min_interval, S_IRUGO | S_IWUSR,
 
 static struct device_attribute *bt_attrs[] = {
         &dev_attr_type,
+        &dev_attr_name,
+        &dev_attr_class,
         &dev_attr_address,
+        &dev_attr_features,
         &dev_attr_manufacturer,
         &dev_attr_hci_version,
         &dev_attr_hci_revision,
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 66c736953cfe..4bbacddeb49d 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -247,7 +247,7 @@ static inline int hidp_queue_report(struct hidp_session *session, unsigned char
 {
         struct sk_buff *skb;
 
-        BT_DBG("session %p hid %p data %p size %d", session, device, data, size);
+        BT_DBG("session %p hid %p data %p size %d", session, session->hid, data, size);
 
         if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
                 BT_ERR("Can't allocate memory for new frame");
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 1de2b6fbcac0..3292b956a7c4 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -255,7 +255,7 @@ static int hidp_sock_create(struct net *net, struct socket *sock, int protocol)
         if (sock->type != SOCK_RAW)
                 return -ESOCKTNOSUPPORT;
 
-        sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hidp_proto, 1);
+        sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hidp_proto);
         if (!sk)
                 return -ENOMEM;
 
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 36ef27b625db..477e052b17b5 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -55,7 +55,9 @@
 #define BT_DBG(D...)
 #endif
 
-#define VERSION "2.8"
+#define VERSION "2.9"
+
+static u32 l2cap_feat_mask = 0x0000;
 
 static const struct proto_ops l2cap_sock_ops;
 
@@ -258,7 +260,119 @@ static void l2cap_chan_del(struct sock *sk, int err)
                 sk->sk_state_change(sk);
 }
 
+static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
+{
+        u8 id;
+
+        /* Get next available identificator.
+         *    1 - 128 are used by kernel.
+         *  129 - 199 are reserved.
+         *  200 - 254 are used by utilities like l2ping, etc.
+         */
+
+        spin_lock_bh(&conn->lock);
+
+        if (++conn->tx_ident > 128)
+                conn->tx_ident = 1;
+
+        id = conn->tx_ident;
+
+        spin_unlock_bh(&conn->lock);
+
+        return id;
+}
+
+static inline int l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
+{
+        struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
+
+        BT_DBG("code 0x%2.2x", code);
+
+        if (!skb)
+                return -ENOMEM;
+
+        return hci_send_acl(conn->hcon, skb, 0);
+}
+
 /* ---- L2CAP connections ---- */
+static void l2cap_conn_start(struct l2cap_conn *conn)
+{
+        struct l2cap_chan_list *l = &conn->chan_list;
+        struct sock *sk;
+
+        BT_DBG("conn %p", conn);
+
+        read_lock(&l->lock);
+
+        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
+                bh_lock_sock(sk);
+
+                if (sk->sk_type != SOCK_SEQPACKET) {
+                        l2cap_sock_clear_timer(sk);
+                        sk->sk_state = BT_CONNECTED;
+                        sk->sk_state_change(sk);
+                } else if (sk->sk_state == BT_CONNECT) {
+                        struct l2cap_conn_req req;
+                        l2cap_pi(sk)->ident = l2cap_get_ident(conn);
+                        req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
+                        req.psm  = l2cap_pi(sk)->psm;
+                        l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
+                                        L2CAP_CONN_REQ, sizeof(req), &req);
+                }
+
+                bh_unlock_sock(sk);
+        }
+
+        read_unlock(&l->lock);
+}
+
+static void l2cap_conn_ready(struct l2cap_conn *conn)
+{
+        BT_DBG("conn %p", conn);
+
+        if (conn->chan_list.head || !hlist_empty(&l2cap_sk_list.head)) {
+                struct l2cap_info_req req;
+
+                req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
+
+                conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
+                conn->info_ident = l2cap_get_ident(conn);
+
+                mod_timer(&conn->info_timer,
+                        jiffies + msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
+
+                l2cap_send_cmd(conn, conn->info_ident,
+                                        L2CAP_INFO_REQ, sizeof(req), &req);
+        }
+}
+
+/* Notify sockets that we cannot guaranty reliability anymore */
+static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
+{
+        struct l2cap_chan_list *l = &conn->chan_list;
+        struct sock *sk;
+
+        BT_DBG("conn %p", conn);
+
+        read_lock(&l->lock);
+
+        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
+                if (l2cap_pi(sk)->link_mode & L2CAP_LM_RELIABLE)
+                        sk->sk_err = err;
+        }
+
+        read_unlock(&l->lock);
+}
+
+static void l2cap_info_timeout(unsigned long arg)
+{
+        struct l2cap_conn *conn = (void *) arg;
+
+        conn->info_ident = 0;
+
+        l2cap_conn_start(conn);
+}
+
 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
 {
         struct l2cap_conn *conn = hcon->l2cap_data;
@@ -279,6 +393,12 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
         conn->src = &hcon->hdev->bdaddr;
         conn->dst = &hcon->dst;
 
+        conn->feat_mask = 0;
+
+        init_timer(&conn->info_timer);
+        conn->info_timer.function = l2cap_info_timeout;
+        conn->info_timer.data = (unsigned long) conn;
+
         spin_lock_init(&conn->lock);
         rwlock_init(&conn->chan_list.lock);
 
@@ -318,40 +438,6 @@ static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, stru
         write_unlock_bh(&l->lock);
 }
 
-static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
-{
-        u8 id;
-
-        /* Get next available identificator.
-         *    1 - 128 are used by kernel.
-         *  129 - 199 are reserved.
-         *  200 - 254 are used by utilities like l2ping, etc.
-         */
-
-        spin_lock_bh(&conn->lock);
-
-        if (++conn->tx_ident > 128)
-                conn->tx_ident = 1;
-
-        id = conn->tx_ident;
-
-        spin_unlock_bh(&conn->lock);
-
-        return id;
-}
-
-static inline int l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
-{
-        struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
-
-        BT_DBG("code 0x%2.2x", code);
-
-        if (!skb)
-                return -ENOMEM;
-
-        return hci_send_acl(conn->hcon, skb, 0);
-}
-
 /* ---- Socket interface ---- */
 static struct sock *__l2cap_get_sock_by_addr(__le16 psm, bdaddr_t *src)
 {
@@ -508,7 +594,6 @@ static void l2cap_sock_init(struct sock *sk, struct sock *parent)
 
         /* Default config options */
         pi->conf_len = 0;
-        pi->conf_mtu = L2CAP_DEFAULT_MTU;
         pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
 }
 
@@ -522,7 +607,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int p
 {
         struct sock *sk;
 
-        sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto, 1);
+        sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
         if (!sk)
                 return NULL;
 
@@ -530,7 +615,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int p
         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 
         sk->sk_destruct = l2cap_sock_destruct;
-        sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
+        sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
 
         sock_reset_flag(sk, SOCK_ZAPPED);
 
@@ -650,6 +735,11 @@ static int l2cap_do_connect(struct sock *sk)
         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
 
         if (hcon->state == BT_CONNECTED) {
+                if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) {
+                        l2cap_conn_ready(conn);
+                        goto done;
+                }
+
                 if (sk->sk_type == SOCK_SEQPACKET) {
                         struct l2cap_conn_req req;
                         l2cap_pi(sk)->ident = l2cap_get_ident(conn);
@@ -958,7 +1048,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
                 opts.imtu     = l2cap_pi(sk)->imtu;
                 opts.omtu     = l2cap_pi(sk)->omtu;
                 opts.flush_to = l2cap_pi(sk)->flush_to;
-                opts.mode     = 0x00;
+                opts.mode     = L2CAP_MODE_BASIC;
 
                 len = min_t(unsigned int, sizeof(opts), optlen);
                 if (copy_from_user((char *) &opts, optval, len)) {
@@ -1007,7 +1097,7 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
                 opts.imtu     = l2cap_pi(sk)->imtu;
                 opts.omtu     = l2cap_pi(sk)->omtu;
                 opts.flush_to = l2cap_pi(sk)->flush_to;
-                opts.mode     = 0x00;
+                opts.mode     = L2CAP_MODE_BASIC;
 
                 len = min_t(unsigned int, len, sizeof(opts));
                 if (copy_to_user(optval, (char *) &opts, len))
@@ -1084,52 +1174,6 @@ static int l2cap_sock_release(struct socket *sock)
         return err;
 }
 
-static void l2cap_conn_ready(struct l2cap_conn *conn)
-{
-        struct l2cap_chan_list *l = &conn->chan_list;
-        struct sock *sk;
-
-        BT_DBG("conn %p", conn);
-
-        read_lock(&l->lock);
-
-        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
-                bh_lock_sock(sk);
-
-                if (sk->sk_type != SOCK_SEQPACKET) {
-                        l2cap_sock_clear_timer(sk);
-                        sk->sk_state = BT_CONNECTED;
-                        sk->sk_state_change(sk);
-                } else if (sk->sk_state == BT_CONNECT) {
-                        struct l2cap_conn_req req;
-                        l2cap_pi(sk)->ident = l2cap_get_ident(conn);
-                        req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
-                        req.psm  = l2cap_pi(sk)->psm;
-                        l2cap_send_cmd(conn, l2cap_pi(sk)->ident, L2CAP_CONN_REQ, sizeof(req), &req);
-                }
-
-                bh_unlock_sock(sk);
-        }
-
-        read_unlock(&l->lock);
-}
-
-/* Notify sockets that we cannot guaranty reliability anymore */
-static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
-{
-        struct l2cap_chan_list *l = &conn->chan_list;
-        struct sock *sk;
-
-        BT_DBG("conn %p", conn);
-
-        read_lock(&l->lock);
-        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
-                if (l2cap_pi(sk)->link_mode & L2CAP_LM_RELIABLE)
-                        sk->sk_err = err;
-        }
-        read_unlock(&l->lock);
-}
-
 static void l2cap_chan_ready(struct sock *sk)
 {
         struct sock *parent = bt_sk(sk)->parent;
@@ -1256,11 +1300,11 @@ static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned
                 break;
 
         case 2:
-                *val = __le16_to_cpu(*((__le16 *)opt->val));
+                *val = __le16_to_cpu(*((__le16 *) opt->val));
                 break;
 
         case 4:
-                *val = __le32_to_cpu(*((__le32 *)opt->val));
+                *val = __le32_to_cpu(*((__le32 *) opt->val));
                 break;
 
         default:
@@ -1332,6 +1376,8 @@ static int l2cap_parse_conf_req(struct sock *sk, void *data)
         int len = pi->conf_len;
         int type, hint, olen;
         unsigned long val;
+        struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
+        u16 mtu = L2CAP_DEFAULT_MTU;
         u16 result = L2CAP_CONF_SUCCESS;
 
         BT_DBG("sk %p", sk);
@@ -1344,7 +1390,7 @@ static int l2cap_parse_conf_req(struct sock *sk, void *data)
 
                 switch (type) {
                 case L2CAP_CONF_MTU:
-                        pi->conf_mtu = val;
+                        mtu = val;
                         break;
 
                 case L2CAP_CONF_FLUSH_TO:
@@ -1354,6 +1400,11 @@ static int l2cap_parse_conf_req(struct sock *sk, void *data)
                 case L2CAP_CONF_QOS:
                         break;
 
+                case L2CAP_CONF_RFC:
+                        if (olen == sizeof(rfc))
+                                memcpy(&rfc, (void *) val, olen);
+                        break;
+
                 default:
                         if (hint)
                                 break;
@@ -1368,12 +1419,24 @@ static int l2cap_parse_conf_req(struct sock *sk, void *data)
                 /* Configure output options and let the other side know
                  * which ones we don't like. */
 
-                if (pi->conf_mtu < pi->omtu)
+                if (rfc.mode == L2CAP_MODE_BASIC) {
+                        if (mtu < pi->omtu)
+                                result = L2CAP_CONF_UNACCEPT;
+                        else {
+                                pi->omtu = mtu;
+                                pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
+                        }
+
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+                } else {
                         result = L2CAP_CONF_UNACCEPT;
-                else
-                        pi->omtu = pi->conf_mtu;
 
-                l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+                        memset(&rfc, 0, sizeof(rfc));
+                        rfc.mode = L2CAP_MODE_BASIC;
+
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                                sizeof(rfc), (unsigned long) &rfc);
+                }
         }
 
         rsp->scid   = cpu_to_le16(pi->dcid);
@@ -1397,6 +1460,23 @@ static int l2cap_build_conf_rsp(struct sock *sk, void *data, u16 result, u16 fla
         return ptr - data;
 }
 
+static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_cmd_rej *rej = (struct l2cap_cmd_rej *) data;
+
+        if (rej->reason != 0x0000)
+                return 0;
+
+        if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
+                                        cmd->ident == conn->info_ident) {
+                conn->info_ident = 0;
+                del_timer(&conn->info_timer);
+                l2cap_conn_start(conn);
+        }
+
+        return 0;
+}
+
 static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
 {
         struct l2cap_chan_list *list = &conn->chan_list;
@@ -1577,16 +1657,19 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
 
-        /* Output config done. */
-        l2cap_pi(sk)->conf_state |= L2CAP_CONF_OUTPUT_DONE;
-
         /* Reset config buffer. */
         l2cap_pi(sk)->conf_len = 0;
 
+        if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE))
+                goto unlock;
+
         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
                 sk->sk_state = BT_CONNECTED;
                 l2cap_chan_ready(sk);
-        } else if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
+                goto unlock;
+        }
+
+        if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
                 u8 req[64];
                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
                                         l2cap_build_conf_req(sk, req), req);
@@ -1646,7 +1729,6 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         if (flags & 0x01)
                 goto done;
 
-        /* Input config done */
         l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
 
         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
@@ -1711,16 +1793,27 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd
 static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
 {
         struct l2cap_info_req *req = (struct l2cap_info_req *) data;
-        struct l2cap_info_rsp rsp;
         u16 type;
 
         type = __le16_to_cpu(req->type);
 
         BT_DBG("type 0x%4.4x", type);
 
-        rsp.type   = cpu_to_le16(type);
-        rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
-        l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp), &rsp);
+        if (type == L2CAP_IT_FEAT_MASK) {
+                u8 buf[8];
+                struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
+                rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
+                rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
+                put_unaligned(cpu_to_le32(l2cap_feat_mask), (__le32 *) rsp->data);
+                l2cap_send_cmd(conn, cmd->ident,
+                                        L2CAP_INFO_RSP, sizeof(buf), buf);
+        } else {
+                struct l2cap_info_rsp rsp;
+                rsp.type   = cpu_to_le16(type);
+                rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
+                l2cap_send_cmd(conn, cmd->ident,
+                                        L2CAP_INFO_RSP, sizeof(rsp), &rsp);
+        }
 
         return 0;
 }
@@ -1735,6 +1828,15 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cm
 
         BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
 
+        conn->info_ident = 0;
+
+        del_timer(&conn->info_timer);
+
+        if (type == L2CAP_IT_FEAT_MASK)
+                conn->feat_mask = __le32_to_cpu(get_unaligned((__le32 *) rsp->data));
+
+        l2cap_conn_start(conn);
+
         return 0;
 }
 
@@ -1764,7 +1866,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *sk
 
                 switch (cmd.code) {
                 case L2CAP_COMMAND_REJ:
-                        /* FIXME: We should process this */
+                        l2cap_command_rej(conn, &cmd, data);
                         break;
 
                 case L2CAP_CONN_REQ:
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index bb7220770f2c..e7ac6ba7ecab 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -33,11 +33,11 @@
 #include <linux/sched.h>
 #include <linux/signal.h>
 #include <linux/init.h>
-#include <linux/freezer.h>
 #include <linux/wait.h>
 #include <linux/device.h>
 #include <linux/net.h>
 #include <linux/mutex.h>
+#include <linux/kthread.h>
 
 #include <net/sock.h>
 #include <asm/uaccess.h>
@@ -68,7 +68,6 @@ static DEFINE_MUTEX(rfcomm_mutex);
 static unsigned long rfcomm_event;
 
 static LIST_HEAD(session_list);
-static atomic_t terminate, running;
 
 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
@@ -1850,26 +1849,6 @@ static inline void rfcomm_process_sessions(void)
         rfcomm_unlock();
 }
 
-static void rfcomm_worker(void)
-{
-        BT_DBG("");
-
-        while (!atomic_read(&terminate)) {
-                set_current_state(TASK_INTERRUPTIBLE);
-                if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
-                        /* No pending events. Let's sleep.
-                         * Incoming connections and data will wake us up. */
-                        schedule();
-                }
-                set_current_state(TASK_RUNNING);
-
-                /* Process stuff */
-                clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
-                rfcomm_process_sessions();
-        }
-        return;
-}
-
 static int rfcomm_add_listener(bdaddr_t *ba)
 {
         struct sockaddr_l2 addr;
@@ -1935,22 +1914,28 @@ static void rfcomm_kill_listener(void)
 
 static int rfcomm_run(void *unused)
 {
-        rfcomm_thread = current;
-
-        atomic_inc(&running);
+        BT_DBG("");
 
-        daemonize("krfcommd");
         set_user_nice(current, -10);
 
-        BT_DBG("");
-
         rfcomm_add_listener(BDADDR_ANY);
 
-        rfcomm_worker();
+        while (!kthread_should_stop()) {
+                set_current_state(TASK_INTERRUPTIBLE);
+                if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
+                        /* No pending events. Let's sleep.
+                         * Incoming connections and data will wake us up. */
+                        schedule();
+                }
+                set_current_state(TASK_RUNNING);
+
+                /* Process stuff */
+                clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
+                rfcomm_process_sessions();
+        }
 
         rfcomm_kill_listener();
 
-        atomic_dec(&running);
         return 0;
 }
 
@@ -2059,7 +2044,11 @@ static int __init rfcomm_init(void)
 
         hci_register_cb(&rfcomm_cb);
 
-        kernel_thread(rfcomm_run, NULL, CLONE_KERNEL);
+        rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
+        if (IS_ERR(rfcomm_thread)) {
+                hci_unregister_cb(&rfcomm_cb);
+                return PTR_ERR(rfcomm_thread);
+        }
 
         if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
                 BT_ERR("Failed to create RFCOMM info file");
@@ -2081,14 +2070,7 @@ static void __exit rfcomm_exit(void)
 
         hci_unregister_cb(&rfcomm_cb);
 
-        /* Terminate working thread.
-         * ie. Set terminate flag and wake it up */
-        atomic_inc(&terminate);
-        rfcomm_schedule(RFCOMM_SCHED_STATE);
-
-        /* Wait until thread is running */
-        while (atomic_read(&running))
-                schedule();
+        kthread_stop(rfcomm_thread);
 
 #ifdef CONFIG_BT_RFCOMM_TTY
         rfcomm_cleanup_ttys();
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 266b6972667d..c46d51035e77 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -287,7 +287,7 @@ static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int
         struct rfcomm_dlc *d;
         struct sock *sk;
 
-        sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto, 1);
+        sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto);
         if (!sk)
                 return NULL;
 
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 22a832098d44..e447651a2dbe 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -189,6 +189,23 @@ static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
         return conn ? &conn->dev : NULL;
 }
 
+static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
+{
+        struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
+        bdaddr_t bdaddr;
+        baswap(&bdaddr, &dev->dst);
+        return sprintf(buf, "%s\n", batostr(&bdaddr));
+}
+
+static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)
+{
+        struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
+        return sprintf(buf, "%d\n", dev->channel);
+}
+
+static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
+static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
+
 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 {
         struct rfcomm_dev *dev;
@@ -281,6 +298,14 @@ out:
                 return err;
         }
 
+        dev_set_drvdata(dev->tty_dev, dev);
+
+        if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)
+                BT_ERR("Failed to create address attribute");
+
+        if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0)
+                BT_ERR("Failed to create channel attribute");
+
         return dev->id;
 }
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 65b6fb1c4154..93ad1aae3f38 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -189,7 +189,7 @@ static int sco_connect(struct sock *sk)
         struct sco_conn *conn;
         struct hci_conn *hcon;
         struct hci_dev  *hdev;
-        int err = 0;
+        int err, type;
 
         BT_DBG("%s -> %s", batostr(src), batostr(dst));
 
@@ -200,7 +200,9 @@ static int sco_connect(struct sock *sk)
 
         err = -ENOMEM;
 
-        hcon = hci_connect(hdev, SCO_LINK, dst);
+        type = lmp_esco_capable(hdev) ? ESCO_LINK : SCO_LINK;
+
+        hcon = hci_connect(hdev, type, dst);
         if (!hcon)
                 goto done;
 
@@ -224,6 +226,7 @@ static int sco_connect(struct sock *sk)
                 sk->sk_state = BT_CONNECT;
                 sco_sock_set_timer(sk, sk->sk_sndtimeo);
         }
+
 done:
         hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
@@ -418,7 +421,7 @@ static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, int pro
 {
         struct sock *sk;
 
-        sk = sk_alloc(net, PF_BLUETOOTH, prio, &sco_proto, 1);
+        sk = sk_alloc(net, PF_BLUETOOTH, prio, &sco_proto);
         if (!sk)
                 return NULL;
 
@@ -846,7 +849,7 @@ static int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
 {
         BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
 
-        if (hcon->type != SCO_LINK)
+        if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
                 return 0;
 
         if (!status) {
@@ -865,10 +868,11 @@ static int sco_disconn_ind(struct hci_conn *hcon, __u8 reason)
 {
         BT_DBG("hcon %p reason %d", hcon, reason);
 
-        if (hcon->type != SCO_LINK)
+        if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
                 return 0;
 
         sco_conn_del(hcon, bt_err(reason));
+
         return 0;
 }
 
diff --git a/net/bridge/netfilter/ebt_arp.c b/net/bridge/netfilter/ebt_arp.c
index 1a46952a56d9..18141392a9b4 100644
--- a/net/bridge/netfilter/ebt_arp.c
+++ b/net/bridge/netfilter/ebt_arp.c
@@ -34,7 +34,7 @@ static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in
            ah->ar_pro, EBT_ARP_PTYPE))
                 return EBT_NOMATCH;
 
-        if (info->bitmask & (EBT_ARP_SRC_IP | EBT_ARP_DST_IP)) {
+        if (info->bitmask & (EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_GRAT)) {
                 __be32 saddr, daddr, *sap, *dap;
 
                 if (ah->ar_pln != sizeof(__be32) || ah->ar_pro != htons(ETH_P_IP))
diff --git a/net/core/dev.c b/net/core/dev.c
index 38b03da5c1ca..be6cedab5aa8 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -120,6 +120,8 @@
 #include <linux/ctype.h>
 #include <linux/if_arp.h>
 
+#include "net-sysfs.h"
+
 /*
  *      The list of packet types we will receive (as opposed to discard)
  *      and the routines to invoke.
@@ -249,10 +251,6 @@ static RAW_NOTIFIER_HEAD(netdev_chain);
 
 DEFINE_PER_CPU(struct softnet_data, softnet_data);
 
-extern int netdev_kobject_init(void);
-extern int netdev_register_kobject(struct net_device *);
-extern void netdev_unregister_kobject(struct net_device *);
-
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 /*
  * register_netdevice() inits dev->_xmit_lock and sets lockdep class
@@ -885,6 +883,9 @@ int dev_change_name(struct net_device *dev, char *newname)
         if (!dev_valid_name(newname))
                 return -EINVAL;
 
+        if (strncmp(newname, dev->name, IFNAMSIZ) == 0)
+                return 0;
+
         memcpy(oldname, dev->name, IFNAMSIZ);
 
         if (strchr(newname, '%')) {
@@ -1007,17 +1008,20 @@ int dev_open(struct net_device *dev)
          *      Call device private open method
          */
         set_bit(__LINK_STATE_START, &dev->state);
-        if (dev->open) {
+
+        if (dev->validate_addr)
+                ret = dev->validate_addr(dev);
+
+        if (!ret && dev->open)
                 ret = dev->open(dev);
-                if (ret)
-                        clear_bit(__LINK_STATE_START, &dev->state);
-        }
 
         /*
          *      If it went open OK then:
          */
 
-        if (!ret) {
+        if (ret)
+                clear_bit(__LINK_STATE_START, &dev->state);
+        else {
                 /*
                  *      Set the flags.
                  */
@@ -1038,6 +1042,7 @@ int dev_open(struct net_device *dev)
                  */
                 call_netdevice_notifiers(NETDEV_UP, dev);
         }
+
         return ret;
 }
 
@@ -1553,7 +1558,7 @@ gso:
                         return rc;
                 }
                 if (unlikely((netif_queue_stopped(dev) ||
-                             netif_subqueue_stopped(dev, skb->queue_mapping)) &&
+                             netif_subqueue_stopped(dev, skb)) &&
                              skb->next))
                         return NETDEV_TX_BUSY;
         } while (skb->next);
@@ -1661,7 +1666,7 @@ gso:
                 q = dev->qdisc;
                 if (q->enqueue) {
                         /* reset queue_mapping to zero */
-                        skb->queue_mapping = 0;
+                        skb_set_queue_mapping(skb, 0);
                         rc = q->enqueue(skb, q);
                         qdisc_run(dev);
                         spin_unlock(&dev->queue_lock);
@@ -1692,7 +1697,7 @@ gso:
                         HARD_TX_LOCK(dev, cpu);
 
                         if (!netif_queue_stopped(dev) &&
-                            !netif_subqueue_stopped(dev, skb->queue_mapping)) {
+                            !netif_subqueue_stopped(dev, skb)) {
                                 rc = 0;
                                 if (!dev_hard_start_xmit(skb, dev)) {
                                         HARD_TX_UNLOCK(dev);
@@ -1746,9 +1751,6 @@ DEFINE_PER_CPU(struct netif_rx_stats, netdev_rx_stat) = { 0, };
  *
  *      return values:
  *      NET_RX_SUCCESS  (no congestion)
- *      NET_RX_CN_LOW   (low congestion)
- *      NET_RX_CN_MOD   (moderate congestion)
- *      NET_RX_CN_HIGH  (high congestion)
  *      NET_RX_DROP     (packet was dropped)
  *
  */
@@ -1996,6 +1998,21 @@ out:
 }
 #endif
 
+/**
+ *      netif_receive_skb - process receive buffer from network
+ *      @skb: buffer to process
+ *
+ *      netif_receive_skb() is the main receive data processing function.
+ *      It always succeeds. The buffer may be dropped during processing
+ *      for congestion control or by the protocol layers.
+ *
+ *      This function may only be called from softirq context and interrupts
+ *      should be enabled.
+ *
+ *      Return values (usually ignored):
+ *      NET_RX_SUCCESS: no congestion
+ *      NET_RX_DROP: packet was dropped
+ */
 int netif_receive_skb(struct sk_buff *skb)
 {
         struct packet_type *ptype, *pt_prev;
@@ -2167,7 +2184,15 @@ static void net_rx_action(struct softirq_action *h)
 
                 weight = n->weight;
 
-                work = n->poll(n, weight);
+                /* This NAPI_STATE_SCHED test is for avoiding a race
+                 * with netpoll's poll_napi().  Only the entity which
+                 * obtains the lock and sees NAPI_STATE_SCHED set will
+                 * actually make the ->poll() call.  Therefore we avoid
+                 * accidently calling ->poll() when NAPI is not scheduled.
+                 */
+                work = 0;
+                if (test_bit(NAPI_STATE_SCHED, &n->state))
+                        work = n->poll(n, weight);
 
                 WARN_ON_ONCE(work > weight);
 
@@ -2663,7 +2688,7 @@ static void __net_exit dev_proc_net_exit(struct net *net)
         proc_net_remove(net, "dev");
 }
 
-static struct pernet_operations __net_initdata dev_proc_ops = {
+static struct pernet_operations dev_proc_ops = {
         .init = dev_proc_net_init,
         .exit = dev_proc_net_exit,
 };
@@ -3483,6 +3508,60 @@ static void net_set_todo(struct net_device *dev)
         spin_unlock(&net_todo_list_lock);
 }
 
+static void rollback_registered(struct net_device *dev)
+{
+        BUG_ON(dev_boot_phase);
+        ASSERT_RTNL();
+
+        /* Some devices call without registering for initialization unwind. */
+        if (dev->reg_state == NETREG_UNINITIALIZED) {
+                printk(KERN_DEBUG "unregister_netdevice: device %s/%p never "
+                                  "was registered\n", dev->name, dev);
+
+                WARN_ON(1);
+                return;
+        }
+
+        BUG_ON(dev->reg_state != NETREG_REGISTERED);
+
+        /* If device is running, close it first. */
+        dev_close(dev);
+
+        /* And unlink it from device chain. */
+        unlist_netdevice(dev);
+
+        dev->reg_state = NETREG_UNREGISTERING;
+
+        synchronize_net();
+
+        /* Shutdown queueing discipline. */
+        dev_shutdown(dev);
+
+
+        /* Notify protocols, that we are about to destroy
+           this device. They should clean all the things.
+        */
+        call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
+
+        /*
+         *      Flush the unicast and multicast chains
+         */
+        dev_addr_discard(dev);
+
+        if (dev->uninit)
+                dev->uninit(dev);
+
+        /* Notifier chain MUST detach us from master device. */
+        BUG_TRAP(!dev->master);
+
+        /* Remove entries from kobject tree */
+        netdev_unregister_kobject(dev);
+
+        synchronize_net();
+
+        dev_put(dev);
+}
+
 /**
  *      register_netdevice      - register a network device
  *      @dev: device to register
@@ -3620,8 +3699,10 @@ int register_netdevice(struct net_device *dev)
         /* Notify protocols, that a new device appeared. */
         ret = call_netdevice_notifiers(NETDEV_REGISTER, dev);
         ret = notifier_to_errno(ret);
-        if (ret)
-                unregister_netdevice(dev);
+        if (ret) {
+                rollback_registered(dev);
+                dev->reg_state = NETREG_UNREGISTERED;
+        }
 
 out:
         return ret;
@@ -3898,59 +3979,9 @@ void synchronize_net(void)
 
 void unregister_netdevice(struct net_device *dev)
 {
-        BUG_ON(dev_boot_phase);
-        ASSERT_RTNL();
-
-        /* Some devices call without registering for initialization unwind. */
-        if (dev->reg_state == NETREG_UNINITIALIZED) {
-                printk(KERN_DEBUG "unregister_netdevice: device %s/%p never "
-                                  "was registered\n", dev->name, dev);
-
-                WARN_ON(1);
-                return;
-        }
-
-        BUG_ON(dev->reg_state != NETREG_REGISTERED);
-
-        /* If device is running, close it first. */
-        dev_close(dev);
-
-        /* And unlink it from device chain. */
-        unlist_netdevice(dev);
-
-        dev->reg_state = NETREG_UNREGISTERING;
-
-        synchronize_net();
-
-        /* Shutdown queueing discipline. */
-        dev_shutdown(dev);
-
-
-        /* Notify protocols, that we are about to destroy
-           this device. They should clean all the things.
-        */
-        call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
-
-        /*
-         *      Flush the unicast and multicast chains
-         */
-        dev_addr_discard(dev);
-
-        if (dev->uninit)
-                dev->uninit(dev);
-
-        /* Notifier chain MUST detach us from master device. */
-        BUG_TRAP(!dev->master);
-
-        /* Remove entries from kobject tree */
-        netdev_unregister_kobject(dev);
-
+        rollback_registered(dev);
         /* Finish processing unregister after unlock */
         net_set_todo(dev);
-
-        synchronize_net();
-
-        dev_put(dev);
 }
 
 /**
@@ -4323,7 +4354,7 @@ static void __net_exit netdev_exit(struct net *net)
         kfree(net->dev_index_head);
 }
 
-static struct pernet_operations __net_initdata netdev_net_ops = {
+static struct pernet_operations  netdev_net_ops = {
         .init = netdev_init,
         .exit = netdev_exit,
 };
@@ -4354,7 +4385,7 @@ static void __net_exit default_device_exit(struct net *net)
         rtnl_unlock();
 }
 
-static struct pernet_operations __net_initdata default_device_ops = {
+static struct pernet_operations  default_device_ops = {
         .exit = default_device_exit,
 };
 
diff --git a/net/core/dev_mcast.c b/net/core/dev_mcast.c
index 15241cf48af8..ae354057d84c 100644
--- a/net/core/dev_mcast.c
+++ b/net/core/dev_mcast.c
@@ -285,7 +285,7 @@ static void __net_exit dev_mc_net_exit(struct net *net)
         proc_net_remove(net, "dev_mcast");
 }
 
-static struct pernet_operations __net_initdata dev_mc_net_ops = {
+static struct pernet_operations dev_mc_net_ops = {
         .init = dev_mc_net_init,
         .exit = dev_mc_net_exit,
 };
diff --git a/net/core/dst.c b/net/core/dst.c
index 16958e64e577..03daead3592a 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -18,7 +18,6 @@
 #include <linux/types.h>
 #include <net/net_namespace.h>
 
-#include <net/net_namespace.h>
 #include <net/dst.h>
 
 /*
diff --git a/net/core/flow.c b/net/core/flow.c
index 0ab5234b17d8..3ed2b4b1d6d4 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -142,8 +142,6 @@ typedef u64 flow_compare_t;
 typedef u32 flow_compare_t;
 #endif
 
-extern void flowi_is_missized(void);
-
 /* I hear what you're saying, use memcmp.  But memcmp cannot make
  * important assumptions that we can here, such as alignment and
  * constant size.
@@ -153,8 +151,7 @@ static int flow_key_compare(struct flowi *key1, struct flowi *key2)
         flow_compare_t *k1, *k1_lim, *k2;
         const int n_elem = sizeof(struct flowi) / sizeof(flow_compare_t);
 
-        if (sizeof(struct flowi) % sizeof(flow_compare_t))
-                flowi_is_missized();
+        BUILD_BUG_ON(sizeof(struct flowi) % sizeof(flow_compare_t));
 
         k1 = (flow_compare_t *) key1;
         k1_lim = k1 + n_elem;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 67ba9914e52e..29b8ee4e35d6 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1435,9 +1435,14 @@ int neigh_table_clear(struct neigh_table *tbl)
         kfree(tbl->phash_buckets);
         tbl->phash_buckets = NULL;
 
+        remove_proc_entry(tbl->id, init_net.proc_net_stat);
+
         free_percpu(tbl->stats);
         tbl->stats = NULL;
 
+        kmem_cache_destroy(tbl->kmem_cachep);
+        tbl->kmem_cachep = NULL;
+
         return 0;
 }
 
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 6628e457ddc0..61ead1d11132 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -18,6 +18,8 @@
 #include <linux/wireless.h>
 #include <net/iw_handler.h>
 
+#include "net-sysfs.h"
+
 #ifdef CONFIG_SYSFS
 static const char fmt_hex[] = "%#x\n";
 static const char fmt_long_hex[] = "%#lx\n";
diff --git a/net/core/net-sysfs.h b/net/core/net-sysfs.h
new file mode 100644
index 000000000000..f5f108db3924
--- /dev/null
+++ b/net/core/net-sysfs.h
@@ -0,0 +1,8 @@
+#ifndef __NET_SYSFS_H__
+#define __NET_SYSFS_H__
+
+int netdev_kobject_init(void);
+int netdev_register_kobject(struct net_device *);
+void netdev_unregister_kobject(struct net_device *);
+
+#endif
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 6f71db8c4428..3f6d37deac45 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -17,74 +17,13 @@ static DEFINE_MUTEX(net_mutex);
 
 LIST_HEAD(net_namespace_list);
 
-static struct kmem_cache *net_cachep;
-
 struct net init_net;
 EXPORT_SYMBOL_GPL(init_net);
 
-static struct net *net_alloc(void)
-{
-        return kmem_cache_zalloc(net_cachep, GFP_KERNEL);
-}
-
-static void net_free(struct net *net)
-{
-        if (!net)
-                return;
-
-        if (unlikely(atomic_read(&net->use_count) != 0)) {
-                printk(KERN_EMERG "network namespace not free! Usage: %d\n",
-                        atomic_read(&net->use_count));
-                return;
-        }
-
-        kmem_cache_free(net_cachep, net);
-}
-
-static void cleanup_net(struct work_struct *work)
-{
-        struct pernet_operations *ops;
-        struct net *net;
-
-        net = container_of(work, struct net, work);
-
-        mutex_lock(&net_mutex);
-
-        /* Don't let anyone else find us. */
-        rtnl_lock();
-        list_del(&net->list);
-        rtnl_unlock();
-
-        /* Run all of the network namespace exit methods */
-        list_for_each_entry_reverse(ops, &pernet_list, list) {
-                if (ops->exit)
-                        ops->exit(net);
-        }
-
-        mutex_unlock(&net_mutex);
-
-        /* Ensure there are no outstanding rcu callbacks using this
-         * network namespace.
-         */
-        rcu_barrier();
-
-        /* Finally it is safe to free my network namespace structure */
-        net_free(net);
-}
-
-
-void __put_net(struct net *net)
-{
-        /* Cleanup the network namespace in process context */
-        INIT_WORK(&net->work, cleanup_net);
-        schedule_work(&net->work);
-}
-EXPORT_SYMBOL_GPL(__put_net);
-
 /*
  * setup_net runs the initializers for the network namespace object.
  */
-static int setup_net(struct net *net)
+static __net_init int setup_net(struct net *net)
 {
         /* Must be called with net_mutex held */
         struct pernet_operations *ops;
@@ -112,9 +51,33 @@ out_undo:
                 if (ops->exit)
                         ops->exit(net);
         }
+
+        rcu_barrier();
         goto out;
 }
 
+#ifdef CONFIG_NET_NS
+static struct kmem_cache *net_cachep;
+
+static struct net *net_alloc(void)
+{
+        return kmem_cache_zalloc(net_cachep, GFP_KERNEL);
+}
+
+static void net_free(struct net *net)
+{
+        if (!net)
+                return;
+
+        if (unlikely(atomic_read(&net->use_count) != 0)) {
+                printk(KERN_EMERG "network namespace not free! Usage: %d\n",
+                        atomic_read(&net->use_count));
+                return;
+        }
+
+        kmem_cache_free(net_cachep, net);
+}
+
 struct net *copy_net_ns(unsigned long flags, struct net *old_net)
 {
         struct net *new_net = NULL;
@@ -125,10 +88,6 @@ struct net *copy_net_ns(unsigned long flags, struct net *old_net)
         if (!(flags & CLONE_NEWNET))
                 return old_net;
 
-#ifndef CONFIG_NET_NS
-        return ERR_PTR(-EINVAL);
-#endif
-
         err = -ENOMEM;
         new_net = net_alloc();
         if (!new_net)
@@ -155,14 +114,64 @@ out:
         return new_net;
 }
 
+static void cleanup_net(struct work_struct *work)
+{
+        struct pernet_operations *ops;
+        struct net *net;
+
+        net = container_of(work, struct net, work);
+
+        mutex_lock(&net_mutex);
+
+        /* Don't let anyone else find us. */
+        rtnl_lock();
+        list_del(&net->list);
+        rtnl_unlock();
+
+        /* Run all of the network namespace exit methods */
+        list_for_each_entry_reverse(ops, &pernet_list, list) {
+                if (ops->exit)
+                        ops->exit(net);
+        }
+
+        mutex_unlock(&net_mutex);
+
+        /* Ensure there are no outstanding rcu callbacks using this
+         * network namespace.
+         */
+        rcu_barrier();
+
+        /* Finally it is safe to free my network namespace structure */
+        net_free(net);
+}
+
+void __put_net(struct net *net)
+{
+        /* Cleanup the network namespace in process context */
+        INIT_WORK(&net->work, cleanup_net);
+        schedule_work(&net->work);
+}
+EXPORT_SYMBOL_GPL(__put_net);
+
+#else
+struct net *copy_net_ns(unsigned long flags, struct net *old_net)
+{
+        if (flags & CLONE_NEWNET)
+                return ERR_PTR(-EINVAL);
+        return old_net;
+}
+#endif
+
 static int __init net_ns_init(void)
 {
         int err;
 
         printk(KERN_INFO "net_namespace: %zd bytes\n", sizeof(struct net));
+#ifdef CONFIG_NET_NS
         net_cachep = kmem_cache_create("net_namespace", sizeof(struct net),
                                         SMP_CACHE_BYTES,
                                         SLAB_PANIC, NULL);
+#endif
         mutex_lock(&net_mutex);
         err = setup_net(&init_net);
 
@@ -185,29 +194,28 @@ static int register_pernet_operations(struct list_head *list,
         struct net *net, *undo_net;
         int error;
 
-        error = 0;
         list_add_tail(&ops->list, list);
-        for_each_net(net) {
-                if (ops->init) {
+        if (ops->init) {
+                for_each_net(net) {
                         error = ops->init(net);
                         if (error)
                                 goto out_undo;
                 }
         }
-out:
-        return error;
+        return 0;
 
 out_undo:
         /* If I have an error cleanup all namespaces I initialized */
         list_del(&ops->list);
-        for_each_net(undo_net) {
-                if (undo_net == net)
-                        goto undone;
-                if (ops->exit)
+        if (ops->exit) {
+                for_each_net(undo_net) {
+                        if (undo_net == net)
+                                goto undone;
                         ops->exit(undo_net);
+                }
         }
 undone:
-        goto out;
+        return error;
 }
 
 static void unregister_pernet_operations(struct pernet_operations *ops)
@@ -215,8 +223,8 @@ static void unregister_pernet_operations(struct pernet_operations *ops)
         struct net *net;
 
         list_del(&ops->list);
-        for_each_net(net)
-                if (ops->exit)
+        if (ops->exit)
+                for_each_net(net)
                         ops->exit(net);
 }
 
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 95daba624967..c499b5c69bed 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -67,7 +67,7 @@ static void queue_process(struct work_struct *work)
                 local_irq_save(flags);
                 netif_tx_lock(dev);
                 if ((netif_queue_stopped(dev) ||
-                     netif_subqueue_stopped(dev, skb->queue_mapping)) ||
+                     netif_subqueue_stopped(dev, skb)) ||
                      dev->hard_start_xmit(skb, dev) != NETDEV_TX_OK) {
                         skb_queue_head(&npinfo->txq, skb);
                         netif_tx_unlock(dev);
@@ -116,6 +116,29 @@ static __sum16 checksum_udp(struct sk_buff *skb, struct udphdr *uh,
  * network adapter, forcing superfluous retries and possibly timeouts.
  * Thus, we set our budget to greater than 1.
  */
+static int poll_one_napi(struct netpoll_info *npinfo,
+                         struct napi_struct *napi, int budget)
+{
+        int work;
+
+        /* net_rx_action's ->poll() invocations and our's are
+         * synchronized by this test which is only made while
+         * holding the napi->poll_lock.
+         */
+        if (!test_bit(NAPI_STATE_SCHED, &napi->state))
+                return budget;
+
+        npinfo->rx_flags |= NETPOLL_RX_DROP;
+        atomic_inc(&trapped);
+
+        work = napi->poll(napi, budget);
+
+        atomic_dec(&trapped);
+        npinfo->rx_flags &= ~NETPOLL_RX_DROP;
+
+        return budget - work;
+}
+
 static void poll_napi(struct netpoll *np)
 {
         struct netpoll_info *npinfo = np->dev->npinfo;
@@ -123,17 +146,13 @@ static void poll_napi(struct netpoll *np)
         int budget = 16;
 
         list_for_each_entry(napi, &np->dev->napi_list, dev_list) {
-                if (test_bit(NAPI_STATE_SCHED, &napi->state) &&
-                    napi->poll_owner != smp_processor_id() &&
+                if (napi->poll_owner != smp_processor_id() &&
                     spin_trylock(&napi->poll_lock)) {
-                        npinfo->rx_flags |= NETPOLL_RX_DROP;
-                        atomic_inc(&trapped);
-
-                        napi->poll(napi, budget);
-
-                        atomic_dec(&trapped);
-                        npinfo->rx_flags &= ~NETPOLL_RX_DROP;
+                        budget = poll_one_napi(npinfo, napi, budget);
                         spin_unlock(&napi->poll_lock);
+
+                        if (!budget)
+                                break;
                 }
         }
 }
@@ -269,7 +288,7 @@ static void netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)
                      tries > 0; --tries) {
                         if (netif_tx_trylock(dev)) {
                                 if (!netif_queue_stopped(dev) &&
-                                    !netif_subqueue_stopped(dev, skb->queue_mapping))
+                                    !netif_subqueue_stopped(dev, skb))
                                         status = dev->hard_start_xmit(skb, dev);
                                 netif_tx_unlock(dev);
 
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index c4719edb55c0..de33f36947e9 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2603,8 +2603,7 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         skb->network_header = skb->tail;
         skb->transport_header = skb->network_header + sizeof(struct iphdr);
         skb_put(skb, sizeof(struct iphdr) + sizeof(struct udphdr));
-        skb->queue_mapping = pkt_dev->cur_queue_map;
-
+        skb_set_queue_mapping(skb, pkt_dev->cur_queue_map);
         iph = ip_hdr(skb);
         udph = udp_hdr(skb);
 
@@ -2941,8 +2940,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         skb->network_header = skb->tail;
         skb->transport_header = skb->network_header + sizeof(struct ipv6hdr);
         skb_put(skb, sizeof(struct ipv6hdr) + sizeof(struct udphdr));
-        skb->queue_mapping = pkt_dev->cur_queue_map;
-
+        skb_set_queue_mapping(skb, pkt_dev->cur_queue_map);
         iph = ipv6_hdr(skb);
         udph = udp_hdr(skb);
 
@@ -3385,7 +3383,7 @@ static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
 
         if ((netif_queue_stopped(odev) ||
              (pkt_dev->skb &&
-              netif_subqueue_stopped(odev, pkt_dev->skb->queue_mapping))) ||
+              netif_subqueue_stopped(odev, pkt_dev->skb))) ||
             need_resched()) {
                 idle_start = getCurUs();
 
@@ -3402,7 +3400,7 @@ static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
                 pkt_dev->idle_acc += getCurUs() - idle_start;
 
                 if (netif_queue_stopped(odev) ||
-                    netif_subqueue_stopped(odev, pkt_dev->skb->queue_mapping)) {
+                    netif_subqueue_stopped(odev, pkt_dev->skb)) {
                         pkt_dev->next_tx_us = getCurUs();       /* TODO */
                         pkt_dev->next_tx_ns = 0;
                         goto out;       /* Try the next interface */
@@ -3431,7 +3429,7 @@ static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
 
         netif_tx_lock_bh(odev);
         if (!netif_queue_stopped(odev) &&
-            !netif_subqueue_stopped(odev, pkt_dev->skb->queue_mapping)) {
+            !netif_subqueue_stopped(odev, pkt_dev->skb)) {
 
                 atomic_inc(&(pkt_dev->skb->users));
               retry_now:
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 4a2640d38261..e1ba26fb4bf2 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -742,7 +742,7 @@ static struct net *get_net_ns_by_pid(pid_t pid)
         /* Lookup the network namespace */
         net = ERR_PTR(-ESRCH);
         rcu_read_lock();
-        tsk = find_task_by_pid(pid);
+        tsk = find_task_by_vpid(pid);
         if (tsk) {
                 struct nsproxy *nsproxy;
                 nsproxy = task_nsproxy(tsk);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 70d9b5da96ae..32d5826b7177 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -415,13 +415,6 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb)
         n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len;
         n->nohdr = 0;
         n->destructor = NULL;
-#ifdef CONFIG_NET_CLS_ACT
-        /* FIXME What is this and why don't we do it in copy_skb_header? */
-        n->tc_verd = SET_TC_VERD(n->tc_verd,0);
-        n->tc_verd = CLR_TC_OK2MUNGE(n->tc_verd);
-        n->tc_verd = CLR_TC_MUNGED(n->tc_verd);
-        C(iif);
-#endif
         C(truesize);
         atomic_set(&n->users, 1);
         C(head);
@@ -2035,8 +2028,8 @@ void __init skb_init(void)
  *      Fill the specified scatter-gather list with mappings/pointers into a
  *      region of the buffer space attached to a socket buffer.
  */
-int
-skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
+static int
+__skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
 {
         int start = skb_headlen(skb);
         int i, copy = start - offset;
@@ -2045,9 +2038,7 @@ skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
         if (copy > 0) {
                 if (copy > len)
                         copy = len;
-                sg[elt].page = virt_to_page(skb->data + offset);
-                sg[elt].offset = (unsigned long)(skb->data + offset) % PAGE_SIZE;
-                sg[elt].length = copy;
+                sg_set_buf(sg, skb->data + offset, copy);
                 elt++;
                 if ((len -= copy) == 0)
                         return elt;
@@ -2065,9 +2056,8 @@ skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
 
                         if (copy > len)
                                 copy = len;
-                        sg[elt].page = frag->page;
-                        sg[elt].offset = frag->page_offset+offset-start;
-                        sg[elt].length = copy;
+                        sg_set_page(&sg[elt], frag->page, copy,
+                                        frag->page_offset+offset-start);
                         elt++;
                         if (!(len -= copy))
                                 return elt;
@@ -2088,7 +2078,8 @@ skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
                         if ((copy = end - offset) > 0) {
                                 if (copy > len)
                                         copy = len;
-                                elt += skb_to_sgvec(list, sg+elt, offset - start, copy);
+                                elt += __skb_to_sgvec(list, sg+elt, offset - start,
+                                                      copy);
                                 if ((len -= copy) == 0)
                                         return elt;
                                 offset += copy;
@@ -2100,6 +2091,15 @@ skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
         return elt;
 }
 
+int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
+{
+        int nsg = __skb_to_sgvec(skb, sg, offset, len);
+
+        sg_mark_end(&sg[nsg - 1]);
+
+        return nsg;
+}
+
 /**
  *      skb_cow_data - Check that a socket buffer's data buffers are writable
  *      @skb: The socket buffer to check.
diff --git a/net/core/sock.c b/net/core/sock.c
index febbcbcf8022..8fc2f84209e4 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -857,46 +857,43 @@ static inline void sock_lock_init(struct sock *sk)
                         af_family_keys + sk->sk_family);
 }
 
-/**
- *      sk_alloc - All socket objects are allocated here
- *      @net: the applicable net namespace
- *      @family: protocol family
- *      @priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
- *      @prot: struct proto associated with this new sock instance
- *      @zero_it: if we should zero the newly allocated sock
- */
-struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
-                      struct proto *prot, int zero_it)
+static void sock_copy(struct sock *nsk, const struct sock *osk)
 {
-        struct sock *sk = NULL;
-        struct kmem_cache *slab = prot->slab;
+#ifdef CONFIG_SECURITY_NETWORK
+        void *sptr = nsk->sk_security;
+#endif
 
+        memcpy(nsk, osk, osk->sk_prot->obj_size);
+#ifdef CONFIG_SECURITY_NETWORK
+        nsk->sk_security = sptr;
+        security_sk_clone(osk, nsk);
+#endif
+}
+
+static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
+                int family)
+{
+        struct sock *sk;
+        struct kmem_cache *slab;
+
+        slab = prot->slab;
         if (slab != NULL)
                 sk = kmem_cache_alloc(slab, priority);
         else
                 sk = kmalloc(prot->obj_size, priority);
 
-        if (sk) {
-                if (zero_it) {
-                        memset(sk, 0, prot->obj_size);
-                        sk->sk_family = family;
-                        /*
-                         * See comment in struct sock definition to understand
-                         * why we need sk_prot_creator -acme
-                         */
-                        sk->sk_prot = sk->sk_prot_creator = prot;
-                        sock_lock_init(sk);
-                        sk->sk_net = get_net(net);
-                }
-
+        if (sk != NULL) {
                 if (security_sk_alloc(sk, family, priority))
                         goto out_free;
 
                 if (!try_module_get(prot->owner))
-                        goto out_free;
+                        goto out_free_sec;
         }
+
         return sk;
 
+out_free_sec:
+        security_sk_free(sk);
 out_free:
         if (slab != NULL)
                 kmem_cache_free(slab, sk);
@@ -905,10 +902,53 @@ out_free:
         return NULL;
 }
 
+static void sk_prot_free(struct proto *prot, struct sock *sk)
+{
+        struct kmem_cache *slab;
+        struct module *owner;
+
+        owner = prot->owner;
+        slab = prot->slab;
+
+        security_sk_free(sk);
+        if (slab != NULL)
+                kmem_cache_free(slab, sk);
+        else
+                kfree(sk);
+        module_put(owner);
+}
+
+/**
+ *      sk_alloc - All socket objects are allocated here
+ *      @net: the applicable net namespace
+ *      @family: protocol family
+ *      @priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
+ *      @prot: struct proto associated with this new sock instance
+ *      @zero_it: if we should zero the newly allocated sock
+ */
+struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
+                      struct proto *prot)
+{
+        struct sock *sk;
+
+        sk = sk_prot_alloc(prot, priority | __GFP_ZERO, family);
+        if (sk) {
+                sk->sk_family = family;
+                /*
+                 * See comment in struct sock definition to understand
+                 * why we need sk_prot_creator -acme
+                 */
+                sk->sk_prot = sk->sk_prot_creator = prot;
+                sock_lock_init(sk);
+                sk->sk_net = get_net(net);
+        }
+
+        return sk;
+}
+
 void sk_free(struct sock *sk)
 {
         struct sk_filter *filter;
-        struct module *owner = sk->sk_prot_creator->owner;
 
         if (sk->sk_destruct)
                 sk->sk_destruct(sk);
@@ -925,25 +965,22 @@ void sk_free(struct sock *sk)
                 printk(KERN_DEBUG "%s: optmem leakage (%d bytes) detected.\n",
                        __FUNCTION__, atomic_read(&sk->sk_omem_alloc));
 
-        security_sk_free(sk);
         put_net(sk->sk_net);
-        if (sk->sk_prot_creator->slab != NULL)
-                kmem_cache_free(sk->sk_prot_creator->slab, sk);
-        else
-                kfree(sk);
-        module_put(owner);
+        sk_prot_free(sk->sk_prot_creator, sk);
 }
 
 struct sock *sk_clone(const struct sock *sk, const gfp_t priority)
 {
-        struct sock *newsk = sk_alloc(sk->sk_net, sk->sk_family, priority, sk->sk_prot, 0);
+        struct sock *newsk;
 
+        newsk = sk_prot_alloc(sk->sk_prot, priority, sk->sk_family);
         if (newsk != NULL) {
                 struct sk_filter *filter;
 
                 sock_copy(newsk, sk);
 
                 /* SANITY */
+                get_net(newsk->sk_net);
                 sk_node_init(&newsk->sk_node);
                 sock_lock_init(newsk);
                 bh_lock_sock(newsk);
@@ -1649,7 +1686,6 @@ void sock_enable_timestamp(struct sock *sk)
                 net_enable_timestamp();
         }
 }
-EXPORT_SYMBOL(sock_enable_timestamp);
 
 /*
  *      Get a socket option on an socket.
@@ -1765,11 +1801,65 @@ EXPORT_SYMBOL(sk_common_release);
 static DEFINE_RWLOCK(proto_list_lock);
 static LIST_HEAD(proto_list);
 
+#ifdef CONFIG_SMP
+/*
+ * Define default functions to keep track of inuse sockets per protocol
+ * Note that often used protocols use dedicated functions to get a speed increase.
+ * (see DEFINE_PROTO_INUSE/REF_PROTO_INUSE)
+ */
+static void inuse_add(struct proto *prot, int inc)
+{
+        per_cpu_ptr(prot->inuse_ptr, smp_processor_id())[0] += inc;
+}
+
+static int inuse_get(const struct proto *prot)
+{
+        int res = 0, cpu;
+        for_each_possible_cpu(cpu)
+                res += per_cpu_ptr(prot->inuse_ptr, cpu)[0];
+        return res;
+}
+
+static int inuse_init(struct proto *prot)
+{
+        if (!prot->inuse_getval || !prot->inuse_add) {
+                prot->inuse_ptr = alloc_percpu(int);
+                if (prot->inuse_ptr == NULL)
+                        return -ENOBUFS;
+
+                prot->inuse_getval = inuse_get;
+                prot->inuse_add = inuse_add;
+        }
+        return 0;
+}
+
+static void inuse_fini(struct proto *prot)
+{
+        if (prot->inuse_ptr != NULL) {
+                free_percpu(prot->inuse_ptr);
+                prot->inuse_ptr = NULL;
+                prot->inuse_getval = NULL;
+                prot->inuse_add = NULL;
+        }
+}
+#else
+static inline int inuse_init(struct proto *prot)
+{
+        return 0;
+}
+
+static inline void inuse_fini(struct proto *prot)
+{
+}
+#endif
+
 int proto_register(struct proto *prot, int alloc_slab)
 {
         char *request_sock_slab_name = NULL;
         char *timewait_sock_slab_name;
-        int rc = -ENOBUFS;
+
+        if (inuse_init(prot))
+                goto out;
 
         if (alloc_slab) {
                 prot->slab = kmem_cache_create(prot->name, prot->obj_size, 0,
@@ -1778,7 +1868,7 @@ int proto_register(struct proto *prot, int alloc_slab)
                 if (prot->slab == NULL) {
                         printk(KERN_CRIT "%s: Can't create sock SLAB cache!\n",
                                prot->name);
-                        goto out;
+                        goto out_free_inuse;
                 }
 
                 if (prot->rsk_prot != NULL) {
@@ -1822,9 +1912,8 @@ int proto_register(struct proto *prot, int alloc_slab)
         write_lock(&proto_list_lock);
         list_add(&prot->node, &proto_list);
         write_unlock(&proto_list_lock);
-        rc = 0;
-out:
-        return rc;
+        return 0;
+
 out_free_timewait_sock_slab_name:
         kfree(timewait_sock_slab_name);
 out_free_request_sock_slab:
@@ -1837,7 +1926,10 @@ out_free_request_sock_slab_name:
 out_free_sock_slab:
         kmem_cache_destroy(prot->slab);
         prot->slab = NULL;
-        goto out;
+out_free_inuse:
+        inuse_fini(prot);
+out:
+        return -ENOBUFS;
 }
 
 EXPORT_SYMBOL(proto_register);
@@ -1848,6 +1940,7 @@ void proto_unregister(struct proto *prot)
         list_del(&prot->node);
         write_unlock(&proto_list_lock);
 
+        inuse_fini(prot);
         if (prot->slab != NULL) {
                 kmem_cache_destroy(prot->slab);
                 prot->slab = NULL;
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 6d5ea9762040..113cc728dc31 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -9,25 +9,12 @@
 #include <linux/sysctl.h>
 #include <linux/module.h>
 #include <linux/socket.h>
+#include <linux/netdevice.h>
 #include <net/sock.h>
+#include <net/xfrm.h>
 
 #ifdef CONFIG_SYSCTL
 
-extern int netdev_max_backlog;
-extern int weight_p;
-
-extern __u32 sysctl_wmem_max;
-extern __u32 sysctl_rmem_max;
-
-extern int sysctl_core_destroy_delay;
-
-#ifdef CONFIG_XFRM
-extern u32 sysctl_xfrm_aevent_etime;
-extern u32 sysctl_xfrm_aevent_rseqth;
-extern int sysctl_xfrm_larval_drop;
-extern u32 sysctl_xfrm_acq_expires;
-#endif
-
 ctl_table core_table[] = {
 #ifdef CONFIG_NET
         {
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 426008e3b7e3..d694656b8800 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -750,20 +750,16 @@ static int ccid2_hc_tx_init(struct ccid *ccid, struct sock *sk)
          */
         hctx->ccid2hctx_ssthresh  = ~0;
         hctx->ccid2hctx_numdupack = 3;
-        hctx->ccid2hctx_seqbufc   = 0;
 
         /* XXX init ~ to window size... */
         if (ccid2_hc_tx_alloc_seq(hctx))
                 return -ENOMEM;
 
-        hctx->ccid2hctx_sent     = 0;
         hctx->ccid2hctx_rto      = 3 * HZ;
         ccid2_change_srtt(hctx, -1);
         hctx->ccid2hctx_rttvar   = -1;
-        hctx->ccid2hctx_lastrtt  = 0;
         hctx->ccid2hctx_rpdupack = -1;
         hctx->ccid2hctx_last_cong = jiffies;
-        hctx->ccid2hctx_high_ack = 0;
 
         hctx->ccid2hctx_rtotimer.function = &ccid2_hc_tx_rto_expire;
         hctx->ccid2hctx_rtotimer.data     = (unsigned long)sk;
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 25772c326172..19b33586333d 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -40,6 +40,8 @@
 #include "lib/tfrc.h"
 #include "ccid3.h"
 
+#include <asm/unaligned.h>
+
 #ifdef CONFIG_IP_DCCP_CCID3_DEBUG
 static int ccid3_debug;
 #define ccid3_pr_debug(format, a...)    DCCP_PR_DEBUG(ccid3_debug, format, ##a)
@@ -544,6 +546,7 @@ static int ccid3_hc_tx_parse_options(struct sock *sk, unsigned char option,
         const struct dccp_sock *dp = dccp_sk(sk);
         struct ccid3_hc_tx_sock *hctx = ccid3_hc_tx_sk(sk);
         struct ccid3_options_received *opt_recv;
+        __be32 opt_val;
 
         opt_recv = &hctx->ccid3hctx_options_received;
 
@@ -563,8 +566,8 @@ static int ccid3_hc_tx_parse_options(struct sock *sk, unsigned char option,
                                   dccp_role(sk), sk, len);
                         rc = -EINVAL;
                 } else {
-                        opt_recv->ccid3or_loss_event_rate =
-                                                ntohl(*(__be32 *)value);
+                        opt_val = get_unaligned((__be32 *)value);
+                        opt_recv->ccid3or_loss_event_rate = ntohl(opt_val);
                         ccid3_pr_debug("%s(%p), LOSS_EVENT_RATE=%u\n",
                                        dccp_role(sk), sk,
                                        opt_recv->ccid3or_loss_event_rate);
@@ -585,8 +588,8 @@ static int ccid3_hc_tx_parse_options(struct sock *sk, unsigned char option,
                                   dccp_role(sk), sk, len);
                         rc = -EINVAL;
                 } else {
-                        opt_recv->ccid3or_receive_rate =
-                                                ntohl(*(__be32 *)value);
+                        opt_val = get_unaligned((__be32 *)value);
+                        opt_recv->ccid3or_receive_rate = ntohl(opt_val);
                         ccid3_pr_debug("%s(%p), RECEIVE_RATE=%u\n",
                                        dccp_role(sk), sk,
                                        opt_recv->ccid3or_receive_rate);
@@ -601,8 +604,6 @@ static int ccid3_hc_tx_init(struct ccid *ccid, struct sock *sk)
 {
         struct ccid3_hc_tx_sock *hctx = ccid_priv(ccid);
 
-        hctx->ccid3hctx_s     = 0;
-        hctx->ccid3hctx_rtt   = 0;
         hctx->ccid3hctx_state = TFRC_SSTATE_NO_SENT;
         INIT_LIST_HEAD(&hctx->ccid3hctx_hist);
 
@@ -963,8 +964,6 @@ static int ccid3_hc_rx_init(struct ccid *ccid, struct sock *sk)
         INIT_LIST_HEAD(&hcrx->ccid3hcrx_li_hist);
         hcrx->ccid3hcrx_tstamp_last_feedback =
                 hcrx->ccid3hcrx_tstamp_last_ack = ktime_get_real();
-        hcrx->ccid3hcrx_s   = 0;
-        hcrx->ccid3hcrx_rtt = 0;
         return 0;
 }
 
diff --git a/net/dccp/diag.c b/net/dccp/diag.c
index 0f3745585a94..d8a3509b26f6 100644
--- a/net/dccp/diag.c
+++ b/net/dccp/diag.c
@@ -68,3 +68,4 @@ module_exit(dccp_diag_fini);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@mandriva.com>");
 MODULE_DESCRIPTION("DCCP inet_diag handler");
+MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_NETLINK, NETLINK_INET_DIAG, DCCPDIAG_GETSOCK);
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 3560a2a875a0..1ce101062824 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -58,6 +58,42 @@ static void dccp_rcv_closereq(struct sock *sk, struct sk_buff *skb)
         dccp_send_close(sk, 0);
 }
 
+static u8 dccp_reset_code_convert(const u8 code)
+{
+        const u8 error_code[] = {
+        [DCCP_RESET_CODE_CLOSED]             = 0,       /* normal termination */
+        [DCCP_RESET_CODE_UNSPECIFIED]        = 0,       /* nothing known */
+        [DCCP_RESET_CODE_ABORTED]            = ECONNRESET,
+
+        [DCCP_RESET_CODE_NO_CONNECTION]      = ECONNREFUSED,
+        [DCCP_RESET_CODE_CONNECTION_REFUSED] = ECONNREFUSED,
+        [DCCP_RESET_CODE_TOO_BUSY]           = EUSERS,
+        [DCCP_RESET_CODE_AGGRESSION_PENALTY] = EDQUOT,
+
+        [DCCP_RESET_CODE_PACKET_ERROR]       = ENOMSG,
+        [DCCP_RESET_CODE_BAD_INIT_COOKIE]    = EBADR,
+        [DCCP_RESET_CODE_BAD_SERVICE_CODE]   = EBADRQC,
+        [DCCP_RESET_CODE_OPTION_ERROR]       = EILSEQ,
+        [DCCP_RESET_CODE_MANDATORY_ERROR]    = EOPNOTSUPP,
+        };
+
+        return code >= DCCP_MAX_RESET_CODES ? 0 : error_code[code];
+}
+
+static void dccp_rcv_reset(struct sock *sk, struct sk_buff *skb)
+{
+        u8 err = dccp_reset_code_convert(dccp_hdr_reset(skb)->dccph_reset_code);
+
+        sk->sk_err = err;
+
+        /* Queue the equivalent of TCP fin so that dccp_recvmsg exits the loop */
+        dccp_fin(sk, skb);
+
+        if (err && !sock_flag(sk, SOCK_DEAD))
+                sk_wake_async(sk, 0, POLL_ERR);
+        dccp_time_wait(sk, DCCP_TIME_WAIT, 0);
+}
+
 static void dccp_event_ack_recv(struct sock *sk, struct sk_buff *skb)
 {
         struct dccp_sock *dp = dccp_sk(sk);
@@ -191,9 +227,8 @@ static int __dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
                  *              S.state := TIMEWAIT
                  *              Set TIMEWAIT timer
                  *              Drop packet and return
-                */
-                dccp_fin(sk, skb);
-                dccp_time_wait(sk, DCCP_TIME_WAIT, 0);
+                 */
+                dccp_rcv_reset(sk, skb);
                 return 0;
         case DCCP_PKT_CLOSEREQ:
                 dccp_rcv_closereq(sk, skb);
@@ -521,12 +556,7 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
          *              Drop packet and return
         */
         if (dh->dccph_type == DCCP_PKT_RESET) {
-                /*
-                 * Queue the equivalent of TCP fin so that dccp_recvmsg
-                 * exits the loop
-                 */
-                dccp_fin(sk, skb);
-                dccp_time_wait(sk, DCCP_TIME_WAIT, 0);
+                dccp_rcv_reset(sk, skb);
                 return 0;
                 /*
                  *   Step 7: Check for unexpected packet types
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 44f6e17e105f..db17b83e8d3e 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -241,8 +241,8 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
                 goto out;
 
         dp = dccp_sk(sk);
-        seq = dccp_hdr_seq(skb);
-        if (sk->sk_state != DCCP_LISTEN &&
+        seq = dccp_hdr_seq(dh);
+        if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING | DCCPF_LISTEN) &&
             !between48(seq, dp->dccps_swl, dp->dccps_swh)) {
                 NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
                 goto out;
@@ -795,7 +795,7 @@ static int dccp_v4_rcv(struct sk_buff *skb)
 
         dh = dccp_hdr(skb);
 
-        DCCP_SKB_CB(skb)->dccpd_seq  = dccp_hdr_seq(skb);
+        DCCP_SKB_CB(skb)->dccpd_seq  = dccp_hdr_seq(dh);
         DCCP_SKB_CB(skb)->dccpd_type = dh->dccph_type;
 
         dccp_pr_debug("%8.8s "
@@ -922,6 +922,8 @@ static struct timewait_sock_ops dccp_timewait_sock_ops = {
         .twsk_obj_size  = sizeof(struct inet_timewait_sock),
 };
 
+DEFINE_PROTO_INUSE(dccp_v4)
+
 static struct proto dccp_v4_prot = {
         .name                   = "DCCP",
         .owner                  = THIS_MODULE,
@@ -950,6 +952,7 @@ static struct proto dccp_v4_prot = {
         .compat_setsockopt      = compat_dccp_setsockopt,
         .compat_getsockopt      = compat_dccp_getsockopt,
 #endif
+        REF_PROTO_INUSE(dccp_v4)
 };
 
 static struct net_protocol dccp_v4_protocol = {
@@ -1037,8 +1040,8 @@ module_exit(dccp_v4_exit);
  * values directly, Also cover the case where the protocol is not specified,
  * i.e. net-pf-PF_INET-proto-0-type-SOCK_DCCP
  */
-MODULE_ALIAS("net-pf-" __stringify(PF_INET) "-proto-33-type-6");
-MODULE_ALIAS("net-pf-" __stringify(PF_INET) "-proto-0-type-6");
+MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 33, 6);
+MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 0, 6);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@mandriva.com>");
 MODULE_DESCRIPTION("DCCP - Datagram Congestion Controlled Protocol");
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index cac53548c2d8..87c98fb86fa8 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -173,7 +173,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         icmpv6_err_convert(type, code, &err);
 
-        seq = DCCP_SKB_CB(skb)->dccpd_seq;
+        seq = dccp_hdr_seq(dh);
         /* Might be for an request_sock */
         switch (sk->sk_state) {
                 struct request_sock *req, **prev;
@@ -787,7 +787,7 @@ static int dccp_v6_rcv(struct sk_buff *skb)
 
         dh = dccp_hdr(skb);
 
-        DCCP_SKB_CB(skb)->dccpd_seq  = dccp_hdr_seq(skb);
+        DCCP_SKB_CB(skb)->dccpd_seq  = dccp_hdr_seq(dh);
         DCCP_SKB_CB(skb)->dccpd_type = dh->dccph_type;
 
         if (dccp_packet_without_ack(skb))
@@ -1107,6 +1107,8 @@ static struct timewait_sock_ops dccp6_timewait_sock_ops = {
         .twsk_obj_size  = sizeof(struct dccp6_timewait_sock),
 };
 
+DEFINE_PROTO_INUSE(dccp_v6)
+
 static struct proto dccp_v6_prot = {
         .name              = "DCCPv6",
         .owner             = THIS_MODULE,
@@ -1135,6 +1137,7 @@ static struct proto dccp_v6_prot = {
         .compat_setsockopt = compat_dccp_setsockopt,
         .compat_getsockopt = compat_dccp_getsockopt,
 #endif
+        REF_PROTO_INUSE(dccp_v6)
 };
 
 static struct inet6_protocol dccp_v6_protocol = {
@@ -1219,8 +1222,8 @@ module_exit(dccp_v6_exit);
  * values directly, Also cover the case where the protocol is not specified,
  * i.e. net-pf-PF_INET6-proto-0-type-SOCK_DCCP
  */
-MODULE_ALIAS("net-pf-" __stringify(PF_INET6) "-proto-33-type-6");
-MODULE_ALIAS("net-pf-" __stringify(PF_INET6) "-proto-0-type-6");
+MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 33, 6);
+MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET6, 0, 6);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Arnaldo Carvalho de Melo <acme@mandriva.com>");
 MODULE_DESCRIPTION("DCCPv6 - Datagram Congestion Controlled Protocol");
diff --git a/net/dccp/options.c b/net/dccp/options.c
index d361b5533309..d286cffe2c49 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -14,6 +14,7 @@
 #include <linux/dccp.h>
 #include <linux/module.h>
 #include <linux/types.h>
+#include <asm/unaligned.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 
@@ -59,6 +60,7 @@ int dccp_parse_options(struct sock *sk, struct sk_buff *skb)
         unsigned char opt, len;
         unsigned char *value;
         u32 elapsed_time;
+        __be32 opt_val;
         int rc;
         int mandatory = 0;
 
@@ -145,7 +147,8 @@ int dccp_parse_options(struct sock *sk, struct sk_buff *skb)
                         if (len != 4)
                                 goto out_invalid_option;
 
-                        opt_recv->dccpor_timestamp = ntohl(*(__be32 *)value);
+                        opt_val = get_unaligned((__be32 *)value);
+                        opt_recv->dccpor_timestamp = ntohl(opt_val);
 
                         dp->dccps_timestamp_echo = opt_recv->dccpor_timestamp;
                         dp->dccps_timestamp_time = ktime_get_real();
@@ -159,7 +162,8 @@ int dccp_parse_options(struct sock *sk, struct sk_buff *skb)
                         if (len != 4 && len != 6 && len != 8)
                                 goto out_invalid_option;
 
-                        opt_recv->dccpor_timestamp_echo = ntohl(*(__be32 *)value);
+                        opt_val = get_unaligned((__be32 *)value);
+                        opt_recv->dccpor_timestamp_echo = ntohl(opt_val);
 
                         dccp_pr_debug("%s rx opt: TIMESTAMP_ECHO=%u, len=%d, "
                                       "ackno=%llu", dccp_role(sk),
@@ -168,16 +172,20 @@ int dccp_parse_options(struct sock *sk, struct sk_buff *skb)
                                       (unsigned long long)
                                       DCCP_SKB_CB(skb)->dccpd_ack_seq);
 
+                        value += 4;
 
-                        if (len == 4) {
+                        if (len == 4) {         /* no elapsed time included */
                                 dccp_pr_debug_cat("\n");
                                 break;
                         }
 
-                        if (len == 6)
-                                elapsed_time = ntohs(*(__be16 *)(value + 4));
-                        else
-                                elapsed_time = ntohl(*(__be32 *)(value + 4));
+                        if (len == 6) {         /* 2-byte elapsed time */
+                                __be16 opt_val2 = get_unaligned((__be16 *)value);
+                                elapsed_time = ntohs(opt_val2);
+                        } else {                /* 4-byte elapsed time */
+                                opt_val = get_unaligned((__be32 *)value);
+                                elapsed_time = ntohl(opt_val);
+                        }
 
                         dccp_pr_debug_cat(", ELAPSED_TIME=%u\n", elapsed_time);
 
@@ -192,10 +200,13 @@ int dccp_parse_options(struct sock *sk, struct sk_buff *skb)
                         if (pkt_type == DCCP_PKT_DATA)
                                 continue;
 
-                        if (len == 2)
-                                elapsed_time = ntohs(*(__be16 *)value);
-                        else
-                                elapsed_time = ntohl(*(__be32 *)value);
+                        if (len == 2) {
+                                __be16 opt_val2 = get_unaligned((__be16 *)value);
+                                elapsed_time = ntohs(opt_val2);
+                        } else {
+                                opt_val = get_unaligned((__be32 *)value);
+                                elapsed_time = ntohl(opt_val);
+                        }
 
                         if (elapsed_time > opt_recv->dccpor_elapsed_time)
                                 opt_recv->dccpor_elapsed_time = elapsed_time;
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index cc9bf1cb2646..7a3bea9c28c1 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -26,6 +26,7 @@
 #include <net/sock.h>
 #include <net/xfrm.h>
 
+#include <asm/ioctls.h>
 #include <asm/semaphore.h>
 #include <linux/spinlock.h>
 #include <linux/timer.h>
@@ -378,8 +379,36 @@ EXPORT_SYMBOL_GPL(dccp_poll);
 
 int dccp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 {
-        dccp_pr_debug("entry\n");
-        return -ENOIOCTLCMD;
+        int rc = -ENOTCONN;
+
+        lock_sock(sk);
+
+        if (sk->sk_state == DCCP_LISTEN)
+                goto out;
+
+        switch (cmd) {
+        case SIOCINQ: {
+                struct sk_buff *skb;
+                unsigned long amount = 0;
+
+                skb = skb_peek(&sk->sk_receive_queue);
+                if (skb != NULL) {
+                        /*
+                         * We will only return the amount of this packet since
+                         * that is all that will be read.
+                         */
+                        amount = skb->len;
+                }
+                rc = put_user(amount, (int __user *)arg);
+        }
+                break;
+        default:
+                rc = -ENOIOCTLCMD;
+                break;
+        }
+out:
+        release_sock(sk);
+        return rc;
 }
 
 EXPORT_SYMBOL_GPL(dccp_ioctl);
@@ -1043,11 +1072,13 @@ static int __init dccp_init(void)
         }
 
         for (i = 0; i < dccp_hashinfo.ehash_size; i++) {
-                rwlock_init(&dccp_hashinfo.ehash[i].lock);
                 INIT_HLIST_HEAD(&dccp_hashinfo.ehash[i].chain);
                 INIT_HLIST_HEAD(&dccp_hashinfo.ehash[i].twchain);
         }
 
+        if (inet_ehash_locks_alloc(&dccp_hashinfo))
+                        goto out_free_dccp_ehash;
+
         bhash_order = ehash_order;
 
         do {
@@ -1062,7 +1093,7 @@ static int __init dccp_init(void)
 
         if (!dccp_hashinfo.bhash) {
                 DCCP_CRIT("Failed to allocate DCCP bind hash table");
-                goto out_free_dccp_ehash;
+                goto out_free_dccp_locks;
         }
 
         for (i = 0; i < dccp_hashinfo.bhash_size; i++) {
@@ -1092,6 +1123,8 @@ out_free_dccp_mib:
 out_free_dccp_bhash:
         free_pages((unsigned long)dccp_hashinfo.bhash, bhash_order);
         dccp_hashinfo.bhash = NULL;
+out_free_dccp_locks:
+        inet_ehash_locks_free(&dccp_hashinfo);
 out_free_dccp_ehash:
         free_pages((unsigned long)dccp_hashinfo.ehash, ehash_order);
         dccp_hashinfo.ehash = NULL;
@@ -1110,6 +1143,7 @@ static void __exit dccp_fini(void)
         free_pages((unsigned long)dccp_hashinfo.ehash,
                    get_order(dccp_hashinfo.ehash_size *
                              sizeof(struct inet_ehash_bucket)));
+        inet_ehash_locks_free(&dccp_hashinfo);
         kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
         dccp_ackvec_exit();
         dccp_sysctl_exit();
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index aabe98d9402f..57d574951838 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -474,7 +474,7 @@ static struct proto dn_proto = {
 static struct sock *dn_alloc_sock(struct net *net, struct socket *sock, gfp_t gfp)
 {
         struct dn_scp *scp;
-        struct sock *sk = sk_alloc(net, PF_DECnet, gfp, &dn_proto, 1);
+        struct sock *sk = sk_alloc(net, PF_DECnet, gfp, &dn_proto);
 
         if  (!sk)
                 goto out;
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index 26130afd8029..66e266fb5908 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -1439,7 +1439,7 @@ static const struct file_operations dn_dev_seq_fops = {
 
 #endif /* CONFIG_PROC_FS */
 
-static int __initdata addr[2];
+static int addr[2];
 module_param_array(addr, int, NULL, 0444);
 MODULE_PARM_DESC(addr, "The DECnet address of this machine: area,node");
 
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 9cae16b4e0b7..f70df073c588 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -624,7 +624,7 @@ static int econet_create(struct net *net, struct socket *sock, int protocol)
         sock->state = SS_UNCONNECTED;
 
         err = -ENOBUFS;
-        sk = sk_alloc(net, PF_ECONET, GFP_KERNEL, &econet_proto, 1);
+        sk = sk_alloc(net, PF_ECONET, GFP_KERNEL, &econet_proto);
         if (sk == NULL)
                 goto out;
 
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index ed8a3d49487d..6b2e454ae313 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -298,6 +298,14 @@ static int eth_change_mtu(struct net_device *dev, int new_mtu)
         return 0;
 }
 
+static int eth_validate_addr(struct net_device *dev)
+{
+        if (!is_valid_ether_addr(dev->dev_addr))
+                return -EINVAL;
+
+        return 0;
+}
+
 const struct header_ops eth_header_ops ____cacheline_aligned = {
         .create         = eth_header,
         .parse          = eth_header_parse,
@@ -317,6 +325,7 @@ void ether_setup(struct net_device *dev)
 
         dev->change_mtu         = eth_change_mtu;
         dev->set_mac_address    = eth_mac_addr;
+        dev->validate_addr      = eth_validate_addr;
 
         dev->type               = ARPHRD_ETHER;
         dev->hard_header_len    = ETH_HLEN;
diff --git a/net/ieee80211/ieee80211_crypt_ccmp.c b/net/ieee80211/ieee80211_crypt_ccmp.c
index 0936a3e0210b..c6d760d9fbbe 100644
--- a/net/ieee80211/ieee80211_crypt_ccmp.c
+++ b/net/ieee80211/ieee80211_crypt_ccmp.c
@@ -25,7 +25,6 @@
 #include <net/ieee80211.h>
 
 #include <linux/crypto.h>
-#include <asm/scatterlist.h>
 
 MODULE_AUTHOR("Jouni Malinen");
 MODULE_DESCRIPTION("Host AP crypt: CCMP");
diff --git a/net/ieee80211/ieee80211_crypt_tkip.c b/net/ieee80211/ieee80211_crypt_tkip.c
index 72e6ab66834f..58b22619ab15 100644
--- a/net/ieee80211/ieee80211_crypt_tkip.c
+++ b/net/ieee80211/ieee80211_crypt_tkip.c
@@ -14,6 +14,7 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/random.h>
+#include <linux/scatterlist.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/mm.h>
@@ -24,7 +25,6 @@
 #include <net/ieee80211.h>
 
 #include <linux/crypto.h>
-#include <asm/scatterlist.h>
 #include <linux/crc32.h>
 
 MODULE_AUTHOR("Jouni Malinen");
@@ -390,9 +390,7 @@ static int ieee80211_tkip_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
         icv[3] = crc >> 24;
 
         crypto_blkcipher_setkey(tkey->tx_tfm_arc4, rc4key, 16);
-        sg.page = virt_to_page(pos);
-        sg.offset = offset_in_page(pos);
-        sg.length = len + 4;
+        sg_init_one(&sg, pos, len + 4);
         return crypto_blkcipher_encrypt(&desc, &sg, &sg, len + 4);
 }
 
@@ -485,9 +483,7 @@ static int ieee80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         plen = skb->len - hdr_len - 12;
 
         crypto_blkcipher_setkey(tkey->rx_tfm_arc4, rc4key, 16);
-        sg.page = virt_to_page(pos);
-        sg.offset = offset_in_page(pos);
-        sg.length = plen + 4;
+        sg_init_one(&sg, pos, plen + 4);
         if (crypto_blkcipher_decrypt(&desc, &sg, &sg, plen + 4)) {
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG ": TKIP: failed to decrypt "
@@ -539,13 +535,9 @@ static int michael_mic(struct crypto_hash *tfm_michael, u8 * key, u8 * hdr,
                 printk(KERN_WARNING "michael_mic: tfm_michael == NULL\n");
                 return -1;
         }
-        sg[0].page = virt_to_page(hdr);
-        sg[0].offset = offset_in_page(hdr);
-        sg[0].length = 16;
-
-        sg[1].page = virt_to_page(data);
-        sg[1].offset = offset_in_page(data);
-        sg[1].length = data_len;
+        sg_init_table(sg, 2);
+        sg_set_buf(&sg[0], hdr, 16);
+        sg_set_buf(&sg[1], data, data_len);
 
         if (crypto_hash_setkey(tfm_michael, key, 8))
                 return -1;
diff --git a/net/ieee80211/ieee80211_crypt_wep.c b/net/ieee80211/ieee80211_crypt_wep.c
index 8d182459344e..3fa30c40779f 100644
--- a/net/ieee80211/ieee80211_crypt_wep.c
+++ b/net/ieee80211/ieee80211_crypt_wep.c
@@ -14,6 +14,7 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/random.h>
+#include <linux/scatterlist.h>
 #include <linux/skbuff.h>
 #include <linux/mm.h>
 #include <asm/string.h>
@@ -21,7 +22,6 @@
 #include <net/ieee80211.h>
 
 #include <linux/crypto.h>
-#include <asm/scatterlist.h>
 #include <linux/crc32.h>
 
 MODULE_AUTHOR("Jouni Malinen");
@@ -170,9 +170,7 @@ static int prism2_wep_encrypt(struct sk_buff *skb, int hdr_len, void *priv)
         icv[3] = crc >> 24;
 
         crypto_blkcipher_setkey(wep->tx_tfm, key, klen);
-        sg.page = virt_to_page(pos);
-        sg.offset = offset_in_page(pos);
-        sg.length = len + 4;
+        sg_init_one(&sg, pos, len + 4);
         return crypto_blkcipher_encrypt(&desc, &sg, &sg, len + 4);
 }
 
@@ -212,9 +210,7 @@ static int prism2_wep_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         plen = skb->len - hdr_len - 8;
 
         crypto_blkcipher_setkey(wep->rx_tfm, key, klen);
-        sg.page = virt_to_page(pos);
-        sg.offset = offset_in_page(pos);
-        sg.length = plen + 4;
+        sg_init_one(&sg, pos, plen + 4);
         if (crypto_blkcipher_decrypt(&desc, &sg, &sg, plen + 4))
                 return -7;
 
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 621b128897d7..d2f22e74b267 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -323,7 +323,7 @@ lookup_protocol:
         BUG_TRAP(answer_prot->slab != NULL);
 
         err = -ENOBUFS;
-        sk = sk_alloc(net, PF_INET, GFP_KERNEL, answer_prot, 1);
+        sk = sk_alloc(net, PF_INET, GFP_KERNEL, answer_prot);
         if (sk == NULL)
                 goto out;
 
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 4e8e3b079f5b..5fc346d8b566 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -8,7 +8,6 @@
 #include <linux/spinlock.h>
 #include <net/icmp.h>
 #include <net/protocol.h>
-#include <asm/scatterlist.h>
 
 
 /* Clear mutable options and find final destination to substitute
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 805a78e6ed55..f18e88bc86ec 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -504,22 +504,16 @@ int cipso_v4_doi_add(struct cipso_v4_doi *doi_def)
         INIT_RCU_HEAD(&doi_def->rcu);
         INIT_LIST_HEAD(&doi_def->dom_list);
 
-        rcu_read_lock();
-        if (cipso_v4_doi_search(doi_def->doi) != NULL)
-                goto doi_add_failure_rlock;
         spin_lock(&cipso_v4_doi_list_lock);
         if (cipso_v4_doi_search(doi_def->doi) != NULL)
-                goto doi_add_failure_slock;
+                goto doi_add_failure;
         list_add_tail_rcu(&doi_def->list, &cipso_v4_doi_list);
         spin_unlock(&cipso_v4_doi_list_lock);
-        rcu_read_unlock();
 
         return 0;
 
-doi_add_failure_slock:
+doi_add_failure:
         spin_unlock(&cipso_v4_doi_list_lock);
-doi_add_failure_rlock:
-        rcu_read_unlock();
         return -EEXIST;
 }
 
@@ -543,29 +537,23 @@ int cipso_v4_doi_remove(u32 doi,
         struct cipso_v4_doi *doi_def;
         struct cipso_v4_domhsh_entry *dom_iter;
 
-        rcu_read_lock();
-        if (cipso_v4_doi_search(doi) != NULL) {
-                spin_lock(&cipso_v4_doi_list_lock);
-                doi_def = cipso_v4_doi_search(doi);
-                if (doi_def == NULL) {
-                        spin_unlock(&cipso_v4_doi_list_lock);
-                        rcu_read_unlock();
-                        return -ENOENT;
-                }
+        spin_lock(&cipso_v4_doi_list_lock);
+        doi_def = cipso_v4_doi_search(doi);
+        if (doi_def != NULL) {
                 doi_def->valid = 0;
                 list_del_rcu(&doi_def->list);
                 spin_unlock(&cipso_v4_doi_list_lock);
+                rcu_read_lock();
                 list_for_each_entry_rcu(dom_iter, &doi_def->dom_list, list)
                         if (dom_iter->valid)
                                 netlbl_domhsh_remove(dom_iter->domain,
                                                      audit_info);
-                cipso_v4_cache_invalidate();
                 rcu_read_unlock();
-
+                cipso_v4_cache_invalidate();
                 call_rcu(&doi_def->rcu, callback);
                 return 0;
         }
-        rcu_read_unlock();
+        spin_unlock(&cipso_v4_doi_list_lock);
 
         return -ENOENT;
 }
@@ -653,22 +641,19 @@ int cipso_v4_doi_domhsh_add(struct cipso_v4_doi *doi_def, const char *domain)
         new_dom->valid = 1;
         INIT_RCU_HEAD(&new_dom->rcu);
 
-        rcu_read_lock();
         spin_lock(&cipso_v4_doi_list_lock);
-        list_for_each_entry_rcu(iter, &doi_def->dom_list, list)
+        list_for_each_entry(iter, &doi_def->dom_list, list)
                 if (iter->valid &&
                     ((domain != NULL && iter->domain != NULL &&
                       strcmp(iter->domain, domain) == 0) ||
                      (domain == NULL && iter->domain == NULL))) {
                         spin_unlock(&cipso_v4_doi_list_lock);
-                        rcu_read_unlock();
                         kfree(new_dom->domain);
                         kfree(new_dom);
                         return -EEXIST;
                 }
         list_add_tail_rcu(&new_dom->list, &doi_def->dom_list);
         spin_unlock(&cipso_v4_doi_list_lock);
-        rcu_read_unlock();
 
         return 0;
 }
@@ -689,9 +674,8 @@ int cipso_v4_doi_domhsh_remove(struct cipso_v4_doi *doi_def,
 {
         struct cipso_v4_domhsh_entry *iter;
 
-        rcu_read_lock();
         spin_lock(&cipso_v4_doi_list_lock);
-        list_for_each_entry_rcu(iter, &doi_def->dom_list, list)
+        list_for_each_entry(iter, &doi_def->dom_list, list)
                 if (iter->valid &&
                     ((domain != NULL && iter->domain != NULL &&
                       strcmp(iter->domain, domain) == 0) ||
@@ -699,13 +683,10 @@ int cipso_v4_doi_domhsh_remove(struct cipso_v4_doi *doi_def,
                         iter->valid = 0;
                         list_del_rcu(&iter->list);
                         spin_unlock(&cipso_v4_doi_list_lock);
-                        rcu_read_unlock();
                         call_rcu(&iter->rcu, cipso_v4_doi_domhsh_free);
-
                         return 0;
                 }
         spin_unlock(&cipso_v4_doi_list_lock);
-        rcu_read_unlock();
 
         return -ENOENT;
 }
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 6b1a31a74cf2..c31bccb9b526 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -3,7 +3,7 @@
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/esp.h>
-#include <asm/scatterlist.h>
+#include <linux/scatterlist.h>
 #include <linux/crypto.h>
 #include <linux/kernel.h>
 #include <linux/pfkeyv2.h>
@@ -110,7 +110,11 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
                         if (!sg)
                                 goto unlock;
                 }
-                skb_to_sgvec(skb, sg, esph->enc_data+esp->conf.ivlen-skb->data, clen);
+                sg_init_table(sg, nfrags);
+                skb_to_sgvec(skb, sg,
+                             esph->enc_data +
+                             esp->conf.ivlen -
+                             skb->data, clen);
                 err = crypto_blkcipher_encrypt(&desc, sg, sg, clen);
                 if (unlikely(sg != &esp->sgbuf[0]))
                         kfree(sg);
@@ -201,7 +205,10 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
                 if (!sg)
                         goto out;
         }
-        skb_to_sgvec(skb, sg, sizeof(*esph) + esp->conf.ivlen, elen);
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg,
+                     sizeof(*esph) + esp->conf.ivlen,
+                     elen);
         err = crypto_blkcipher_decrypt(&desc, sg, sg, elen);
         if (unlikely(sg != &esp->sgbuf[0]))
                 kfree(sg);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 78b514ba1414..732d8f088b13 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -59,6 +59,13 @@ struct fib_table *ip_fib_main_table;
 #define FIB_TABLE_HASHSZ 1
 static struct hlist_head fib_table_hash[FIB_TABLE_HASHSZ];
 
+static void __init fib4_rules_init(void)
+{
+        ip_fib_local_table = fib_hash_init(RT_TABLE_LOCAL);
+        hlist_add_head_rcu(&ip_fib_local_table->tb_hlist, &fib_table_hash[0]);
+        ip_fib_main_table  = fib_hash_init(RT_TABLE_MAIN);
+        hlist_add_head_rcu(&ip_fib_main_table->tb_hlist, &fib_table_hash[0]);
+}
 #else
 
 #define FIB_TABLE_HASHSZ 256
@@ -128,13 +135,14 @@ struct net_device * ip_dev_find(__be32 addr)
         struct flowi fl = { .nl_u = { .ip4_u = { .daddr = addr } } };
         struct fib_result res;
         struct net_device *dev = NULL;
+        struct fib_table *local_table;
 
 #ifdef CONFIG_IP_MULTIPLE_TABLES
         res.r = NULL;
 #endif
 
-        if (!ip_fib_local_table ||
-            ip_fib_local_table->tb_lookup(ip_fib_local_table, &fl, &res))
+        local_table = fib_get_table(RT_TABLE_LOCAL);
+        if (!local_table || local_table->tb_lookup(local_table, &fl, &res))
                 return NULL;
         if (res.type != RTN_LOCAL)
                 goto out;
@@ -152,6 +160,7 @@ unsigned inet_addr_type(__be32 addr)
         struct flowi            fl = { .nl_u = { .ip4_u = { .daddr = addr } } };
         struct fib_result       res;
         unsigned ret = RTN_BROADCAST;
+        struct fib_table *local_table;
 
         if (ZERONET(addr) || BADCLASS(addr))
                 return RTN_BROADCAST;
@@ -162,10 +171,10 @@ unsigned inet_addr_type(__be32 addr)
         res.r = NULL;
 #endif
 
-        if (ip_fib_local_table) {
+        local_table = fib_get_table(RT_TABLE_LOCAL);
+        if (local_table) {
                 ret = RTN_UNICAST;
-                if (!ip_fib_local_table->tb_lookup(ip_fib_local_table,
-                                                   &fl, &res)) {
+                if (!local_table->tb_lookup(local_table, &fl, &res)) {
                         ret = res.type;
                         fib_res_put(&res);
                 }
@@ -903,14 +912,8 @@ void __init ip_fib_init(void)
 
         for (i = 0; i < FIB_TABLE_HASHSZ; i++)
                 INIT_HLIST_HEAD(&fib_table_hash[i]);
-#ifndef CONFIG_IP_MULTIPLE_TABLES
-        ip_fib_local_table = fib_hash_init(RT_TABLE_LOCAL);
-        hlist_add_head_rcu(&ip_fib_local_table->tb_hlist, &fib_table_hash[0]);
-        ip_fib_main_table  = fib_hash_init(RT_TABLE_MAIN);
-        hlist_add_head_rcu(&ip_fib_main_table->tb_hlist, &fib_table_hash[0]);
-#else
+
         fib4_rules_init();
-#endif
 
         register_netdevice_notifier(&fib_netdev_notifier);
         register_inetaddr_notifier(&fib_inetaddr_notifier);
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 272c69e106e9..233de0634298 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -1104,5 +1104,4 @@ void __init icmp_init(struct net_proto_family *ops)
 EXPORT_SYMBOL(icmp_err_convert);
 EXPORT_SYMBOL(icmp_send);
 EXPORT_SYMBOL(icmp_statistics);
-EXPORT_SYMBOL(icmpmsg_statistics);
 EXPORT_SYMBOL(xrlim_allow);
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 7eb83ebed2ec..b0170732b5e9 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -747,13 +747,14 @@ skip_listen_ht:
 
         for (i = s_i; i < hashinfo->ehash_size; i++) {
                 struct inet_ehash_bucket *head = &hashinfo->ehash[i];
+                rwlock_t *lock = inet_ehash_lockp(hashinfo, i);
                 struct sock *sk;
                 struct hlist_node *node;
 
                 if (i > s_i)
                         s_num = 0;
 
-                read_lock_bh(&head->lock);
+                read_lock_bh(lock);
                 num = 0;
                 sk_for_each(sk, node, &head->chain) {
                         struct inet_sock *inet = inet_sk(sk);
@@ -769,7 +770,7 @@ skip_listen_ht:
                             r->id.idiag_dport)
                                 goto next_normal;
                         if (inet_csk_diag_dump(sk, skb, cb) < 0) {
-                                read_unlock_bh(&head->lock);
+                                read_unlock_bh(lock);
                                 goto done;
                         }
 next_normal:
@@ -791,14 +792,14 @@ next_normal:
                                     r->id.idiag_dport)
                                         goto next_dying;
                                 if (inet_twsk_diag_dump(tw, skb, cb) < 0) {
-                                        read_unlock_bh(&head->lock);
+                                        read_unlock_bh(lock);
                                         goto done;
                                 }
 next_dying:
                                 ++num;
                         }
                 }
-                read_unlock_bh(&head->lock);
+                read_unlock_bh(lock);
         }
 
 done:
@@ -815,6 +816,12 @@ static int inet_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
             nlmsg_len(nlh) < hdrlen)
                 return -EINVAL;
 
+#ifdef CONFIG_KMOD
+        if (inet_diag_table[nlh->nlmsg_type] == NULL)
+                request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
+                               NETLINK_INET_DIAG, nlh->nlmsg_type);
+#endif
+
         if (inet_diag_table[nlh->nlmsg_type] == NULL)
                 return -ENOENT;
 
@@ -914,3 +921,4 @@ static void __exit inet_diag_exit(void)
 module_init(inet_diag_init);
 module_exit(inet_diag_exit);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_INET_DIAG);
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 16eecc7046a3..67704da04fc4 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -204,12 +204,13 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
         const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
         unsigned int hash = inet_ehashfn(daddr, lport, saddr, inet->dport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
+        rwlock_t *lock = inet_ehash_lockp(hinfo, hash);
         struct sock *sk2;
         const struct hlist_node *node;
         struct inet_timewait_sock *tw;
 
         prefetch(head->chain.first);
-        write_lock(&head->lock);
+        write_lock(lock);
 
         /* Check TIME-WAIT sockets first. */
         sk_for_each(sk2, node, &head->twchain) {
@@ -239,7 +240,7 @@ unique:
         BUG_TRAP(sk_unhashed(sk));
         __sk_add_node(sk, &head->chain);
         sock_prot_inc_use(sk->sk_prot);
-        write_unlock(&head->lock);
+        write_unlock(lock);
 
         if (twp) {
                 *twp = tw;
@@ -255,7 +256,7 @@ unique:
         return 0;
 
 not_unique:
-        write_unlock(&head->lock);
+        write_unlock(lock);
         return -EADDRNOTAVAIL;
 }
 
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 4e189e28f306..a60b99e0ebdc 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -20,16 +20,16 @@ static void __inet_twsk_kill(struct inet_timewait_sock *tw,
         struct inet_bind_hashbucket *bhead;
         struct inet_bind_bucket *tb;
         /* Unlink from established hashes. */
-        struct inet_ehash_bucket *ehead = inet_ehash_bucket(hashinfo, tw->tw_hash);
+        rwlock_t *lock = inet_ehash_lockp(hashinfo, tw->tw_hash);
 
-        write_lock(&ehead->lock);
+        write_lock(lock);
         if (hlist_unhashed(&tw->tw_node)) {
-                write_unlock(&ehead->lock);
+                write_unlock(lock);
                 return;
         }
         __hlist_del(&tw->tw_node);
         sk_node_init(&tw->tw_node);
-        write_unlock(&ehead->lock);
+        write_unlock(lock);
 
         /* Disassociate with bind bucket. */
         bhead = &hashinfo->bhash[inet_bhashfn(tw->tw_num, hashinfo->bhash_size)];
@@ -59,6 +59,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
         const struct inet_sock *inet = inet_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct inet_ehash_bucket *ehead = inet_ehash_bucket(hashinfo, sk->sk_hash);
+        rwlock_t *lock = inet_ehash_lockp(hashinfo, sk->sk_hash);
         struct inet_bind_hashbucket *bhead;
         /* Step 1: Put TW into bind hash. Original socket stays there too.
            Note, that any socket with inet->num != 0 MUST be bound in
@@ -71,7 +72,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
         inet_twsk_add_bind_node(tw, &tw->tw_tb->owners);
         spin_unlock(&bhead->lock);
 
-        write_lock(&ehead->lock);
+        write_lock(lock);
 
         /* Step 2: Remove SK from established hash. */
         if (__sk_del_node_init(sk))
@@ -81,7 +82,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
         inet_twsk_add_node(tw, &ehead->twchain);
         atomic_inc(&tw->tw_refcnt);
 
-        write_unlock(&ehead->lock);
+        write_unlock(lock);
 }
 
 EXPORT_SYMBOL_GPL(__inet_twsk_hashdance);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index f151900efaf9..02b02a8d681c 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -674,7 +674,7 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         struct rtable *rt;                      /* Route to the other host */
         struct net_device *tdev;                        /* Device to other host */
         struct iphdr  *iph;                     /* Our new IP header */
-        int    max_headroom;                    /* The extra header space needed */
+        unsigned int max_headroom;              /* The extra header space needed */
         int    gre_hlen;
         __be32 dst;
         int    mtu;
@@ -1033,7 +1033,6 @@ static int ipgre_tunnel_change_mtu(struct net_device *dev, int new_mtu)
         return 0;
 }
 
-#ifdef CONFIG_NET_IPGRE_BROADCAST
 /* Nice toy. Unfortunately, useless in real life :-)
    It allows to construct virtual multiprotocol broadcast "LAN"
    over the Internet, provided multicast routing is tuned.
@@ -1092,10 +1091,19 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
         return -t->hlen;
 }
 
+static int ipgre_header_parse(const struct sk_buff *skb, unsigned char *haddr)
+{
+        struct iphdr *iph = (struct iphdr*) skb_mac_header(skb);
+        memcpy(haddr, &iph->saddr, 4);
+        return 4;
+}
+
 static const struct header_ops ipgre_header_ops = {
         .create = ipgre_header,
+        .parse  = ipgre_header_parse,
 };
 
+#ifdef CONFIG_NET_IPGRE_BROADCAST
 static int ipgre_open(struct net_device *dev)
 {
         struct ip_tunnel *t = netdev_priv(dev);
@@ -1197,6 +1205,8 @@ static int ipgre_tunnel_init(struct net_device *dev)
                         dev->stop = ipgre_close;
                 }
 #endif
+        } else {
+                dev->header_ops = &ipgre_header_ops;
         }
 
         if (!tdev && tunnel->parms.link)
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index f508835ba713..fd99fbd685ea 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -161,7 +161,7 @@ static inline int ip_finish_output2(struct sk_buff *skb)
         struct dst_entry *dst = skb->dst;
         struct rtable *rt = (struct rtable *)dst;
         struct net_device *dev = dst->dev;
-        int hh_len = LL_RESERVED_SPACE(dev);
+        unsigned int hh_len = LL_RESERVED_SPACE(dev);
 
         if (rt->rt_type == RTN_MULTICAST)
                 IP_INC_STATS(IPSTATS_MIB_OUTMCASTPKTS);
@@ -1183,6 +1183,17 @@ error:
         return err;
 }
 
+static void ip_cork_release(struct inet_sock *inet)
+{
+        inet->cork.flags &= ~IPCORK_OPT;
+        kfree(inet->cork.opt);
+        inet->cork.opt = NULL;
+        if (inet->cork.rt) {
+                ip_rt_put(inet->cork.rt);
+                inet->cork.rt = NULL;
+        }
+}
+
 /*
  *      Combined all pending IP fragments on the socket as one IP datagram
  *      and push them out.
@@ -1276,13 +1287,7 @@ int ip_push_pending_frames(struct sock *sk)
         }
 
 out:
-        inet->cork.flags &= ~IPCORK_OPT;
-        kfree(inet->cork.opt);
-        inet->cork.opt = NULL;
-        if (inet->cork.rt) {
-                ip_rt_put(inet->cork.rt);
-                inet->cork.rt = NULL;
-        }
+        ip_cork_release(inet);
         return err;
 
 error:
@@ -1295,19 +1300,12 @@ error:
  */
 void ip_flush_pending_frames(struct sock *sk)
 {
-        struct inet_sock *inet = inet_sk(sk);
         struct sk_buff *skb;
 
         while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL)
                 kfree_skb(skb);
 
-        inet->cork.flags &= ~IPCORK_OPT;
-        kfree(inet->cork.opt);
-        inet->cork.opt = NULL;
-        if (inet->cork.rt) {
-                ip_rt_put(inet->cork.rt);
-                inet->cork.rt = NULL;
-        }
+        ip_cork_release(inet_sk(sk));
 }
 
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index f51f20e487c8..82817e554363 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -437,10 +437,8 @@ static int do_ip_setsockopt(struct sock *sk, int level,
 
         /* If optlen==0, it is equivalent to val == 0 */
 
-#ifdef CONFIG_IP_MROUTE
-        if (optname >= MRT_BASE && optname <= (MRT_BASE + 10))
+        if (ip_mroute_opt(optname))
                 return ip_mroute_setsockopt(sk,optname,optval,optlen);
-#endif
 
         err = 0;
         lock_sock(sk);
@@ -909,11 +907,9 @@ int ip_setsockopt(struct sock *sk, int level,
 #ifdef CONFIG_NETFILTER
         /* we need to exclude all possible ENOPROTOOPTs except default case */
         if (err == -ENOPROTOOPT && optname != IP_HDRINCL &&
-                optname != IP_IPSEC_POLICY && optname != IP_XFRM_POLICY
-#ifdef CONFIG_IP_MROUTE
-                && (optname < MRT_BASE || optname > (MRT_BASE + 10))
-#endif
-           ) {
+                        optname != IP_IPSEC_POLICY &&
+                        optname != IP_XFRM_POLICY &&
+                        !ip_mroute_opt(optname)) {
                 lock_sock(sk);
                 err = nf_setsockopt(sk, PF_INET, optname, optval, optlen);
                 release_sock(sk);
@@ -935,11 +931,9 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname,
 #ifdef CONFIG_NETFILTER
         /* we need to exclude all possible ENOPROTOOPTs except default case */
         if (err == -ENOPROTOOPT && optname != IP_HDRINCL &&
-            optname != IP_IPSEC_POLICY && optname != IP_XFRM_POLICY
-#ifdef CONFIG_IP_MROUTE
-            && (optname < MRT_BASE || optname > (MRT_BASE + 10))
-#endif
-           ) {
+                        optname != IP_IPSEC_POLICY &&
+                        optname != IP_XFRM_POLICY &&
+                        !ip_mroute_opt(optname)) {
                 lock_sock(sk);
                 err = compat_nf_setsockopt(sk, PF_INET, optname,
                                            optval, optlen);
@@ -967,11 +961,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
         if (level != SOL_IP)
                 return -EOPNOTSUPP;
 
-#ifdef CONFIG_IP_MROUTE
-        if (optname >= MRT_BASE && optname <= MRT_BASE+10) {
+        if (ip_mroute_opt(optname))
                 return ip_mroute_getsockopt(sk,optname,optval,optlen);
-        }
-#endif
 
         if (get_user(len,optlen))
                 return -EFAULT;
@@ -1171,11 +1162,8 @@ int ip_getsockopt(struct sock *sk, int level,
         err = do_ip_getsockopt(sk, level, optname, optval, optlen);
 #ifdef CONFIG_NETFILTER
         /* we need to exclude all possible ENOPROTOOPTs except default case */
-        if (err == -ENOPROTOOPT && optname != IP_PKTOPTIONS
-#ifdef CONFIG_IP_MROUTE
-                && (optname < MRT_BASE || optname > MRT_BASE+10)
-#endif
-           ) {
+        if (err == -ENOPROTOOPT && optname != IP_PKTOPTIONS &&
+                        !ip_mroute_opt(optname)) {
                 int len;
 
                 if (get_user(len,optlen))
@@ -1200,11 +1188,8 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname,
         int err = do_ip_getsockopt(sk, level, optname, optval, optlen);
 #ifdef CONFIG_NETFILTER
         /* we need to exclude all possible ENOPROTOOPTs except default case */
-        if (err == -ENOPROTOOPT && optname != IP_PKTOPTIONS
-#ifdef CONFIG_IP_MROUTE
-            && (optname < MRT_BASE || optname > MRT_BASE+10)
-#endif
-           ) {
+        if (err == -ENOPROTOOPT && optname != IP_PKTOPTIONS &&
+                        !ip_mroute_opt(optname)) {
                 int len;
 
                 if (get_user(len, optlen))
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 0bfeb02a5f87..2c44a94c2135 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -14,9 +14,9 @@
  *   - Adaptive compression.
  */
 #include <linux/module.h>
-#include <asm/scatterlist.h>
 #include <asm/semaphore.h>
 #include <linux/crypto.h>
+#include <linux/err.h>
 #include <linux/pfkeyv2.h>
 #include <linux/percpu.h>
 #include <linux/smp.h>
@@ -345,7 +345,7 @@ static struct crypto_comp **ipcomp_alloc_tfms(const char *alg_name)
         for_each_possible_cpu(cpu) {
                 struct crypto_comp *tfm = crypto_alloc_comp(alg_name, 0,
                                                             CRYPTO_ALG_ASYNC);
-                if (!tfm)
+                if (IS_ERR(tfm))
                         goto error;
                 *per_cpu_ptr(tfms, cpu) = tfm;
         }
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 5cd5bbe1379a..8c2b2b0741da 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -515,7 +515,7 @@ static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         struct net_device *tdev;                        /* Device to other host */
         struct iphdr  *old_iph = ip_hdr(skb);
         struct iphdr  *iph;                     /* Our new IP header */
-        int    max_headroom;                    /* The extra header space needed */
+        unsigned int max_headroom;              /* The extra header space needed */
         __be32 dst = tiph->daddr;
         int    mtu;
 
diff --git a/net/ipv4/ipvs/ip_vs_conn.c b/net/ipv4/ipvs/ip_vs_conn.c
index 4b702f708d30..b7eeae622d9b 100644
--- a/net/ipv4/ipvs/ip_vs_conn.c
+++ b/net/ipv4/ipvs/ip_vs_conn.c
@@ -426,6 +426,25 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
 
 
 /*
+ * Check if there is a destination for the connection, if so
+ * bind the connection to the destination.
+ */
+struct ip_vs_dest *ip_vs_try_bind_dest(struct ip_vs_conn *cp)
+{
+        struct ip_vs_dest *dest;
+
+        if ((cp) && (!cp->dest)) {
+                dest = ip_vs_find_dest(cp->daddr, cp->dport,
+                                       cp->vaddr, cp->vport, cp->protocol);
+                ip_vs_bind_dest(cp, dest);
+                return dest;
+        } else
+                return NULL;
+}
+EXPORT_SYMBOL(ip_vs_try_bind_dest);
+
+
+/*
  *      Unbind a connection entry with its VS destination
  *      Called by the ip_vs_conn_expire function.
  */
diff --git a/net/ipv4/ipvs/ip_vs_core.c b/net/ipv4/ipvs/ip_vs_core.c
index c6ed7654e839..20c884a57721 100644
--- a/net/ipv4/ipvs/ip_vs_core.c
+++ b/net/ipv4/ipvs/ip_vs_core.c
@@ -979,15 +979,23 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
                 ret = NF_ACCEPT;
         }
 
-        /* increase its packet counter and check if it is needed
-           to be synchronized */
+        /* Increase its packet counter and check if it is needed
+         * to be synchronized
+         *
+         * Sync connection if it is about to close to
+         * encorage the standby servers to update the connections timeout
+         */
         atomic_inc(&cp->in_pkts);
         if ((ip_vs_sync_state & IP_VS_STATE_MASTER) &&
-            (cp->protocol != IPPROTO_TCP ||
-             cp->state == IP_VS_TCP_S_ESTABLISHED) &&
-            (atomic_read(&cp->in_pkts) % sysctl_ip_vs_sync_threshold[1]
-             == sysctl_ip_vs_sync_threshold[0]))
+            (((cp->protocol != IPPROTO_TCP ||
+               cp->state == IP_VS_TCP_S_ESTABLISHED) &&
+              (atomic_read(&cp->in_pkts) % sysctl_ip_vs_sync_threshold[1]
+               == sysctl_ip_vs_sync_threshold[0])) ||
+             ((cp->protocol == IPPROTO_TCP) && (cp->old_state != cp->state) &&
+              ((cp->state == IP_VS_TCP_S_FIN_WAIT) ||
+               (cp->state == IP_VS_TCP_S_CLOSE)))))
                 ip_vs_sync_conn(cp);
+        cp->old_state = cp->state;
 
         ip_vs_conn_put(cp);
         return ret;
diff --git a/net/ipv4/ipvs/ip_vs_ctl.c b/net/ipv4/ipvs/ip_vs_ctl.c
index 7345fc252a23..3c4d22a468ec 100644
--- a/net/ipv4/ipvs/ip_vs_ctl.c
+++ b/net/ipv4/ipvs/ip_vs_ctl.c
@@ -579,6 +579,32 @@ ip_vs_lookup_dest(struct ip_vs_service *svc, __be32 daddr, __be16 dport)
         return NULL;
 }
 
+/*
+ * Find destination by {daddr,dport,vaddr,protocol}
+ * Cretaed to be used in ip_vs_process_message() in
+ * the backup synchronization daemon. It finds the
+ * destination to be bound to the received connection
+ * on the backup.
+ *
+ * ip_vs_lookup_real_service() looked promissing, but
+ * seems not working as expected.
+ */
+struct ip_vs_dest *ip_vs_find_dest(__be32 daddr, __be16 dport,
+                                    __be32 vaddr, __be16 vport, __u16 protocol)
+{
+        struct ip_vs_dest *dest;
+        struct ip_vs_service *svc;
+
+        svc = ip_vs_service_get(0, protocol, vaddr, vport);
+        if (!svc)
+                return NULL;
+        dest = ip_vs_lookup_dest(svc, daddr, dport);
+        if (dest)
+                atomic_inc(&dest->refcnt);
+        ip_vs_service_put(svc);
+        return dest;
+}
+EXPORT_SYMBOL(ip_vs_find_dest);
 
 /*
  *  Lookup dest by {svc,addr,port} in the destination trash.
diff --git a/net/ipv4/ipvs/ip_vs_lblcr.c b/net/ipv4/ipvs/ip_vs_lblcr.c
index 6a1fec416eaf..427b593c1069 100644
--- a/net/ipv4/ipvs/ip_vs_lblcr.c
+++ b/net/ipv4/ipvs/ip_vs_lblcr.c
@@ -48,8 +48,6 @@
 /* for sysctl */
 #include <linux/fs.h>
 #include <linux/sysctl.h>
-/* for proc_net_create/proc_net_remove */
-#include <linux/proc_fs.h>
 #include <net/net_namespace.h>
 
 #include <net/ip_vs.h>
@@ -547,71 +545,6 @@ static void ip_vs_lblcr_check_expire(unsigned long data)
         mod_timer(&tbl->periodic_timer, jiffies+CHECK_EXPIRE_INTERVAL);
 }
 
-
-#ifdef CONFIG_IP_VS_LBLCR_DEBUG
-static struct ip_vs_lblcr_table *lblcr_table_list;
-
-/*
- *      /proc/net/ip_vs_lblcr to display the mappings of
- *                  destination IP address <==> its serverSet
- */
-static int
-ip_vs_lblcr_getinfo(char *buffer, char **start, off_t offset, int length)
-{
-        off_t pos=0, begin;
-        int len=0, size;
-        struct ip_vs_lblcr_table *tbl;
-        unsigned long now = jiffies;
-        int i;
-        struct ip_vs_lblcr_entry *en;
-
-        tbl = lblcr_table_list;
-
-        size = sprintf(buffer, "LastTime Dest IP address  Server set\n");
-        pos += size;
-        len += size;
-
-        for (i=0; i<IP_VS_LBLCR_TAB_SIZE; i++) {
-                read_lock_bh(&tbl->lock);
-                list_for_each_entry(en, &tbl->bucket[i], list) {
-                        char tbuf[16];
-                        struct ip_vs_dest_list *d;
-
-                        sprintf(tbuf, "%u.%u.%u.%u", NIPQUAD(en->addr));
-                        size = sprintf(buffer+len, "%8lu %-16s ",
-                                       now-en->lastuse, tbuf);
-
-                        read_lock(&en->set.lock);
-                        for (d=en->set.list; d!=NULL; d=d->next) {
-                                size += sprintf(buffer+len+size,
-                                                "%u.%u.%u.%u ",
-                                                NIPQUAD(d->dest->addr));
-                        }
-                        read_unlock(&en->set.lock);
-                        size += sprintf(buffer+len+size, "\n");
-                        len += size;
-                        pos += size;
-                        if (pos <= offset)
-                                len=0;
-                        if (pos >= offset+length) {
-                                read_unlock_bh(&tbl->lock);
-                                goto done;
-                        }
-                }
-                read_unlock_bh(&tbl->lock);
-        }
-
-  done:
-        begin = len - (pos - offset);
-        *start = buffer + begin;
-        len -= begin;
-        if(len>length)
-                len = length;
-        return len;
-}
-#endif
-
-
 static int ip_vs_lblcr_init_svc(struct ip_vs_service *svc)
 {
         int i;
@@ -650,9 +583,6 @@ static int ip_vs_lblcr_init_svc(struct ip_vs_service *svc)
         tbl->periodic_timer.expires = jiffies+CHECK_EXPIRE_INTERVAL;
         add_timer(&tbl->periodic_timer);
 
-#ifdef CONFIG_IP_VS_LBLCR_DEBUG
-        lblcr_table_list = tbl;
-#endif
         return 0;
 }
 
@@ -843,18 +773,12 @@ static int __init ip_vs_lblcr_init(void)
 {
         INIT_LIST_HEAD(&ip_vs_lblcr_scheduler.n_list);
         sysctl_header = register_sysctl_table(lblcr_root_table);
-#ifdef CONFIG_IP_VS_LBLCR_DEBUG
-        proc_net_create(&init_net, "ip_vs_lblcr", 0, ip_vs_lblcr_getinfo);
-#endif
         return register_ip_vs_scheduler(&ip_vs_lblcr_scheduler);
 }
 
 
 static void __exit ip_vs_lblcr_cleanup(void)
 {
-#ifdef CONFIG_IP_VS_LBLCR_DEBUG
-        proc_net_remove(&init_net, "ip_vs_lblcr");
-#endif
         unregister_sysctl_table(sysctl_header);
         unregister_ip_vs_scheduler(&ip_vs_lblcr_scheduler);
 }
diff --git a/net/ipv4/ipvs/ip_vs_sync.c b/net/ipv4/ipvs/ip_vs_sync.c
index c99f2a33fb9e..bd930efc18da 100644
--- a/net/ipv4/ipvs/ip_vs_sync.c
+++ b/net/ipv4/ipvs/ip_vs_sync.c
@@ -72,7 +72,6 @@ struct ip_vs_sync_thread_data {
         int state;
 };
 
-#define IP_VS_SYNC_CONN_TIMEOUT (3*60*HZ)
 #define SIMPLE_CONN_SIZE  (sizeof(struct ip_vs_sync_conn))
 #define FULL_CONN_SIZE  \
 (sizeof(struct ip_vs_sync_conn) + sizeof(struct ip_vs_sync_conn_options))
@@ -284,6 +283,8 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
         struct ip_vs_sync_conn *s;
         struct ip_vs_sync_conn_options *opt;
         struct ip_vs_conn *cp;
+        struct ip_vs_protocol *pp;
+        struct ip_vs_dest *dest;
         char *p;
         int i;
 
@@ -317,20 +318,34 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
                                                s->caddr, s->cport,
                                                s->vaddr, s->vport);
                 if (!cp) {
+                        /*
+                         * Find the appropriate destination for the connection.
+                         * If it is not found the connection will remain unbound
+                         * but still handled.
+                         */
+                        dest = ip_vs_find_dest(s->daddr, s->dport,
+                                               s->vaddr, s->vport,
+                                               s->protocol);
                         cp = ip_vs_conn_new(s->protocol,
                                             s->caddr, s->cport,
                                             s->vaddr, s->vport,
                                             s->daddr, s->dport,
-                                            flags, NULL);
+                                            flags, dest);
+                        if (dest)
+                                atomic_dec(&dest->refcnt);
                         if (!cp) {
                                 IP_VS_ERR("ip_vs_conn_new failed\n");
                                 return;
                         }
                         cp->state = ntohs(s->state);
                 } else if (!cp->dest) {
-                        /* it is an entry created by the synchronization */
-                        cp->state = ntohs(s->state);
-                        cp->flags = flags | IP_VS_CONN_F_HASHED;
+                        dest = ip_vs_try_bind_dest(cp);
+                        if (!dest) {
+                                /* it is an unbound entry created by
+                                 * synchronization */
+                                cp->flags = flags | IP_VS_CONN_F_HASHED;
+                        } else
+                                atomic_dec(&dest->refcnt);
                 }       /* Note that we don't touch its state and flags
                            if it is a normal entry. */
 
@@ -342,7 +357,9 @@ static void ip_vs_process_message(const char *buffer, const size_t buflen)
                         p += SIMPLE_CONN_SIZE;
 
                 atomic_set(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
-                cp->timeout = IP_VS_SYNC_CONN_TIMEOUT;
+                cp->state = ntohs(s->state);
+                pp = ip_vs_proto_get(s->protocol);
+                cp->timeout = pp->timeout_table[cp->state];
                 ip_vs_conn_put(cp);
 
                 if (p > buffer+buflen) {
diff --git a/net/ipv4/ipvs/ip_vs_xmit.c b/net/ipv4/ipvs/ip_vs_xmit.c
index d0a92dec1050..7c074e386c17 100644
--- a/net/ipv4/ipvs/ip_vs_xmit.c
+++ b/net/ipv4/ipvs/ip_vs_xmit.c
@@ -325,7 +325,7 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         __be16 df = old_iph->frag_off;
         sk_buff_data_t old_transport_header = skb->transport_header;
         struct iphdr  *iph;                     /* Our new IP header */
-        int    max_headroom;                    /* The extra header space needed */
+        unsigned int max_headroom;              /* The extra header space needed */
         int    mtu;
 
         EnterFunction(10);
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index fa97947c6ae1..9aca9c55687c 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -128,7 +128,7 @@ config IP_NF_MATCH_ADDRTYPE
           eg. UNICAST, LOCAL, BROADCAST, ...
         
           If you want to compile it as a module, say M here and read
-          <file:Documentation/modules.txt>.  If unsure, say `N'.
+          <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 
 # `filter', generic and specific targets
 config IP_NF_FILTER
@@ -371,7 +371,7 @@ config IP_NF_RAW
           and OUTPUT chains.
         
           If you want to compile it as a module, say M here and read
-          <file:Documentation/modules.txt>.  If unsure, say `N'.
+          <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 
 # ARP tables
 config IP_NF_ARPTABLES
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 409d273f6f82..7456833d6ade 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -41,27 +41,27 @@ obj-$(CONFIG_NF_NAT) += iptable_nat.o
 obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
 
 # matches
+obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o
+obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
+obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
 obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
 obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
-obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
 obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
-obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
-obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
+obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
-obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o
 
 # targets
-obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
-obj-$(CONFIG_IP_NF_TARGET_TOS) += ipt_TOS.o
+obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o
 obj-$(CONFIG_IP_NF_TARGET_ECN) += ipt_ECN.o
+obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
 obj-$(CONFIG_IP_NF_TARGET_MASQUERADE) += ipt_MASQUERADE.o
-obj-$(CONFIG_IP_NF_TARGET_REDIRECT) += ipt_REDIRECT.o
 obj-$(CONFIG_IP_NF_TARGET_NETMAP) += ipt_NETMAP.o
+obj-$(CONFIG_IP_NF_TARGET_REDIRECT) += ipt_REDIRECT.o
+obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
 obj-$(CONFIG_IP_NF_TARGET_SAME) += ipt_SAME.o
-obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
-obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
-obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o
+obj-$(CONFIG_IP_NF_TARGET_TOS) += ipt_TOS.o
 obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
+obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
 
 # generic ARP tables
 obj-$(CONFIG_IP_NF_ARPTABLES) += arp_tables.o
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 10a2ce09fd8e..14d64a383db1 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -22,6 +22,7 @@
 #include <linux/spinlock.h>
 #include <linux/sysctl.h>
 #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <linux/security.h>
 #include <linux/mutex.h>
 #include <net/net_namespace.h>
@@ -607,15 +608,11 @@ static ctl_table ipq_root_table[] = {
         { .ctl_name = 0 }
 };
 
-#ifdef CONFIG_PROC_FS
-static int
-ipq_get_info(char *buffer, char **start, off_t offset, int length)
+static int ip_queue_show(struct seq_file *m, void *v)
 {
-        int len;
-
         read_lock_bh(&queue_lock);
 
-        len = sprintf(buffer,
+        seq_printf(m,
                       "Peer PID          : %d\n"
                       "Copy mode         : %hu\n"
                       "Copy range        : %u\n"
@@ -632,16 +629,21 @@ ipq_get_info(char *buffer, char **start, off_t offset, int length)
                       queue_user_dropped);
 
         read_unlock_bh(&queue_lock);
+        return 0;
+}
 
-        *start = buffer + offset;
-        len -= offset;
-        if (len > length)
-                len = length;
-        else if (len < 0)
-                len = 0;
-        return len;
+static int ip_queue_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, ip_queue_show, NULL);
 }
-#endif /* CONFIG_PROC_FS */
+
+static const struct file_operations ip_queue_proc_fops = {
+        .open           = ip_queue_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+        .owner          = THIS_MODULE,
+};
 
 static struct nf_queue_handler nfqh = {
         .name   = "ip_queue",
@@ -661,10 +663,11 @@ static int __init ip_queue_init(void)
                 goto cleanup_netlink_notifier;
         }
 
-        proc = proc_net_create(&init_net, IPQ_PROC_FS_NAME, 0, ipq_get_info);
-        if (proc)
+        proc = create_proc_entry(IPQ_PROC_FS_NAME, 0, init_net.proc_net);
+        if (proc) {
                 proc->owner = THIS_MODULE;
-        else {
+                proc->proc_fops = &ip_queue_proc_fops;
+        } else {
                 printk(KERN_ERR "ip_queue: failed to create proc entry\n");
                 goto cleanup_ipqnl;
         }
diff --git a/net/ipv4/netfilter/nf_nat_amanda.c b/net/ipv4/netfilter/nf_nat_amanda.c
index 35a5aa69cd92..c31b87668250 100644
--- a/net/ipv4/netfilter/nf_nat_amanda.c
+++ b/net/ipv4/netfilter/nf_nat_amanda.c
@@ -69,7 +69,7 @@ static void __exit nf_nat_amanda_fini(void)
 
 static int __init nf_nat_amanda_init(void)
 {
-        BUG_ON(rcu_dereference(nf_nat_amanda_hook));
+        BUG_ON(nf_nat_amanda_hook != NULL);
         rcu_assign_pointer(nf_nat_amanda_hook, help);
         return 0;
 }
diff --git a/net/ipv4/netfilter/nf_nat_ftp.c b/net/ipv4/netfilter/nf_nat_ftp.c
index e1a16d3ea4cb..a1d5d58a58bf 100644
--- a/net/ipv4/netfilter/nf_nat_ftp.c
+++ b/net/ipv4/netfilter/nf_nat_ftp.c
@@ -147,7 +147,7 @@ static void __exit nf_nat_ftp_fini(void)
 
 static int __init nf_nat_ftp_init(void)
 {
-        BUG_ON(rcu_dereference(nf_nat_ftp_hook));
+        BUG_ON(nf_nat_ftp_hook != NULL);
         rcu_assign_pointer(nf_nat_ftp_hook, nf_nat_ftp);
         return 0;
 }
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index a868c8c41328..93e18ef114f2 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -544,15 +544,15 @@ static int nat_callforwarding(struct sk_buff *skb, struct nf_conn *ct,
 /****************************************************************************/
 static int __init init(void)
 {
-        BUG_ON(rcu_dereference(set_h245_addr_hook) != NULL);
-        BUG_ON(rcu_dereference(set_h225_addr_hook) != NULL);
-        BUG_ON(rcu_dereference(set_sig_addr_hook) != NULL);
-        BUG_ON(rcu_dereference(set_ras_addr_hook) != NULL);
-        BUG_ON(rcu_dereference(nat_rtp_rtcp_hook) != NULL);
-        BUG_ON(rcu_dereference(nat_t120_hook) != NULL);
-        BUG_ON(rcu_dereference(nat_h245_hook) != NULL);
-        BUG_ON(rcu_dereference(nat_callforwarding_hook) != NULL);
-        BUG_ON(rcu_dereference(nat_q931_hook) != NULL);
+        BUG_ON(set_h245_addr_hook != NULL);
+        BUG_ON(set_h225_addr_hook != NULL);
+        BUG_ON(set_sig_addr_hook != NULL);
+        BUG_ON(set_ras_addr_hook != NULL);
+        BUG_ON(nat_rtp_rtcp_hook != NULL);
+        BUG_ON(nat_t120_hook != NULL);
+        BUG_ON(nat_h245_hook != NULL);
+        BUG_ON(nat_callforwarding_hook != NULL);
+        BUG_ON(nat_q931_hook != NULL);
 
         rcu_assign_pointer(set_h245_addr_hook, set_h245_addr);
         rcu_assign_pointer(set_h225_addr_hook, set_h225_addr);
diff --git a/net/ipv4/netfilter/nf_nat_irc.c b/net/ipv4/netfilter/nf_nat_irc.c
index 766e2c16c6b9..fe6f9cef6c85 100644
--- a/net/ipv4/netfilter/nf_nat_irc.c
+++ b/net/ipv4/netfilter/nf_nat_irc.c
@@ -74,7 +74,7 @@ static void __exit nf_nat_irc_fini(void)
 
 static int __init nf_nat_irc_init(void)
 {
-        BUG_ON(rcu_dereference(nf_nat_irc_hook));
+        BUG_ON(nf_nat_irc_hook != NULL);
         rcu_assign_pointer(nf_nat_irc_hook, help);
         return 0;
 }
diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
index e1385a099079..6817e7995f35 100644
--- a/net/ipv4/netfilter/nf_nat_pptp.c
+++ b/net/ipv4/netfilter/nf_nat_pptp.c
@@ -281,16 +281,16 @@ static int __init nf_nat_helper_pptp_init(void)
 {
         nf_nat_need_gre();
 
-        BUG_ON(rcu_dereference(nf_nat_pptp_hook_outbound));
+        BUG_ON(nf_nat_pptp_hook_outbound != NULL);
         rcu_assign_pointer(nf_nat_pptp_hook_outbound, pptp_outbound_pkt);
 
-        BUG_ON(rcu_dereference(nf_nat_pptp_hook_inbound));
+        BUG_ON(nf_nat_pptp_hook_inbound != NULL);
         rcu_assign_pointer(nf_nat_pptp_hook_inbound, pptp_inbound_pkt);
 
-        BUG_ON(rcu_dereference(nf_nat_pptp_hook_exp_gre));
+        BUG_ON(nf_nat_pptp_hook_exp_gre != NULL);
         rcu_assign_pointer(nf_nat_pptp_hook_exp_gre, pptp_exp_gre);
 
-        BUG_ON(rcu_dereference(nf_nat_pptp_hook_expectfn));
+        BUG_ON(nf_nat_pptp_hook_expectfn != NULL);
         rcu_assign_pointer(nf_nat_pptp_hook_expectfn, pptp_nat_expected);
         return 0;
 }
diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index ce9edbcc01e3..3ca98971a1e9 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -293,8 +293,8 @@ static void __exit nf_nat_sip_fini(void)
 
 static int __init nf_nat_sip_init(void)
 {
-        BUG_ON(rcu_dereference(nf_nat_sip_hook));
-        BUG_ON(rcu_dereference(nf_nat_sdp_hook));
+        BUG_ON(nf_nat_sip_hook != NULL);
+        BUG_ON(nf_nat_sdp_hook != NULL);
         rcu_assign_pointer(nf_nat_sip_hook, ip_nat_sip);
         rcu_assign_pointer(nf_nat_sdp_hook, ip_nat_sdp);
         return 0;
diff --git a/net/ipv4/netfilter/nf_nat_tftp.c b/net/ipv4/netfilter/nf_nat_tftp.c
index 0ecec701cb44..1360a94766dd 100644
--- a/net/ipv4/netfilter/nf_nat_tftp.c
+++ b/net/ipv4/netfilter/nf_nat_tftp.c
@@ -43,7 +43,7 @@ static void __exit nf_nat_tftp_fini(void)
 
 static int __init nf_nat_tftp_init(void)
 {
-        BUG_ON(rcu_dereference(nf_nat_tftp_hook));
+        BUG_ON(nf_nat_tftp_hook != NULL);
         rcu_assign_pointer(nf_nat_tftp_hook, help);
         return 0;
 }
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index fd16cb8f8abe..ce34b281803f 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -46,17 +46,6 @@
 #include <net/sock.h>
 #include <net/raw.h>
 
-static int fold_prot_inuse(struct proto *proto)
-{
-        int res = 0;
-        int cpu;
-
-        for_each_possible_cpu(cpu)
-                res += proto->stats[cpu].inuse;
-
-        return res;
-}
-
 /*
  *      Report socket allocation statistics [mea@utu.fi]
  */
@@ -64,12 +53,12 @@ static int sockstat_seq_show(struct seq_file *seq, void *v)
 {
         socket_seq_show(seq);
         seq_printf(seq, "TCP: inuse %d orphan %d tw %d alloc %d mem %d\n",
-                   fold_prot_inuse(&tcp_prot), atomic_read(&tcp_orphan_count),
+                   sock_prot_inuse(&tcp_prot), atomic_read(&tcp_orphan_count),
                    tcp_death_row.tw_count, atomic_read(&tcp_sockets_allocated),
                    atomic_read(&tcp_memory_allocated));
-        seq_printf(seq, "UDP: inuse %d\n", fold_prot_inuse(&udp_prot));
-        seq_printf(seq, "UDPLITE: inuse %d\n", fold_prot_inuse(&udplite_prot));
-        seq_printf(seq, "RAW: inuse %d\n", fold_prot_inuse(&raw_prot));
+        seq_printf(seq, "UDP: inuse %d\n", sock_prot_inuse(&udp_prot));
+        seq_printf(seq, "UDPLITE: inuse %d\n", sock_prot_inuse(&udplite_prot));
+        seq_printf(seq, "RAW: inuse %d\n", sock_prot_inuse(&raw_prot));
         seq_printf(seq,  "FRAG: inuse %d memory %d\n",
                         ip_frag_nqueues(), ip_frag_mem());
         return 0;
@@ -121,14 +110,6 @@ static const struct snmp_mib snmp4_ipextstats_list[] = {
         SNMP_MIB_SENTINEL
 };
 
-static const struct snmp_mib snmp4_icmp_list[] = {
-        SNMP_MIB_ITEM("InMsgs", ICMP_MIB_INMSGS),
-        SNMP_MIB_ITEM("InErrors", ICMP_MIB_INERRORS),
-        SNMP_MIB_ITEM("OutMsgs", ICMP_MIB_OUTMSGS),
-        SNMP_MIB_ITEM("OutErrors", ICMP_MIB_OUTERRORS),
-        SNMP_MIB_SENTINEL
-};
-
 static struct {
         char *name;
         int index;
@@ -312,7 +293,7 @@ static void icmp_put(struct seq_file *seq)
         for (i=0; icmpmibmap[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
                         snmp_fold_field((void **) icmpmsg_statistics,
-                                icmpmibmap[i].index));
+                                icmpmibmap[i].index | 0x100));
 }
 
 /*
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 3916faca3afe..66b42f547bf9 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -760,6 +760,8 @@ static int raw_ioctl(struct sock *sk, int cmd, unsigned long arg)
         }
 }
 
+DEFINE_PROTO_INUSE(raw)
+
 struct proto raw_prot = {
         .name              = "RAW",
         .owner             = THIS_MODULE,
@@ -781,6 +783,7 @@ struct proto raw_prot = {
         .compat_setsockopt = compat_raw_setsockopt,
         .compat_getsockopt = compat_raw_getsockopt,
 #endif
+        REF_PROTO_INUSE(raw)
 };
 
 #ifdef CONFIG_PROC_FS
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 2e6ad6dbba6c..8e65182f7af1 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2453,14 +2453,14 @@ void __init tcp_init(void)
                                         0,
                                         &tcp_hashinfo.ehash_size,
                                         NULL,
-                                        0);
+                                        thash_entries ? 0 : 512 * 1024);
         tcp_hashinfo.ehash_size = 1 << tcp_hashinfo.ehash_size;
         for (i = 0; i < tcp_hashinfo.ehash_size; i++) {
-                rwlock_init(&tcp_hashinfo.ehash[i].lock);
                 INIT_HLIST_HEAD(&tcp_hashinfo.ehash[i].chain);
                 INIT_HLIST_HEAD(&tcp_hashinfo.ehash[i].twchain);
         }
-
+        if (inet_ehash_locks_alloc(&tcp_hashinfo))
+                panic("TCP: failed to alloc ehash_locks");
         tcp_hashinfo.bhash =
                 alloc_large_system_hash("TCP bind",
                                         sizeof(struct inet_bind_hashbucket),
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index 3904d2158a92..2fbcc7d1b1a0 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -56,3 +56,4 @@ static void __exit tcp_diag_exit(void)
 module_init(tcp_diag_init);
 module_exit(tcp_diag_exit);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_NETLINK, NETLINK_INET_DIAG, TCPDIAG_GETSOCK);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 9288220b73a8..ca9590f4f520 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -103,7 +103,7 @@ int sysctl_tcp_abc __read_mostly;
 #define FLAG_SLOWPATH           0x100 /* Do not skip RFC checks for window update.*/
 #define FLAG_ONLY_ORIG_SACKED   0x200 /* SACKs only non-rexmit sent before RTO */
 #define FLAG_SND_UNA_ADVANCED   0x400 /* Snd_una was changed (!= FLAG_DATA_ACKED) */
-#define FLAG_DSACKING_ACK       0x800 /* SACK blocks contained DSACK info */
+#define FLAG_DSACKING_ACK       0x800 /* SACK blocks contained D-SACK info */
 #define FLAG_NONHEAD_RETRANS_ACKED      0x1000 /* Non-head rexmitted data was ACKed */
 
 #define FLAG_ACKED              (FLAG_DATA_ACKED|FLAG_SYN_ACKED)
@@ -866,7 +866,7 @@ static void tcp_disable_fack(struct tcp_sock *tp)
         tp->rx_opt.sack_ok &= ~2;
 }
 
-/* Take a notice that peer is sending DSACKs */
+/* Take a notice that peer is sending D-SACKs */
 static void tcp_dsack_seen(struct tcp_sock *tp)
 {
         tp->rx_opt.sack_ok |= 4;
@@ -1058,7 +1058,7 @@ static void tcp_update_reordering(struct sock *sk, const int metric,
  *
  * With D-SACK the lower bound is extended to cover sequence space below
  * SND.UNA down to undo_marker, which is the last point of interest. Yet
- * again, DSACK block must not to go across snd_una (for the same reason as
+ * again, D-SACK block must not to go across snd_una (for the same reason as
  * for the normal SACK blocks, explained above). But there all simplicity
  * ends, TCP might receive valid D-SACKs below that. As long as they reside
  * fully below undo_marker they do not affect behavior in anyway and can
@@ -1080,7 +1080,7 @@ static int tcp_is_sackblock_valid(struct tcp_sock *tp, int is_dsack,
         if (!before(start_seq, tp->snd_nxt))
                 return 0;
 
-        /* In outstanding window? ...This is valid exit for DSACKs too.
+        /* In outstanding window? ...This is valid exit for D-SACKs too.
          * start_seq == snd_una is non-sensical (see comments above)
          */
         if (after(start_seq, tp->snd_una))
@@ -1204,8 +1204,8 @@ static int tcp_check_dsack(struct tcp_sock *tp, struct sk_buff *ack_skb,
  * which may fail and creates some hassle (caller must handle error case
  * returns).
  */
-int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
-                          u32 start_seq, u32 end_seq)
+static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
+                                 u32 start_seq, u32 end_seq)
 {
         int in_sack, err;
         unsigned int pkt_len;
@@ -1248,6 +1248,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
         int cached_fack_count;
         int i;
         int first_sack_index;
+        int force_one_sack;
 
         if (!tp->sacked_out) {
                 if (WARN_ON(tp->fackets_out))
@@ -1272,18 +1273,18 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
          * if the only SACK change is the increase of the end_seq of
          * the first block then only apply that SACK block
          * and use retrans queue hinting otherwise slowpath */
-        flag = 1;
+        force_one_sack = 1;
         for (i = 0; i < num_sacks; i++) {
                 __be32 start_seq = sp[i].start_seq;
                 __be32 end_seq = sp[i].end_seq;
 
                 if (i == 0) {
                         if (tp->recv_sack_cache[i].start_seq != start_seq)
-                                flag = 0;
+                                force_one_sack = 0;
                 } else {
                         if ((tp->recv_sack_cache[i].start_seq != start_seq) ||
                             (tp->recv_sack_cache[i].end_seq != end_seq))
-                                flag = 0;
+                                force_one_sack = 0;
                 }
                 tp->recv_sack_cache[i].start_seq = start_seq;
                 tp->recv_sack_cache[i].end_seq = end_seq;
@@ -1295,7 +1296,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
         }
 
         first_sack_index = 0;
-        if (flag)
+        if (force_one_sack)
                 num_sacks = 1;
         else {
                 int j;
@@ -1321,9 +1322,6 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                 }
         }
 
-        /* clear flag as used for different purpose in following code */
-        flag = 0;
-
         /* Use SACK fastpath hint if valid */
         cached_skb = tp->fastpath_skb_hint;
         cached_fack_count = tp->fastpath_cnt_hint;
@@ -1332,12 +1330,15 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                 cached_fack_count = 0;
         }
 
-        for (i=0; i<num_sacks; i++, sp++) {
+        for (i = 0; i < num_sacks; i++) {
                 struct sk_buff *skb;
                 __u32 start_seq = ntohl(sp->start_seq);
                 __u32 end_seq = ntohl(sp->end_seq);
                 int fack_count;
                 int dup_sack = (found_dup_sack && (i == first_sack_index));
+                int next_dup = (found_dup_sack && (i+1 == first_sack_index));
+
+                sp++;
 
                 if (!tcp_is_sackblock_valid(tp, dup_sack, start_seq, end_seq)) {
                         if (dup_sack) {
@@ -1363,7 +1364,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                         flag |= FLAG_DATA_LOST;
 
                 tcp_for_write_queue_from(skb, sk) {
-                        int in_sack;
+                        int in_sack = 0;
                         u8 sacked;
 
                         if (skb == tcp_send_head(sk))
@@ -1382,7 +1383,23 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                         if (!before(TCP_SKB_CB(skb)->seq, end_seq))
                                 break;
 
-                        in_sack = tcp_match_skb_to_sack(sk, skb, start_seq, end_seq);
+                        dup_sack = (found_dup_sack && (i == first_sack_index));
+
+                        /* Due to sorting DSACK may reside within this SACK block! */
+                        if (next_dup) {
+                                u32 dup_start = ntohl(sp->start_seq);
+                                u32 dup_end = ntohl(sp->end_seq);
+
+                                if (before(TCP_SKB_CB(skb)->seq, dup_end)) {
+                                        in_sack = tcp_match_skb_to_sack(sk, skb, dup_start, dup_end);
+                                        if (in_sack > 0)
+                                                dup_sack = 1;
+                                }
+                        }
+
+                        /* DSACK info lost if out-of-mem, try SACK still */
+                        if (in_sack <= 0)
+                                in_sack = tcp_match_skb_to_sack(sk, skb, start_seq, end_seq);
                         if (in_sack < 0)
                                 break;
 
@@ -1615,7 +1632,7 @@ void tcp_enter_frto(struct sock *sk)
              !icsk->icsk_retransmits)) {
                 tp->prior_ssthresh = tcp_current_ssthresh(sk);
                 /* Our state is too optimistic in ssthresh() call because cwnd
-                 * is not reduced until tcp_enter_frto_loss() when previous FRTO
+                 * is not reduced until tcp_enter_frto_loss() when previous F-RTO
                  * recovery has not yet completed. Pattern would be this: RTO,
                  * Cumulative ACK, RTO (2xRTO for the same segment does not end
                  * up here twice).
@@ -1801,7 +1818,7 @@ void tcp_enter_loss(struct sock *sk, int how)
         tcp_set_ca_state(sk, TCP_CA_Loss);
         tp->high_seq = tp->snd_nxt;
         TCP_ECN_queue_cwr(tp);
-        /* Abort FRTO algorithm if one is in progress */
+        /* Abort F-RTO algorithm if one is in progress */
         tp->frto_counter = 0;
 }
 
@@ -1946,7 +1963,7 @@ static int tcp_time_to_recover(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
         __u32 packets_out;
 
-        /* Do not perform any recovery during FRTO algorithm */
+        /* Do not perform any recovery during F-RTO algorithm */
         if (tp->frto_counter)
                 return 0;
 
@@ -2061,7 +2078,7 @@ static void tcp_update_scoreboard(struct sock *sk)
                         if (!tcp_skb_timedout(sk, skb))
                                 break;
 
-                        if (!(TCP_SKB_CB(skb)->sacked&TCPCB_TAGBITS)) {
+                        if (!(TCP_SKB_CB(skb)->sacked & (TCPCB_SACKED_ACKED|TCPCB_LOST))) {
                                 TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
                                 tp->lost_out += tcp_skb_pcount(skb);
                                 tcp_verify_retransmit_hint(tp, skb);
@@ -2962,7 +2979,7 @@ static int tcp_process_frto(struct sock *sk, int flag)
         }
 
         if (tp->frto_counter == 1) {
-                /* Sending of the next skb must be allowed or no FRTO */
+                /* Sending of the next skb must be allowed or no F-RTO */
                 if (!tcp_send_head(sk) ||
                     after(TCP_SKB_CB(tcp_send_head(sk))->end_seq,
                                      tp->snd_una + tp->snd_wnd)) {
@@ -3909,7 +3926,7 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list,
 
         while (before(start, end)) {
                 struct sk_buff *nskb;
-                int header = skb_headroom(skb);
+                unsigned int header = skb_headroom(skb);
                 int copy = SKB_MAX_ORDER(header, 0);
 
                 /* Too big header? This can happen with IPv6. */
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 38cf73a56731..e566f3c67677 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -858,16 +858,16 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
                       u8 *newkey, u8 newkeylen)
 {
         /* Add Key to the list */
-        struct tcp4_md5sig_key *key;
+        struct tcp_md5sig_key *key;
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcp4_md5sig_key *keys;
 
-        key = (struct tcp4_md5sig_key *)tcp_v4_md5_do_lookup(sk, addr);
+        key = tcp_v4_md5_do_lookup(sk, addr);
         if (key) {
                 /* Pre-existing entry - just update that one. */
-                kfree(key->base.key);
-                key->base.key = newkey;
-                key->base.keylen = newkeylen;
+                kfree(key->key);
+                key->key = newkey;
+                key->keylen = newkeylen;
         } else {
                 struct tcp_md5sig_info *md5sig;
 
@@ -1055,6 +1055,9 @@ static int tcp_v4_do_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
         bp->pad = 0;
         bp->protocol = protocol;
         bp->len = htons(tcplen);
+
+        sg_init_table(sg, 4);
+
         sg_set_buf(&sg[block++], bp, sizeof(*bp));
         nbytes += sizeof(*bp);
 
@@ -1080,6 +1083,8 @@ static int tcp_v4_do_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
         sg_set_buf(&sg[block++], key->key, key->keylen);
         nbytes += key->keylen;
 
+        sg_mark_end(&sg[block - 1]);
+
         /* Now store the Hash into the packet */
         err = crypto_hash_init(desc);
         if (err)
@@ -2044,8 +2049,9 @@ static void *established_get_first(struct seq_file *seq)
                 struct sock *sk;
                 struct hlist_node *node;
                 struct inet_timewait_sock *tw;
+                rwlock_t *lock = inet_ehash_lockp(&tcp_hashinfo, st->bucket);
 
-                read_lock_bh(&tcp_hashinfo.ehash[st->bucket].lock);
+                read_lock_bh(lock);
                 sk_for_each(sk, node, &tcp_hashinfo.ehash[st->bucket].chain) {
                         if (sk->sk_family != st->family) {
                                 continue;
@@ -2062,7 +2068,7 @@ static void *established_get_first(struct seq_file *seq)
                         rc = tw;
                         goto out;
                 }
-                read_unlock_bh(&tcp_hashinfo.ehash[st->bucket].lock);
+                read_unlock_bh(lock);
                 st->state = TCP_SEQ_STATE_ESTABLISHED;
         }
 out:
@@ -2089,11 +2095,11 @@ get_tw:
                         cur = tw;
                         goto out;
                 }
-                read_unlock_bh(&tcp_hashinfo.ehash[st->bucket].lock);
+                read_unlock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket));
                 st->state = TCP_SEQ_STATE_ESTABLISHED;
 
                 if (++st->bucket < tcp_hashinfo.ehash_size) {
-                        read_lock_bh(&tcp_hashinfo.ehash[st->bucket].lock);
+                        read_lock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket));
                         sk = sk_head(&tcp_hashinfo.ehash[st->bucket].chain);
                 } else {
                         cur = NULL;
@@ -2201,7 +2207,7 @@ static void tcp_seq_stop(struct seq_file *seq, void *v)
         case TCP_SEQ_STATE_TIME_WAIT:
         case TCP_SEQ_STATE_ESTABLISHED:
                 if (v)
-                        read_unlock_bh(&tcp_hashinfo.ehash[st->bucket].lock);
+                        read_unlock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket));
                 break;
         }
 }
@@ -2412,6 +2418,8 @@ void tcp4_proc_exit(void)
 }
 #endif /* CONFIG_PROC_FS */
 
+DEFINE_PROTO_INUSE(tcp)
+
 struct proto tcp_prot = {
         .name                   = "TCP",
         .owner                  = THIS_MODULE,
@@ -2446,6 +2454,7 @@ struct proto tcp_prot = {
         .compat_setsockopt      = compat_tcp_setsockopt,
         .compat_getsockopt      = compat_tcp_getsockopt,
 #endif
+        REF_PROTO_INUSE(tcp)
 };
 
 void __init tcp_v4_init(struct net_proto_family *ops)
diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
index b49dedcda52d..007304e99842 100644
--- a/net/ipv4/tcp_vegas.c
+++ b/net/ipv4/tcp_vegas.c
@@ -266,26 +266,25 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack,
                          */
                         diff = (old_wnd << V_PARAM_SHIFT) - target_cwnd;
 
-                        if (tp->snd_cwnd <= tp->snd_ssthresh) {
-                                /* Slow start.  */
-                                if (diff > gamma) {
-                                        /* Going too fast. Time to slow down
-                                         * and switch to congestion avoidance.
-                                         */
-                                        tp->snd_ssthresh = 2;
-
-                                        /* Set cwnd to match the actual rate
-                                         * exactly:
-                                         *   cwnd = (actual rate) * baseRTT
-                                         * Then we add 1 because the integer
-                                         * truncation robs us of full link
-                                         * utilization.
-                                         */
-                                        tp->snd_cwnd = min(tp->snd_cwnd,
-                                                           (target_cwnd >>
-                                                            V_PARAM_SHIFT)+1);
+                        if (diff > gamma && tp->snd_ssthresh > 2 ) {
+                                /* Going too fast. Time to slow down
+                                 * and switch to congestion avoidance.
+                                 */
+                                tp->snd_ssthresh = 2;
+
+                                /* Set cwnd to match the actual rate
+                                 * exactly:
+                                 *   cwnd = (actual rate) * baseRTT
+                                 * Then we add 1 because the integer
+                                 * truncation robs us of full link
+                                 * utilization.
+                                 */
+                                tp->snd_cwnd = min(tp->snd_cwnd,
+                                                   (target_cwnd >>
+                                                    V_PARAM_SHIFT)+1);
 
-                                }
+                        } else if (tp->snd_cwnd <= tp->snd_ssthresh) {
+                                /* Slow start.  */
                                 tcp_slow_start(tp);
                         } else {
                                 /* Congestion avoidance. */
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 35d2b0e9e10b..03c400ca14c5 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1152,7 +1152,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
                 return __udp4_lib_mcast_deliver(skb, uh, saddr, daddr, udptable);
 
         sk = __udp4_lib_lookup(saddr, uh->source, daddr, uh->dest,
-                               skb->dev->ifindex, udptable        );
+                               inet_iif(skb), udptable);
 
         if (sk != NULL) {
                 int ret = udp_queue_rcv_skb(sk, skb);
@@ -1430,6 +1430,8 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
 
 }
 
+DEFINE_PROTO_INUSE(udp)
+
 struct proto udp_prot = {
         .name              = "UDP",
         .owner             = THIS_MODULE,
@@ -1452,6 +1454,7 @@ struct proto udp_prot = {
         .compat_setsockopt = compat_udp_setsockopt,
         .compat_getsockopt = compat_udp_getsockopt,
 #endif
+        REF_PROTO_INUSE(udp)
 };
 
 /* ------------------------------------------------------------------------ */
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index 94977205abb4..f5baeb3e8b85 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -44,6 +44,8 @@ static	struct net_protocol udplite_protocol = {
         .no_policy      = 1,
 };
 
+DEFINE_PROTO_INUSE(udplite)
+
 struct proto    udplite_prot = {
         .name              = "UDP-Lite",
         .owner             = THIS_MODULE,
@@ -67,6 +69,7 @@ struct proto 	udplite_prot = {
         .compat_setsockopt = compat_udp_setsockopt,
         .compat_getsockopt = compat_udp_getsockopt,
 #endif
+        REF_PROTO_INUSE(udplite)
 };
 
 static struct inet_protosw udplite4_protosw = {
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 348bd8d06112..1bd8d818f8e9 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4288,8 +4288,4 @@ void __exit addrconf_cleanup(void)
         del_timer(&addr_chk_timer);
 
         rtnl_unlock();
-
-#ifdef CONFIG_PROC_FS
-        proc_net_remove(&init_net, "if_inet6");
-#endif
 }
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 1b1caf3aa1c1..ecbd38894fdd 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -162,7 +162,7 @@ lookup_protocol:
         BUG_TRAP(answer_prot->slab != NULL);
 
         err = -ENOBUFS;
-        sk = sk_alloc(net, PF_INET6, GFP_KERNEL, answer_prot, 1);
+        sk = sk_alloc(net, PF_INET6, GFP_KERNEL, answer_prot);
         if (sk == NULL)
                 goto out;
 
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 67cd06613a25..4eaf55072b1b 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -35,7 +35,6 @@
 #include <net/ipv6.h>
 #include <net/protocol.h>
 #include <net/xfrm.h>
-#include <asm/scatterlist.h>
 
 static int zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
 {
@@ -483,6 +482,7 @@ static int ah6_init_state(struct xfrm_state *x)
                 break;
         case XFRM_MODE_TUNNEL:
                 x->props.header_len += sizeof(struct ipv6hdr);
+                break;
         default:
                 goto error;
         }
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index b0715432e454..7db66f10e00d 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -29,7 +29,7 @@
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/esp.h>
-#include <asm/scatterlist.h>
+#include <linux/scatterlist.h>
 #include <linux/crypto.h>
 #include <linux/kernel.h>
 #include <linux/pfkeyv2.h>
@@ -109,7 +109,11 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
                         if (!sg)
                                 goto unlock;
                 }
-                skb_to_sgvec(skb, sg, esph->enc_data+esp->conf.ivlen-skb->data, clen);
+                sg_init_table(sg, nfrags);
+                skb_to_sgvec(skb, sg,
+                             esph->enc_data +
+                             esp->conf.ivlen -
+                             skb->data, clen);
                 err = crypto_blkcipher_encrypt(&desc, sg, sg, clen);
                 if (unlikely(sg != &esp->sgbuf[0]))
                         kfree(sg);
@@ -205,7 +209,10 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
                                 goto out;
                         }
                 }
-                skb_to_sgvec(skb, sg, sizeof(*esph) + esp->conf.ivlen, elen);
+                sg_init_table(sg, nfrags);
+                skb_to_sgvec(skb, sg,
+                             sizeof(*esph) + esp->conf.ivlen,
+                             elen);
                 ret = crypto_blkcipher_decrypt(&desc, sg, sg, elen);
                 if (unlikely(sg != &esp->sgbuf[0]))
                         kfree(sg);
@@ -360,6 +367,7 @@ static int esp6_init_state(struct xfrm_state *x)
                 break;
         case XFRM_MODE_TUNNEL:
                 x->props.header_len += sizeof(struct ipv6hdr);
+                break;
         default:
                 goto error;
         }
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index d6f1026f1943..adc73adadfae 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -37,9 +37,8 @@ void __inet6_hash(struct inet_hashinfo *hashinfo,
         } else {
                 unsigned int hash;
                 sk->sk_hash = hash = inet6_sk_ehashfn(sk);
-                hash &= (hashinfo->ehash_size - 1);
-                list = &hashinfo->ehash[hash].chain;
-                lock = &hashinfo->ehash[hash].lock;
+                list = &inet_ehash_bucket(hashinfo, hash)->chain;
+                lock = inet_ehash_lockp(hashinfo, hash);
                 write_lock(lock);
         }
 
@@ -70,9 +69,10 @@ struct sock *__inet6_lookup_established(struct inet_hashinfo *hashinfo,
          */
         unsigned int hash = inet6_ehashfn(daddr, hnum, saddr, sport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hashinfo, hash);
+        rwlock_t *lock = inet_ehash_lockp(hashinfo, hash);
 
         prefetch(head->chain.first);
-        read_lock(&head->lock);
+        read_lock(lock);
         sk_for_each(sk, node, &head->chain) {
                 /* For IPV6 do the cheaper port and family tests first. */
                 if (INET6_MATCH(sk, hash, saddr, daddr, ports, dif))
@@ -92,12 +92,12 @@ struct sock *__inet6_lookup_established(struct inet_hashinfo *hashinfo,
                                 goto hit;
                 }
         }
-        read_unlock(&head->lock);
+        read_unlock(lock);
         return NULL;
 
 hit:
         sock_hold(sk);
-        read_unlock(&head->lock);
+        read_unlock(lock);
         return sk;
 }
 EXPORT_SYMBOL(__inet6_lookup_established);
@@ -175,12 +175,13 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         const unsigned int hash = inet6_ehashfn(daddr, lport, saddr,
                                                 inet->dport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
+        rwlock_t *lock = inet_ehash_lockp(hinfo, hash);
         struct sock *sk2;
         const struct hlist_node *node;
         struct inet_timewait_sock *tw;
 
         prefetch(head->chain.first);
-        write_lock(&head->lock);
+        write_lock(lock);
 
         /* Check TIME-WAIT sockets first. */
         sk_for_each(sk2, node, &head->twchain) {
@@ -216,7 +217,7 @@ unique:
         __sk_add_node(sk, &head->chain);
         sk->sk_hash = hash;
         sock_prot_inc_use(sk->sk_prot);
-        write_unlock(&head->lock);
+        write_unlock(lock);
 
         if (twp != NULL) {
                 *twp = tw;
@@ -231,7 +232,7 @@ unique:
         return 0;
 
 not_unique:
-        write_unlock(&head->lock);
+        write_unlock(lock);
         return -EADDRNOTAVAIL;
 }
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 13565dfb1b45..86e1835ce4e4 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -171,7 +171,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         u32 mtu;
 
         if (opt) {
-                int head_room;
+                unsigned int head_room;
 
                 /* First: exthdrs may take lots of space (~8K for now)
                    MAX_HEADER is not enough.
@@ -1339,6 +1339,19 @@ error:
         return err;
 }
 
+static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
+{
+        inet->cork.flags &= ~IPCORK_OPT;
+        kfree(np->cork.opt);
+        np->cork.opt = NULL;
+        if (np->cork.rt) {
+                dst_release(&np->cork.rt->u.dst);
+                np->cork.rt = NULL;
+                inet->cork.flags &= ~IPCORK_ALLFRAG;
+        }
+        memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
+}
+
 int ip6_push_pending_frames(struct sock *sk)
 {
         struct sk_buff *skb, *tmp_skb;
@@ -1415,15 +1428,7 @@ int ip6_push_pending_frames(struct sock *sk)
         }
 
 out:
-        inet->cork.flags &= ~IPCORK_OPT;
-        kfree(np->cork.opt);
-        np->cork.opt = NULL;
-        if (np->cork.rt) {
-                dst_release(&np->cork.rt->u.dst);
-                np->cork.rt = NULL;
-                inet->cork.flags &= ~IPCORK_ALLFRAG;
-        }
-        memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
+        ip6_cork_release(inet, np);
         return err;
 error:
         goto out;
@@ -1431,8 +1436,6 @@ error:
 
 void ip6_flush_pending_frames(struct sock *sk)
 {
-        struct inet_sock *inet = inet_sk(sk);
-        struct ipv6_pinfo *np = inet6_sk(sk);
         struct sk_buff *skb;
 
         while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
@@ -1442,14 +1445,5 @@ void ip6_flush_pending_frames(struct sock *sk)
                 kfree_skb(skb);
         }
 
-        inet->cork.flags &= ~IPCORK_OPT;
-
-        kfree(np->cork.opt);
-        np->cork.opt = NULL;
-        if (np->cork.rt) {
-                dst_release(&np->cork.rt->u.dst);
-                np->cork.rt = NULL;
-                inet->cork.flags &= ~IPCORK_ALLFRAG;
-        }
-        memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
+        ip6_cork_release(inet_sk(sk), inet6_sk(sk));
 }
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 2320cc27ff9e..5383b33db8ca 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -838,7 +838,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
         struct dst_entry *dst;
         struct net_device *tdev;
         int mtu;
-        int max_headroom = sizeof(struct ipv6hdr);
+        unsigned int max_headroom = sizeof(struct ipv6hdr);
         u8 proto;
         int err = -1;
         int pkt_len;
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 80ef2a1d39fd..0cd4056f9127 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -34,9 +34,9 @@
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/ipcomp.h>
-#include <asm/scatterlist.h>
 #include <asm/semaphore.h>
 #include <linux/crypto.h>
+#include <linux/err.h>
 #include <linux/pfkeyv2.h>
 #include <linux/random.h>
 #include <linux/percpu.h>
@@ -359,7 +359,7 @@ static struct crypto_comp **ipcomp6_alloc_tfms(const char *alg_name)
         for_each_possible_cpu(cpu) {
                 struct crypto_comp *tfm = crypto_alloc_comp(alg_name, 0,
                                                             CRYPTO_ALG_ASYNC);
-                if (!tfm)
+                if (IS_ERR(tfm))
                         goto error;
                 *per_cpu_ptr(tfms, cpu) = tfm;
         }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 20cfc90d5597..36f7dbfb6dbb 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1670,7 +1670,7 @@ int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, struct file * f
                                             filp, buffer, lenp, ppos);
 
         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
-                 (strcmp(ctl->procname, "base_reacable_time_ms") == 0))
+                 (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
                 ret = proc_dointvec_ms_jiffies(ctl, write,
                                                filp, buffer, lenp, ppos);
         else
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index 4513eab77397..e789ec44d23b 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -4,25 +4,29 @@
 
 # Link order matters here.
 obj-$(CONFIG_IP6_NF_IPTABLES) += ip6_tables.o
-obj-$(CONFIG_IP6_NF_MATCH_RT) += ip6t_rt.o
-obj-$(CONFIG_IP6_NF_MATCH_OPTS) += ip6t_hbh.o
-obj-$(CONFIG_IP6_NF_MATCH_IPV6HEADER) += ip6t_ipv6header.o
-obj-$(CONFIG_IP6_NF_MATCH_FRAG) += ip6t_frag.o
-obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o
-obj-$(CONFIG_IP6_NF_MATCH_EUI64) += ip6t_eui64.o
-obj-$(CONFIG_IP6_NF_MATCH_OWNER) += ip6t_owner.o
 obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
 obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
-obj-$(CONFIG_IP6_NF_TARGET_HL) += ip6t_HL.o
 obj-$(CONFIG_IP6_NF_QUEUE) += ip6_queue.o
-obj-$(CONFIG_IP6_NF_TARGET_LOG) += ip6t_LOG.o
 obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
-obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
-obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o
-obj-$(CONFIG_IP6_NF_MATCH_MH) += ip6t_mh.o
 
 # objects for l3 independent conntrack
 nf_conntrack_ipv6-objs  :=  nf_conntrack_l3proto_ipv6.o nf_conntrack_proto_icmpv6.o nf_conntrack_reasm.o
 
 # l3 independent conntrack
 obj-$(CONFIG_NF_CONNTRACK_IPV6) += nf_conntrack_ipv6.o
+
+# matches
+obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o
+obj-$(CONFIG_IP6_NF_MATCH_EUI64) += ip6t_eui64.o
+obj-$(CONFIG_IP6_NF_MATCH_FRAG) += ip6t_frag.o
+obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
+obj-$(CONFIG_IP6_NF_MATCH_IPV6HEADER) += ip6t_ipv6header.o
+obj-$(CONFIG_IP6_NF_MATCH_MH) += ip6t_mh.o
+obj-$(CONFIG_IP6_NF_MATCH_OPTS) += ip6t_hbh.o
+obj-$(CONFIG_IP6_NF_MATCH_OWNER) += ip6t_owner.o
+obj-$(CONFIG_IP6_NF_MATCH_RT) += ip6t_rt.o
+
+# targets
+obj-$(CONFIG_IP6_NF_TARGET_HL) += ip6t_HL.o
+obj-$(CONFIG_IP6_NF_TARGET_LOG) += ip6t_LOG.o
+obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 6413a30d9f68..e273605eef85 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -23,6 +23,7 @@
 #include <linux/spinlock.h>
 #include <linux/sysctl.h>
 #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <linux/mutex.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -596,15 +597,11 @@ static ctl_table ipq_root_table[] = {
         { .ctl_name = 0 }
 };
 
-#ifdef CONFIG_PROC_FS
-static int
-ipq_get_info(char *buffer, char **start, off_t offset, int length)
+static int ip6_queue_show(struct seq_file *m, void *v)
 {
-        int len;
-
         read_lock_bh(&queue_lock);
 
-        len = sprintf(buffer,
+        seq_printf(m,
                       "Peer PID          : %d\n"
                       "Copy mode         : %hu\n"
                       "Copy range        : %u\n"
@@ -621,16 +618,21 @@ ipq_get_info(char *buffer, char **start, off_t offset, int length)
                       queue_user_dropped);
 
         read_unlock_bh(&queue_lock);
+        return 0;
+}
 
-        *start = buffer + offset;
-        len -= offset;
-        if (len > length)
-                len = length;
-        else if (len < 0)
-                len = 0;
-        return len;
+static int ip6_queue_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, ip6_queue_show, NULL);
 }
-#endif /* CONFIG_PROC_FS */
+
+static const struct file_operations ip6_queue_proc_fops = {
+        .open           = ip6_queue_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+        .owner          = THIS_MODULE,
+};
 
 static struct nf_queue_handler nfqh = {
         .name   = "ip6_queue",
@@ -650,10 +652,11 @@ static int __init ip6_queue_init(void)
                 goto cleanup_netlink_notifier;
         }
 
-        proc = proc_net_create(&init_net, IPQ_PROC_FS_NAME, 0, ipq_get_info);
-        if (proc)
+        proc = create_proc_entry(IPQ_PROC_FS_NAME, 0, init_net.proc_net);
+        if (proc) {
                 proc->owner = THIS_MODULE;
-        else {
+                proc->proc_fops = &ip6_queue_proc_fops;
+        } else {
                 printk(KERN_ERR "ip6_queue: failed to create proc entry\n");
                 goto cleanup_ipqnl;
         }
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index be526ad92543..8631ed7fe8a9 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -32,27 +32,16 @@
 
 static struct proc_dir_entry *proc_net_devsnmp6;
 
-static int fold_prot_inuse(struct proto *proto)
-{
-        int res = 0;
-        int cpu;
-
-        for_each_possible_cpu(cpu)
-                res += proto->stats[cpu].inuse;
-
-        return res;
-}
-
 static int sockstat6_seq_show(struct seq_file *seq, void *v)
 {
         seq_printf(seq, "TCP6: inuse %d\n",
-                       fold_prot_inuse(&tcpv6_prot));
+                       sock_prot_inuse(&tcpv6_prot));
         seq_printf(seq, "UDP6: inuse %d\n",
-                       fold_prot_inuse(&udpv6_prot));
+                       sock_prot_inuse(&udpv6_prot));
         seq_printf(seq, "UDPLITE6: inuse %d\n",
-                        fold_prot_inuse(&udplitev6_prot));
+                        sock_prot_inuse(&udplitev6_prot));
         seq_printf(seq, "RAW6: inuse %d\n",
-                       fold_prot_inuse(&rawv6_prot));
+                       sock_prot_inuse(&rawv6_prot));
         seq_printf(seq, "FRAG6: inuse %d memory %d\n",
                        ip6_frag_nqueues(), ip6_frag_mem());
         return 0;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index ca24ef19cd8f..807260d03586 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1144,6 +1144,8 @@ static int rawv6_init_sk(struct sock *sk)
         return(0);
 }
 
+DEFINE_PROTO_INUSE(rawv6)
+
 struct proto rawv6_prot = {
         .name              = "RAWv6",
         .owner             = THIS_MODULE,
@@ -1166,6 +1168,7 @@ struct proto rawv6_prot = {
         .compat_setsockopt = compat_rawv6_setsockopt,
         .compat_getsockopt = compat_rawv6_getsockopt,
 #endif
+        REF_PROTO_INUSE(rawv6)
 };
 
 #ifdef CONFIG_PROC_FS
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 95f8e4a62f68..973a97abc446 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -38,12 +38,8 @@
 #include <linux/in6.h>
 #include <linux/init.h>
 #include <linux/if_arp.h>
-
-#ifdef  CONFIG_PROC_FS
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
-#endif
-
 #include <net/net_namespace.h>
 #include <net/snmp.h>
 #include <net/ipv6.h>
@@ -2288,71 +2284,50 @@ struct rt6_proc_arg
 
 static int rt6_info_route(struct rt6_info *rt, void *p_arg)
 {
-        struct rt6_proc_arg *arg = (struct rt6_proc_arg *) p_arg;
+        struct seq_file *m = p_arg;
 
-        if (arg->skip < arg->offset / RT6_INFO_LEN) {
-                arg->skip++;
-                return 0;
-        }
-
-        if (arg->len >= arg->length)
-                return 0;
-
-        arg->len += sprintf(arg->buffer + arg->len,
-                            NIP6_SEQFMT " %02x ",
-                            NIP6(rt->rt6i_dst.addr),
-                            rt->rt6i_dst.plen);
+        seq_printf(m, NIP6_SEQFMT " %02x ", NIP6(rt->rt6i_dst.addr),
+                   rt->rt6i_dst.plen);
 
 #ifdef CONFIG_IPV6_SUBTREES
-        arg->len += sprintf(arg->buffer + arg->len,
-                            NIP6_SEQFMT " %02x ",
-                            NIP6(rt->rt6i_src.addr),
-                            rt->rt6i_src.plen);
+        seq_printf(m, NIP6_SEQFMT " %02x ", NIP6(rt->rt6i_src.addr),
+                   rt->rt6i_src.plen);
 #else
-        arg->len += sprintf(arg->buffer + arg->len,
-                            "00000000000000000000000000000000 00 ");
+        seq_puts(m, "00000000000000000000000000000000 00 ");
 #endif
 
         if (rt->rt6i_nexthop) {
-                arg->len += sprintf(arg->buffer + arg->len,
-                                    NIP6_SEQFMT,
-                                    NIP6(*((struct in6_addr *)rt->rt6i_nexthop->primary_key)));
+                seq_printf(m, NIP6_SEQFMT,
+                           NIP6(*((struct in6_addr *)rt->rt6i_nexthop->primary_key)));
         } else {
-                arg->len += sprintf(arg->buffer + arg->len,
-                                    "00000000000000000000000000000000");
+                seq_puts(m, "00000000000000000000000000000000");
         }
-        arg->len += sprintf(arg->buffer + arg->len,
-                            " %08x %08x %08x %08x %8s\n",
-                            rt->rt6i_metric, atomic_read(&rt->u.dst.__refcnt),
-                            rt->u.dst.__use, rt->rt6i_flags,
-                            rt->rt6i_dev ? rt->rt6i_dev->name : "");
+        seq_printf(m, " %08x %08x %08x %08x %8s\n",
+                   rt->rt6i_metric, atomic_read(&rt->u.dst.__refcnt),
+                   rt->u.dst.__use, rt->rt6i_flags,
+                   rt->rt6i_dev ? rt->rt6i_dev->name : "");
         return 0;
 }
 
-static int rt6_proc_info(char *buffer, char **start, off_t offset, int length)
+static int ipv6_route_show(struct seq_file *m, void *v)
 {
-        struct rt6_proc_arg arg = {
-                .buffer = buffer,
-                .offset = offset,
-                .length = length,
-        };
-
-        fib6_clean_all(rt6_info_route, 0, &arg);
-
-        *start = buffer;
-        if (offset)
-                *start += offset % RT6_INFO_LEN;
-
-        arg.len -= offset % RT6_INFO_LEN;
-
-        if (arg.len > length)
-                arg.len = length;
-        if (arg.len < 0)
-                arg.len = 0;
+        fib6_clean_all(rt6_info_route, 0, m);
+        return 0;
+}
 
-        return arg.len;
+static int ipv6_route_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, ipv6_route_show, NULL);
 }
 
+static const struct file_operations ipv6_route_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = ipv6_route_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
 static int rt6_stats_seq_show(struct seq_file *seq, void *v)
 {
         seq_printf(seq, "%04x %04x %04x %04x %04x %04x %04x\n",
@@ -2489,22 +2464,14 @@ ctl_table ipv6_route_table[] = {
 
 void __init ip6_route_init(void)
 {
-#ifdef  CONFIG_PROC_FS
-        struct proc_dir_entry *p;
-#endif
         ip6_dst_ops.kmem_cachep =
                 kmem_cache_create("ip6_dst_cache", sizeof(struct rt6_info), 0,
                                   SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
         ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops.kmem_cachep;
 
         fib6_init();
-#ifdef  CONFIG_PROC_FS
-        p = proc_net_create(&init_net, "ipv6_route", 0, rt6_proc_info);
-        if (p)
-                p->owner = THIS_MODULE;
-
+        proc_net_fops_create(&init_net, "ipv6_route", 0, &ipv6_route_proc_fops);
         proc_net_fops_create(&init_net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
-#endif
 #ifdef CONFIG_XFRM
         xfrm6_init();
 #endif
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 466657a9a8bd..71433d29d884 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -430,7 +430,7 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         struct rtable *rt;                      /* Route to the other host */
         struct net_device *tdev;                        /* Device to other host */
         struct iphdr  *iph;                     /* Our new IP header */
-        int    max_headroom;                    /* The extra header space needed */
+        unsigned int max_headroom;              /* The extra header space needed */
         __be32 dst = tiph->daddr;
         int    mtu;
         struct in6_addr *addr6;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 737b755342bd..3aad861975a0 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -59,6 +59,7 @@
 #include <net/snmp.h>
 #include <net/dsfield.h>
 #include <net/timewait_sock.h>
+#include <net/netdma.h>
 
 #include <asm/uaccess.h>
 
@@ -560,16 +561,16 @@ static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
                              char *newkey, u8 newkeylen)
 {
         /* Add key to the list */
-        struct tcp6_md5sig_key *key;
+        struct tcp_md5sig_key *key;
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcp6_md5sig_key *keys;
 
-        key = (struct tcp6_md5sig_key*) tcp_v6_md5_do_lookup(sk, peer);
+        key = tcp_v6_md5_do_lookup(sk, peer);
         if (key) {
                 /* modify existing entry - just update that one */
-                kfree(key->base.key);
-                key->base.key = newkey;
-                key->base.keylen = newkeylen;
+                kfree(key->key);
+                key->key = newkey;
+                key->keylen = newkeylen;
         } else {
                 /* reallocate new list if current one is full. */
                 if (!tp->md5sig_info) {
@@ -757,6 +758,8 @@ static int tcp_v6_do_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
         bp->len = htonl(tcplen);
         bp->protocol = htonl(protocol);
 
+        sg_init_table(sg, 4);
+
         sg_set_buf(&sg[block++], bp, sizeof(*bp));
         nbytes += sizeof(*bp);
 
@@ -778,6 +781,8 @@ static int tcp_v6_do_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
         sg_set_buf(&sg[block++], key->key, key->keylen);
         nbytes += key->keylen;
 
+        sg_mark_end(&sg[block - 1]);
+
         /* Now store the hash into the packet */
         err = crypto_hash_init(desc);
         if (err) {
@@ -1728,6 +1733,8 @@ process:
         if (!sock_owned_by_user(sk)) {
 #ifdef CONFIG_NET_DMA
                 struct tcp_sock *tp = tcp_sk(sk);
+                if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
+                        tp->ucopy.dma_chan = get_softnet_dma();
                 if (tp->ucopy.dma_chan)
                         ret = tcp_v6_do_rcv(sk, skb);
                 else
@@ -2100,6 +2107,8 @@ void tcp6_proc_exit(void)
 }
 #endif
 
+DEFINE_PROTO_INUSE(tcpv6)
+
 struct proto tcpv6_prot = {
         .name                   = "TCPv6",
         .owner                  = THIS_MODULE,
@@ -2134,6 +2143,7 @@ struct proto tcpv6_prot = {
         .compat_setsockopt      = compat_tcp_setsockopt,
         .compat_getsockopt      = compat_tcp_getsockopt,
 #endif
+        REF_PROTO_INUSE(tcpv6)
 };
 
 static struct inet6_protocol tcpv6_protocol = {
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index caebad6ee510..ee1cc3f8599f 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -205,12 +205,11 @@ out:
         return err;
 
 csum_copy_err:
+        UDP6_INC_STATS_USER(UDP_MIB_INERRORS, is_udplite);
         skb_kill_datagram(sk, skb, flags);
 
-        if (flags & MSG_DONTWAIT) {
-                UDP6_INC_STATS_USER(UDP_MIB_INERRORS, is_udplite);
+        if (flags & MSG_DONTWAIT)
                 return -EAGAIN;
-        }
         goto try_again;
 }
 
@@ -971,6 +970,8 @@ void udp6_proc_exit(void) {
 
 /* ------------------------------------------------------------------------ */
 
+DEFINE_PROTO_INUSE(udpv6)
+
 struct proto udpv6_prot = {
         .name              = "UDPv6",
         .owner             = THIS_MODULE,
@@ -992,6 +993,7 @@ struct proto udpv6_prot = {
         .compat_setsockopt = compat_udpv6_setsockopt,
         .compat_getsockopt = compat_udpv6_getsockopt,
 #endif
+        REF_PROTO_INUSE(udpv6)
 };
 
 static struct inet_protosw udpv6_protosw = {
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 766566f7de47..5a0379f71415 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -40,6 +40,8 @@ static int udplite_v6_get_port(struct sock *sk, unsigned short snum)
         return udplite_get_port(sk, snum, ipv6_rcv_saddr_equal);
 }
 
+DEFINE_PROTO_INUSE(udplitev6)
+
 struct proto udplitev6_prot = {
         .name              = "UDPLITEv6",
         .owner             = THIS_MODULE,
@@ -62,6 +64,7 @@ struct proto udplitev6_prot = {
         .compat_setsockopt = compat_udpv6_setsockopt,
         .compat_getsockopt = compat_udpv6_getsockopt,
 #endif
+        REF_PROTO_INUSE(udplitev6)
 };
 
 static struct inet_protosw udplite6_protosw = {
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 29b063d43120..a195a66e0cc7 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -1381,7 +1381,7 @@ static int ipx_create(struct net *net, struct socket *sock, int protocol)
                 goto out;
 
         rc = -ENOMEM;
-        sk = sk_alloc(net, PF_IPX, GFP_KERNEL, &ipx_proto, 1);
+        sk = sk_alloc(net, PF_IPX, GFP_KERNEL, &ipx_proto);
         if (!sk)
                 goto out;
 #ifdef IPX_REFCNT_DEBUG
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 0328ae2654f4..48ce59a6e026 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1078,7 +1078,7 @@ static int irda_create(struct net *net, struct socket *sock, int protocol)
         }
 
         /* Allocate networking socket */
-        sk = sk_alloc(net, PF_IRDA, GFP_ATOMIC, &irda_proto, 1);
+        sk = sk_alloc(net, PF_IRDA, GFP_ATOMIC, &irda_proto);
         if (sk == NULL)
                 return -ENOMEM;
 
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index 3d241e415a2a..1120b150e211 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -77,7 +77,7 @@ static int ircomm_tty_read_proc(char *buf, char **start, off_t offset, int len,
 #endif /* CONFIG_PROC_FS */
 static struct tty_driver *driver;
 
-hashbin_t *ircomm_tty = NULL;
+static hashbin_t *ircomm_tty = NULL;
 
 static const struct tty_operations ops = {
         .open            = ircomm_tty_open,
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 2f9f8dce5a69..e0eab5927c4f 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -731,15 +731,25 @@ dev_irnet_ioctl(struct inode *	inode,
       /* Get termios */
     case TCGETS:
       DEBUG(FS_INFO, "Get termios.\n");
+#ifndef TCGETS2
       if(kernel_termios_to_user_termios((struct termios __user *)argp, &ap->termios))
         break;
+#else
+      if(kernel_termios_to_user_termios_1((struct termios __user *)argp, &ap->termios))
+        break;
+#endif
       err = 0;
       break;
       /* Set termios */
     case TCSETSF:
       DEBUG(FS_INFO, "Set termios.\n");
+#ifndef TCGETS2
       if(user_termios_to_kernel_termios(&ap->termios, (struct termios __user *)argp))
         break;
+#else
+      if(user_termios_to_kernel_termios_1(&ap->termios, (struct termios __user *)argp))
+        break;
+#endif
       err = 0;
       break;
 
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 43e01c8d382b..aef664580355 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -216,7 +216,7 @@ static struct sock *iucv_sock_alloc(struct socket *sock, int proto, gfp_t prio)
 {
         struct sock *sk;
 
-        sk = sk_alloc(&init_net, PF_IUCV, prio, &iucv_proto, 1);
+        sk = sk_alloc(&init_net, PF_IUCV, prio, &iucv_proto);
         if (!sk)
                 return NULL;
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 7969f8a716df..10c89d47f685 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -152,7 +152,7 @@ static int pfkey_create(struct net *net, struct socket *sock, int protocol)
                 return -EPROTONOSUPPORT;
 
         err = -ENOMEM;
-        sk = sk_alloc(net, PF_KEY, GFP_KERNEL, &key_proto, 1);
+        sk = sk_alloc(net, PF_KEY, GFP_KERNEL, &key_proto);
         if (sk == NULL)
                 goto out;
 
@@ -395,9 +395,9 @@ static inline int pfkey_sec_ctx_len(struct sadb_x_sec_ctx *sec_ctx)
 static inline int verify_sec_ctx_len(void *p)
 {
         struct sadb_x_sec_ctx *sec_ctx = (struct sadb_x_sec_ctx *)p;
-        int len;
+        int len = sec_ctx->sadb_x_ctx_len;
 
-        if (sec_ctx->sadb_x_ctx_len > PAGE_SIZE)
+        if (len > PAGE_SIZE)
                 return -EINVAL;
 
         len = pfkey_sec_ctx_len(sec_ctx);
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index 8ebc2769dfda..5c0b484237c8 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -869,7 +869,7 @@ static void llc_sk_init(struct sock* sk)
  */
 struct sock *llc_sk_alloc(struct net *net, int family, gfp_t priority, struct proto *prot)
 {
-        struct sock *sk = sk_alloc(net, family, priority, prot, 1);
+        struct sock *sk = sk_alloc(net, family, priority, prot);
 
         if (!sk)
                 goto out;
diff --git a/net/mac80211/aes_ccm.c b/net/mac80211/aes_ccm.c
index bf7ba128b963..e62fe55944b8 100644
--- a/net/mac80211/aes_ccm.c
+++ b/net/mac80211/aes_ccm.c
@@ -11,7 +11,6 @@
 #include <linux/types.h>
 #include <linux/crypto.h>
 #include <linux/err.h>
-#include <asm/scatterlist.h>
 
 #include <net/mac80211.h>
 #include "ieee80211_key.h"
diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
index f7ffeec3913f..fda0e06453e8 100644
--- a/net/mac80211/ieee80211_sta.c
+++ b/net/mac80211/ieee80211_sta.c
@@ -1184,7 +1184,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct net_device *dev,
         printk(KERN_DEBUG "%s: RX %sssocResp from %s (capab=0x%x "
                "status=%d aid=%d)\n",
                dev->name, reassoc ? "Rea" : "A", print_mac(mac, mgmt->sa),
-               capab_info, status_code, aid & ~(BIT(15) | BIT(14)));
+               capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
 
         if (status_code != WLAN_STATUS_SUCCESS) {
                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
@@ -2096,7 +2096,8 @@ static int ieee80211_sta_match_ssid(struct ieee80211_if_sta *ifsta,
 {
         int tmp, hidden_ssid;
 
-        if (!memcmp(ifsta->ssid, ssid, ssid_len))
+        if (ssid_len == ifsta->ssid_len &&
+            !memcmp(ifsta->ssid, ssid, ssid_len))
                 return 1;
 
         if (ifsta->flags & IEEE80211_STA_AUTO_BSSID_SEL)
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index 6675261e958f..a84a23310ff4 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -16,7 +16,7 @@
 #include <linux/crypto.h>
 #include <linux/err.h>
 #include <linux/mm.h>
-#include <asm/scatterlist.h>
+#include <linux/scatterlist.h>
 
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
@@ -138,9 +138,7 @@ void ieee80211_wep_encrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
         *icv = cpu_to_le32(~crc32_le(~0, data, data_len));
 
         crypto_blkcipher_setkey(tfm, rc4key, klen);
-        sg.page = virt_to_page(data);
-        sg.offset = offset_in_page(data);
-        sg.length = data_len + WEP_ICV_LEN;
+        sg_init_one(&sg, data, data_len + WEP_ICV_LEN);
         crypto_blkcipher_encrypt(&desc, &sg, &sg, sg.length);
 }
 
@@ -204,9 +202,7 @@ int ieee80211_wep_decrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
         __le32 crc;
 
         crypto_blkcipher_setkey(tfm, rc4key, klen);
-        sg.page = virt_to_page(data);
-        sg.offset = offset_in_page(data);
-        sg.length = data_len + WEP_ICV_LEN;
+        sg_init_one(&sg, data, data_len + WEP_ICV_LEN);
         crypto_blkcipher_decrypt(&desc, &sg, &sg, sg.length);
 
         crc = cpu_to_le32(~crc32_le(~0, data, data_len));
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index d7a600a5720a..21a9fcc03796 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -363,7 +363,7 @@ config NETFILTER_XT_TARGET_TRACE
           the tables, chains, rules.
 
           If you want to compile it as a module, say M here and read
-          <file:Documentation/modules.txt>.  If unsure, say `N'.
+          <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 
 config NETFILTER_XT_TARGET_SECMARK
         tristate '"SECMARK" target support'
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 93c58f973831..ad0e36ebea3d 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -40,15 +40,15 @@ obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
 # targets
 obj-$(CONFIG_NETFILTER_XT_TARGET_CLASSIFY) += xt_CLASSIFY.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_CONNMARK) += xt_CONNMARK.o
+obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_DSCP) += xt_DSCP.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_MARK) += xt_MARK.o
-obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE) += xt_NFQUEUE.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_NFLOG) += xt_NFLOG.o
+obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE) += xt_NFQUEUE.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_NOTRACK) += xt_NOTRACK.o
-obj-$(CONFIG_NETFILTER_XT_TARGET_TRACE) += xt_TRACE.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_SECMARK) += xt_SECMARK.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_TCPMSS) += xt_TCPMSS.o
-obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o
+obj-$(CONFIG_NETFILTER_XT_TARGET_TRACE) += xt_TRACE.o
 
 # matches
 obj-$(CONFIG_NETFILTER_XT_MATCH_COMMENT) += xt_comment.o
@@ -59,22 +59,22 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_CONNTRACK) += xt_conntrack.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_LENGTH) += xt_length.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_LIMIT) += xt_limit.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_MAC) += xt_mac.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_MARK) += xt_mark.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_MULTIPORT) += xt_multiport.o
-obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_PHYSDEV) += xt_physdev.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA) += xt_quota.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_STATE) += xt_state.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_STATISTIC) += xt_statistic.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_STRING) += xt_string.o
-obj-$(CONFIG_NETFILTER_XT_MATCH_TIME) += xt_time.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_TCPMSS) += xt_tcpmss.o
-obj-$(CONFIG_NETFILTER_XT_MATCH_PHYSDEV) += xt_physdev.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_TIME) += xt_time.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_U32) += xt_u32.o
-obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 4d6171bc0829..000c2fb462d0 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -999,7 +999,7 @@ struct hlist_head *nf_ct_alloc_hashtable(int *sizep, int *vmalloced)
         *vmalloced = 0;
 
         size = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_head));
-        hash = (void*)__get_free_pages(GFP_KERNEL,
+        hash = (void*)__get_free_pages(GFP_KERNEL|__GFP_NOWARN,
                                        get_order(sizeof(struct hlist_head)
                                                  * size));
         if (!hash) {
diff --git a/net/netfilter/nf_sockopt.c b/net/netfilter/nf_sockopt.c
index aa2831587b82..2dfac3253569 100644
--- a/net/netfilter/nf_sockopt.c
+++ b/net/netfilter/nf_sockopt.c
@@ -23,14 +23,13 @@ static inline int overlap(int min1, int max1, int min2, int max2)
 /* Functions to register sockopt ranges (exclusive). */
 int nf_register_sockopt(struct nf_sockopt_ops *reg)
 {
-        struct list_head *i;
+        struct nf_sockopt_ops *ops;
         int ret = 0;
 
         if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0)
                 return -EINTR;
 
-        list_for_each(i, &nf_sockopts) {
-                struct nf_sockopt_ops *ops = (struct nf_sockopt_ops *)i;
+        list_for_each_entry(ops, &nf_sockopts, list) {
                 if (ops->pf == reg->pf
                     && (overlap(ops->set_optmin, ops->set_optmax,
                                 reg->set_optmin, reg->set_optmax)
@@ -65,7 +64,6 @@ EXPORT_SYMBOL(nf_unregister_sockopt);
 static int nf_sockopt(struct sock *sk, int pf, int val,
                       char __user *opt, int *len, int get)
 {
-        struct list_head *i;
         struct nf_sockopt_ops *ops;
         int ret;
 
@@ -75,8 +73,7 @@ static int nf_sockopt(struct sock *sk, int pf, int val,
         if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0)
                 return -EINTR;
 
-        list_for_each(i, &nf_sockopts) {
-                ops = (struct nf_sockopt_ops *)i;
+        list_for_each_entry(ops, &nf_sockopts, list) {
                 if (ops->pf == pf) {
                         if (!try_module_get(ops->owner))
                                 goto out_nosup;
@@ -124,7 +121,6 @@ EXPORT_SYMBOL(nf_getsockopt);
 static int compat_nf_sockopt(struct sock *sk, int pf, int val,
                              char __user *opt, int *len, int get)
 {
-        struct list_head *i;
         struct nf_sockopt_ops *ops;
         int ret;
 
@@ -135,8 +131,7 @@ static int compat_nf_sockopt(struct sock *sk, int pf, int val,
         if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0)
                 return -EINTR;
 
-        list_for_each(i, &nf_sockopts) {
-                ops = (struct nf_sockopt_ops *)i;
+        list_for_each_entry(ops, &nf_sockopts, list) {
                 if (ops->pf == pf) {
                         if (!try_module_get(ops->owner))
                                 goto out_nosup;
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 06cff1d13690..d7becf08a93a 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -4,7 +4,8 @@
  *   (c) 2000 Gerd Knorr <kraxel@bytesex.org>
  *   Nov 2002: Martin Bene <martin.bene@icomedias.com>:
  *              only ignore TIME_WAIT or gone connections
- *   Copyright © Jan Engelhardt <jengelh@gmx.de>, 2007
+ *   (C) CC Computer Consultants GmbH, 2007
+ *   Contact: <jengelh@computergmbh.de>
  *
  * based on ...
  *
@@ -306,7 +307,7 @@ static void __exit xt_connlimit_exit(void)
 
 module_init(xt_connlimit_init);
 module_exit(xt_connlimit_exit);
-MODULE_AUTHOR("Jan Engelhardt <jengelh@gmx.de>");
+MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
 MODULE_DESCRIPTION("netfilter xt_connlimit match module");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ipt_connlimit");
diff --git a/net/netfilter/xt_time.c b/net/netfilter/xt_time.c
index ef48bbd93573..ff44f86c24ce 100644
--- a/net/netfilter/xt_time.c
+++ b/net/netfilter/xt_time.c
@@ -1,6 +1,7 @@
 /*
  *      xt_time
- *      Copyright © Jan Engelhardt <jengelh@computergmbh.de>, 2007
+ *      Copyright © CC Computer Consultants GmbH, 2007
+ *      Contact: <jengelh@computergmbh.de>
  *
  *      based on ipt_time by Fabrice MARIE <fabrice@netfilter.org>
  *      This is a module which is used for time matching
diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c
index bec427915b30..af75b8c3f20b 100644
--- a/net/netfilter/xt_u32.c
+++ b/net/netfilter/xt_u32.c
@@ -2,7 +2,8 @@
  *      xt_u32 - kernel module to match u32 packet content
  *
  *      Original author: Don Cohen <don@isis.cs3-inc.com>
- *      © Jan Engelhardt <jengelh@gmx.de>, 2007
+ *      (C) CC Computer Consultants GmbH, 2007
+ *      Contact: <jengelh@computergmbh.de>
  */
 
 #include <linux/module.h>
@@ -129,7 +130,7 @@ static void __exit xt_u32_exit(void)
 
 module_init(xt_u32_init);
 module_exit(xt_u32_exit);
-MODULE_AUTHOR("Jan Engelhardt <jengelh@gmx.de>");
+MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
 MODULE_DESCRIPTION("netfilter u32 match module");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ipt_u32");
diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
index b6c844b7e1c1..b3675bd7db33 100644
--- a/net/netlabel/netlabel_domainhash.c
+++ b/net/netlabel/netlabel_domainhash.c
@@ -178,11 +178,9 @@ int netlbl_domhsh_init(u32 size)
         for (iter = 0; iter < hsh_tbl->size; iter++)
                 INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
 
-        rcu_read_lock();
         spin_lock(&netlbl_domhsh_lock);
         rcu_assign_pointer(netlbl_domhsh, hsh_tbl);
         spin_unlock(&netlbl_domhsh_lock);
-        rcu_read_unlock();
 
         return 0;
 }
@@ -222,7 +220,6 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
         entry->valid = 1;
         INIT_RCU_HEAD(&entry->rcu);
 
-        ret_val = 0;
         rcu_read_lock();
         if (entry->domain != NULL) {
                 bkt = netlbl_domhsh_hash(entry->domain);
@@ -233,7 +230,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                 else
                         ret_val = -EEXIST;
                 spin_unlock(&netlbl_domhsh_lock);
-        } else if (entry->domain == NULL) {
+        } else {
                 INIT_LIST_HEAD(&entry->list);
                 spin_lock(&netlbl_domhsh_def_lock);
                 if (rcu_dereference(netlbl_domhsh_def) == NULL)
@@ -241,9 +238,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                 else
                         ret_val = -EEXIST;
                 spin_unlock(&netlbl_domhsh_def_lock);
-        } else
-                ret_val = -EINVAL;
-
+        }
         audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_ADD, audit_info);
         if (audit_buf != NULL) {
                 audit_log_format(audit_buf,
@@ -262,7 +257,6 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                 audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
                 audit_log_end(audit_buf);
         }
-
         rcu_read_unlock();
 
         if (ret_val != 0) {
@@ -313,38 +307,30 @@ int netlbl_domhsh_remove(const char *domain, struct netlbl_audit *audit_info)
         struct audit_buffer *audit_buf;
 
         rcu_read_lock();
-        if (domain != NULL)
-                entry = netlbl_domhsh_search(domain, 0);
-        else
-                entry = netlbl_domhsh_search(domain, 1);
+        entry = netlbl_domhsh_search(domain, (domain != NULL ? 0 : 1));
         if (entry == NULL)
                 goto remove_return;
         switch (entry->type) {
-        case NETLBL_NLTYPE_UNLABELED:
-                break;
         case NETLBL_NLTYPE_CIPSOV4:
-                ret_val = cipso_v4_doi_domhsh_remove(entry->type_def.cipsov4,
-                                                     entry->domain);
-                if (ret_val != 0)
-                        goto remove_return;
+                cipso_v4_doi_domhsh_remove(entry->type_def.cipsov4,
+                                           entry->domain);
                 break;
         }
-        ret_val = 0;
         if (entry != rcu_dereference(netlbl_domhsh_def)) {
                 spin_lock(&netlbl_domhsh_lock);
                 if (entry->valid) {
                         entry->valid = 0;
                         list_del_rcu(&entry->list);
-                } else
-                        ret_val = -ENOENT;
+                        ret_val = 0;
+                }
                 spin_unlock(&netlbl_domhsh_lock);
         } else {
                 spin_lock(&netlbl_domhsh_def_lock);
                 if (entry->valid) {
                         entry->valid = 0;
                         rcu_assign_pointer(netlbl_domhsh_def, NULL);
-                } else
-                        ret_val = -ENOENT;
+                        ret_val = 0;
+                }
                 spin_unlock(&netlbl_domhsh_def_lock);
         }
 
@@ -357,11 +343,10 @@ int netlbl_domhsh_remove(const char *domain, struct netlbl_audit *audit_info)
                 audit_log_end(audit_buf);
         }
 
-        if (ret_val == 0)
-                call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
-
 remove_return:
         rcu_read_unlock();
+        if (ret_val == 0)
+                call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
         return ret_val;
 }
 
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index 5315dacc5222..56483377997a 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -85,11 +85,9 @@ static const struct nla_policy netlbl_mgmt_genl_policy[NLBL_MGMT_A_MAX + 1] = {
  */
 void netlbl_mgmt_protocount_inc(void)
 {
-        rcu_read_lock();
         spin_lock(&netlabel_mgmt_protocount_lock);
         netlabel_mgmt_protocount++;
         spin_unlock(&netlabel_mgmt_protocount_lock);
-        rcu_read_unlock();
 }
 
 /**
@@ -103,12 +101,10 @@ void netlbl_mgmt_protocount_inc(void)
  */
 void netlbl_mgmt_protocount_dec(void)
 {
-        rcu_read_lock();
         spin_lock(&netlabel_mgmt_protocount_lock);
         if (netlabel_mgmt_protocount > 0)
                 netlabel_mgmt_protocount--;
         spin_unlock(&netlabel_mgmt_protocount_lock);
-        rcu_read_unlock();
 }
 
 /**
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 5c303c68af1d..348292450deb 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -84,12 +84,10 @@ static void netlbl_unlabel_acceptflg_set(u8 value,
         struct audit_buffer *audit_buf;
         u8 old_val;
 
-        rcu_read_lock();
-        old_val = netlabel_unlabel_acceptflg;
         spin_lock(&netlabel_unlabel_acceptflg_lock);
+        old_val = netlabel_unlabel_acceptflg;
         netlabel_unlabel_acceptflg = value;
         spin_unlock(&netlabel_unlabel_acceptflg_lock);
-        rcu_read_unlock();
 
         audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW,
                                               audit_info);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 98e313e5e594..415c97236f63 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -396,7 +396,7 @@ static int __netlink_create(struct net *net, struct socket *sock,
 
         sock->ops = &netlink_ops;
 
-        sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto, 1);
+        sk = sk_alloc(net, PF_NETLINK, GFP_KERNEL, &netlink_proto);
         if (!sk)
                 return -ENOMEM;
 
@@ -752,7 +752,7 @@ struct sock *netlink_getsockbyfilp(struct file *filp)
  * 1: repeat lookup - reference dropped while waiting for socket memory.
  */
 int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
-                long timeo, struct sock *ssk)
+                      long *timeo, struct sock *ssk)
 {
         struct netlink_sock *nlk;
 
@@ -761,7 +761,7 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
         if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
             test_bit(0, &nlk->state)) {
                 DECLARE_WAITQUEUE(wait, current);
-                if (!timeo) {
+                if (!*timeo) {
                         if (!ssk || netlink_is_kernel(ssk))
                                 netlink_overrun(sk);
                         sock_put(sk);
@@ -775,7 +775,7 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
                 if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
                      test_bit(0, &nlk->state)) &&
                     !sock_flag(sk, SOCK_DEAD))
-                        timeo = schedule_timeout(timeo);
+                        *timeo = schedule_timeout(*timeo);
 
                 __set_current_state(TASK_RUNNING);
                 remove_wait_queue(&nlk->wait, &wait);
@@ -783,7 +783,7 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
 
                 if (signal_pending(current)) {
                         kfree_skb(skb);
-                        return sock_intr_errno(timeo);
+                        return sock_intr_errno(*timeo);
                 }
                 return 1;
         }
@@ -877,7 +877,7 @@ retry:
         if (netlink_is_kernel(sk))
                 return netlink_unicast_kernel(sk, skb);
 
-        err = netlink_attachskb(sk, skb, nonblock, timeo, ssk);
+        err = netlink_attachskb(sk, skb, nonblock, &timeo, ssk);
         if (err == 1)
                 goto retry;
         if (err)
@@ -1565,7 +1565,11 @@ int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
 
         netlink_dump(sk);
         sock_put(sk);
-        return 0;
+
+        /* We successfully started a dump, by returning -EINTR we
+         * signal not to send ACK even if it was requested.
+         */
+        return -EINTR;
 }
 
 void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
@@ -1619,17 +1623,21 @@ int netlink_rcv_skb(struct sk_buff *skb, int (*cb)(struct sk_buff *,
 
                 /* Only requests are handled by the kernel */
                 if (!(nlh->nlmsg_flags & NLM_F_REQUEST))
-                        goto skip;
+                        goto ack;
 
                 /* Skip control messages */
                 if (nlh->nlmsg_type < NLMSG_MIN_TYPE)
-                        goto skip;
+                        goto ack;
 
                 err = cb(skb, nlh);
-skip:
+                if (err == -EINTR)
+                        goto skip;
+
+ack:
                 if (nlh->nlmsg_flags & NLM_F_ACK || err)
                         netlink_ack(skb, nlh, err);
 
+skip:
                 msglen = NLMSG_ALIGN(nlh->nlmsg_len);
                 if (msglen > skb->len)
                         msglen = skb->len;
@@ -1880,7 +1888,7 @@ static void __net_exit netlink_net_exit(struct net *net)
 #endif
 }
 
-static struct pernet_operations __net_initdata netlink_net_ops = {
+static struct pernet_operations netlink_net_ops = {
         .init = netlink_net_init,
         .exit = netlink_net_exit,
 };
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 3a4d479ea64e..972250c974f1 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -423,7 +423,8 @@ static int nr_create(struct net *net, struct socket *sock, int protocol)
         if (sock->type != SOCK_SEQPACKET || protocol != 0)
                 return -ESOCKTNOSUPPORT;
 
-        if ((sk = sk_alloc(net, PF_NETROM, GFP_ATOMIC, &nr_proto, 1)) == NULL)
+        sk = sk_alloc(net, PF_NETROM, GFP_ATOMIC, &nr_proto);
+        if (sk  == NULL)
                 return -ENOMEM;
 
         nr = nr_sk(sk);
@@ -465,7 +466,8 @@ static struct sock *nr_make_new(struct sock *osk)
         if (osk->sk_type != SOCK_SEQPACKET)
                 return NULL;
 
-        if ((sk = sk_alloc(osk->sk_net, PF_NETROM, GFP_ATOMIC, osk->sk_prot, 1)) == NULL)
+        sk = sk_alloc(osk->sk_net, PF_NETROM, GFP_ATOMIC, osk->sk_prot);
+        if (sk == NULL)
                 return NULL;
 
         nr = nr_sk(sk);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index d0936506b731..4cb2dfba0993 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -995,7 +995,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol)
         sock->state = SS_UNCONNECTED;
 
         err = -ENOBUFS;
-        sk = sk_alloc(net, PF_PACKET, GFP_KERNEL, &packet_proto, 1);
+        sk = sk_alloc(net, PF_PACKET, GFP_KERNEL, &packet_proto);
         if (sk == NULL)
                 goto out;
 
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 509defe53ee5..ed2d65cd8010 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -513,7 +513,8 @@ static int rose_create(struct net *net, struct socket *sock, int protocol)
         if (sock->type != SOCK_SEQPACKET || protocol != 0)
                 return -ESOCKTNOSUPPORT;
 
-        if ((sk = sk_alloc(net, PF_ROSE, GFP_ATOMIC, &rose_proto, 1)) == NULL)
+        sk = sk_alloc(net, PF_ROSE, GFP_ATOMIC, &rose_proto);
+        if (sk == NULL)
                 return -ENOMEM;
 
         rose = rose_sk(sk);
@@ -551,7 +552,8 @@ static struct sock *rose_make_new(struct sock *osk)
         if (osk->sk_type != SOCK_SEQPACKET)
                 return NULL;
 
-        if ((sk = sk_alloc(osk->sk_net, PF_ROSE, GFP_ATOMIC, &rose_proto, 1)) == NULL)
+        sk = sk_alloc(osk->sk_net, PF_ROSE, GFP_ATOMIC, &rose_proto);
+        if (sk == NULL)
                 return NULL;
 
         rose = rose_sk(sk);
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index c680017f5c8e..d6389450c4bf 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -627,7 +627,7 @@ static int rxrpc_create(struct net *net, struct socket *sock, int protocol)
         sock->ops = &rxrpc_rpc_ops;
         sock->state = SS_UNCONNECTED;
 
-        sk = sk_alloc(net, PF_RXRPC, GFP_KERNEL, &rxrpc_proto, 1);
+        sk = sk_alloc(net, PF_RXRPC, GFP_KERNEL, &rxrpc_proto);
         if (!sk)
                 return -ENOMEM;
 
diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index ac3cabdca78c..e09a95aa68ff 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -135,9 +135,8 @@ static void rxkad_prime_packet_security(struct rxrpc_connection *conn)
         tmpbuf.x[2] = 0;
         tmpbuf.x[3] = htonl(conn->security_ix);
 
-        memset(sg, 0, sizeof(sg));
-        sg_set_buf(&sg[0], &tmpbuf, sizeof(tmpbuf));
-        sg_set_buf(&sg[1], &tmpbuf, sizeof(tmpbuf));
+        sg_init_one(&sg[0], &tmpbuf, sizeof(tmpbuf));
+        sg_init_one(&sg[1], &tmpbuf, sizeof(tmpbuf));
         crypto_blkcipher_encrypt_iv(&desc, &sg[0], &sg[1], sizeof(tmpbuf));
 
         memcpy(&conn->csum_iv, &tmpbuf.x[2], sizeof(conn->csum_iv));
@@ -180,9 +179,8 @@ static int rxkad_secure_packet_auth(const struct rxrpc_call *call,
         desc.info = iv.x;
         desc.flags = 0;
 
-        memset(sg, 0, sizeof(sg));
-        sg_set_buf(&sg[0], &tmpbuf, sizeof(tmpbuf));
-        sg_set_buf(&sg[1], &tmpbuf, sizeof(tmpbuf));
+        sg_init_one(&sg[0], &tmpbuf, sizeof(tmpbuf));
+        sg_init_one(&sg[1], &tmpbuf, sizeof(tmpbuf));
         crypto_blkcipher_encrypt_iv(&desc, &sg[0], &sg[1], sizeof(tmpbuf));
 
         memcpy(sechdr, &tmpbuf, sizeof(tmpbuf));
@@ -227,9 +225,8 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
         desc.info = iv.x;
         desc.flags = 0;
 
-        memset(sg, 0, sizeof(sg[0]) * 2);
-        sg_set_buf(&sg[0], sechdr, sizeof(rxkhdr));
-        sg_set_buf(&sg[1], &rxkhdr, sizeof(rxkhdr));
+        sg_init_one(&sg[0], sechdr, sizeof(rxkhdr));
+        sg_init_one(&sg[1], &rxkhdr, sizeof(rxkhdr));
         crypto_blkcipher_encrypt_iv(&desc, &sg[0], &sg[1], sizeof(rxkhdr));
 
         /* we want to encrypt the skbuff in-place */
@@ -240,6 +237,7 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
         len = data_size + call->conn->size_align - 1;
         len &= ~(call->conn->size_align - 1);
 
+        sg_init_table(sg, nsg);
         skb_to_sgvec(skb, sg, 0, len);
         crypto_blkcipher_encrypt_iv(&desc, sg, sg, len);
 
@@ -290,9 +288,8 @@ static int rxkad_secure_packet(const struct rxrpc_call *call,
         tmpbuf.x[0] = sp->hdr.callNumber;
         tmpbuf.x[1] = x;
 
-        memset(&sg, 0, sizeof(sg));
-        sg_set_buf(&sg[0], &tmpbuf, sizeof(tmpbuf));
-        sg_set_buf(&sg[1], &tmpbuf, sizeof(tmpbuf));
+        sg_init_one(&sg[0], &tmpbuf, sizeof(tmpbuf));
+        sg_init_one(&sg[1], &tmpbuf, sizeof(tmpbuf));
         crypto_blkcipher_encrypt_iv(&desc, &sg[0], &sg[1], sizeof(tmpbuf));
 
         x = ntohl(tmpbuf.x[1]);
@@ -332,19 +329,22 @@ static int rxkad_verify_packet_auth(const struct rxrpc_call *call,
         struct rxrpc_skb_priv *sp;
         struct blkcipher_desc desc;
         struct rxrpc_crypt iv;
-        struct scatterlist sg[2];
+        struct scatterlist sg[16];
         struct sk_buff *trailer;
         u32 data_size, buf;
         u16 check;
+        int nsg;
 
         _enter("");
 
         sp = rxrpc_skb(skb);
 
         /* we want to decrypt the skbuff in-place */
-        if (skb_cow_data(skb, 0, &trailer) < 0)
+        nsg = skb_cow_data(skb, 0, &trailer);
+        if (nsg < 0 || nsg > 16)
                 goto nomem;
 
+        sg_init_table(sg, nsg);
         skb_to_sgvec(skb, sg, 0, 8);
 
         /* start the decryption afresh */
@@ -426,6 +426,7 @@ static int rxkad_verify_packet_encrypt(const struct rxrpc_call *call,
                         goto nomem;
         }
 
+        sg_init_table(sg, nsg);
         skb_to_sgvec(skb, sg, 0, skb->len);
 
         /* decrypt from the session key */
@@ -521,9 +522,8 @@ static int rxkad_verify_packet(const struct rxrpc_call *call,
         tmpbuf.x[0] = call->call_id;
         tmpbuf.x[1] = x;
 
-        memset(&sg, 0, sizeof(sg));
-        sg_set_buf(&sg[0], &tmpbuf, sizeof(tmpbuf));
-        sg_set_buf(&sg[1], &tmpbuf, sizeof(tmpbuf));
+        sg_init_one(&sg[0], &tmpbuf, sizeof(tmpbuf));
+        sg_init_one(&sg[1], &tmpbuf, sizeof(tmpbuf));
         crypto_blkcipher_encrypt_iv(&desc, &sg[0], &sg[1], sizeof(tmpbuf));
 
         x = ntohl(tmpbuf.x[1]);
@@ -690,16 +690,20 @@ static void rxkad_calc_response_checksum(struct rxkad_response *response)
 static void rxkad_sg_set_buf2(struct scatterlist sg[2],
                               void *buf, size_t buflen)
 {
+        int nsg = 1;
 
-        memset(sg, 0, sizeof(sg));
+        sg_init_table(sg, 2);
 
         sg_set_buf(&sg[0], buf, buflen);
         if (sg[0].offset + buflen > PAGE_SIZE) {
                 /* the buffer was split over two pages */
                 sg[0].length = PAGE_SIZE - sg[0].offset;
                 sg_set_buf(&sg[1], buf + sg[0].length, buflen - sg[0].length);
+                nsg++;
         }
 
+        sg_mark_end(&sg[nsg - 1]);
+
         ASSERTCMP(sg[0].length + sg[1].length, ==, buflen);
 }
 
@@ -712,7 +716,7 @@ static void rxkad_encrypt_response(struct rxrpc_connection *conn,
 {
         struct blkcipher_desc desc;
         struct rxrpc_crypt iv;
-        struct scatterlist ssg[2], dsg[2];
+        struct scatterlist sg[2];
 
         /* continue encrypting from where we left off */
         memcpy(&iv, s2->session_key, sizeof(iv));
@@ -720,9 +724,8 @@ static void rxkad_encrypt_response(struct rxrpc_connection *conn,
         desc.info = iv.x;
         desc.flags = 0;
 
-        rxkad_sg_set_buf2(ssg, &resp->encrypted, sizeof(resp->encrypted));
-        memcpy(dsg, ssg, sizeof(dsg));
-        crypto_blkcipher_encrypt_iv(&desc, dsg, ssg, sizeof(resp->encrypted));
+        rxkad_sg_set_buf2(sg, &resp->encrypted, sizeof(resp->encrypted));
+        crypto_blkcipher_encrypt_iv(&desc, sg, sg, sizeof(resp->encrypted));
 }
 
 /*
@@ -817,7 +820,7 @@ static int rxkad_decrypt_ticket(struct rxrpc_connection *conn,
 {
         struct blkcipher_desc desc;
         struct rxrpc_crypt iv, key;
-        struct scatterlist ssg[1], dsg[1];
+        struct scatterlist sg[1];
         struct in_addr addr;
         unsigned life;
         time_t issue, now;
@@ -850,9 +853,8 @@ static int rxkad_decrypt_ticket(struct rxrpc_connection *conn,
         desc.info = iv.x;
         desc.flags = 0;
 
-        sg_init_one(&ssg[0], ticket, ticket_len);
-        memcpy(dsg, ssg, sizeof(dsg));
-        crypto_blkcipher_decrypt_iv(&desc, dsg, ssg, ticket_len);
+        sg_init_one(&sg[0], ticket, ticket_len);
+        crypto_blkcipher_decrypt_iv(&desc, sg, sg, ticket_len);
 
         p = ticket;
         end = p + ticket_len;
@@ -961,7 +963,7 @@ static void rxkad_decrypt_response(struct rxrpc_connection *conn,
                                    const struct rxrpc_crypt *session_key)
 {
         struct blkcipher_desc desc;
-        struct scatterlist ssg[2], dsg[2];
+        struct scatterlist sg[2];
         struct rxrpc_crypt iv;
 
         _enter(",,%08x%08x",
@@ -979,9 +981,8 @@ static void rxkad_decrypt_response(struct rxrpc_connection *conn,
         desc.info = iv.x;
         desc.flags = 0;
 
-        rxkad_sg_set_buf2(ssg, &resp->encrypted, sizeof(resp->encrypted));
-        memcpy(dsg, ssg, sizeof(dsg));
-        crypto_blkcipher_decrypt_iv(&desc, dsg, ssg, sizeof(resp->encrypted));
+        rxkad_sg_set_buf2(sg, &resp->encrypted, sizeof(resp->encrypted));
+        crypto_blkcipher_decrypt_iv(&desc, sg, sg, sizeof(resp->encrypted));
         mutex_unlock(&rxkad_ci_mutex);
 
         _leave("");
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index fd7bca4d5c20..c3fde9180f9d 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -166,7 +166,7 @@ bad_mirred:
                 return TC_ACT_SHOT;
         }
 
-        skb2 = skb_clone(skb, GFP_ATOMIC);
+        skb2 = skb_act_clone(skb, GFP_ATOMIC);
         if (skb2 == NULL)
                 goto bad_mirred;
         if (m->tcfm_eaction != TCA_EGRESS_MIRROR &&
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 9e98c6e567dd..53171029439f 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -91,7 +91,7 @@ static struct tc_u_common *u32_list;
 
 static __inline__ unsigned u32_hash_fold(u32 key, struct tc_u32_sel *sel, u8 fshift)
 {
-        unsigned h = (key & sel->hmask)>>fshift;
+        unsigned h = ntohl(key & sel->hmask)>>fshift;
 
         return h;
 }
@@ -615,7 +615,7 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle,
         n->handle = handle;
 {
         u8 i = 0;
-        u32 mask = s->hmask;
+        u32 mask = ntohl(s->hmask);
         if (mask) {
                 while (!(mask & 1)) {
                         i++;
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index abd82fc3ec60..de894096e442 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -136,7 +136,7 @@ prio_dequeue(struct Qdisc* sch)
                  * pulling an skb.  This way we avoid excessive requeues
                  * for slower queues.
                  */
-                if (!netif_subqueue_stopped(sch->dev, (q->mq ? prio : 0))) {
+                if (!__netif_subqueue_stopped(sch->dev, (q->mq ? prio : 0))) {
                         qdisc = q->queues[prio];
                         skb = qdisc->dequeue(qdisc);
                         if (skb) {
@@ -165,7 +165,7 @@ static struct sk_buff *rr_dequeue(struct Qdisc* sch)
                  * for slower queues.  If the queue is stopped, try the
                  * next queue.
                  */
-                if (!netif_subqueue_stopped(sch->dev,
+                if (!__netif_subqueue_stopped(sch->dev,
                                             (q->mq ? q->curband : 0))) {
                         qdisc = q->queues[q->curband];
                         skb = qdisc->dequeue(qdisc);
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index be57cf317a7f..c0ed06d4a504 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -252,6 +252,9 @@ __teql_resolve(struct sk_buff *skb, struct sk_buff *skb_res, struct net_device *
 static inline int teql_resolve(struct sk_buff *skb,
                                struct sk_buff *skb_res, struct net_device *dev)
 {
+        if (dev->qdisc == &noop_qdisc)
+                return -ENODEV;
+
         if (dev->header_ops == NULL ||
             skb->dst == NULL ||
             skb->dst->neighbour == NULL)
@@ -266,7 +269,7 @@ static int teql_master_xmit(struct sk_buff *skb, struct net_device *dev)
         int busy;
         int nores;
         int len = skb->len;
-        int subq = skb->queue_mapping;
+        int subq = skb_get_queue_mapping(skb);
         struct sk_buff *skb_res = NULL;
 
         start = master->slaves;
@@ -284,7 +287,7 @@ restart:
                 if (slave->qdisc_sleeping != q)
                         continue;
                 if (netif_queue_stopped(slave) ||
-                    netif_subqueue_stopped(slave, subq) ||
+                    __netif_subqueue_stopped(slave, subq) ||
                     !netif_running(slave)) {
                         busy = 1;
                         continue;
@@ -294,7 +297,7 @@ restart:
                 case 0:
                         if (netif_tx_trylock(slave)) {
                                 if (!netif_queue_stopped(slave) &&
-                                    !netif_subqueue_stopped(slave, subq) &&
+                                    !__netif_subqueue_stopped(slave, subq) &&
                                     slave->hard_start_xmit(skb, slave) == 0) {
                                         netif_tx_unlock(slave);
                                         master->slaves = NEXT_SLAVE(q);
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 781810724714..6d5fa6bb371b 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -107,7 +107,7 @@ struct sctp_shared_key *sctp_auth_shkey_create(__u16 key_id, gfp_t gfp)
 }
 
 /* Free the shared key stucture */
-void sctp_auth_shkey_free(struct sctp_shared_key *sh_key)
+static void sctp_auth_shkey_free(struct sctp_shared_key *sh_key)
 {
         BUG_ON(!list_empty(&sh_key->key_list));
         sctp_auth_key_put(sh_key->key);
@@ -220,7 +220,7 @@ static struct sctp_auth_bytes *sctp_auth_make_key_vector(
 
 
 /* Make a key vector based on our local parameters */
-struct sctp_auth_bytes *sctp_auth_make_local_vector(
+static struct sctp_auth_bytes *sctp_auth_make_local_vector(
                                     const struct sctp_association *asoc,
                                     gfp_t gfp)
 {
@@ -232,7 +232,7 @@ struct sctp_auth_bytes *sctp_auth_make_local_vector(
 }
 
 /* Make a key vector based on peer's parameters */
-struct sctp_auth_bytes *sctp_auth_make_peer_vector(
+static struct sctp_auth_bytes *sctp_auth_make_peer_vector(
                                     const struct sctp_association *asoc,
                                     gfp_t gfp)
 {
@@ -556,7 +556,7 @@ struct sctp_hmac *sctp_auth_asoc_get_hmac(const struct sctp_association *asoc)
         return &sctp_hmac_list[id];
 }
 
-static int __sctp_auth_find_hmacid(__u16 *hmacs, int n_elts, __u16 hmac_id)
+static int __sctp_auth_find_hmacid(__be16 *hmacs, int n_elts, __be16 hmac_id)
 {
         int  found = 0;
         int  i;
@@ -573,7 +573,7 @@ static int __sctp_auth_find_hmacid(__u16 *hmacs, int n_elts, __u16 hmac_id)
 
 /* See if the HMAC_ID is one that we claim as supported */
 int sctp_auth_asoc_verify_hmac_id(const struct sctp_association *asoc,
-                                    __u16 hmac_id)
+                                    __be16 hmac_id)
 {
         struct sctp_hmac_algo_param *hmacs;
         __u16 n_elt;
@@ -726,9 +726,7 @@ void sctp_auth_calculate_hmac(const struct sctp_association *asoc,
 
         /* set up scatter list */
         end = skb_tail_pointer(skb);
-        sg.page = virt_to_page(auth);
-        sg.offset = (unsigned long)(auth) % PAGE_SIZE;
-        sg.length = end - (unsigned char *)auth;
+        sg_init_one(&sg, auth, end - (unsigned char *)auth);
 
         desc.tfm = asoc->ep->auth_hmacs[hmac_id];
         desc.flags = 0;
diff --git a/net/sctp/crc32c.c b/net/sctp/crc32c.c
index 59cf7b06d216..181edabdb8ca 100644
--- a/net/sctp/crc32c.c
+++ b/net/sctp/crc32c.c
@@ -170,6 +170,7 @@ __u32 sctp_update_cksum(__u8 *buffer, __u16 length, __u32 crc32)
         return crc32;
 }
 
+#if 0
 __u32 sctp_update_copy_cksum(__u8 *to, __u8 *from, __u16 length, __u32 crc32)
 {
         __u32 i;
@@ -186,6 +187,7 @@ __u32 sctp_update_copy_cksum(__u8 *to, __u8 *from, __u16 length, __u32 crc32)
 
         return crc32;
 }
+#endif  /*  0  */
 
 __u32 sctp_end_cksum(__u32 crc32)
 {
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index eb4deaf58914..7f31ff638bc6 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -631,7 +631,7 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
         struct sctp6_sock *newsctp6sk;
 
-        newsk = sk_alloc(sk->sk_net, PF_INET6, GFP_KERNEL, sk->sk_prot, 1);
+        newsk = sk_alloc(sk->sk_net, PF_INET6, GFP_KERNEL, sk->sk_prot);
         if (!newsk)
                 goto out;
 
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index f5cd96f5fe74..40c1a47d1b8d 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -552,7 +552,8 @@ static struct sock *sctp_v4_create_accept_sk(struct sock *sk,
 {
         struct inet_sock *inet = inet_sk(sk);
         struct inet_sock *newinet;
-        struct sock *newsk = sk_alloc(sk->sk_net, PF_INET, GFP_KERNEL, sk->sk_prot, 1);
+        struct sock *newsk = sk_alloc(sk->sk_net, PF_INET, GFP_KERNEL,
+                        sk->sk_prot);
 
         if (!newsk)
                 goto out;
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index f983a369d4e2..c377e4e8f653 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -56,7 +56,7 @@
 #include <linux/ipv6.h>
 #include <linux/net.h>
 #include <linux/inet.h>
-#include <asm/scatterlist.h>
+#include <linux/scatterlist.h>
 #include <linux/crypto.h>
 #include <net/sock.h>
 
@@ -1513,9 +1513,7 @@ static sctp_cookie_param_t *sctp_pack_cookie(const struct sctp_endpoint *ep,
                 struct hash_desc desc;
 
                 /* Sign the message.  */
-                sg.page = virt_to_page(&cookie->c);
-                sg.offset = (unsigned long)(&cookie->c) % PAGE_SIZE;
-                sg.length = bodysize;
+                sg_init_one(&sg, &cookie->c, bodysize);
                 keylen = SCTP_SECRET_SIZE;
                 key = (char *)ep->secret_key[ep->current_key];
                 desc.tfm = sctp_sk(ep->base.sk)->hmac;
@@ -1585,9 +1583,7 @@ struct sctp_association *sctp_unpack_cookie(
 
         /* Check the signature.  */
         keylen = SCTP_SECRET_SIZE;
-        sg.page = virt_to_page(bear_cookie);
-        sg.offset = (unsigned long)(bear_cookie) % PAGE_SIZE;
-        sg.length = bodysize;
+        sg_init_one(&sg, bear_cookie, bodysize);
         key = (char *)ep->secret_key[ep->current_key];
         desc.tfm = sctp_sk(ep->base.sk)->hmac;
         desc.flags = 0;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index bd6f42a15a4b..a7ecf3159e53 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6455,6 +6455,8 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
 }
 
 
+DEFINE_PROTO_INUSE(sctp)
+
 /* This proto struct describes the ULP interface for SCTP.  */
 struct proto sctp_prot = {
         .name        =  "SCTP",
@@ -6483,9 +6485,12 @@ struct proto sctp_prot = {
         .memory_pressure = &sctp_memory_pressure,
         .enter_memory_pressure = sctp_enter_memory_pressure,
         .memory_allocated = &sctp_memory_allocated,
+        REF_PROTO_INUSE(sctp)
 };
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+DEFINE_PROTO_INUSE(sctpv6)
+
 struct proto sctpv6_prot = {
         .name           = "SCTPv6",
         .owner          = THIS_MODULE,
@@ -6513,5 +6518,6 @@ struct proto sctpv6_prot = {
         .memory_pressure = &sctp_memory_pressure,
         .enter_memory_pressure = sctp_enter_memory_pressure,
         .memory_allocated = &sctp_memory_allocated,
+        REF_PROTO_INUSE(sctpv6)
 };
 #endif /* defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index b9370956b187..4be92d0a2cab 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -908,8 +908,8 @@ void sctp_ulpq_skip(struct sctp_ulpq *ulpq, __u16 sid, __u16 ssn)
         return;
 }
 
-/* Renege 'needed' bytes from the ordering queue. */
-static __u16 sctp_ulpq_renege_order(struct sctp_ulpq *ulpq, __u16 needed)
+static __u16 sctp_ulpq_renege_list(struct sctp_ulpq *ulpq,
+                struct sk_buff_head *list, __u16 needed)
 {
         __u16 freed = 0;
         __u32 tsn;
@@ -919,7 +919,7 @@ static __u16 sctp_ulpq_renege_order(struct sctp_ulpq *ulpq, __u16 needed)
 
         tsnmap = &ulpq->asoc->peer.tsn_map;
 
-        while ((skb = __skb_dequeue_tail(&ulpq->lobby)) != NULL) {
+        while ((skb = __skb_dequeue_tail(list)) != NULL) {
                 freed += skb_headlen(skb);
                 event = sctp_skb2event(skb);
                 tsn = event->tsn;
@@ -933,30 +933,16 @@ static __u16 sctp_ulpq_renege_order(struct sctp_ulpq *ulpq, __u16 needed)
         return freed;
 }
 
+/* Renege 'needed' bytes from the ordering queue. */
+static __u16 sctp_ulpq_renege_order(struct sctp_ulpq *ulpq, __u16 needed)
+{
+        return sctp_ulpq_renege_list(ulpq, &ulpq->lobby, needed);
+}
+
 /* Renege 'needed' bytes from the reassembly queue. */
 static __u16 sctp_ulpq_renege_frags(struct sctp_ulpq *ulpq, __u16 needed)
 {
-        __u16 freed = 0;
-        __u32 tsn;
-        struct sk_buff *skb;
-        struct sctp_ulpevent *event;
-        struct sctp_tsnmap *tsnmap;
-
-        tsnmap = &ulpq->asoc->peer.tsn_map;
-
-        /* Walk backwards through the list, reneges the newest tsns. */
-        while ((skb = __skb_dequeue_tail(&ulpq->reasm)) != NULL) {
-                freed += skb_headlen(skb);
-                event = sctp_skb2event(skb);
-                tsn = event->tsn;
-
-                sctp_ulpevent_free(event);
-                sctp_tsnmap_renege(tsnmap, tsn);
-                if (freed >= needed)
-                        return freed;
-        }
-
-        return freed;
+        return sctp_ulpq_renege_list(ulpq, &ulpq->reasm, needed);
 }
 
 /* Partial deliver the first message as there is pressure on rwnd. */
diff --git a/net/socket.c b/net/socket.c
index 540013ea8620..5d879fd3d01d 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1250,11 +1250,14 @@ asmlinkage long sys_socketpair(int family, int type, int protocol,
                 goto out_release_both;
 
         fd1 = sock_alloc_fd(&newfile1);
-        if (unlikely(fd1 < 0))
+        if (unlikely(fd1 < 0)) {
+                err = fd1;
                 goto out_release_both;
+        }
 
         fd2 = sock_alloc_fd(&newfile2);
         if (unlikely(fd2 < 0)) {
+                err = fd2;
                 put_filp(newfile1);
                 put_unused_fd(fd1);
                 goto out_release_both;
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index bfb6a29633dd..0dd792338fa9 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -75,7 +75,7 @@ krb5_encrypt(
                 memcpy(local_iv, iv, crypto_blkcipher_ivsize(tfm));
 
         memcpy(out, in, length);
-        sg_set_buf(sg, out, length);
+        sg_init_one(sg, out, length);
 
         ret = crypto_blkcipher_encrypt_iv(&desc, sg, sg, length);
 out:
@@ -110,7 +110,7 @@ krb5_decrypt(
                 memcpy(local_iv,iv, crypto_blkcipher_ivsize(tfm));
 
         memcpy(out, in, length);
-        sg_set_buf(sg, out, length);
+        sg_init_one(sg, out, length);
 
         ret = crypto_blkcipher_decrypt_iv(&desc, sg, sg, length);
 out:
@@ -146,7 +146,7 @@ make_checksum(char *cksumname, char *header, int hdrlen, struct xdr_buf *body,
         err = crypto_hash_init(&desc);
         if (err)
                 goto out;
-        sg_set_buf(sg, header, hdrlen);
+        sg_init_one(sg, header, hdrlen);
         err = crypto_hash_update(&desc, sg, hdrlen);
         if (err)
                 goto out;
@@ -188,8 +188,6 @@ encryptor(struct scatterlist *sg, void *data)
         /* Worst case is 4 fragments: head, end of page 1, start
          * of page 2, tail.  Anything more is a bug. */
         BUG_ON(desc->fragno > 3);
-        desc->infrags[desc->fragno] = *sg;
-        desc->outfrags[desc->fragno] = *sg;
 
         page_pos = desc->pos - outbuf->head[0].iov_len;
         if (page_pos >= 0 && page_pos < outbuf->page_len) {
@@ -197,9 +195,12 @@ encryptor(struct scatterlist *sg, void *data)
                 int i = (page_pos + outbuf->page_base) >> PAGE_CACHE_SHIFT;
                 in_page = desc->pages[i];
         } else {
-                in_page = sg->page;
+                in_page = sg_page(sg);
         }
-        desc->infrags[desc->fragno].page = in_page;
+        sg_set_page(&desc->infrags[desc->fragno], in_page, sg->length,
+                    sg->offset);
+        sg_set_page(&desc->outfrags[desc->fragno], sg_page(sg), sg->length,
+                    sg->offset);
         desc->fragno++;
         desc->fraglen += sg->length;
         desc->pos += sg->length;
@@ -210,16 +211,22 @@ encryptor(struct scatterlist *sg, void *data)
         if (thislen == 0)
                 return 0;
 
+        sg_mark_end(&desc->infrags[desc->fragno - 1]);
+        sg_mark_end(&desc->outfrags[desc->fragno - 1]);
+
         ret = crypto_blkcipher_encrypt_iv(&desc->desc, desc->outfrags,
                                           desc->infrags, thislen);
         if (ret)
                 return ret;
+
+        sg_init_table(desc->infrags, 4);
+        sg_init_table(desc->outfrags, 4);
+
         if (fraglen) {
-                desc->outfrags[0].page = sg->page;
-                desc->outfrags[0].offset = sg->offset + sg->length - fraglen;
-                desc->outfrags[0].length = fraglen;
+                sg_set_page(&desc->outfrags[0], sg_page(sg), fraglen,
+                                sg->offset + sg->length - fraglen);
                 desc->infrags[0] = desc->outfrags[0];
-                desc->infrags[0].page = in_page;
+                sg_assign_page(&desc->infrags[0], in_page);
                 desc->fragno = 1;
                 desc->fraglen = fraglen;
         } else {
@@ -248,6 +255,9 @@ gss_encrypt_xdr_buf(struct crypto_blkcipher *tfm, struct xdr_buf *buf,
         desc.fragno = 0;
         desc.fraglen = 0;
 
+        sg_init_table(desc.infrags, 4);
+        sg_init_table(desc.outfrags, 4);
+
         ret = xdr_process_buf(buf, offset, buf->len - offset, encryptor, &desc);
         return ret;
 }
@@ -272,7 +282,8 @@ decryptor(struct scatterlist *sg, void *data)
         /* Worst case is 4 fragments: head, end of page 1, start
          * of page 2, tail.  Anything more is a bug. */
         BUG_ON(desc->fragno > 3);
-        desc->frags[desc->fragno] = *sg;
+        sg_set_page(&desc->frags[desc->fragno], sg_page(sg), sg->length,
+                    sg->offset);
         desc->fragno++;
         desc->fraglen += sg->length;
 
@@ -282,14 +293,18 @@ decryptor(struct scatterlist *sg, void *data)
         if (thislen == 0)
                 return 0;
 
+        sg_mark_end(&desc->frags[desc->fragno - 1]);
+
         ret = crypto_blkcipher_decrypt_iv(&desc->desc, desc->frags,
                                           desc->frags, thislen);
         if (ret)
                 return ret;
+
+        sg_init_table(desc->frags, 4);
+
         if (fraglen) {
-                desc->frags[0].page = sg->page;
-                desc->frags[0].offset = sg->offset + sg->length - fraglen;
-                desc->frags[0].length = fraglen;
+                sg_set_page(&desc->frags[0], sg_page(sg), fraglen,
+                                sg->offset + sg->length - fraglen);
                 desc->fragno = 1;
                 desc->fraglen = fraglen;
         } else {
@@ -314,6 +329,9 @@ gss_decrypt_xdr_buf(struct crypto_blkcipher *tfm, struct xdr_buf *buf,
         desc.desc.flags = 0;
         desc.fragno = 0;
         desc.fraglen = 0;
+
+        sg_init_table(desc.frags, 4);
+
         return xdr_process_buf(buf, offset, buf->len - offset, decryptor, &desc);
 }
 
diff --git a/net/sunrpc/auth_gss/gss_krb5_seal.c b/net/sunrpc/auth_gss/gss_krb5_seal.c
index a0d9faa59cb5..1c6eda5077c1 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seal.c
@@ -63,7 +63,6 @@
 #include <linux/jiffies.h>
 #include <linux/sunrpc/gss_krb5.h>
 #include <linux/random.h>
-#include <asm/scatterlist.h>
 #include <linux/crypto.h>
 
 #ifdef RPC_DEBUG
diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c
index 8bd074df27d3..3bdc527ee64a 100644
--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
+++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
@@ -4,7 +4,6 @@
 #include <linux/sunrpc/gss_krb5.h>
 #include <linux/random.h>
 #include <linux/pagemap.h>
-#include <asm/scatterlist.h>
 #include <linux/crypto.h>
 
 #ifdef RPC_DEBUG
diff --git a/net/sunrpc/auth_gss/gss_spkm3_seal.c b/net/sunrpc/auth_gss/gss_spkm3_seal.c
index d158635de6c0..abf17ce2e3b1 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_seal.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_seal.c
@@ -173,7 +173,7 @@ make_spkm3_checksum(s32 cksumtype, struct xdr_netobj *key, char *header,
         if (err)
                 goto out;
 
-        sg_set_buf(sg, header, hdrlen);
+        sg_init_one(sg, header, hdrlen);
         crypto_hash_update(&desc, sg, sg->length);
 
         xdr_process_buf(body, body_offset, body->len - body_offset,
diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
index 864b541bbf51..2be714e9b382 100644
--- a/net/sunrpc/sysctl.c
+++ b/net/sunrpc/sysctl.c
@@ -87,9 +87,8 @@ proc_dodebug(ctl_table *table, int write, struct file *file,
                         left--, s++;
                 *(unsigned int *) table->data = value;
                 /* Display the RPC tasks on writing to rpc_debug */
-                if (table->ctl_name == CTL_RPCDEBUG) {
+                if (strcmp(table->procname, "rpc_debug") == 0)
                         rpc_show_tasks();
-                }
         } else {
                 if (!access_ok(VERIFY_WRITE, buffer, left))
                         return -EFAULT;
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 6a59180e1667..fdc5e6d7562b 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -1030,6 +1030,8 @@ xdr_process_buf(struct xdr_buf *buf, unsigned int offset, unsigned int len,
         unsigned page_len, thislen, page_offset;
         struct scatterlist      sg[1];
 
+        sg_init_table(sg, 1);
+
         if (offset >= buf->head[0].iov_len) {
                 offset -= buf->head[0].iov_len;
         } else {
@@ -1059,9 +1061,7 @@ xdr_process_buf(struct xdr_buf *buf, unsigned int offset, unsigned int len,
                 do {
                         if (thislen > page_len)
                                 thislen = page_len;
-                        sg->page = buf->pages[i];
-                        sg->offset = page_offset;
-                        sg->length = thislen;
+                        sg_set_page(sg, buf->pages[i], thislen, page_offset);
                         ret = actor(sg, data);
                         if (ret)
                                 goto out;
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 12db63580427..9e11ce715958 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -181,7 +181,7 @@ rpcrdma_create_chunks(struct rpc_rqst *rqst, struct xdr_buf *target,
         struct rpcrdma_read_chunk *cur_rchunk = NULL;
         struct rpcrdma_write_array *warray = NULL;
         struct rpcrdma_write_chunk *cur_wchunk = NULL;
-        u32 *iptr = headerp->rm_body.rm_chunks;
+        __be32 *iptr = headerp->rm_body.rm_chunks;
 
         if (type == rpcrdma_readch || type == rpcrdma_areadch) {
                 /* a read chunk - server will RDMA Read our memory */
@@ -217,25 +217,25 @@ rpcrdma_create_chunks(struct rpc_rqst *rqst, struct xdr_buf *target,
                         cur_rchunk->rc_target.rs_handle = htonl(seg->mr_rkey);
                         cur_rchunk->rc_target.rs_length = htonl(seg->mr_len);
                         xdr_encode_hyper(
-                                        (u32 *)&cur_rchunk->rc_target.rs_offset,
+                                        (__be32 *)&cur_rchunk->rc_target.rs_offset,
                                         seg->mr_base);
                         dprintk("RPC:       %s: read chunk "
                                 "elem %d@0x%llx:0x%x pos %d (%s)\n", __func__,
-                                seg->mr_len, seg->mr_base, seg->mr_rkey, pos,
-                                n < nsegs ? "more" : "last");
+                                seg->mr_len, (unsigned long long)seg->mr_base,
+                                seg->mr_rkey, pos, n < nsegs ? "more" : "last");
                         cur_rchunk++;
                         r_xprt->rx_stats.read_chunk_count++;
                 } else {                /* write/reply */
                         cur_wchunk->wc_target.rs_handle = htonl(seg->mr_rkey);
                         cur_wchunk->wc_target.rs_length = htonl(seg->mr_len);
                         xdr_encode_hyper(
-                                        (u32 *)&cur_wchunk->wc_target.rs_offset,
+                                        (__be32 *)&cur_wchunk->wc_target.rs_offset,
                                         seg->mr_base);
                         dprintk("RPC:       %s: %s chunk "
                                 "elem %d@0x%llx:0x%x (%s)\n", __func__,
                                 (type == rpcrdma_replych) ? "reply" : "write",
-                                seg->mr_len, seg->mr_base, seg->mr_rkey,
-                                n < nsegs ? "more" : "last");
+                                seg->mr_len, (unsigned long long)seg->mr_base,
+                                seg->mr_rkey, n < nsegs ? "more" : "last");
                         cur_wchunk++;
                         if (type == rpcrdma_replych)
                                 r_xprt->rx_stats.reply_chunk_count++;
@@ -257,14 +257,14 @@ rpcrdma_create_chunks(struct rpc_rqst *rqst, struct xdr_buf *target,
          * finish off header. If write, marshal discrim and nchunks.
          */
         if (cur_rchunk) {
-                iptr = (u32 *) cur_rchunk;
+                iptr = (__be32 *) cur_rchunk;
                 *iptr++ = xdr_zero;     /* finish the read chunk list */
                 *iptr++ = xdr_zero;     /* encode a NULL write chunk list */
                 *iptr++ = xdr_zero;     /* encode a NULL reply chunk */
         } else {
                 warray->wc_discrim = xdr_one;
                 warray->wc_nchunks = htonl(nchunks);
-                iptr = (u32 *) cur_wchunk;
+                iptr = (__be32 *) cur_wchunk;
                 if (type == rpcrdma_writech) {
                         *iptr++ = xdr_zero; /* finish the write chunk list */
                         *iptr++ = xdr_zero; /* encode a NULL reply chunk */
@@ -559,7 +559,7 @@ rpcrdma_marshal_req(struct rpc_rqst *rqst)
  * RDMA'd by server. See map at rpcrdma_create_chunks()! :-)
  */
 static int
-rpcrdma_count_chunks(struct rpcrdma_rep *rep, int max, int wrchunk, u32 **iptrp)
+rpcrdma_count_chunks(struct rpcrdma_rep *rep, int max, int wrchunk, __be32 **iptrp)
 {
         unsigned int i, total_len;
         struct rpcrdma_write_chunk *cur_wchunk;
@@ -573,11 +573,11 @@ rpcrdma_count_chunks(struct rpcrdma_rep *rep, int max, int wrchunk, u32 **iptrp)
                 struct rpcrdma_segment *seg = &cur_wchunk->wc_target;
                 ifdebug(FACILITY) {
                         u64 off;
-                        xdr_decode_hyper((u32 *)&seg->rs_offset, &off);
+                        xdr_decode_hyper((__be32 *)&seg->rs_offset, &off);
                         dprintk("RPC:       %s: chunk %d@0x%llx:0x%x\n",
                                 __func__,
                                 ntohl(seg->rs_length),
-                                off,
+                                (unsigned long long)off,
                                 ntohl(seg->rs_handle));
                 }
                 total_len += ntohl(seg->rs_length);
@@ -585,7 +585,7 @@ rpcrdma_count_chunks(struct rpcrdma_rep *rep, int max, int wrchunk, u32 **iptrp)
         }
         /* check and adjust for properly terminated write chunk */
         if (wrchunk) {
-                u32 *w = (u32 *) cur_wchunk;
+                __be32 *w = (__be32 *) cur_wchunk;
                 if (*w++ != xdr_zero)
                         return -1;
                 cur_wchunk = (struct rpcrdma_write_chunk *) w;
@@ -593,7 +593,7 @@ rpcrdma_count_chunks(struct rpcrdma_rep *rep, int max, int wrchunk, u32 **iptrp)
         if ((char *) cur_wchunk > rep->rr_base + rep->rr_len)
                 return -1;
 
-        *iptrp = (u32 *) cur_wchunk;
+        *iptrp = (__be32 *) cur_wchunk;
         return total_len;
 }
 
@@ -721,7 +721,7 @@ rpcrdma_reply_handler(struct rpcrdma_rep *rep)
         struct rpc_rqst *rqst;
         struct rpc_xprt *xprt = rep->rr_xprt;
         struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(xprt);
-        u32 *iptr;
+        __be32 *iptr;
         int i, rdmalen, status;
 
         /* Check status. If bad, signal disconnect and return rep to pool */
@@ -801,7 +801,7 @@ repost:
                         r_xprt->rx_stats.total_rdma_reply += rdmalen;
                 } else {
                         /* else ordinary inline */
-                        iptr = (u32 *)((unsigned char *)headerp + 28);
+                        iptr = (__be32 *)((unsigned char *)headerp + 28);
                         rep->rr_len -= 28; /*sizeof *headerp;*/
                         status = rep->rr_len;
                 }
@@ -816,7 +816,7 @@ repost:
                     headerp->rm_body.rm_chunks[2] != xdr_one ||
                     req->rl_nchunks == 0)
                         goto badheader;
-                iptr = (u32 *)((unsigned char *)headerp + 28);
+                iptr = (__be32 *)((unsigned char *)headerp + 28);
                 rdmalen = rpcrdma_count_chunks(rep, req->rl_nchunks, 0, &iptr);
                 if (rdmalen < 0)
                         goto badheader;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index e36b4b5a5222..6b792265dc06 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -201,7 +201,7 @@ static int tipc_create(struct net *net, struct socket *sock, int protocol)
                 return -EPROTOTYPE;
         }
 
-        sk = sk_alloc(net, AF_TIPC, GFP_KERNEL, &tipc_proto, 1);
+        sk = sk_alloc(net, AF_TIPC, GFP_KERNEL, &tipc_proto);
         if (!sk) {
                 tipc_deleteport(ref);
                 return -ENOMEM;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 9163ec526c2a..515e7a692f9b 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -602,7 +602,7 @@ static struct sock * unix_create1(struct net *net, struct socket *sock)
         if (atomic_read(&unix_nr_socks) >= 2*get_max_files())
                 goto out;
 
-        sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_proto, 1);
+        sk = sk_alloc(net, PF_UNIX, GFP_KERNEL, &unix_proto);
         if (!sk)
                 goto out;
 
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index fc416f9606a9..92cfe8e3e0b8 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -472,7 +472,7 @@ static struct proto x25_proto = {
 static struct sock *x25_alloc_socket(struct net *net)
 {
         struct x25_sock *x25;
-        struct sock *sk = sk_alloc(net, AF_X25, GFP_ATOMIC, &x25_proto, 1);
+        struct sock *sk = sk_alloc(net, AF_X25, GFP_ATOMIC, &x25_proto);
 
         if (!sk)
                 goto out;
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index 5ced62c19c63..1686f64c4352 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/pfkeyv2.h>
 #include <linux/crypto.h>
+#include <linux/scatterlist.h>
 #include <net/xfrm.h>
 #if defined(CONFIG_INET_AH) || defined(CONFIG_INET_AH_MODULE) || defined(CONFIG_INET6_AH) || defined(CONFIG_INET6_AH_MODULE)
 #include <net/ah.h>
@@ -20,7 +21,6 @@
 #if defined(CONFIG_INET_ESP) || defined(CONFIG_INET_ESP_MODULE) || defined(CONFIG_INET6_ESP) || defined(CONFIG_INET6_ESP_MODULE)
 #include <net/esp.h>
 #endif
-#include <asm/scatterlist.h>
 
 /*
  * Algorithms supported by IPsec.  These entries contain properties which
@@ -552,9 +552,7 @@ int skb_icv_walk(const struct sk_buff *skb, struct hash_desc *desc,
                 if (copy > len)
                         copy = len;
 
-                sg.page = virt_to_page(skb->data + offset);
-                sg.offset = (unsigned long)(skb->data + offset) % PAGE_SIZE;
-                sg.length = copy;
+                sg_init_one(&sg, skb->data + offset, copy);
 
                 err = icv_update(desc, &sg, copy);
                 if (unlikely(err))
@@ -577,9 +575,9 @@ int skb_icv_walk(const struct sk_buff *skb, struct hash_desc *desc,
                         if (copy > len)
                                 copy = len;
 
-                        sg.page = frag->page;
-                        sg.offset = frag->page_offset + offset-start;
-                        sg.length = copy;
+                        sg_init_table(&sg, 1);
+                        sg_set_page(&sg, frag->page, copy,
+                                    frag->page_offset + offset-start);
 
                         err = icv_update(desc, &sg, copy);
                         if (unlikely(err))