237 files changed, 7903 insertions, 4651 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 7850412f52b7..969e7004cf86 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -49,11 +49,6 @@ const char vlan_version[] = DRV_VERSION;
 static const char vlan_copyright[] = "Ben Greear <greearb@candelatech.com>";
 static const char vlan_buggyright[] = "David S. Miller <davem@redhat.com>";
 
-static struct packet_type vlan_packet_type __read_mostly = {
-        .type = cpu_to_be16(ETH_P_8021Q),
-        .func = vlan_skb_recv, /* VLAN receive method */
-};
-
 /* End of global variables definitions. */
 
 static void vlan_group_free(struct vlan_group *grp)
@@ -327,10 +322,6 @@ static void vlan_sync_address(struct net_device *dev,
 static void vlan_transfer_features(struct net_device *dev,
                                    struct net_device *vlandev)
 {
-        u32 old_features = vlandev->features;
-
-        vlandev->features &= ~dev->vlan_features;
-        vlandev->features |= dev->features & dev->vlan_features;
         vlandev->gso_max_size = dev->gso_max_size;
 
         if (dev->features & NETIF_F_HW_VLAN_TX)
@@ -341,8 +332,8 @@ static void vlan_transfer_features(struct net_device *dev,
 #if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
         vlandev->fcoe_ddp_xid = dev->fcoe_ddp_xid;
 #endif
-        if (old_features != vlandev->features)
-                netdev_features_change(vlandev);
+
+        netdev_update_features(vlandev);
 }
 
 static void __vlan_device_event(struct net_device *dev, unsigned long event)
@@ -508,6 +499,18 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
         case NETDEV_PRE_TYPE_CHANGE:
                 /* Forbid underlaying device to change its type. */
                 return NOTIFY_BAD;
+
+        case NETDEV_NOTIFY_PEERS:
+        case NETDEV_BONDING_FAILOVER:
+                /* Propagate to vlan devices */
+                for (i = 0; i < VLAN_N_VID; i++) {
+                        vlandev = vlan_group_get_device(grp, i);
+                        if (!vlandev)
+                                continue;
+
+                        call_netdevice_notifiers(event, vlandev);
+                }
+                break;
         }
 
 out:
@@ -688,7 +691,6 @@ static int __init vlan_proto_init(void)
         if (err < 0)
                 goto err4;
 
-        dev_add_pack(&vlan_packet_type);
         vlan_ioctl_set(vlan_ioctl_handler);
         return 0;
 
@@ -709,8 +711,6 @@ static void __exit vlan_cleanup_module(void)
 
         unregister_netdevice_notifier(&vlan_notifier_block);
 
-        dev_remove_pack(&vlan_packet_type);
-
         unregister_pernet_subsys(&vlan_net_ops);
         rcu_barrier(); /* Wait for completion of call_rcu()'s */
 
diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h
index 5687c9b95f33..c3408def8a19 100644
--- a/net/8021q/vlan.h
+++ b/net/8021q/vlan.h
@@ -75,8 +75,6 @@ static inline struct vlan_dev_info *vlan_dev_info(const struct net_device *dev)
 }
 
 /* found in vlan_dev.c */
-int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
-                  struct packet_type *ptype, struct net_device *orig_dev);
 void vlan_dev_set_ingress_priority(const struct net_device *dev,
                                    u32 skb_prio, u16 vlan_prio);
 int vlan_dev_set_egress_priority(const struct net_device *dev,
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index ce8e3ab3e7a5..41495dc2a4c9 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -4,7 +4,7 @@
 #include <linux/netpoll.h>
 #include "vlan.h"
 
-bool vlan_hwaccel_do_receive(struct sk_buff **skbp)
+bool vlan_do_receive(struct sk_buff **skbp)
 {
         struct sk_buff *skb = *skbp;
         u16 vlan_id = skb->vlan_tci & VLAN_VID_MASK;
@@ -88,3 +88,86 @@ gro_result_t vlan_gro_frags(struct napi_struct *napi, struct vlan_group *grp,
         return napi_gro_frags(napi);
 }
 EXPORT_SYMBOL(vlan_gro_frags);
+
+static struct sk_buff *vlan_check_reorder_header(struct sk_buff *skb)
+{
+        if (vlan_dev_info(skb->dev)->flags & VLAN_FLAG_REORDER_HDR) {
+                if (skb_cow(skb, skb_headroom(skb)) < 0)
+                        skb = NULL;
+                if (skb) {
+                        /* Lifted from Gleb's VLAN code... */
+                        memmove(skb->data - ETH_HLEN,
+                                skb->data - VLAN_ETH_HLEN, 12);
+                        skb->mac_header += VLAN_HLEN;
+                }
+        }
+        return skb;
+}
+
+static void vlan_set_encap_proto(struct sk_buff *skb, struct vlan_hdr *vhdr)
+{
+        __be16 proto;
+        unsigned char *rawp;
+
+        /*
+         * Was a VLAN packet, grab the encapsulated protocol, which the layer
+         * three protocols care about.
+         */
+
+        proto = vhdr->h_vlan_encapsulated_proto;
+        if (ntohs(proto) >= 1536) {
+                skb->protocol = proto;
+                return;
+        }
+
+        rawp = skb->data;
+        if (*(unsigned short *) rawp == 0xFFFF)
+                /*
+                 * This is a magic hack to spot IPX packets. Older Novell
+                 * breaks the protocol design and runs IPX over 802.3 without
+                 * an 802.2 LLC layer. We look for FFFF which isn't a used
+                 * 802.2 SSAP/DSAP. This won't work for fault tolerant netware
+                 * but does for the rest.
+                 */
+                skb->protocol = htons(ETH_P_802_3);
+        else
+                /*
+                 * Real 802.2 LLC
+                 */
+                skb->protocol = htons(ETH_P_802_2);
+}
+
+struct sk_buff *vlan_untag(struct sk_buff *skb)
+{
+        struct vlan_hdr *vhdr;
+        u16 vlan_tci;
+
+        if (unlikely(vlan_tx_tag_present(skb))) {
+                /* vlan_tci is already set-up so leave this for another time */
+                return skb;
+        }
+
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (unlikely(!skb))
+                goto err_free;
+
+        if (unlikely(!pskb_may_pull(skb, VLAN_HLEN)))
+                goto err_free;
+
+        vhdr = (struct vlan_hdr *) skb->data;
+        vlan_tci = ntohs(vhdr->h_vlan_TCI);
+        __vlan_hwaccel_put_tag(skb, vlan_tci);
+
+        skb_pull_rcsum(skb, VLAN_HLEN);
+        vlan_set_encap_proto(skb, vhdr);
+
+        skb = vlan_check_reorder_header(skb);
+        if (unlikely(!skb))
+                goto err_free;
+
+        return skb;
+
+err_free:
+        kfree_skb(skb);
+        return NULL;
+}
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index e34ea9e5e28b..d174c312b7f1 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -65,179 +65,6 @@ static int vlan_dev_rebuild_header(struct sk_buff *skb)
         return 0;
 }
 
-static inline struct sk_buff *vlan_check_reorder_header(struct sk_buff *skb)
-{
-        if (vlan_dev_info(skb->dev)->flags & VLAN_FLAG_REORDER_HDR) {
-                if (skb_cow(skb, skb_headroom(skb)) < 0)
-                        skb = NULL;
-                if (skb) {
-                        /* Lifted from Gleb's VLAN code... */
-                        memmove(skb->data - ETH_HLEN,
-                                skb->data - VLAN_ETH_HLEN, 12);
-                        skb->mac_header += VLAN_HLEN;
-                }
-        }
-
-        return skb;
-}
-
-static inline void vlan_set_encap_proto(struct sk_buff *skb,
-                struct vlan_hdr *vhdr)
-{
-        __be16 proto;
-        unsigned char *rawp;
-
-        /*
-         * Was a VLAN packet, grab the encapsulated protocol, which the layer
-         * three protocols care about.
-         */
-
-        proto = vhdr->h_vlan_encapsulated_proto;
-        if (ntohs(proto) >= 1536) {
-                skb->protocol = proto;
-                return;
-        }
-
-        rawp = skb->data;
-        if (*(unsigned short *)rawp == 0xFFFF)
-                /*
-                 * This is a magic hack to spot IPX packets. Older Novell
-                 * breaks the protocol design and runs IPX over 802.3 without
-                 * an 802.2 LLC layer. We look for FFFF which isn't a used
-                 * 802.2 SSAP/DSAP. This won't work for fault tolerant netware
-                 * but does for the rest.
-                 */
-                skb->protocol = htons(ETH_P_802_3);
-        else
-                /*
-                 * Real 802.2 LLC
-                 */
-                skb->protocol = htons(ETH_P_802_2);
-}
-
-/*
- *      Determine the packet's protocol ID. The rule here is that we
- *      assume 802.3 if the type field is short enough to be a length.
- *      This is normal practice and works for any 'now in use' protocol.
- *
- *  Also, at this point we assume that we ARE dealing exclusively with
- *  VLAN packets, or packets that should be made into VLAN packets based
- *  on a default VLAN ID.
- *
- *  NOTE:  Should be similar to ethernet/eth.c.
- *
- *  SANITY NOTE:  This method is called when a packet is moving up the stack
- *                towards userland.  To get here, it would have already passed
- *                through the ethernet/eth.c eth_type_trans() method.
- *  SANITY NOTE 2: We are referencing to the VLAN_HDR frields, which MAY be
- *                 stored UNALIGNED in the memory.  RISC systems don't like
- *                 such cases very much...
- *  SANITY NOTE 2a: According to Dave Miller & Alexey, it will always be
- *                  aligned, so there doesn't need to be any of the unaligned
- *                  stuff.  It has been commented out now...  --Ben
- *
- */
-int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
-                  struct packet_type *ptype, struct net_device *orig_dev)
-{
-        struct vlan_hdr *vhdr;
-        struct vlan_pcpu_stats *rx_stats;
-        struct net_device *vlan_dev;
-        u16 vlan_id;
-        u16 vlan_tci;
-
-        skb = skb_share_check(skb, GFP_ATOMIC);
-        if (skb == NULL)
-                goto err_free;
-
-        if (unlikely(!pskb_may_pull(skb, VLAN_HLEN)))
-                goto err_free;
-
-        vhdr = (struct vlan_hdr *)skb->data;
-        vlan_tci = ntohs(vhdr->h_vlan_TCI);
-        vlan_id = vlan_tci & VLAN_VID_MASK;
-
-        rcu_read_lock();
-        vlan_dev = vlan_find_dev(dev, vlan_id);
-
-        /* If the VLAN device is defined, we use it.
-         * If not, and the VID is 0, it is a 802.1p packet (not
-         * really a VLAN), so we will just netif_rx it later to the
-         * original interface, but with the skb->proto set to the
-         * wrapped proto: we do nothing here.
-         */
-
-        if (!vlan_dev) {
-                if (vlan_id) {
-                        pr_debug("%s: ERROR: No net_device for VID: %u on dev: %s\n",
-                                 __func__, vlan_id, dev->name);
-                        goto err_unlock;
-                }
-                rx_stats = NULL;
-        } else {
-                skb->dev = vlan_dev;
-
-                rx_stats = this_cpu_ptr(vlan_dev_info(skb->dev)->vlan_pcpu_stats);
-
-                u64_stats_update_begin(&rx_stats->syncp);
-                rx_stats->rx_packets++;
-                rx_stats->rx_bytes += skb->len;
-
-                skb->priority = vlan_get_ingress_priority(skb->dev, vlan_tci);
-
-                pr_debug("%s: priority: %u for TCI: %hu\n",
-                         __func__, skb->priority, vlan_tci);
-
-                switch (skb->pkt_type) {
-                case PACKET_BROADCAST:
-                        /* Yeah, stats collect these together.. */
-                        /* stats->broadcast ++; // no such counter :-( */
-                        break;
-
-                case PACKET_MULTICAST:
-                        rx_stats->rx_multicast++;
-                        break;
-
-                case PACKET_OTHERHOST:
-                        /* Our lower layer thinks this is not local, let's make
-                         * sure.
-                         * This allows the VLAN to have a different MAC than the
-                         * underlying device, and still route correctly.
-                         */
-                        if (!compare_ether_addr(eth_hdr(skb)->h_dest,
-                                                skb->dev->dev_addr))
-                                skb->pkt_type = PACKET_HOST;
-                        break;
-                default:
-                        break;
-                }
-                u64_stats_update_end(&rx_stats->syncp);
-        }
-
-        skb_pull_rcsum(skb, VLAN_HLEN);
-        vlan_set_encap_proto(skb, vhdr);
-
-        if (vlan_dev) {
-                skb = vlan_check_reorder_header(skb);
-                if (!skb) {
-                        rx_stats->rx_errors++;
-                        goto err_unlock;
-                }
-        }
-
-        netif_rx(skb);
-
-        rcu_read_unlock();
-        return NET_RX_SUCCESS;
-
-err_unlock:
-        rcu_read_unlock();
-err_free:
-        atomic_long_inc(&dev->rx_dropped);
-        kfree_skb(skb);
-        return NET_RX_DROP;
-}
-
 static inline u16
 vlan_dev_get_egress_qos_mask(struct net_device *dev, struct sk_buff *skb)
 {
@@ -704,8 +531,8 @@ static int vlan_dev_init(struct net_device *dev)
                                           (1<<__LINK_STATE_DORMANT))) |
                       (1<<__LINK_STATE_PRESENT);
 
-        dev->features |= real_dev->features & real_dev->vlan_features;
-        dev->features |= NETIF_F_LLTX;
+        dev->hw_features = real_dev->vlan_features & NETIF_F_ALL_TX_OFFLOADS;
+        dev->features |= real_dev->vlan_features | NETIF_F_LLTX;
         dev->gso_max_size = real_dev->gso_max_size;
 
         /* ipv6 shared card related stuff */
@@ -759,6 +586,17 @@ static void vlan_dev_uninit(struct net_device *dev)
         }
 }
 
+static u32 vlan_dev_fix_features(struct net_device *dev, u32 features)
+{
+        struct net_device *real_dev = vlan_dev_info(dev)->real_dev;
+
+        features &= (real_dev->features | NETIF_F_LLTX);
+        if (dev_ethtool_get_rx_csum(real_dev))
+                features |= NETIF_F_RXCSUM;
+
+        return features;
+}
+
 static int vlan_ethtool_get_settings(struct net_device *dev,
                                      struct ethtool_cmd *cmd)
 {
@@ -774,18 +612,6 @@ static void vlan_ethtool_get_drvinfo(struct net_device *dev,
         strcpy(info->fw_version, "N/A");
 }
 
-static u32 vlan_ethtool_get_rx_csum(struct net_device *dev)
-{
-        const struct vlan_dev_info *vlan = vlan_dev_info(dev);
-        return dev_ethtool_get_rx_csum(vlan->real_dev);
-}
-
-static u32 vlan_ethtool_get_flags(struct net_device *dev)
-{
-        const struct vlan_dev_info *vlan = vlan_dev_info(dev);
-        return dev_ethtool_get_flags(vlan->real_dev);
-}
-
 static struct rtnl_link_stats64 *vlan_dev_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
 {
 
@@ -823,32 +649,10 @@ static struct rtnl_link_stats64 *vlan_dev_get_stats64(struct net_device *dev, st
         return stats;
 }
 
-static int vlan_ethtool_set_tso(struct net_device *dev, u32 data)
-{
-       if (data) {
-                struct net_device *real_dev = vlan_dev_info(dev)->real_dev;
-
-                /* Underlying device must support TSO for VLAN-tagged packets
-                 * and must have TSO enabled now.
-                 */
-                if (!(real_dev->vlan_features & NETIF_F_TSO))
-                        return -EOPNOTSUPP;
-                if (!(real_dev->features & NETIF_F_TSO))
-                        return -EINVAL;
-                dev->features |= NETIF_F_TSO;
-        } else {
-                dev->features &= ~NETIF_F_TSO;
-        }
-        return 0;
-}
-
 static const struct ethtool_ops vlan_ethtool_ops = {
         .get_settings           = vlan_ethtool_get_settings,
         .get_drvinfo            = vlan_ethtool_get_drvinfo,
         .get_link               = ethtool_op_get_link,
-        .get_rx_csum            = vlan_ethtool_get_rx_csum,
-        .get_flags              = vlan_ethtool_get_flags,
-        .set_tso                = vlan_ethtool_set_tso,
 };
 
 static const struct net_device_ops vlan_netdev_ops = {
@@ -874,6 +678,7 @@ static const struct net_device_ops vlan_netdev_ops = {
         .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
         .ndo_fcoe_ddp_target    = vlan_dev_fcoe_ddp_target,
 #endif
+        .ndo_fix_features       = vlan_dev_fix_features,
 };
 
 void vlan_setup(struct net_device *dev)
diff --git a/net/9p/client.c b/net/9p/client.c
index 48b8e084e710..0ce959218607 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -1302,7 +1302,7 @@ int
 p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset,
                                                                 u32 count)
 {
-        int err, rsize, total;
+        int err, rsize;
         struct p9_client *clnt;
         struct p9_req_t *req;
         char *dataptr;
@@ -1311,7 +1311,6 @@ p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset,
                                         (long long unsigned) offset, count);
         err = 0;
         clnt = fid->clnt;
-        total = 0;
 
         rsize = fid->iounit;
         if (!rsize || rsize > clnt->msize-P9_IOHDRSZ)
@@ -1367,7 +1366,7 @@ int
 p9_client_write(struct p9_fid *fid, char *data, const char __user *udata,
                                                         u64 offset, u32 count)
 {
-        int err, rsize, total;
+        int err, rsize;
         struct p9_client *clnt;
         struct p9_req_t *req;
 
@@ -1375,7 +1374,6 @@ p9_client_write(struct p9_fid *fid, char *data, const char __user *udata,
                                 fid->fid, (long long unsigned) offset, count);
         err = 0;
         clnt = fid->clnt;
-        total = 0;
 
         rsize = fid->iounit;
         if (!rsize || rsize > clnt->msize-P9_IOHDRSZ)
@@ -1766,7 +1764,7 @@ EXPORT_SYMBOL_GPL(p9_client_xattrcreate);
 
 int p9_client_readdir(struct p9_fid *fid, char *data, u32 count, u64 offset)
 {
-        int err, rsize, total;
+        int err, rsize;
         struct p9_client *clnt;
         struct p9_req_t *req;
         char *dataptr;
@@ -1776,7 +1774,6 @@ int p9_client_readdir(struct p9_fid *fid, char *data, u32 count, u64 offset)
 
         err = 0;
         clnt = fid->clnt;
-        total = 0;
 
         rsize = fid->iounit;
         if (!rsize || rsize > clnt->msize-P9_READDIRHDRSZ)
diff --git a/net/Kconfig b/net/Kconfig
index 79cabf1ee68b..878151c772c9 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -232,6 +232,20 @@ config XPS
         depends on SMP && SYSFS && USE_GENERIC_SMP_HELPERS
         default y
 
+config HAVE_BPF_JIT
+        bool
+
+config BPF_JIT
+        bool "enable BPF Just In Time compiler"
+        depends on HAVE_BPF_JIT
+        depends on MODULES
+        ---help---
+          Berkeley Packet Filter filtering capabilities are normally handled
+          by an interpreter. This option allows kernel to generate a native
+          code when filter is loaded in memory. This should speedup
+          packet sniffing (libpcap/tcpdump). Note : Admin should enable
+          this feature changing /proc/sys/net/core/bpf_jit_enable
+
 menu "Network testing"
 
 config NET_PKTGEN
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 38754fdb88ba..25073b6ef474 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -129,7 +129,6 @@ static struct net_device *dev_lec[MAX_LEC_ITF];
 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
 static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
 {
-        struct ethhdr *eth;
         char *buff;
         struct lec_priv *priv;
 
@@ -138,7 +137,6 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
          * LE_TOPOLOGY_REQUEST with the same value of Topology Change bit
          * as the Config BPDU has
          */
-        eth = (struct ethhdr *)skb->data;
         buff = skb->data + skb->dev->hard_header_len;
         if (*buff++ == 0x42 && *buff++ == 0x42 && *buff++ == 0x03) {
                 struct sock *sk;
@@ -1180,7 +1178,6 @@ static int __init lane_module_init(void)
 static void __exit lane_module_cleanup(void)
 {
         int i;
-        struct lec_priv *priv;
 
         remove_proc_entry("lec", atm_proc_root);
 
@@ -1188,7 +1185,6 @@ static void __exit lane_module_cleanup(void)
 
         for (i = 0; i < MAX_LEC_ITF; i++) {
                 if (dev_lec[i] != NULL) {
-                        priv = netdev_priv(dev_lec[i]);
                         unregister_netdev(dev_lec[i]);
                         free_netdev(dev_lec[i]);
                         dev_lec[i] = NULL;
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 6da5daeebab7..e7c69f4619ec 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1538,8 +1538,6 @@ static int ax25_sendmsg(struct kiocb *iocb, struct socket *sock,
         }
 
         /* Build a packet */
-        SOCK_DEBUG(sk, "AX.25: sendto: Addresses built. Building packet.\n");
-
         /* Assume the worst case */
         size = len + ax25->ax25_dev->dev->hard_header_len;
 
@@ -1549,8 +1547,6 @@ static int ax25_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         skb_reserve(skb, size - len);
 
-        SOCK_DEBUG(sk, "AX.25: Appending user data\n");
-
         /* User data follows immediately after the AX.25 data */
         if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
                 err = -EFAULT;
@@ -1564,8 +1560,6 @@ static int ax25_sendmsg(struct kiocb *iocb, struct socket *sock,
         if (!ax25->pidincl)
                 *skb_push(skb, 1) = sk->sk_protocol;
 
-        SOCK_DEBUG(sk, "AX.25: Transmitting buffer\n");
-
         if (sk->sk_type == SOCK_SEQPACKET) {
                 /* Connected mode sockets go via the LAPB machine */
                 if (sk->sk_state != TCP_ESTABLISHED) {
@@ -1583,22 +1577,14 @@ static int ax25_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         skb_push(skb, 1 + ax25_addr_size(dp));
 
-        SOCK_DEBUG(sk, "Building AX.25 Header (dp=%p).\n", dp);
-
-        if (dp != NULL)
-                SOCK_DEBUG(sk, "Num digipeaters=%d\n", dp->ndigi);
+        /* Building AX.25 Header */
 
         /* Build an AX.25 header */
         lv = ax25_addr_build(skb->data, &ax25->source_addr, &sax.sax25_call,
                              dp, AX25_COMMAND, AX25_MODULUS);
 
-        SOCK_DEBUG(sk, "Built header (%d bytes)\n",lv);
-
         skb_set_transport_header(skb, lv);
 
-        SOCK_DEBUG(sk, "base=%p pos=%p\n",
-                   skb->data, skb_transport_header(skb));
-
         *skb_transport_header(skb) = AX25_UI;
 
         /* Datagram frames go straight out of the door as UI */
diff --git a/net/ax25/ax25_iface.c b/net/ax25/ax25_iface.c
index 5a0dda8df492..60b545e2822a 100644
--- a/net/ax25/ax25_iface.c
+++ b/net/ax25/ax25_iface.c
@@ -58,7 +58,7 @@ EXPORT_SYMBOL_GPL(ax25_register_pid);
 
 void ax25_protocol_release(unsigned int pid)
 {
-        struct ax25_protocol *s, *protocol;
+        struct ax25_protocol *protocol;
 
         write_lock_bh(&protocol_list_lock);
         protocol = protocol_list;
@@ -72,7 +72,6 @@ void ax25_protocol_release(unsigned int pid)
 
         while (protocol != NULL && protocol->next != NULL) {
                 if (protocol->next->pid == pid) {
-                        s = protocol->next;
                         protocol->next = protocol->next->next;
                         goto out;
                 }
diff --git a/net/batman-adv/aggregation.c b/net/batman-adv/aggregation.c
index af45d6b2031f..c11788c4c1a1 100644
--- a/net/batman-adv/aggregation.c
+++ b/net/batman-adv/aggregation.c
@@ -95,7 +95,6 @@ static bool can_aggregate_with(struct batman_packet *new_batman_packet,
         return false;
 }
 
-#define atomic_dec_not_zero(v)          atomic_add_unless((v), -1, 0)
 /* create a new aggregated packet and add this packet to it */
 static void new_aggregated_packet(unsigned char *packet_buff, int packet_len,
                                   unsigned long send_time, bool direct_link,
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index 3cc43558cf9c..65f39530799d 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -23,6 +23,7 @@
 #include "gateway_client.h"
 #include "gateway_common.h"
 #include "hard-interface.h"
+#include "originator.h"
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/udp.h>
@@ -42,61 +43,76 @@ static void gw_node_free_ref(struct gw_node *gw_node)
                 call_rcu(&gw_node->rcu, gw_node_free_rcu);
 }
 
-void *gw_get_selected(struct bat_priv *bat_priv)
+static struct gw_node *gw_get_selected_gw_node(struct bat_priv *bat_priv)
 {
-        struct gw_node *curr_gateway_tmp;
-        struct orig_node *orig_node = NULL;
+        struct gw_node *gw_node;
 
         rcu_read_lock();
-        curr_gateway_tmp = rcu_dereference(bat_priv->curr_gw);
-        if (!curr_gateway_tmp)
-                goto out;
-
-        orig_node = curr_gateway_tmp->orig_node;
-        if (!orig_node)
+        gw_node = rcu_dereference(bat_priv->curr_gw);
+        if (!gw_node)
                 goto out;
 
-        if (!atomic_inc_not_zero(&orig_node->refcount))
-                orig_node = NULL;
+        if (!atomic_inc_not_zero(&gw_node->refcount))
+                gw_node = NULL;
 
 out:
         rcu_read_unlock();
-        return orig_node;
+        return gw_node;
 }
 
-void gw_deselect(struct bat_priv *bat_priv)
+struct orig_node *gw_get_selected_orig(struct bat_priv *bat_priv)
 {
         struct gw_node *gw_node;
+        struct orig_node *orig_node = NULL;
 
-        spin_lock_bh(&bat_priv->gw_list_lock);
-        gw_node = rcu_dereference(bat_priv->curr_gw);
-        rcu_assign_pointer(bat_priv->curr_gw, NULL);
-        spin_unlock_bh(&bat_priv->gw_list_lock);
+        gw_node = gw_get_selected_gw_node(bat_priv);
+        if (!gw_node)
+                goto out;
+
+        rcu_read_lock();
+        orig_node = gw_node->orig_node;
+        if (!orig_node)
+                goto unlock;
+
+        if (!atomic_inc_not_zero(&orig_node->refcount))
+                orig_node = NULL;
 
+unlock:
+        rcu_read_unlock();
+out:
         if (gw_node)
                 gw_node_free_ref(gw_node);
+        return orig_node;
 }
 
 static void gw_select(struct bat_priv *bat_priv, struct gw_node *new_gw_node)
 {
         struct gw_node *curr_gw_node;
 
+        spin_lock_bh(&bat_priv->gw_list_lock);
+
         if (new_gw_node && !atomic_inc_not_zero(&new_gw_node->refcount))
                 new_gw_node = NULL;
 
-        spin_lock_bh(&bat_priv->gw_list_lock);
-        curr_gw_node = rcu_dereference(bat_priv->curr_gw);
+        curr_gw_node = bat_priv->curr_gw;
         rcu_assign_pointer(bat_priv->curr_gw, new_gw_node);
-        spin_unlock_bh(&bat_priv->gw_list_lock);
 
         if (curr_gw_node)
                 gw_node_free_ref(curr_gw_node);
+
+        spin_unlock_bh(&bat_priv->gw_list_lock);
+}
+
+void gw_deselect(struct bat_priv *bat_priv)
+{
+        gw_select(bat_priv, NULL);
 }
 
 void gw_election(struct bat_priv *bat_priv)
 {
         struct hlist_node *node;
-        struct gw_node *gw_node, *curr_gw, *curr_gw_tmp = NULL;
+        struct gw_node *gw_node, *curr_gw = NULL, *curr_gw_tmp = NULL;
+        struct neigh_node *router;
         uint8_t max_tq = 0;
         uint32_t max_gw_factor = 0, tmp_gw_factor = 0;
         int down, up;
@@ -110,32 +126,25 @@ void gw_election(struct bat_priv *bat_priv)
         if (atomic_read(&bat_priv->gw_mode) != GW_MODE_CLIENT)
                 return;
 
-        rcu_read_lock();
-        curr_gw = rcu_dereference(bat_priv->curr_gw);
-        if (curr_gw) {
-                rcu_read_unlock();
-                return;
-        }
+        curr_gw = gw_get_selected_gw_node(bat_priv);
+        if (curr_gw)
+                goto out;
 
+        rcu_read_lock();
         if (hlist_empty(&bat_priv->gw_list)) {
-
-                if (curr_gw) {
-                        rcu_read_unlock();
-                        bat_dbg(DBG_BATMAN, bat_priv,
-                                "Removing selected gateway - "
-                                "no gateway in range\n");
-                        gw_deselect(bat_priv);
-                } else
-                        rcu_read_unlock();
-
-                return;
+                bat_dbg(DBG_BATMAN, bat_priv,
+                        "Removing selected gateway - "
+                        "no gateway in range\n");
+                gw_deselect(bat_priv);
+                goto unlock;
         }
 
         hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw_list, list) {
-                if (!gw_node->orig_node->router)
+                if (gw_node->deleted)
                         continue;
 
-                if (gw_node->deleted)
+                router = orig_node_get_router(gw_node->orig_node);
+                if (!router)
                         continue;
 
                 switch (atomic_read(&bat_priv->gw_sel_class)) {
@@ -143,15 +152,14 @@ void gw_election(struct bat_priv *bat_priv)
                         gw_bandwidth_to_kbit(gw_node->orig_node->gw_flags,
                                              &down, &up);
 
-                        tmp_gw_factor = (gw_node->orig_node->router->tq_avg *
-                                         gw_node->orig_node->router->tq_avg *
+                        tmp_gw_factor = (router->tq_avg * router->tq_avg *
                                          down * 100 * 100) /
                                          (TQ_LOCAL_WINDOW_SIZE *
                                          TQ_LOCAL_WINDOW_SIZE * 64);
 
                         if ((tmp_gw_factor > max_gw_factor) ||
                             ((tmp_gw_factor == max_gw_factor) &&
-                             (gw_node->orig_node->router->tq_avg > max_tq)))
+                             (router->tq_avg > max_tq)))
                                 curr_gw_tmp = gw_node;
                         break;
 
@@ -163,19 +171,25 @@ void gw_election(struct bat_priv *bat_priv)
                           *     soon as a better gateway appears which has
                           *     $routing_class more tq points)
                           **/
-                        if (gw_node->orig_node->router->tq_avg > max_tq)
+                        if (router->tq_avg > max_tq)
                                 curr_gw_tmp = gw_node;
                         break;
                 }
 
-                if (gw_node->orig_node->router->tq_avg > max_tq)
-                        max_tq = gw_node->orig_node->router->tq_avg;
+                if (router->tq_avg > max_tq)
+                        max_tq = router->tq_avg;
 
                 if (tmp_gw_factor > max_gw_factor)
                         max_gw_factor = tmp_gw_factor;
+
+                neigh_node_free_ref(router);
         }
 
         if (curr_gw != curr_gw_tmp) {
+                router = orig_node_get_router(curr_gw_tmp->orig_node);
+                if (!router)
+                        goto unlock;
+
                 if ((curr_gw) && (!curr_gw_tmp))
                         bat_dbg(DBG_BATMAN, bat_priv,
                                 "Removing selected gateway - "
@@ -186,48 +200,50 @@ void gw_election(struct bat_priv *bat_priv)
                                 "(gw_flags: %i, tq: %i)\n",
                                 curr_gw_tmp->orig_node->orig,
                                 curr_gw_tmp->orig_node->gw_flags,
-                                curr_gw_tmp->orig_node->router->tq_avg);
+                                router->tq_avg);
                 else
                         bat_dbg(DBG_BATMAN, bat_priv,
                                 "Changing route to gateway %pM "
                                 "(gw_flags: %i, tq: %i)\n",
                                 curr_gw_tmp->orig_node->orig,
                                 curr_gw_tmp->orig_node->gw_flags,
-                                curr_gw_tmp->orig_node->router->tq_avg);
+                                router->tq_avg);
 
+                neigh_node_free_ref(router);
                 gw_select(bat_priv, curr_gw_tmp);
         }
 
+unlock:
         rcu_read_unlock();
+out:
+        if (curr_gw)
+                gw_node_free_ref(curr_gw);
 }
 
 void gw_check_election(struct bat_priv *bat_priv, struct orig_node *orig_node)
 {
-        struct gw_node *curr_gateway_tmp;
+        struct orig_node *curr_gw_orig;
+        struct neigh_node *router_gw = NULL, *router_orig = NULL;
         uint8_t gw_tq_avg, orig_tq_avg;
 
-        rcu_read_lock();
-        curr_gateway_tmp = rcu_dereference(bat_priv->curr_gw);
-        if (!curr_gateway_tmp)
-                goto out_rcu;
-
-        if (!curr_gateway_tmp->orig_node)
-                goto deselect_rcu;
+        curr_gw_orig = gw_get_selected_orig(bat_priv);
+        if (!curr_gw_orig)
+                goto deselect;
 
-        if (!curr_gateway_tmp->orig_node->router)
-                goto deselect_rcu;
+        router_gw = orig_node_get_router(curr_gw_orig);
+        if (!router_gw)
+                goto deselect;
 
         /* this node already is the gateway */
-        if (curr_gateway_tmp->orig_node == orig_node)
-                goto out_rcu;
-
-        if (!orig_node->router)
-                goto out_rcu;
+        if (curr_gw_orig == orig_node)
+                goto out;
 
-        gw_tq_avg = curr_gateway_tmp->orig_node->router->tq_avg;
-        rcu_read_unlock();
+        router_orig = orig_node_get_router(orig_node);
+        if (!router_orig)
+                goto out;
 
-        orig_tq_avg = orig_node->router->tq_avg;
+        gw_tq_avg = router_gw->tq_avg;
+        orig_tq_avg = router_orig->tq_avg;
 
         /* the TQ value has to be better */
         if (orig_tq_avg < gw_tq_avg)
@@ -245,16 +261,17 @@ void gw_check_election(struct bat_priv *bat_priv, struct orig_node *orig_node)
                 "Restarting gateway selection: better gateway found (tq curr: "
                 "%i, tq new: %i)\n",
                 gw_tq_avg, orig_tq_avg);
-        goto deselect;
 
-out_rcu:
-        rcu_read_unlock();
-        goto out;
-deselect_rcu:
-        rcu_read_unlock();
 deselect:
         gw_deselect(bat_priv);
 out:
+        if (curr_gw_orig)
+                orig_node_free_ref(curr_gw_orig);
+        if (router_gw)
+                neigh_node_free_ref(router_gw);
+        if (router_orig)
+                neigh_node_free_ref(router_orig);
+
         return;
 }
 
@@ -291,7 +308,15 @@ void gw_node_update(struct bat_priv *bat_priv,
                     struct orig_node *orig_node, uint8_t new_gwflags)
 {
         struct hlist_node *node;
-        struct gw_node *gw_node;
+        struct gw_node *gw_node, *curr_gw;
+
+        /**
+         * Note: We don't need a NULL check here, since curr_gw never gets
+         * dereferenced. If curr_gw is NULL we also should not exit as we may
+         * have this gateway in our list (duplication check!) even though we
+         * have no currently selected gateway.
+         */
+        curr_gw = gw_get_selected_gw_node(bat_priv);
 
         rcu_read_lock();
         hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw_list, list) {
@@ -312,22 +337,26 @@ void gw_node_update(struct bat_priv *bat_priv,
                                 "Gateway %pM removed from gateway list\n",
                                 orig_node->orig);
 
-                        if (gw_node == rcu_dereference(bat_priv->curr_gw)) {
-                                rcu_read_unlock();
-                                gw_deselect(bat_priv);
-                                return;
-                        }
+                        if (gw_node == curr_gw)
+                                goto deselect;
                 }
 
-                rcu_read_unlock();
-                return;
+                goto unlock;
         }
-        rcu_read_unlock();
 
         if (new_gwflags == 0)
-                return;
+                goto unlock;
 
         gw_node_add(bat_priv, orig_node, new_gwflags);
+        goto unlock;
+
+deselect:
+        gw_deselect(bat_priv);
+unlock:
+        rcu_read_unlock();
+
+        if (curr_gw)
+                gw_node_free_ref(curr_gw);
 }
 
 void gw_node_delete(struct bat_priv *bat_priv, struct orig_node *orig_node)
@@ -337,9 +366,12 @@ void gw_node_delete(struct bat_priv *bat_priv, struct orig_node *orig_node)
 
 void gw_node_purge(struct bat_priv *bat_priv)
 {
-        struct gw_node *gw_node;
+        struct gw_node *gw_node, *curr_gw;
         struct hlist_node *node, *node_tmp;
         unsigned long timeout = 2 * PURGE_TIMEOUT * HZ;
+        char do_deselect = 0;
+
+        curr_gw = gw_get_selected_gw_node(bat_priv);
 
         spin_lock_bh(&bat_priv->gw_list_lock);
 
@@ -350,41 +382,56 @@ void gw_node_purge(struct bat_priv *bat_priv)
                     atomic_read(&bat_priv->mesh_state) == MESH_ACTIVE)
                         continue;
 
-                if (rcu_dereference(bat_priv->curr_gw) == gw_node)
-                        gw_deselect(bat_priv);
+                if (curr_gw == gw_node)
+                        do_deselect = 1;
 
                 hlist_del_rcu(&gw_node->list);
                 gw_node_free_ref(gw_node);
         }
 
-
         spin_unlock_bh(&bat_priv->gw_list_lock);
+
+        /* gw_deselect() needs to acquire the gw_list_lock */
+        if (do_deselect)
+                gw_deselect(bat_priv);
+
+        if (curr_gw)
+                gw_node_free_ref(curr_gw);
 }
 
+/**
+ * fails if orig_node has no router
+ */
 static int _write_buffer_text(struct bat_priv *bat_priv,
                               struct seq_file *seq, struct gw_node *gw_node)
 {
         struct gw_node *curr_gw;
-        int down, up, ret;
+        struct neigh_node *router;
+        int down, up, ret = -1;
 
         gw_bandwidth_to_kbit(gw_node->orig_node->gw_flags, &down, &up);
 
-        rcu_read_lock();
-        curr_gw = rcu_dereference(bat_priv->curr_gw);
+        router = orig_node_get_router(gw_node->orig_node);
+        if (!router)
+                goto out;
 
-        ret = seq_printf(seq, "%s %pM (%3i) %pM [%10s]: %3i - %i%s/%i%s\n",
-                       (curr_gw == gw_node ? "=>" : "  "),
-                       gw_node->orig_node->orig,
-                       gw_node->orig_node->router->tq_avg,
-                       gw_node->orig_node->router->addr,
-                       gw_node->orig_node->router->if_incoming->net_dev->name,
-                       gw_node->orig_node->gw_flags,
-                       (down > 2048 ? down / 1024 : down),
-                       (down > 2048 ? "MBit" : "KBit"),
-                       (up > 2048 ? up / 1024 : up),
-                       (up > 2048 ? "MBit" : "KBit"));
+        curr_gw = gw_get_selected_gw_node(bat_priv);
 
-        rcu_read_unlock();
+        ret = seq_printf(seq, "%s %pM (%3i) %pM [%10s]: %3i - %i%s/%i%s\n",
+                         (curr_gw == gw_node ? "=>" : "  "),
+                         gw_node->orig_node->orig,
+                         router->tq_avg, router->addr,
+                         router->if_incoming->net_dev->name,
+                         gw_node->orig_node->gw_flags,
+                         (down > 2048 ? down / 1024 : down),
+                         (down > 2048 ? "MBit" : "KBit"),
+                         (up > 2048 ? up / 1024 : up),
+                         (up > 2048 ? "MBit" : "KBit"));
+
+        neigh_node_free_ref(router);
+        if (curr_gw)
+                gw_node_free_ref(curr_gw);
+out:
         return ret;
 }
 
@@ -392,40 +439,42 @@ int gw_client_seq_print_text(struct seq_file *seq, void *offset)
 {
         struct net_device *net_dev = (struct net_device *)seq->private;
         struct bat_priv *bat_priv = netdev_priv(net_dev);
+        struct hard_iface *primary_if;
         struct gw_node *gw_node;
         struct hlist_node *node;
-        int gw_count = 0;
-
-        if (!bat_priv->primary_if) {
+        int gw_count = 0, ret = 0;
 
-                return seq_printf(seq, "BATMAN mesh %s disabled - please "
-                                  "specify interfaces to enable it\n",
-                                  net_dev->name);
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if) {
+                ret = seq_printf(seq, "BATMAN mesh %s disabled - please "
+                                 "specify interfaces to enable it\n",
+                                 net_dev->name);
+                goto out;
         }
 
-        if (bat_priv->primary_if->if_status != IF_ACTIVE) {
-
-                return seq_printf(seq, "BATMAN mesh %s disabled - "
-                                       "primary interface not active\n",
-                                       net_dev->name);
+        if (primary_if->if_status != IF_ACTIVE) {
+                ret = seq_printf(seq, "BATMAN mesh %s disabled - "
+                                 "primary interface not active\n",
+                                 net_dev->name);
+                goto out;
         }
 
         seq_printf(seq, "      %-12s (%s/%i) %17s [%10s]: gw_class ... "
                    "[B.A.T.M.A.N. adv %s%s, MainIF/MAC: %s/%pM (%s)]\n",
                    "Gateway", "#", TQ_MAX_VALUE, "Nexthop",
                    "outgoingIF", SOURCE_VERSION, REVISION_VERSION_STR,
-                   bat_priv->primary_if->net_dev->name,
-                   bat_priv->primary_if->net_dev->dev_addr, net_dev->name);
+                   primary_if->net_dev->name,
+                   primary_if->net_dev->dev_addr, net_dev->name);
 
         rcu_read_lock();
         hlist_for_each_entry_rcu(gw_node, node, &bat_priv->gw_list, list) {
                 if (gw_node->deleted)
                         continue;
 
-                if (!gw_node->orig_node->router)
+                /* fails if orig_node has no router */
+                if (_write_buffer_text(bat_priv, seq, gw_node) < 0)
                         continue;
 
-                _write_buffer_text(bat_priv, seq, gw_node);
                 gw_count++;
         }
         rcu_read_unlock();
@@ -433,7 +482,10 @@ int gw_client_seq_print_text(struct seq_file *seq, void *offset)
         if (gw_count == 0)
                 seq_printf(seq, "No gateways in range ...\n");
 
-        return 0;
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
+        return ret;
 }
 
 int gw_is_target(struct bat_priv *bat_priv, struct sk_buff *skb)
@@ -442,6 +494,7 @@ int gw_is_target(struct bat_priv *bat_priv, struct sk_buff *skb)
         struct iphdr *iphdr;
         struct ipv6hdr *ipv6hdr;
         struct udphdr *udphdr;
+        struct gw_node *curr_gw;
         unsigned int header_len = 0;
 
         if (atomic_read(&bat_priv->gw_mode) == GW_MODE_OFF)
@@ -506,12 +559,11 @@ int gw_is_target(struct bat_priv *bat_priv, struct sk_buff *skb)
         if (atomic_read(&bat_priv->gw_mode) == GW_MODE_SERVER)
                 return -1;
 
-        rcu_read_lock();
-        if (!rcu_dereference(bat_priv->curr_gw)) {
-                rcu_read_unlock();
+        curr_gw = gw_get_selected_gw_node(bat_priv);
+        if (!curr_gw)
                 return 0;
-        }
-        rcu_read_unlock();
 
+        if (curr_gw)
+                gw_node_free_ref(curr_gw);
         return 1;
 }
diff --git a/net/batman-adv/gateway_client.h b/net/batman-adv/gateway_client.h
index 2aa439124ee3..1ce8c6066da1 100644
--- a/net/batman-adv/gateway_client.h
+++ b/net/batman-adv/gateway_client.h
@@ -24,7 +24,7 @@
 
 void gw_deselect(struct bat_priv *bat_priv);
 void gw_election(struct bat_priv *bat_priv);
-void *gw_get_selected(struct bat_priv *bat_priv);
+struct orig_node *gw_get_selected_orig(struct bat_priv *bat_priv);
 void gw_check_election(struct bat_priv *bat_priv, struct orig_node *orig_node);
 void gw_node_update(struct bat_priv *bat_priv,
                     struct orig_node *orig_node, uint8_t new_gwflags);
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index b3058e46ee6b..3e888f133d75 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -110,47 +110,60 @@ out:
         return hard_iface;
 }
 
-static void update_primary_addr(struct bat_priv *bat_priv)
+static void primary_if_update_addr(struct bat_priv *bat_priv)
 {
         struct vis_packet *vis_packet;
+        struct hard_iface *primary_if;
+
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if)
+                goto out;
 
         vis_packet = (struct vis_packet *)
                                 bat_priv->my_vis_info->skb_packet->data;
-        memcpy(vis_packet->vis_orig,
-               bat_priv->primary_if->net_dev->dev_addr, ETH_ALEN);
+        memcpy(vis_packet->vis_orig, primary_if->net_dev->dev_addr, ETH_ALEN);
         memcpy(vis_packet->sender_orig,
-               bat_priv->primary_if->net_dev->dev_addr, ETH_ALEN);
+               primary_if->net_dev->dev_addr, ETH_ALEN);
+
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
 }
 
-static void set_primary_if(struct bat_priv *bat_priv,
-                           struct hard_iface *hard_iface)
+static void primary_if_select(struct bat_priv *bat_priv,
+                              struct hard_iface *new_hard_iface)
 {
+        struct hard_iface *curr_hard_iface;
         struct batman_packet *batman_packet;
-        struct hard_iface *old_if;
 
-        if (hard_iface && !atomic_inc_not_zero(&hard_iface->refcount))
-                hard_iface = NULL;
+        spin_lock_bh(&hardif_list_lock);
 
-        old_if = bat_priv->primary_if;
-        bat_priv->primary_if = hard_iface;
+        if (new_hard_iface && !atomic_inc_not_zero(&new_hard_iface->refcount))
+                new_hard_iface = NULL;
 
-        if (old_if)
-                hardif_free_ref(old_if);
+        curr_hard_iface = bat_priv->primary_if;
+        rcu_assign_pointer(bat_priv->primary_if, new_hard_iface);
 
-        if (!bat_priv->primary_if)
-                return;
+        if (curr_hard_iface)
+                hardif_free_ref(curr_hard_iface);
 
-        batman_packet = (struct batman_packet *)(hard_iface->packet_buff);
+        if (!new_hard_iface)
+                goto out;
+
+        batman_packet = (struct batman_packet *)(new_hard_iface->packet_buff);
         batman_packet->flags = PRIMARIES_FIRST_HOP;
         batman_packet->ttl = TTL;
 
-        update_primary_addr(bat_priv);
+        primary_if_update_addr(bat_priv);
 
         /***
          * hacky trick to make sure that we send the HNA information via
          * our new primary interface
          */
         atomic_set(&bat_priv->hna_local_changed, 1);
+
+out:
+        spin_unlock_bh(&hardif_list_lock);
 }
 
 static bool hardif_is_iface_up(struct hard_iface *hard_iface)
@@ -236,9 +249,10 @@ void update_min_mtu(struct net_device *soft_iface)
 static void hardif_activate_interface(struct hard_iface *hard_iface)
 {
         struct bat_priv *bat_priv;
+        struct hard_iface *primary_if = NULL;
 
         if (hard_iface->if_status != IF_INACTIVE)
-                return;
+                goto out;
 
         bat_priv = netdev_priv(hard_iface->soft_iface);
 
@@ -249,14 +263,18 @@ static void hardif_activate_interface(struct hard_iface *hard_iface)
          * the first active interface becomes our primary interface or
          * the next active interface after the old primay interface was removed
          */
-        if (!bat_priv->primary_if)
-                set_primary_if(bat_priv, hard_iface);
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if)
+                primary_if_select(bat_priv, hard_iface);
 
         bat_info(hard_iface->soft_iface, "Interface activated: %s\n",
                  hard_iface->net_dev->name);
 
         update_min_mtu(hard_iface->soft_iface);
-        return;
+
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
 }
 
 static void hardif_deactivate_interface(struct hard_iface *hard_iface)
@@ -386,12 +404,13 @@ err:
 void hardif_disable_interface(struct hard_iface *hard_iface)
 {
         struct bat_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
+        struct hard_iface *primary_if = NULL;
 
         if (hard_iface->if_status == IF_ACTIVE)
                 hardif_deactivate_interface(hard_iface);
 
         if (hard_iface->if_status != IF_INACTIVE)
-                return;
+                goto out;
 
         bat_info(hard_iface->soft_iface, "Removing interface: %s\n",
                  hard_iface->net_dev->name);
@@ -400,11 +419,12 @@ void hardif_disable_interface(struct hard_iface *hard_iface)
         bat_priv->num_ifaces--;
         orig_hash_del_if(hard_iface, bat_priv->num_ifaces);
 
-        if (hard_iface == bat_priv->primary_if) {
+        primary_if = primary_if_get_selected(bat_priv);
+        if (hard_iface == primary_if) {
                 struct hard_iface *new_if;
 
                 new_if = hardif_get_active(hard_iface->soft_iface);
-                set_primary_if(bat_priv, new_if);
+                primary_if_select(bat_priv, new_if);
 
                 if (new_if)
                         hardif_free_ref(new_if);
@@ -425,6 +445,10 @@ void hardif_disable_interface(struct hard_iface *hard_iface)
 
         hard_iface->soft_iface = NULL;
         hardif_free_ref(hard_iface);
+
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
 }
 
 static struct hard_iface *hardif_add_interface(struct net_device *net_dev)
@@ -514,6 +538,7 @@ static int hard_if_event(struct notifier_block *this,
 {
         struct net_device *net_dev = (struct net_device *)ptr;
         struct hard_iface *hard_iface = hardif_get_by_netdev(net_dev);
+        struct hard_iface *primary_if = NULL;
         struct bat_priv *bat_priv;
 
         if (!hard_iface && event == NETDEV_REGISTER)
@@ -549,8 +574,12 @@ static int hard_if_event(struct notifier_block *this,
                 update_mac_addresses(hard_iface);
 
                 bat_priv = netdev_priv(hard_iface->soft_iface);
-                if (hard_iface == bat_priv->primary_if)
-                        update_primary_addr(bat_priv);
+                primary_if = primary_if_get_selected(bat_priv);
+                if (!primary_if)
+                        goto hardif_put;
+
+                if (hard_iface == primary_if)
+                        primary_if_update_addr(bat_priv);
                 break;
         default:
                 break;
@@ -559,6 +588,8 @@ static int hard_if_event(struct notifier_block *this,
 hardif_put:
         hardif_free_ref(hard_iface);
 out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
         return NOTIFY_DONE;
 }
 
diff --git a/net/batman-adv/hard-interface.h b/net/batman-adv/hard-interface.h
index a9ddf36e51c8..64265991460b 100644
--- a/net/batman-adv/hard-interface.h
+++ b/net/batman-adv/hard-interface.h
@@ -45,4 +45,22 @@ static inline void hardif_free_ref(struct hard_iface *hard_iface)
                 call_rcu(&hard_iface->rcu, hardif_free_rcu);
 }
 
+static inline struct hard_iface *primary_if_get_selected(
+                                                struct bat_priv *bat_priv)
+{
+        struct hard_iface *hard_iface;
+
+        rcu_read_lock();
+        hard_iface = rcu_dereference(bat_priv->primary_if);
+        if (!hard_iface)
+                goto out;
+
+        if (!atomic_inc_not_zero(&hard_iface->refcount))
+                hard_iface = NULL;
+
+out:
+        rcu_read_unlock();
+        return hard_iface;
+}
+
 #endif /* _NET_BATMAN_ADV_HARD_INTERFACE_H_ */
diff --git a/net/batman-adv/icmp_socket.c b/net/batman-adv/icmp_socket.c
index 34ce56c358e5..fa22ba2bb832 100644
--- a/net/batman-adv/icmp_socket.c
+++ b/net/batman-adv/icmp_socket.c
@@ -153,6 +153,7 @@ static ssize_t bat_socket_write(struct file *file, const char __user *buff,
 {
         struct socket_client *socket_client = file->private_data;
         struct bat_priv *bat_priv = socket_client->bat_priv;
+        struct hard_iface *primary_if = NULL;
         struct sk_buff *skb;
         struct icmp_packet_rr *icmp_packet;
 
@@ -167,15 +168,21 @@ static ssize_t bat_socket_write(struct file *file, const char __user *buff,
                 return -EINVAL;
         }
 
-        if (!bat_priv->primary_if)
-                return -EFAULT;
+        primary_if = primary_if_get_selected(bat_priv);
+
+        if (!primary_if) {
+                len = -EFAULT;
+                goto out;
+        }
 
         if (len >= sizeof(struct icmp_packet_rr))
                 packet_len = sizeof(struct icmp_packet_rr);
 
         skb = dev_alloc_skb(packet_len + sizeof(struct ethhdr));
-        if (!skb)
-                return -ENOMEM;
+        if (!skb) {
+                len = -ENOMEM;
+                goto out;
+        }
 
         skb_reserve(skb, sizeof(struct ethhdr));
         icmp_packet = (struct icmp_packet_rr *)skb_put(skb, packet_len);
@@ -218,23 +225,13 @@ static ssize_t bat_socket_write(struct file *file, const char __user *buff,
         if (atomic_read(&bat_priv->mesh_state) != MESH_ACTIVE)
                 goto dst_unreach;
 
-        rcu_read_lock();
         orig_node = orig_hash_find(bat_priv, icmp_packet->dst);
-
         if (!orig_node)
-                goto unlock;
-
-        neigh_node = orig_node->router;
+                goto dst_unreach;
 
+        neigh_node = orig_node_get_router(orig_node);
         if (!neigh_node)
-                goto unlock;
-
-        if (!atomic_inc_not_zero(&neigh_node->refcount)) {
-                neigh_node = NULL;
-                goto unlock;
-        }
-
-        rcu_read_unlock();
+                goto dst_unreach;
 
         if (!neigh_node->if_incoming)
                 goto dst_unreach;
@@ -243,7 +240,7 @@ static ssize_t bat_socket_write(struct file *file, const char __user *buff,
                 goto dst_unreach;
 
         memcpy(icmp_packet->orig,
-               bat_priv->primary_if->net_dev->dev_addr, ETH_ALEN);
+               primary_if->net_dev->dev_addr, ETH_ALEN);
 
         if (packet_len == sizeof(struct icmp_packet_rr))
                 memcpy(icmp_packet->rr,
@@ -252,14 +249,14 @@ static ssize_t bat_socket_write(struct file *file, const char __user *buff,
         send_skb_packet(skb, neigh_node->if_incoming, neigh_node->addr);
         goto out;
 
-unlock:
-        rcu_read_unlock();
 dst_unreach:
         icmp_packet->msg_type = DESTINATION_UNREACHABLE;
         bat_socket_add_packet(socket_client, icmp_packet, packet_len);
 free_skb:
         kfree_skb(skb);
 out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
         if (neigh_node)
                 neigh_node_free_ref(neigh_node);
         if (orig_node)
diff --git a/net/batman-adv/main.h b/net/batman-adv/main.h
index dc248697de71..ace72852ed7b 100644
--- a/net/batman-adv/main.h
+++ b/net/batman-adv/main.h
@@ -175,4 +175,6 @@ static inline int compare_eth(void *data1, void *data2)
         return (memcmp(data1, data2, ETH_ALEN) == 0 ? 1 : 0);
 }
 
+#define atomic_dec_not_zero(v)  atomic_add_unless((v), -1, 0)
+
 #endif /* _NET_BATMAN_ADV_MAIN_H_ */
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 0b9133022d2d..ef4a9be7613a 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -70,6 +70,21 @@ void neigh_node_free_ref(struct neigh_node *neigh_node)
                 call_rcu(&neigh_node->rcu, neigh_node_free_rcu);
 }
 
+/* increases the refcounter of a found router */
+struct neigh_node *orig_node_get_router(struct orig_node *orig_node)
+{
+        struct neigh_node *router;
+
+        rcu_read_lock();
+        router = rcu_dereference(orig_node->router);
+
+        if (router && !atomic_inc_not_zero(&router->refcount))
+                router = NULL;
+
+        rcu_read_unlock();
+        return router;
+}
+
 struct neigh_node *create_neighbor(struct orig_node *orig_node,
                                    struct orig_node *orig_neigh_node,
                                    uint8_t *neigh,
@@ -87,6 +102,7 @@ struct neigh_node *create_neighbor(struct orig_node *orig_node,
 
         INIT_HLIST_NODE(&neigh_node->list);
         INIT_LIST_HEAD(&neigh_node->bonding_list);
+        spin_lock_init(&neigh_node->tq_lock);
 
         memcpy(neigh_node->addr, neigh, ETH_ALEN);
         neigh_node->orig_node = orig_neigh_node;
@@ -389,29 +405,34 @@ int orig_seq_print_text(struct seq_file *seq, void *offset)
         struct hashtable_t *hash = bat_priv->orig_hash;
         struct hlist_node *node, *node_tmp;
         struct hlist_head *head;
+        struct hard_iface *primary_if;
         struct orig_node *orig_node;
-        struct neigh_node *neigh_node;
+        struct neigh_node *neigh_node, *neigh_node_tmp;
         int batman_count = 0;
         int last_seen_secs;
         int last_seen_msecs;
-        int i;
+        int i, ret = 0;
 
-        if ((!bat_priv->primary_if) ||
-            (bat_priv->primary_if->if_status != IF_ACTIVE)) {
-                if (!bat_priv->primary_if)
-                        return seq_printf(seq, "BATMAN mesh %s disabled - "
-                                     "please specify interfaces to enable it\n",
-                                     net_dev->name);
+        primary_if = primary_if_get_selected(bat_priv);
+
+        if (!primary_if) {
+                ret = seq_printf(seq, "BATMAN mesh %s disabled - "
+                                 "please specify interfaces to enable it\n",
+                                 net_dev->name);
+                goto out;
+        }
 
-                return seq_printf(seq, "BATMAN mesh %s "
-                                  "disabled - primary interface not active\n",
-                                  net_dev->name);
+        if (primary_if->if_status != IF_ACTIVE) {
+                ret = seq_printf(seq, "BATMAN mesh %s "
+                                 "disabled - primary interface not active\n",
+                                 net_dev->name);
+                goto out;
         }
 
         seq_printf(seq, "[B.A.T.M.A.N. adv %s%s, MainIF/MAC: %s/%pM (%s)]\n",
                    SOURCE_VERSION, REVISION_VERSION_STR,
-                   bat_priv->primary_if->net_dev->name,
-                   bat_priv->primary_if->net_dev->dev_addr, net_dev->name);
+                   primary_if->net_dev->name,
+                   primary_if->net_dev->dev_addr, net_dev->name);
         seq_printf(seq, "  %-15s %s (%s/%i) %17s [%10s]: %20s ...\n",
                    "Originator", "last-seen", "#", TQ_MAX_VALUE, "Nexthop",
                    "outgoingIF", "Potential nexthops");
@@ -421,40 +442,47 @@ int orig_seq_print_text(struct seq_file *seq, void *offset)
 
                 rcu_read_lock();
                 hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
-                        if (!orig_node->router)
+                        neigh_node = orig_node_get_router(orig_node);
+                        if (!neigh_node)
                                 continue;
 
-                        if (orig_node->router->tq_avg == 0)
-                                continue;
+                        if (neigh_node->tq_avg == 0)
+                                goto next;
 
                         last_seen_secs = jiffies_to_msecs(jiffies -
                                                 orig_node->last_valid) / 1000;
                         last_seen_msecs = jiffies_to_msecs(jiffies -
                                                 orig_node->last_valid) % 1000;
 
-                        neigh_node = orig_node->router;
                         seq_printf(seq, "%pM %4i.%03is   (%3i) %pM [%10s]:",
                                    orig_node->orig, last_seen_secs,
                                    last_seen_msecs, neigh_node->tq_avg,
                                    neigh_node->addr,
                                    neigh_node->if_incoming->net_dev->name);
 
-                        hlist_for_each_entry_rcu(neigh_node, node_tmp,
+                        hlist_for_each_entry_rcu(neigh_node_tmp, node_tmp,
                                                  &orig_node->neigh_list, list) {
-                                seq_printf(seq, " %pM (%3i)", neigh_node->addr,
-                                                neigh_node->tq_avg);
+                                seq_printf(seq, " %pM (%3i)",
+                                           neigh_node_tmp->addr,
+                                           neigh_node_tmp->tq_avg);
                         }
 
                         seq_printf(seq, "\n");
                         batman_count++;
+
+next:
+                        neigh_node_free_ref(neigh_node);
                 }
                 rcu_read_unlock();
         }
 
-        if ((batman_count == 0))
+        if (batman_count == 0)
                 seq_printf(seq, "No batman nodes in range ...\n");
 
-        return 0;
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
+        return ret;
 }
 
 static int orig_node_add_if(struct orig_node *orig_node, int max_if_num)
diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h
index 5cc011057da1..e1d641f27aa9 100644
--- a/net/batman-adv/originator.h
+++ b/net/batman-adv/originator.h
@@ -34,6 +34,7 @@ struct neigh_node *create_neighbor(struct orig_node *orig_node,
                                    uint8_t *neigh,
                                    struct hard_iface *if_incoming);
 void neigh_node_free_ref(struct neigh_node *neigh_node);
+struct neigh_node *orig_node_get_router(struct orig_node *orig_node);
 int orig_seq_print_text(struct seq_file *seq, void *offset);
 int orig_hash_add_if(struct hard_iface *hard_iface, int max_if_num);
 int orig_hash_del_if(struct hard_iface *hard_iface, int max_if_num);
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index c172f5d0e05a..49f571553050 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -87,18 +87,20 @@ static void update_route(struct bat_priv *bat_priv,
                          struct neigh_node *neigh_node,
                          unsigned char *hna_buff, int hna_buff_len)
 {
-        struct neigh_node *neigh_node_tmp;
+        struct neigh_node *curr_router;
+
+        curr_router = orig_node_get_router(orig_node);
 
         /* route deleted */
-        if ((orig_node->router) && (!neigh_node)) {
+        if ((curr_router) && (!neigh_node)) {
 
                 bat_dbg(DBG_ROUTES, bat_priv, "Deleting route towards: %pM\n",
                         orig_node->orig);
                 hna_global_del_orig(bat_priv, orig_node,
                                     "originator timed out");
 
-                /* route added */
-        } else if ((!orig_node->router) && (neigh_node)) {
+        /* route added */
+        } else if ((!curr_router) && (neigh_node)) {
 
                 bat_dbg(DBG_ROUTES, bat_priv,
                         "Adding route towards: %pM (via %pM)\n",
@@ -106,21 +108,29 @@ static void update_route(struct bat_priv *bat_priv,
                 hna_global_add_orig(bat_priv, orig_node,
                                     hna_buff, hna_buff_len);
 
-                /* route changed */
+        /* route changed */
         } else {
                 bat_dbg(DBG_ROUTES, bat_priv,
                         "Changing route towards: %pM "
                         "(now via %pM - was via %pM)\n",
                         orig_node->orig, neigh_node->addr,
-                        orig_node->router->addr);
+                        curr_router->addr);
         }
 
+        if (curr_router)
+                neigh_node_free_ref(curr_router);
+
+        /* increase refcount of new best neighbor */
         if (neigh_node && !atomic_inc_not_zero(&neigh_node->refcount))
                 neigh_node = NULL;
-        neigh_node_tmp = orig_node->router;
-        orig_node->router = neigh_node;
-        if (neigh_node_tmp)
-                neigh_node_free_ref(neigh_node_tmp);
+
+        spin_lock_bh(&orig_node->neigh_list_lock);
+        rcu_assign_pointer(orig_node->router, neigh_node);
+        spin_unlock_bh(&orig_node->neigh_list_lock);
+
+        /* decrease refcount of previous best neighbor */
+        if (curr_router)
+                neigh_node_free_ref(curr_router);
 }
 
 
@@ -128,16 +138,23 @@ void update_routes(struct bat_priv *bat_priv, struct orig_node *orig_node,
                    struct neigh_node *neigh_node, unsigned char *hna_buff,
                    int hna_buff_len)
 {
+        struct neigh_node *router = NULL;
 
         if (!orig_node)
-                return;
+                goto out;
+
+        router = orig_node_get_router(orig_node);
 
-        if (orig_node->router != neigh_node)
+        if (router != neigh_node)
                 update_route(bat_priv, orig_node, neigh_node,
                              hna_buff, hna_buff_len);
         /* may be just HNA changed */
         else
                 update_HNA(bat_priv, orig_node, hna_buff, hna_buff_len);
+
+out:
+        if (router)
+                neigh_node_free_ref(router);
 }
 
 static int is_bidirectional_neigh(struct orig_node *orig_node,
@@ -288,8 +305,8 @@ static void bonding_candidate_add(struct orig_node *orig_node,
                                   struct neigh_node *neigh_node)
 {
         struct hlist_node *node;
-        struct neigh_node *tmp_neigh_node;
-        uint8_t best_tq, interference_candidate = 0;
+        struct neigh_node *tmp_neigh_node, *router = NULL;
+        uint8_t interference_candidate = 0;
 
         spin_lock_bh(&orig_node->neigh_list_lock);
 
@@ -298,13 +315,12 @@ static void bonding_candidate_add(struct orig_node *orig_node,
                          neigh_node->orig_node->primary_addr))
                 goto candidate_del;
 
-        if (!orig_node->router)
+        router = orig_node_get_router(orig_node);
+        if (!router)
                 goto candidate_del;
 
-        best_tq = orig_node->router->tq_avg;
-
         /* ... and is good enough to be considered */
-        if (neigh_node->tq_avg < best_tq - BONDING_TQ_THRESHOLD)
+        if (neigh_node->tq_avg < router->tq_avg - BONDING_TQ_THRESHOLD)
                 goto candidate_del;
 
         /**
@@ -350,7 +366,9 @@ candidate_del:
 
 out:
         spin_unlock_bh(&orig_node->neigh_list_lock);
-        return;
+
+        if (router)
+                neigh_node_free_ref(router);
 }
 
 /* copy primary address for bonding */
@@ -373,6 +391,7 @@ static void update_orig(struct bat_priv *bat_priv,
                         char is_duplicate)
 {
         struct neigh_node *neigh_node = NULL, *tmp_neigh_node = NULL;
+        struct neigh_node *router = NULL;
         struct orig_node *orig_node_tmp;
         struct hlist_node *node;
         int tmp_hna_buff_len;
@@ -396,10 +415,12 @@ static void update_orig(struct bat_priv *bat_priv,
                 if (is_duplicate)
                         continue;
 
+                spin_lock_bh(&tmp_neigh_node->tq_lock);
                 ring_buffer_set(tmp_neigh_node->tq_recv,
                                 &tmp_neigh_node->tq_index, 0);
                 tmp_neigh_node->tq_avg =
                         ring_buffer_avg(tmp_neigh_node->tq_recv);
+                spin_unlock_bh(&tmp_neigh_node->tq_lock);
         }
 
         if (!neigh_node) {
@@ -424,10 +445,12 @@ static void update_orig(struct bat_priv *bat_priv,
         orig_node->flags = batman_packet->flags;
         neigh_node->last_valid = jiffies;
 
+        spin_lock_bh(&neigh_node->tq_lock);
         ring_buffer_set(neigh_node->tq_recv,
                         &neigh_node->tq_index,
                         batman_packet->tq);
         neigh_node->tq_avg = ring_buffer_avg(neigh_node->tq_recv);
+        spin_unlock_bh(&neigh_node->tq_lock);
 
         if (!is_duplicate) {
                 orig_node->last_ttl = batman_packet->ttl;
@@ -441,19 +464,18 @@ static void update_orig(struct bat_priv *bat_priv,
 
         /* if this neighbor already is our next hop there is nothing
          * to change */
-        if (orig_node->router == neigh_node)
+        router = orig_node_get_router(orig_node);
+        if (router == neigh_node)
                 goto update_hna;
 
         /* if this neighbor does not offer a better TQ we won't consider it */
-        if ((orig_node->router) &&
-            (orig_node->router->tq_avg > neigh_node->tq_avg))
+        if (router && (router->tq_avg > neigh_node->tq_avg))
                 goto update_hna;
 
         /* if the TQ is the same and the link not more symetric we
          * won't consider it either */
-        if ((orig_node->router) &&
-             (neigh_node->tq_avg == orig_node->router->tq_avg)) {
-                orig_node_tmp = orig_node->router->orig_node;
+        if (router && (neigh_node->tq_avg == router->tq_avg)) {
+                orig_node_tmp = router->orig_node;
                 spin_lock_bh(&orig_node_tmp->ogm_cnt_lock);
                 bcast_own_sum_orig =
                         orig_node_tmp->bcast_own_sum[if_incoming->if_num];
@@ -474,7 +496,7 @@ static void update_orig(struct bat_priv *bat_priv,
         goto update_gw;
 
 update_hna:
-        update_routes(bat_priv, orig_node, orig_node->router,
+        update_routes(bat_priv, orig_node, router,
                       hna_buff, tmp_hna_buff_len);
 
 update_gw:
@@ -496,6 +518,8 @@ unlock:
 out:
         if (neigh_node)
                 neigh_node_free_ref(neigh_node);
+        if (router)
+                neigh_node_free_ref(router);
 }
 
 /* checks whether the host restarted and is in the protection time.
@@ -603,6 +627,8 @@ void receive_bat_packet(struct ethhdr *ethhdr,
         struct bat_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
         struct hard_iface *hard_iface;
         struct orig_node *orig_neigh_node, *orig_node;
+        struct neigh_node *router = NULL, *router_router = NULL;
+        struct neigh_node *orig_neigh_router = NULL;
         char has_directlink_flag;
         char is_my_addr = 0, is_my_orig = 0, is_my_oldorig = 0;
         char is_broadcast = 0, is_bidirectional, is_single_hop_neigh;
@@ -747,14 +773,15 @@ void receive_bat_packet(struct ethhdr *ethhdr,
                 goto out;
         }
 
+        router = orig_node_get_router(orig_node);
+        if (router)
+                router_router = orig_node_get_router(router->orig_node);
+
         /* avoid temporary routing loops */
-        if ((orig_node->router) &&
-            (orig_node->router->orig_node->router) &&
-            (compare_eth(orig_node->router->addr,
-                         batman_packet->prev_sender)) &&
+        if (router && router_router &&
+            (compare_eth(router->addr, batman_packet->prev_sender)) &&
             !(compare_eth(batman_packet->orig, batman_packet->prev_sender)) &&
-            (compare_eth(orig_node->router->addr,
-                         orig_node->router->orig_node->router->addr))) {
+            (compare_eth(router->addr, router_router->addr))) {
                 bat_dbg(DBG_BATMAN, bat_priv,
                         "Drop packet: ignoring all rebroadcast packets that "
                         "may make me loop (sender: %pM)\n", ethhdr->h_source);
@@ -769,9 +796,11 @@ void receive_bat_packet(struct ethhdr *ethhdr,
         if (!orig_neigh_node)
                 goto out;
 
+        orig_neigh_router = orig_node_get_router(orig_neigh_node);
+
         /* drop packet if sender is not a direct neighbor and if we
          * don't route towards it */
-        if (!is_single_hop_neigh && (!orig_neigh_node->router)) {
+        if (!is_single_hop_neigh && (!orig_neigh_router)) {
                 bat_dbg(DBG_BATMAN, bat_priv,
                         "Drop packet: OGM via unknown neighbor!\n");
                 goto out_neigh;
@@ -825,6 +854,13 @@ out_neigh:
         if ((orig_neigh_node) && (!is_single_hop_neigh))
                 orig_node_free_ref(orig_neigh_node);
 out:
+        if (router)
+                neigh_node_free_ref(router);
+        if (router_router)
+                neigh_node_free_ref(router_router);
+        if (orig_neigh_router)
+                neigh_node_free_ref(orig_neigh_router);
+
         orig_node_free_ref(orig_node);
 }
 
@@ -868,8 +904,9 @@ int recv_bat_packet(struct sk_buff *skb, struct hard_iface *hard_iface)
 static int recv_my_icmp_packet(struct bat_priv *bat_priv,
                                struct sk_buff *skb, size_t icmp_len)
 {
+        struct hard_iface *primary_if = NULL;
         struct orig_node *orig_node = NULL;
-        struct neigh_node *neigh_node = NULL;
+        struct neigh_node *router = NULL;
         struct icmp_packet_rr *icmp_packet;
         int ret = NET_RX_DROP;
 
@@ -881,28 +918,19 @@ static int recv_my_icmp_packet(struct bat_priv *bat_priv,
                 goto out;
         }
 
-        if (!bat_priv->primary_if)
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if)
                 goto out;
 
         /* answer echo request (ping) */
         /* get routing information */
-        rcu_read_lock();
         orig_node = orig_hash_find(bat_priv, icmp_packet->orig);
-
         if (!orig_node)
-                goto unlock;
-
-        neigh_node = orig_node->router;
-
-        if (!neigh_node)
-                goto unlock;
-
-        if (!atomic_inc_not_zero(&neigh_node->refcount)) {
-                neigh_node = NULL;
-                goto unlock;
-        }
+                goto out;
 
-        rcu_read_unlock();
+        router = orig_node_get_router(orig_node);
+        if (!router)
+                goto out;
 
         /* create a copy of the skb, if needed, to modify it. */
         if (skb_cow(skb, sizeof(struct ethhdr)) < 0)
@@ -911,20 +939,18 @@ static int recv_my_icmp_packet(struct bat_priv *bat_priv,
         icmp_packet = (struct icmp_packet_rr *)skb->data;
 
         memcpy(icmp_packet->dst, icmp_packet->orig, ETH_ALEN);
-        memcpy(icmp_packet->orig,
-                bat_priv->primary_if->net_dev->dev_addr, ETH_ALEN);
+        memcpy(icmp_packet->orig, primary_if->net_dev->dev_addr, ETH_ALEN);
         icmp_packet->msg_type = ECHO_REPLY;
         icmp_packet->ttl = TTL;
 
-        send_skb_packet(skb, neigh_node->if_incoming, neigh_node->addr);
+        send_skb_packet(skb, router->if_incoming, router->addr);
         ret = NET_RX_SUCCESS;
-        goto out;
 
-unlock:
-        rcu_read_unlock();
 out:
-        if (neigh_node)
-                neigh_node_free_ref(neigh_node);
+        if (primary_if)
+                hardif_free_ref(primary_if);
+        if (router)
+                neigh_node_free_ref(router);
         if (orig_node)
                 orig_node_free_ref(orig_node);
         return ret;
@@ -933,8 +959,9 @@ out:
 static int recv_icmp_ttl_exceeded(struct bat_priv *bat_priv,
                                   struct sk_buff *skb)
 {
+        struct hard_iface *primary_if = NULL;
         struct orig_node *orig_node = NULL;
-        struct neigh_node *neigh_node = NULL;
+        struct neigh_node *router = NULL;
         struct icmp_packet *icmp_packet;
         int ret = NET_RX_DROP;
 
@@ -948,27 +975,18 @@ static int recv_icmp_ttl_exceeded(struct bat_priv *bat_priv,
                 goto out;
         }
 
-        if (!bat_priv->primary_if)
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if)
                 goto out;
 
         /* get routing information */
-        rcu_read_lock();
         orig_node = orig_hash_find(bat_priv, icmp_packet->orig);
-
         if (!orig_node)
-                goto unlock;
-
-        neigh_node = orig_node->router;
-
-        if (!neigh_node)
-                goto unlock;
-
-        if (!atomic_inc_not_zero(&neigh_node->refcount)) {
-                neigh_node = NULL;
-                goto unlock;
-        }
+                goto out;
 
-        rcu_read_unlock();
+        router = orig_node_get_router(orig_node);
+        if (!router)
+                goto out;
 
         /* create a copy of the skb, if needed, to modify it. */
         if (skb_cow(skb, sizeof(struct ethhdr)) < 0)
@@ -977,20 +995,18 @@ static int recv_icmp_ttl_exceeded(struct bat_priv *bat_priv,
         icmp_packet = (struct icmp_packet *)skb->data;
 
         memcpy(icmp_packet->dst, icmp_packet->orig, ETH_ALEN);
-        memcpy(icmp_packet->orig,
-                bat_priv->primary_if->net_dev->dev_addr, ETH_ALEN);
+        memcpy(icmp_packet->orig, primary_if->net_dev->dev_addr, ETH_ALEN);
         icmp_packet->msg_type = TTL_EXCEEDED;
         icmp_packet->ttl = TTL;
 
-        send_skb_packet(skb, neigh_node->if_incoming, neigh_node->addr);
+        send_skb_packet(skb, router->if_incoming, router->addr);
         ret = NET_RX_SUCCESS;
-        goto out;
 
-unlock:
-        rcu_read_unlock();
 out:
-        if (neigh_node)
-                neigh_node_free_ref(neigh_node);
+        if (primary_if)
+                hardif_free_ref(primary_if);
+        if (router)
+                neigh_node_free_ref(router);
         if (orig_node)
                 orig_node_free_ref(orig_node);
         return ret;
@@ -1003,7 +1019,7 @@ int recv_icmp_packet(struct sk_buff *skb, struct hard_iface *recv_if)
         struct icmp_packet_rr *icmp_packet;
         struct ethhdr *ethhdr;
         struct orig_node *orig_node = NULL;
-        struct neigh_node *neigh_node = NULL;
+        struct neigh_node *router = NULL;
         int hdr_size = sizeof(struct icmp_packet);
         int ret = NET_RX_DROP;
 
@@ -1050,23 +1066,13 @@ int recv_icmp_packet(struct sk_buff *skb, struct hard_iface *recv_if)
                 return recv_icmp_ttl_exceeded(bat_priv, skb);
 
         /* get routing information */
-        rcu_read_lock();
         orig_node = orig_hash_find(bat_priv, icmp_packet->dst);
-
         if (!orig_node)
-                goto unlock;
-
-        neigh_node = orig_node->router;
-
-        if (!neigh_node)
-                goto unlock;
-
-        if (!atomic_inc_not_zero(&neigh_node->refcount)) {
-                neigh_node = NULL;
-                goto unlock;
-        }
+                goto out;
 
-        rcu_read_unlock();
+        router = orig_node_get_router(orig_node);
+        if (!router)
+                goto out;
 
         /* create a copy of the skb, if needed, to modify it. */
         if (skb_cow(skb, sizeof(struct ethhdr)) < 0)
@@ -1078,20 +1084,117 @@ int recv_icmp_packet(struct sk_buff *skb, struct hard_iface *recv_if)
         icmp_packet->ttl--;
 
         /* route it */
-        send_skb_packet(skb, neigh_node->if_incoming, neigh_node->addr);
+        send_skb_packet(skb, router->if_incoming, router->addr);
         ret = NET_RX_SUCCESS;
-        goto out;
 
-unlock:
-        rcu_read_unlock();
 out:
-        if (neigh_node)
-                neigh_node_free_ref(neigh_node);
+        if (router)
+                neigh_node_free_ref(router);
         if (orig_node)
                 orig_node_free_ref(orig_node);
         return ret;
 }
 
+/* In the bonding case, send the packets in a round
+ * robin fashion over the remaining interfaces.
+ *
+ * This method rotates the bonding list and increases the
+ * returned router's refcount. */
+static struct neigh_node *find_bond_router(struct orig_node *primary_orig,
+                                           struct hard_iface *recv_if)
+{
+        struct neigh_node *tmp_neigh_node;
+        struct neigh_node *router = NULL, *first_candidate = NULL;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(tmp_neigh_node, &primary_orig->bond_list,
+                                bonding_list) {
+                if (!first_candidate)
+                        first_candidate = tmp_neigh_node;
+
+                /* recv_if == NULL on the first node. */
+                if (tmp_neigh_node->if_incoming == recv_if)
+                        continue;
+
+                if (!atomic_inc_not_zero(&tmp_neigh_node->refcount))
+                        continue;
+
+                router = tmp_neigh_node;
+                break;
+        }
+
+        /* use the first candidate if nothing was found. */
+        if (!router && first_candidate &&
+            atomic_inc_not_zero(&first_candidate->refcount))
+                router = first_candidate;
+
+        if (!router)
+                goto out;
+
+        /* selected should point to the next element
+         * after the current router */
+        spin_lock_bh(&primary_orig->neigh_list_lock);
+        /* this is a list_move(), which unfortunately
+         * does not exist as rcu version */
+        list_del_rcu(&primary_orig->bond_list);
+        list_add_rcu(&primary_orig->bond_list,
+                     &router->bonding_list);
+        spin_unlock_bh(&primary_orig->neigh_list_lock);
+
+out:
+        rcu_read_unlock();
+        return router;
+}
+
+/* Interface Alternating: Use the best of the
+ * remaining candidates which are not using
+ * this interface.
+ *
+ * Increases the returned router's refcount */
+static struct neigh_node *find_ifalter_router(struct orig_node *primary_orig,
+                                              struct hard_iface *recv_if)
+{
+        struct neigh_node *tmp_neigh_node;
+        struct neigh_node *router = NULL, *first_candidate = NULL;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(tmp_neigh_node, &primary_orig->bond_list,
+                                bonding_list) {
+                if (!first_candidate)
+                        first_candidate = tmp_neigh_node;
+
+                /* recv_if == NULL on the first node. */
+                if (tmp_neigh_node->if_incoming == recv_if)
+                        continue;
+
+                if (!atomic_inc_not_zero(&tmp_neigh_node->refcount))
+                        continue;
+
+                /* if we don't have a router yet
+                 * or this one is better, choose it. */
+                if ((!router) ||
+                    (tmp_neigh_node->tq_avg > router->tq_avg)) {
+                        /* decrement refcount of
+                         * previously selected router */
+                        if (router)
+                                neigh_node_free_ref(router);
+
+                        router = tmp_neigh_node;
+                        atomic_inc_not_zero(&router->refcount);
+                }
+
+                neigh_node_free_ref(tmp_neigh_node);
+        }
+
+        /* use the first candidate if nothing was found. */
+        if (!router && first_candidate &&
+            atomic_inc_not_zero(&first_candidate->refcount))
+                router = first_candidate;
+
+        rcu_read_unlock();
+        return router;
+}
+
 /* find a suitable router for this originator, and use
  * bonding if possible. increases the found neighbors
  * refcount.*/
@@ -1101,14 +1204,15 @@ struct neigh_node *find_router(struct bat_priv *bat_priv,
 {
         struct orig_node *primary_orig_node;
         struct orig_node *router_orig;
-        struct neigh_node *router, *first_candidate, *tmp_neigh_node;
+        struct neigh_node *router;
         static uint8_t zero_mac[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
         int bonding_enabled;
 
         if (!orig_node)
                 return NULL;
 
-        if (!orig_node->router)
+        router = orig_node_get_router(orig_node);
+        if (!router)
                 return NULL;
 
         /* without bonding, the first node should
@@ -1117,9 +1221,8 @@ struct neigh_node *find_router(struct bat_priv *bat_priv,
 
         rcu_read_lock();
         /* select default router to output */
-        router = orig_node->router;
-        router_orig = orig_node->router->orig_node;
-        if (!router_orig || !atomic_inc_not_zero(&router->refcount)) {
+        router_orig = router->orig_node;
+        if (!router_orig) {
                 rcu_read_unlock();
                 return NULL;
         }
@@ -1151,88 +1254,17 @@ struct neigh_node *find_router(struct bat_priv *bat_priv,
         if (atomic_read(&primary_orig_node->bond_candidates) < 2)
                 goto return_router;
 
-
         /* all nodes between should choose a candidate which
          * is is not on the interface where the packet came
          * in. */
 
         neigh_node_free_ref(router);
-        first_candidate = NULL;
-        router = NULL;
-
-        if (bonding_enabled) {
-                /* in the bonding case, send the packets in a round
-                 * robin fashion over the remaining interfaces. */
-
-                list_for_each_entry_rcu(tmp_neigh_node,
-                                &primary_orig_node->bond_list, bonding_list) {
-                        if (!first_candidate)
-                                first_candidate = tmp_neigh_node;
-                        /* recv_if == NULL on the first node. */
-                        if (tmp_neigh_node->if_incoming != recv_if &&
-                            atomic_inc_not_zero(&tmp_neigh_node->refcount)) {
-                                router = tmp_neigh_node;
-                                break;
-                        }
-                }
-
-                /* use the first candidate if nothing was found. */
-                if (!router && first_candidate &&
-                    atomic_inc_not_zero(&first_candidate->refcount))
-                        router = first_candidate;
-
-                if (!router) {
-                        rcu_read_unlock();
-                        return NULL;
-                }
-
-                /* selected should point to the next element
-                 * after the current router */
-                spin_lock_bh(&primary_orig_node->neigh_list_lock);
-                /* this is a list_move(), which unfortunately
-                 * does not exist as rcu version */
-                list_del_rcu(&primary_orig_node->bond_list);
-                list_add_rcu(&primary_orig_node->bond_list,
-                                &router->bonding_list);
-                spin_unlock_bh(&primary_orig_node->neigh_list_lock);
-
-        } else {
-                /* if bonding is disabled, use the best of the
-                 * remaining candidates which are not using
-                 * this interface. */
-                list_for_each_entry_rcu(tmp_neigh_node,
-                        &primary_orig_node->bond_list, bonding_list) {
-                        if (!first_candidate)
-                                first_candidate = tmp_neigh_node;
-
-                        /* recv_if == NULL on the first node. */
-                        if (tmp_neigh_node->if_incoming == recv_if)
-                                continue;
-
-                        if (!atomic_inc_not_zero(&tmp_neigh_node->refcount))
-                                continue;
-
-                        /* if we don't have a router yet
-                         * or this one is better, choose it. */
-                        if ((!router) ||
-                            (tmp_neigh_node->tq_avg > router->tq_avg)) {
-                                /* decrement refcount of
-                                 * previously selected router */
-                                if (router)
-                                        neigh_node_free_ref(router);
 
-                                router = tmp_neigh_node;
-                                atomic_inc_not_zero(&router->refcount);
-                        }
-
-                        neigh_node_free_ref(tmp_neigh_node);
-                }
+        if (bonding_enabled)
+                router = find_bond_router(primary_orig_node, recv_if);
+        else
+                router = find_ifalter_router(primary_orig_node, recv_if);
 
-                /* use the first candidate if nothing was found. */
-                if (!router && first_candidate &&
-                    atomic_inc_not_zero(&first_candidate->refcount))
-                        router = first_candidate;
-        }
 return_router:
         rcu_read_unlock();
         return router;
@@ -1284,13 +1316,10 @@ int route_unicast_packet(struct sk_buff *skb, struct hard_iface *recv_if)
         }
 
         /* get routing information */
-        rcu_read_lock();
         orig_node = orig_hash_find(bat_priv, unicast_packet->dest);
 
         if (!orig_node)
-                goto unlock;
-
-        rcu_read_unlock();
+                goto out;
 
         /* find_router() increases neigh_nodes refcount if found. */
         neigh_node = find_router(bat_priv, orig_node, recv_if);
@@ -1336,10 +1365,7 @@ int route_unicast_packet(struct sk_buff *skb, struct hard_iface *recv_if)
         /* route it */
         send_skb_packet(skb, neigh_node->if_incoming, neigh_node->addr);
         ret = NET_RX_SUCCESS;
-        goto out;
 
-unlock:
-        rcu_read_unlock();
 out:
         if (neigh_node)
                 neigh_node_free_ref(neigh_node);
@@ -1438,13 +1464,10 @@ int recv_bcast_packet(struct sk_buff *skb, struct hard_iface *recv_if)
         if (bcast_packet->ttl < 2)
                 goto out;
 
-        rcu_read_lock();
         orig_node = orig_hash_find(bat_priv, bcast_packet->orig);
 
         if (!orig_node)
-                goto rcu_unlock;
-
-        rcu_read_unlock();
+                goto out;
 
         spin_lock_bh(&orig_node->bcast_seqno_lock);
 
@@ -1475,9 +1498,6 @@ int recv_bcast_packet(struct sk_buff *skb, struct hard_iface *recv_if)
         ret = NET_RX_SUCCESS;
         goto out;
 
-rcu_unlock:
-        rcu_read_unlock();
-        goto out;
 spin_unlock:
         spin_unlock_bh(&orig_node->bcast_seqno_lock);
 out:
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index d49e54d932af..02b541a6dfef 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -244,6 +244,7 @@ static void rebuild_batman_packet(struct bat_priv *bat_priv,
 void schedule_own_packet(struct hard_iface *hard_iface)
 {
         struct bat_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
+        struct hard_iface *primary_if;
         unsigned long send_time;
         struct batman_packet *batman_packet;
         int vis_server;
@@ -253,6 +254,7 @@ void schedule_own_packet(struct hard_iface *hard_iface)
                 return;
 
         vis_server = atomic_read(&bat_priv->vis_mode);
+        primary_if = primary_if_get_selected(bat_priv);
 
         /**
          * the interface gets activated here to avoid race conditions between
@@ -266,7 +268,7 @@ void schedule_own_packet(struct hard_iface *hard_iface)
 
         /* if local hna has changed and interface is a primary interface */
         if ((atomic_read(&bat_priv->hna_local_changed)) &&
-            (hard_iface == bat_priv->primary_if))
+            (hard_iface == primary_if))
                 rebuild_batman_packet(bat_priv, hard_iface);
 
         /**
@@ -284,7 +286,7 @@ void schedule_own_packet(struct hard_iface *hard_iface)
         else
                 batman_packet->flags &= ~VIS_SERVER;
 
-        if ((hard_iface == bat_priv->primary_if) &&
+        if ((hard_iface == primary_if) &&
             (atomic_read(&bat_priv->gw_mode) == GW_MODE_SERVER))
                 batman_packet->gw_flags =
                                 (uint8_t)atomic_read(&bat_priv->gw_bandwidth);
@@ -299,6 +301,9 @@ void schedule_own_packet(struct hard_iface *hard_iface)
                                hard_iface->packet_buff,
                                hard_iface->packet_len,
                                hard_iface, 1, send_time);
+
+        if (primary_if)
+                hardif_free_ref(primary_if);
 }
 
 void schedule_forward_packet(struct orig_node *orig_node,
@@ -308,6 +313,7 @@ void schedule_forward_packet(struct orig_node *orig_node,
                              struct hard_iface *if_incoming)
 {
         struct bat_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
+        struct neigh_node *router;
         unsigned char in_tq, in_ttl, tq_avg = 0;
         unsigned long send_time;
 
@@ -316,6 +322,8 @@ void schedule_forward_packet(struct orig_node *orig_node,
                 return;
         }
 
+        router = orig_node_get_router(orig_node);
+
         in_tq = batman_packet->tq;
         in_ttl = batman_packet->ttl;
 
@@ -324,20 +332,22 @@ void schedule_forward_packet(struct orig_node *orig_node,
 
         /* rebroadcast tq of our best ranking neighbor to ensure the rebroadcast
          * of our best tq value */
-        if ((orig_node->router) && (orig_node->router->tq_avg != 0)) {
+        if (router && router->tq_avg != 0) {
 
                 /* rebroadcast ogm of best ranking neighbor as is */
-                if (!compare_eth(orig_node->router->addr, ethhdr->h_source)) {
-                        batman_packet->tq = orig_node->router->tq_avg;
+                if (!compare_eth(router->addr, ethhdr->h_source)) {
+                        batman_packet->tq = router->tq_avg;
 
-                        if (orig_node->router->last_ttl)
-                                batman_packet->ttl = orig_node->router->last_ttl
-                                                        - 1;
+                        if (router->last_ttl)
+                                batman_packet->ttl = router->last_ttl - 1;
                 }
 
-                tq_avg = orig_node->router->tq_avg;
+                tq_avg = router->tq_avg;
         }
 
+        if (router)
+                neigh_node_free_ref(router);
+
         /* apply hop penalty */
         batman_packet->tq = hop_penalty(batman_packet->tq, bat_priv);
 
@@ -388,7 +398,6 @@ static void _add_bcast_packet_to_list(struct bat_priv *bat_priv,
                            send_time);
 }
 
-#define atomic_dec_not_zero(v)          atomic_add_unless((v), -1, 0)
 /* add a broadcast packet to the queue and setup timers. broadcast packets
  * are sent multiple times to increase probability for beeing received.
  *
@@ -399,6 +408,7 @@ static void _add_bcast_packet_to_list(struct bat_priv *bat_priv,
  * skb is freed. */
 int add_bcast_packet_to_list(struct bat_priv *bat_priv, struct sk_buff *skb)
 {
+        struct hard_iface *primary_if = NULL;
         struct forw_packet *forw_packet;
         struct bcast_packet *bcast_packet;
 
@@ -407,7 +417,8 @@ int add_bcast_packet_to_list(struct bat_priv *bat_priv, struct sk_buff *skb)
                 goto out;
         }
 
-        if (!bat_priv->primary_if)
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if)
                 goto out;
 
         forw_packet = kmalloc(sizeof(struct forw_packet), GFP_ATOMIC);
@@ -426,7 +437,7 @@ int add_bcast_packet_to_list(struct bat_priv *bat_priv, struct sk_buff *skb)
         skb_reset_mac_header(skb);
 
         forw_packet->skb = skb;
-        forw_packet->if_incoming = bat_priv->primary_if;
+        forw_packet->if_incoming = primary_if;
 
         /* how often did we send the bcast packet ? */
         forw_packet->num_packets = 0;
@@ -439,6 +450,8 @@ packet_free:
 out_and_inc:
         atomic_inc(&bat_priv->bcast_queue_left);
 out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
         return NETDEV_TX_BUSY;
 }
 
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 824e1f6e50f2..9e5fcd1596cf 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -43,8 +43,6 @@ static void bat_get_drvinfo(struct net_device *dev,
 static u32 bat_get_msglevel(struct net_device *dev);
 static void bat_set_msglevel(struct net_device *dev, u32 value);
 static u32 bat_get_link(struct net_device *dev);
-static u32 bat_get_rx_csum(struct net_device *dev);
-static int bat_set_rx_csum(struct net_device *dev, u32 data);
 
 static const struct ethtool_ops bat_ethtool_ops = {
         .get_settings = bat_get_settings,
@@ -52,8 +50,6 @@ static const struct ethtool_ops bat_ethtool_ops = {
         .get_msglevel = bat_get_msglevel,
         .set_msglevel = bat_set_msglevel,
         .get_link = bat_get_link,
-        .get_rx_csum = bat_get_rx_csum,
-        .set_rx_csum = bat_set_rx_csum
 };
 
 int my_skb_head_push(struct sk_buff *skb, unsigned int len)
@@ -90,10 +86,51 @@ static void softif_neigh_free_ref(struct softif_neigh *softif_neigh)
                 call_rcu(&softif_neigh->rcu, softif_neigh_free_rcu);
 }
 
+static struct softif_neigh *softif_neigh_get_selected(struct bat_priv *bat_priv)
+{
+        struct softif_neigh *neigh;
+
+        rcu_read_lock();
+        neigh = rcu_dereference(bat_priv->softif_neigh);
+
+        if (neigh && !atomic_inc_not_zero(&neigh->refcount))
+                neigh = NULL;
+
+        rcu_read_unlock();
+        return neigh;
+}
+
+static void softif_neigh_select(struct bat_priv *bat_priv,
+                                struct softif_neigh *new_neigh)
+{
+        struct softif_neigh *curr_neigh;
+
+        spin_lock_bh(&bat_priv->softif_neigh_lock);
+
+        if (new_neigh && !atomic_inc_not_zero(&new_neigh->refcount))
+                new_neigh = NULL;
+
+        curr_neigh = bat_priv->softif_neigh;
+        rcu_assign_pointer(bat_priv->softif_neigh, new_neigh);
+
+        if (curr_neigh)
+                softif_neigh_free_ref(curr_neigh);
+
+        spin_unlock_bh(&bat_priv->softif_neigh_lock);
+}
+
+static void softif_neigh_deselect(struct bat_priv *bat_priv)
+{
+        softif_neigh_select(bat_priv, NULL);
+}
+
 void softif_neigh_purge(struct bat_priv *bat_priv)
 {
-        struct softif_neigh *softif_neigh, *softif_neigh_tmp;
+        struct softif_neigh *softif_neigh, *curr_softif_neigh;
         struct hlist_node *node, *node_tmp;
+        char do_deselect = 0;
+
+        curr_softif_neigh = softif_neigh_get_selected(bat_priv);
 
         spin_lock_bh(&bat_priv->softif_neigh_lock);
 
@@ -105,22 +142,26 @@ void softif_neigh_purge(struct bat_priv *bat_priv)
                     (atomic_read(&bat_priv->mesh_state) == MESH_ACTIVE))
                         continue;
 
-                hlist_del_rcu(&softif_neigh->list);
-
-                if (bat_priv->softif_neigh == softif_neigh) {
+                if (curr_softif_neigh == softif_neigh) {
                         bat_dbg(DBG_ROUTES, bat_priv,
                                  "Current mesh exit point '%pM' vanished "
                                  "(vid: %d).\n",
                                  softif_neigh->addr, softif_neigh->vid);
-                        softif_neigh_tmp = bat_priv->softif_neigh;
-                        bat_priv->softif_neigh = NULL;
-                        softif_neigh_free_ref(softif_neigh_tmp);
+                        do_deselect = 1;
                 }
 
+                hlist_del_rcu(&softif_neigh->list);
                 softif_neigh_free_ref(softif_neigh);
         }
 
         spin_unlock_bh(&bat_priv->softif_neigh_lock);
+
+        /* soft_neigh_deselect() needs to acquire the softif_neigh_lock */
+        if (do_deselect)
+                softif_neigh_deselect(bat_priv);
+
+        if (curr_softif_neigh)
+                softif_neigh_free_ref(curr_softif_neigh);
 }
 
 static struct softif_neigh *softif_neigh_get(struct bat_priv *bat_priv,
@@ -170,26 +211,44 @@ int softif_neigh_seq_print_text(struct seq_file *seq, void *offset)
         struct net_device *net_dev = (struct net_device *)seq->private;
         struct bat_priv *bat_priv = netdev_priv(net_dev);
         struct softif_neigh *softif_neigh;
+        struct hard_iface *primary_if;
         struct hlist_node *node;
+        struct softif_neigh *curr_softif_neigh;
+        int ret = 0;
+
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if) {
+                ret = seq_printf(seq, "BATMAN mesh %s disabled - "
+                                 "please specify interfaces to enable it\n",
+                                 net_dev->name);
+                goto out;
+        }
 
-        if (!bat_priv->primary_if) {
-                return seq_printf(seq, "BATMAN mesh %s disabled - "
-                               "please specify interfaces to enable it\n",
-                               net_dev->name);
+        if (primary_if->if_status != IF_ACTIVE) {
+                ret = seq_printf(seq, "BATMAN mesh %s "
+                                 "disabled - primary interface not active\n",
+                                 net_dev->name);
+                goto out;
         }
 
         seq_printf(seq, "Softif neighbor list (%s)\n", net_dev->name);
 
+        curr_softif_neigh = softif_neigh_get_selected(bat_priv);
         rcu_read_lock();
         hlist_for_each_entry_rcu(softif_neigh, node,
                                  &bat_priv->softif_neigh_list, list)
                 seq_printf(seq, "%s %pM (vid: %d)\n",
-                                bat_priv->softif_neigh == softif_neigh
+                                curr_softif_neigh == softif_neigh
                                 ? "=>" : "  ", softif_neigh->addr,
                                 softif_neigh->vid);
         rcu_read_unlock();
+        if (curr_softif_neigh)
+                softif_neigh_free_ref(curr_softif_neigh);
 
-        return 0;
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
+        return ret;
 }
 
 static void softif_batman_recv(struct sk_buff *skb, struct net_device *dev,
@@ -198,7 +257,9 @@ static void softif_batman_recv(struct sk_buff *skb, struct net_device *dev,
         struct bat_priv *bat_priv = netdev_priv(dev);
         struct ethhdr *ethhdr = (struct ethhdr *)skb->data;
         struct batman_packet *batman_packet;
-        struct softif_neigh *softif_neigh, *softif_neigh_tmp;
+        struct softif_neigh *softif_neigh = NULL;
+        struct hard_iface *primary_if = NULL;
+        struct softif_neigh *curr_softif_neigh = NULL;
 
         if (ntohs(ethhdr->h_proto) == ETH_P_8021Q)
                 batman_packet = (struct batman_packet *)
@@ -207,63 +268,72 @@ static void softif_batman_recv(struct sk_buff *skb, struct net_device *dev,
                 batman_packet = (struct batman_packet *)(skb->data + ETH_HLEN);
 
         if (batman_packet->version != COMPAT_VERSION)
-                goto err;
+                goto out;
 
         if (batman_packet->packet_type != BAT_PACKET)
-                goto err;
+                goto out;
 
         if (!(batman_packet->flags & PRIMARIES_FIRST_HOP))
-                goto err;
+                goto out;
 
         if (is_my_mac(batman_packet->orig))
-                goto err;
+                goto out;
 
         softif_neigh = softif_neigh_get(bat_priv, batman_packet->orig, vid);
-
         if (!softif_neigh)
-                goto err;
+                goto out;
+
+        curr_softif_neigh = softif_neigh_get_selected(bat_priv);
+        if (!curr_softif_neigh)
+                goto out;
+
+        if (curr_softif_neigh == softif_neigh)
+                goto out;
 
-        if (bat_priv->softif_neigh == softif_neigh)
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if)
                 goto out;
 
         /* we got a neighbor but its mac is 'bigger' than ours  */
-        if (memcmp(bat_priv->primary_if->net_dev->dev_addr,
+        if (memcmp(primary_if->net_dev->dev_addr,
                    softif_neigh->addr, ETH_ALEN) < 0)
                 goto out;
 
         /* switch to new 'smallest neighbor' */
-        if ((bat_priv->softif_neigh) &&
-            (memcmp(softif_neigh->addr, bat_priv->softif_neigh->addr,
+        if ((curr_softif_neigh) &&
+            (memcmp(softif_neigh->addr, curr_softif_neigh->addr,
                                                         ETH_ALEN) < 0)) {
                 bat_dbg(DBG_ROUTES, bat_priv,
                         "Changing mesh exit point from %pM (vid: %d) "
                         "to %pM (vid: %d).\n",
-                         bat_priv->softif_neigh->addr,
-                         bat_priv->softif_neigh->vid,
+                         curr_softif_neigh->addr,
+                         curr_softif_neigh->vid,
                          softif_neigh->addr, softif_neigh->vid);
-                softif_neigh_tmp = bat_priv->softif_neigh;
-                bat_priv->softif_neigh = softif_neigh;
-                softif_neigh_free_ref(softif_neigh_tmp);
-                /* we need to hold the additional reference */
-                goto err;
+
+                softif_neigh_select(bat_priv, softif_neigh);
+                goto out;
         }
 
         /* close own batX device and use softif_neigh as exit node */
-        if ((!bat_priv->softif_neigh) &&
+        if ((!curr_softif_neigh) &&
             (memcmp(softif_neigh->addr,
-                    bat_priv->primary_if->net_dev->dev_addr, ETH_ALEN) < 0)) {
+                    primary_if->net_dev->dev_addr, ETH_ALEN) < 0)) {
                 bat_dbg(DBG_ROUTES, bat_priv,
                         "Setting mesh exit point to %pM (vid: %d).\n",
                         softif_neigh->addr, softif_neigh->vid);
-                bat_priv->softif_neigh = softif_neigh;
-                /* we need to hold the additional reference */
-                goto err;
+
+                softif_neigh_select(bat_priv, softif_neigh);
+                goto out;
         }
 
 out:
-        softif_neigh_free_ref(softif_neigh);
-err:
         kfree_skb(skb);
+        if (softif_neigh)
+                softif_neigh_free_ref(softif_neigh);
+        if (curr_softif_neigh)
+                softif_neigh_free_ref(curr_softif_neigh);
+        if (primary_if)
+                hardif_free_ref(primary_if);
         return;
 }
 
@@ -319,8 +389,10 @@ int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
 {
         struct ethhdr *ethhdr = (struct ethhdr *)skb->data;
         struct bat_priv *bat_priv = netdev_priv(soft_iface);
+        struct hard_iface *primary_if = NULL;
         struct bcast_packet *bcast_packet;
         struct vlan_ethhdr *vhdr;
+        struct softif_neigh *curr_softif_neigh = NULL;
         int data_len = skb->len, ret;
         short vid = -1;
         bool do_bcast = false;
@@ -348,7 +420,8 @@ int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
          * if we have a another chosen mesh exit node in range
          * it will transport the packets to the mesh
          */
-        if ((bat_priv->softif_neigh) && (bat_priv->softif_neigh->vid == vid))
+        curr_softif_neigh = softif_neigh_get_selected(bat_priv);
+        if ((curr_softif_neigh) && (curr_softif_neigh->vid == vid))
                 goto dropped;
 
         /* TODO: check this for locks */
@@ -366,7 +439,8 @@ int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
 
         /* ethernet packet should be broadcasted */
         if (do_bcast) {
-                if (!bat_priv->primary_if)
+                primary_if = primary_if_get_selected(bat_priv);
+                if (!primary_if)
                         goto dropped;
 
                 if (my_skb_head_push(skb, sizeof(struct bcast_packet)) < 0)
@@ -382,7 +456,7 @@ int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
                 /* hw address of first interface is the orig mac because only
                  * this mac is known throughout the mesh */
                 memcpy(bcast_packet->orig,
-                       bat_priv->primary_if->net_dev->dev_addr, ETH_ALEN);
+                       primary_if->net_dev->dev_addr, ETH_ALEN);
 
                 /* set broadcast sequence number */
                 bcast_packet->seqno =
@@ -410,6 +484,10 @@ dropped:
 dropped_freed:
         bat_priv->stats.tx_dropped++;
 end:
+        if (curr_softif_neigh)
+                softif_neigh_free_ref(curr_softif_neigh);
+        if (primary_if)
+                hardif_free_ref(primary_if);
         return NETDEV_TX_OK;
 }
 
@@ -421,6 +499,7 @@ void interface_rx(struct net_device *soft_iface,
         struct unicast_packet *unicast_packet;
         struct ethhdr *ethhdr;
         struct vlan_ethhdr *vhdr;
+        struct softif_neigh *curr_softif_neigh = NULL;
         short vid = -1;
         int ret;
 
@@ -450,7 +529,8 @@ void interface_rx(struct net_device *soft_iface,
          * if we have a another chosen mesh exit node in range
          * it will transport the packets to the non-mesh network
          */
-        if ((bat_priv->softif_neigh) && (bat_priv->softif_neigh->vid == vid)) {
+        curr_softif_neigh = softif_neigh_get_selected(bat_priv);
+        if (curr_softif_neigh && (curr_softif_neigh->vid == vid)) {
                 skb_push(skb, hdr_size);
                 unicast_packet = (struct unicast_packet *)skb->data;
 
@@ -461,7 +541,7 @@ void interface_rx(struct net_device *soft_iface,
                 skb_reset_mac_header(skb);
 
                 memcpy(unicast_packet->dest,
-                       bat_priv->softif_neigh->addr, ETH_ALEN);
+                       curr_softif_neigh->addr, ETH_ALEN);
                 ret = route_unicast_packet(skb, recv_if);
                 if (ret == NET_RX_DROP)
                         goto dropped;
@@ -486,11 +566,13 @@ void interface_rx(struct net_device *soft_iface,
         soft_iface->last_rx = jiffies;
 
         netif_rx(skb);
-        return;
+        goto out;
 
 dropped:
         kfree_skb(skb);
 out:
+        if (curr_softif_neigh)
+                softif_neigh_free_ref(curr_softif_neigh);
         return;
 }
 
@@ -524,6 +606,7 @@ static void interface_setup(struct net_device *dev)
         dev->hard_start_xmit = interface_tx;
 #endif
         dev->destructor = free_netdev;
+        dev->tx_queue_len = 0;
 
         /**
          * can't call min_mtu, because the needed variables
@@ -640,7 +723,7 @@ static int bat_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
 {
         cmd->supported = 0;
         cmd->advertising = 0;
-        cmd->speed = SPEED_10;
+        ethtool_cmd_speed_set(cmd, SPEED_10);
         cmd->duplex = DUPLEX_FULL;
         cmd->port = PORT_TP;
         cmd->phy_address = 0;
@@ -675,12 +758,3 @@ static u32 bat_get_link(struct net_device *dev)
         return 1;
 }
 
-static u32 bat_get_rx_csum(struct net_device *dev)
-{
-        return 0;
-}
-
-static int bat_set_rx_csum(struct net_device *dev, u32 data)
-{
-        return -EOPNOTSUPP;
-}
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 8d15b48d1692..f931830d630e 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -22,6 +22,7 @@
 #include "main.h"
 #include "translation-table.h"
 #include "soft-interface.h"
+#include "hard-interface.h"
 #include "hash.h"
 #include "originator.h"
 
@@ -237,16 +238,26 @@ int hna_local_seq_print_text(struct seq_file *seq, void *offset)
         struct bat_priv *bat_priv = netdev_priv(net_dev);
         struct hashtable_t *hash = bat_priv->hna_local_hash;
         struct hna_local_entry *hna_local_entry;
+        struct hard_iface *primary_if;
         struct hlist_node *node;
         struct hlist_head *head;
         size_t buf_size, pos;
         char *buff;
-        int i;
+        int i, ret = 0;
 
-        if (!bat_priv->primary_if) {
-                return seq_printf(seq, "BATMAN mesh %s disabled - "
-                               "please specify interfaces to enable it\n",
-                               net_dev->name);
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if) {
+                ret = seq_printf(seq, "BATMAN mesh %s disabled - "
+                                 "please specify interfaces to enable it\n",
+                                 net_dev->name);
+                goto out;
+        }
+
+        if (primary_if->if_status != IF_ACTIVE) {
+                ret = seq_printf(seq, "BATMAN mesh %s disabled - "
+                                 "primary interface not active\n",
+                                 net_dev->name);
+                goto out;
         }
 
         seq_printf(seq, "Locally retrieved addresses (from %s) "
@@ -269,7 +280,8 @@ int hna_local_seq_print_text(struct seq_file *seq, void *offset)
         buff = kmalloc(buf_size, GFP_ATOMIC);
         if (!buff) {
                 spin_unlock_bh(&bat_priv->hna_lhash_lock);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto out;
         }
 
         buff[0] = '\0';
@@ -291,7 +303,10 @@ int hna_local_seq_print_text(struct seq_file *seq, void *offset)
 
         seq_printf(seq, "%s", buff);
         kfree(buff);
-        return 0;
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
+        return ret;
 }
 
 static void _hna_local_del(struct hlist_node *node, void *arg)
@@ -468,16 +483,26 @@ int hna_global_seq_print_text(struct seq_file *seq, void *offset)
         struct bat_priv *bat_priv = netdev_priv(net_dev);
         struct hashtable_t *hash = bat_priv->hna_global_hash;
         struct hna_global_entry *hna_global_entry;
+        struct hard_iface *primary_if;
         struct hlist_node *node;
         struct hlist_head *head;
         size_t buf_size, pos;
         char *buff;
-        int i;
+        int i, ret = 0;
 
-        if (!bat_priv->primary_if) {
-                return seq_printf(seq, "BATMAN mesh %s disabled - "
-                                  "please specify interfaces to enable it\n",
-                                  net_dev->name);
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if) {
+                ret = seq_printf(seq, "BATMAN mesh %s disabled - please "
+                                 "specify interfaces to enable it\n",
+                                 net_dev->name);
+                goto out;
+        }
+
+        if (primary_if->if_status != IF_ACTIVE) {
+                ret = seq_printf(seq, "BATMAN mesh %s disabled - "
+                                 "primary interface not active\n",
+                                 net_dev->name);
+                goto out;
         }
 
         seq_printf(seq, "Globally announced HNAs received via the mesh %s\n",
@@ -499,7 +524,8 @@ int hna_global_seq_print_text(struct seq_file *seq, void *offset)
         buff = kmalloc(buf_size, GFP_ATOMIC);
         if (!buff) {
                 spin_unlock_bh(&bat_priv->hna_ghash_lock);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto out;
         }
         buff[0] = '\0';
         pos = 0;
@@ -522,7 +548,10 @@ int hna_global_seq_print_text(struct seq_file *seq, void *offset)
 
         seq_printf(seq, "%s", buff);
         kfree(buff);
-        return 0;
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
+        return ret;
 }
 
 static void _hna_global_del_orig(struct bat_priv *bat_priv,
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 83445cf0cc9f..947bafc6431a 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -67,7 +67,7 @@ struct hard_iface {
 struct orig_node {
         uint8_t orig[ETH_ALEN];
         uint8_t primary_addr[ETH_ALEN];
-        struct neigh_node *router;
+        struct neigh_node __rcu *router; /* rcu protected pointer */
         unsigned long *bcast_own;
         uint8_t *bcast_own_sum;
         unsigned long last_valid;
@@ -83,7 +83,7 @@ struct orig_node {
         uint32_t last_bcast_seqno;
         struct hlist_head neigh_list;
         struct list_head frag_list;
-        spinlock_t neigh_list_lock; /* protects neighbor list */
+        spinlock_t neigh_list_lock; /* protects neigh_list and router */
         atomic_t refcount;
         struct rcu_head rcu;
         struct hlist_node hash_entry;
@@ -125,6 +125,7 @@ struct neigh_node {
         struct rcu_head rcu;
         struct orig_node *orig_node;
         struct hard_iface *if_incoming;
+        spinlock_t tq_lock;     /* protects: tq_recv, tq_index */
 };
 
 
@@ -146,9 +147,8 @@ struct bat_priv {
         atomic_t batman_queue_left;
         char num_ifaces;
         struct hlist_head softif_neigh_list;
-        struct softif_neigh *softif_neigh;
+        struct softif_neigh __rcu *softif_neigh;
         struct debug_log *debug_log;
-        struct hard_iface *primary_if;
         struct kobject *mesh_obj;
         struct dentry *debug_dir;
         struct hlist_head forw_bat_list;
@@ -173,6 +173,7 @@ struct bat_priv {
         struct delayed_work orig_work;
         struct delayed_work vis_work;
         struct gw_node __rcu *curr_gw;  /* rcu protected pointer */
+        struct hard_iface __rcu *primary_if;  /* rcu protected pointer */
         struct vis_info *my_vis_info;
 };
 
diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c
index 19f84bd443af..b46cbf1507e4 100644
--- a/net/batman-adv/unicast.c
+++ b/net/batman-adv/unicast.c
@@ -221,15 +221,17 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv,
                   struct hard_iface *hard_iface, uint8_t dstaddr[])
 {
         struct unicast_packet tmp_uc, *unicast_packet;
+        struct hard_iface *primary_if;
         struct sk_buff *frag_skb;
         struct unicast_frag_packet *frag1, *frag2;
         int uc_hdr_len = sizeof(struct unicast_packet);
         int ucf_hdr_len = sizeof(struct unicast_frag_packet);
         int data_len = skb->len - uc_hdr_len;
-        int large_tail = 0;
+        int large_tail = 0, ret = NET_RX_DROP;
         uint16_t seqno;
 
-        if (!bat_priv->primary_if)
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if)
                 goto dropped;
 
         frag_skb = dev_alloc_skb(data_len - (data_len / 2) + ucf_hdr_len);
@@ -254,7 +256,7 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv,
         frag1->version = COMPAT_VERSION;
         frag1->packet_type = BAT_UNICAST_FRAG;
 
-        memcpy(frag1->orig, bat_priv->primary_if->net_dev->dev_addr, ETH_ALEN);
+        memcpy(frag1->orig, primary_if->net_dev->dev_addr, ETH_ALEN);
         memcpy(frag2, frag1, sizeof(struct unicast_frag_packet));
 
         if (data_len & 1)
@@ -269,13 +271,17 @@ int frag_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv,
 
         send_skb_packet(skb, hard_iface, dstaddr);
         send_skb_packet(frag_skb, hard_iface, dstaddr);
-        return NET_RX_SUCCESS;
+        ret = NET_RX_SUCCESS;
+        goto out;
 
 drop_frag:
         kfree_skb(frag_skb);
 dropped:
         kfree_skb(skb);
-        return NET_RX_DROP;
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
+        return ret;
 }
 
 int unicast_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv)
@@ -289,7 +295,7 @@ int unicast_send_skb(struct sk_buff *skb, struct bat_priv *bat_priv)
 
         /* get routing information */
         if (is_multicast_ether_addr(ethhdr->h_dest)) {
-                orig_node = (struct orig_node *)gw_get_selected(bat_priv);
+                orig_node = (struct orig_node *)gw_get_selected_orig(bat_priv);
                 if (orig_node)
                         goto find_router;
         }
diff --git a/net/batman-adv/vis.c b/net/batman-adv/vis.c
index f90212f42082..c8f571d3b5d4 100644
--- a/net/batman-adv/vis.c
+++ b/net/batman-adv/vis.c
@@ -204,6 +204,7 @@ static ssize_t vis_data_read_entry(char *buff, struct vis_info_entry *entry,
 
 int vis_seq_print_text(struct seq_file *seq, void *offset)
 {
+        struct hard_iface *primary_if;
         struct hlist_node *node;
         struct hlist_head *head;
         struct vis_info *info;
@@ -215,15 +216,18 @@ int vis_seq_print_text(struct seq_file *seq, void *offset)
         HLIST_HEAD(vis_if_list);
         struct if_list_entry *entry;
         struct hlist_node *pos, *n;
-        int i, j;
+        int i, j, ret = 0;
         int vis_server = atomic_read(&bat_priv->vis_mode);
         size_t buff_pos, buf_size;
         char *buff;
         int compare;
 
-        if ((!bat_priv->primary_if) ||
-            (vis_server == VIS_TYPE_CLIENT_UPDATE))
-                return 0;
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if)
+                goto out;
+
+        if (vis_server == VIS_TYPE_CLIENT_UPDATE)
+                goto out;
 
         buf_size = 1;
         /* Estimate length */
@@ -270,7 +274,8 @@ int vis_seq_print_text(struct seq_file *seq, void *offset)
         buff = kmalloc(buf_size, GFP_ATOMIC);
         if (!buff) {
                 spin_unlock_bh(&bat_priv->vis_hash_lock);
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto out;
         }
         buff[0] = '\0';
         buff_pos = 0;
@@ -328,7 +333,10 @@ int vis_seq_print_text(struct seq_file *seq, void *offset)
         seq_printf(seq, "%s", buff);
         kfree(buff);
 
-        return 0;
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
+        return ret;
 }
 
 /* add the info packet to the send list, if it was not
@@ -558,6 +566,7 @@ static int find_best_vis_server(struct bat_priv *bat_priv,
                                 struct vis_info *info)
 {
         struct hashtable_t *hash = bat_priv->orig_hash;
+        struct neigh_node *router;
         struct hlist_node *node;
         struct hlist_head *head;
         struct orig_node *orig_node;
@@ -571,13 +580,17 @@ static int find_best_vis_server(struct bat_priv *bat_priv,
 
                 rcu_read_lock();
                 hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
-                        if ((orig_node) && (orig_node->router) &&
-                            (orig_node->flags & VIS_SERVER) &&
-                            (orig_node->router->tq_avg > best_tq)) {
-                                best_tq = orig_node->router->tq_avg;
+                        router = orig_node_get_router(orig_node);
+                        if (!router)
+                                continue;
+
+                        if ((orig_node->flags & VIS_SERVER) &&
+                            (router->tq_avg > best_tq)) {
+                                best_tq = router->tq_avg;
                                 memcpy(packet->target_orig, orig_node->orig,
                                        ETH_ALEN);
                         }
+                        neigh_node_free_ref(router);
                 }
                 rcu_read_unlock();
         }
@@ -605,7 +618,7 @@ static int generate_vis_packet(struct bat_priv *bat_priv)
         struct hlist_node *node;
         struct hlist_head *head;
         struct orig_node *orig_node;
-        struct neigh_node *neigh_node;
+        struct neigh_node *router;
         struct vis_info *info = (struct vis_info *)bat_priv->my_vis_info;
         struct vis_packet *packet = (struct vis_packet *)info->skb_packet->data;
         struct vis_info_entry *entry;
@@ -633,30 +646,32 @@ static int generate_vis_packet(struct bat_priv *bat_priv)
 
                 rcu_read_lock();
                 hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
-                        neigh_node = orig_node->router;
-
-                        if (!neigh_node)
+                        router = orig_node_get_router(orig_node);
+                        if (!router)
                                 continue;
 
-                        if (!compare_eth(neigh_node->addr, orig_node->orig))
-                                continue;
+                        if (!compare_eth(router->addr, orig_node->orig))
+                                goto next;
 
-                        if (neigh_node->if_incoming->if_status != IF_ACTIVE)
-                                continue;
+                        if (router->if_incoming->if_status != IF_ACTIVE)
+                                goto next;
 
-                        if (neigh_node->tq_avg < 1)
-                                continue;
+                        if (router->tq_avg < 1)
+                                goto next;
 
                         /* fill one entry into buffer. */
                         entry = (struct vis_info_entry *)
                                       skb_put(info->skb_packet, sizeof(*entry));
                         memcpy(entry->src,
-                               neigh_node->if_incoming->net_dev->dev_addr,
+                               router->if_incoming->net_dev->dev_addr,
                                ETH_ALEN);
                         memcpy(entry->dest, orig_node->orig, ETH_ALEN);
-                        entry->quality = neigh_node->tq_avg;
+                        entry->quality = router->tq_avg;
                         packet->entries++;
 
+next:
+                        neigh_node_free_ref(router);
+
                         if (vis_packet_full(info))
                                 goto unlock;
                 }
@@ -725,6 +740,7 @@ static void purge_vis_packets(struct bat_priv *bat_priv)
 static void broadcast_vis_packet(struct bat_priv *bat_priv,
                                  struct vis_info *info)
 {
+        struct neigh_node *router;
         struct hashtable_t *hash = bat_priv->orig_hash;
         struct hlist_node *node;
         struct hlist_head *head;
@@ -745,19 +761,26 @@ static void broadcast_vis_packet(struct bat_priv *bat_priv,
                 rcu_read_lock();
                 hlist_for_each_entry_rcu(orig_node, node, head, hash_entry) {
                         /* if it's a vis server and reachable, send it. */
-                        if ((!orig_node) || (!orig_node->router))
-                                continue;
                         if (!(orig_node->flags & VIS_SERVER))
                                 continue;
+
+                        router = orig_node_get_router(orig_node);
+                        if (!router)
+                                continue;
+
                         /* don't send it if we already received the packet from
-                        * this node. */
+                         * this node. */
                         if (recv_list_is_in(bat_priv, &info->recv_list,
-                                            orig_node->orig))
+                                            orig_node->orig)) {
+                                neigh_node_free_ref(router);
                                 continue;
+                        }
 
                         memcpy(packet->target_orig, orig_node->orig, ETH_ALEN);
-                        hard_iface = orig_node->router->if_incoming;
-                        memcpy(dstaddr, orig_node->router->addr, ETH_ALEN);
+                        hard_iface = router->if_incoming;
+                        memcpy(dstaddr, router->addr, ETH_ALEN);
+
+                        neigh_node_free_ref(router);
 
                         skb = skb_clone(info->skb_packet, GFP_ATOMIC);
                         if (skb)
@@ -772,60 +795,48 @@ static void unicast_vis_packet(struct bat_priv *bat_priv,
                                struct vis_info *info)
 {
         struct orig_node *orig_node;
-        struct neigh_node *neigh_node = NULL;
+        struct neigh_node *router = NULL;
         struct sk_buff *skb;
         struct vis_packet *packet;
 
         packet = (struct vis_packet *)info->skb_packet->data;
 
-        rcu_read_lock();
         orig_node = orig_hash_find(bat_priv, packet->target_orig);
-
         if (!orig_node)
-                goto unlock;
-
-        neigh_node = orig_node->router;
+                goto out;
 
-        if (!neigh_node)
-                goto unlock;
-
-        if (!atomic_inc_not_zero(&neigh_node->refcount)) {
-                neigh_node = NULL;
-                goto unlock;
-        }
-
-        rcu_read_unlock();
+        router = orig_node_get_router(orig_node);
+        if (!router)
+                goto out;
 
         skb = skb_clone(info->skb_packet, GFP_ATOMIC);
         if (skb)
-                send_skb_packet(skb, neigh_node->if_incoming,
-                                neigh_node->addr);
+                send_skb_packet(skb, router->if_incoming, router->addr);
 
-        goto out;
-
-unlock:
-        rcu_read_unlock();
 out:
-        if (neigh_node)
-                neigh_node_free_ref(neigh_node);
+        if (router)
+                neigh_node_free_ref(router);
         if (orig_node)
                 orig_node_free_ref(orig_node);
-        return;
 }
 
 /* only send one vis packet. called from send_vis_packets() */
 static void send_vis_packet(struct bat_priv *bat_priv, struct vis_info *info)
 {
+        struct hard_iface *primary_if;
         struct vis_packet *packet;
 
+        primary_if = primary_if_get_selected(bat_priv);
+        if (!primary_if)
+                goto out;
+
         packet = (struct vis_packet *)info->skb_packet->data;
         if (packet->ttl < 2) {
                 pr_debug("Error - can't send vis packet: ttl exceeded\n");
-                return;
+                goto out;
         }
 
-        memcpy(packet->sender_orig, bat_priv->primary_if->net_dev->dev_addr,
-               ETH_ALEN);
+        memcpy(packet->sender_orig, primary_if->net_dev->dev_addr, ETH_ALEN);
         packet->ttl--;
 
         if (is_broadcast_ether_addr(packet->target_orig))
@@ -833,6 +844,10 @@ static void send_vis_packet(struct bat_priv *bat_priv, struct vis_info *info)
         else
                 unicast_vis_packet(bat_priv, info);
         packet->ttl++; /* restore TTL */
+
+out:
+        if (primary_if)
+                hardif_free_ref(primary_if);
 }
 
 /* called from timer; send (and maybe generate) vis packet. */
@@ -859,8 +874,7 @@ static void send_vis_packets(struct work_struct *work)
                 kref_get(&info->refcount);
                 spin_unlock_bh(&bat_priv->vis_hash_lock);
 
-                if (bat_priv->primary_if)
-                        send_vis_packet(bat_priv, info);
+                send_vis_packet(bat_priv, info);
 
                 spin_lock_bh(&bat_priv->vis_hash_lock);
                 send_list_del(info);
diff --git a/net/bluetooth/bnep/bnep.h b/net/bluetooth/bnep/bnep.h
index 70672544db86..8e6c06158f8e 100644
--- a/net/bluetooth/bnep/bnep.h
+++ b/net/bluetooth/bnep/bnep.h
@@ -23,88 +23,88 @@
 #include <linux/crc32.h>
 #include <net/bluetooth/bluetooth.h>
 
-// Limits
-#define BNEP_MAX_PROTO_FILTERS     5
-#define BNEP_MAX_MULTICAST_FILTERS 20
-
-// UUIDs
-#define BNEP_BASE_UUID 0x0000000000001000800000805F9B34FB
-#define BNEP_UUID16    0x02
-#define BNEP_UUID32    0x04
-#define BNEP_UUID128   0x16
-
-#define BNEP_SVC_PANU  0x1115
-#define BNEP_SVC_NAP   0x1116
-#define BNEP_SVC_GN    0x1117
-
-// Packet types
-#define BNEP_GENERAL               0x00
-#define BNEP_CONTROL               0x01
-#define BNEP_COMPRESSED            0x02
-#define BNEP_COMPRESSED_SRC_ONLY   0x03
-#define BNEP_COMPRESSED_DST_ONLY   0x04
-
-// Control types
-#define BNEP_CMD_NOT_UNDERSTOOD    0x00
-#define BNEP_SETUP_CONN_REQ        0x01
-#define BNEP_SETUP_CONN_RSP        0x02
-#define BNEP_FILTER_NET_TYPE_SET   0x03
-#define BNEP_FILTER_NET_TYPE_RSP   0x04
-#define BNEP_FILTER_MULTI_ADDR_SET 0x05
-#define BNEP_FILTER_MULTI_ADDR_RSP 0x06
-
-// Extension types
-#define BNEP_EXT_CONTROL           0x00
-
-// Response messages
-#define BNEP_SUCCESS               0x00
-
-#define BNEP_CONN_INVALID_DST      0x01
-#define BNEP_CONN_INVALID_SRC      0x02
-#define BNEP_CONN_INVALID_SVC      0x03
-#define BNEP_CONN_NOT_ALLOWED      0x04
-
-#define BNEP_FILTER_UNSUPPORTED_REQ    0x01
-#define BNEP_FILTER_INVALID_RANGE      0x02
-#define BNEP_FILTER_INVALID_MCADDR     0x02
-#define BNEP_FILTER_LIMIT_REACHED      0x03
-#define BNEP_FILTER_DENIED_SECURITY    0x04
-
-// L2CAP settings
-#define BNEP_MTU         1691
-#define BNEP_PSM         0x0f
-#define BNEP_FLUSH_TO    0xffff
-#define BNEP_CONNECT_TO  15
-#define BNEP_FILTER_TO   15
-
-// Headers
-#define BNEP_TYPE_MASK   0x7f
-#define BNEP_EXT_HEADER  0x80
+/* Limits */
+#define BNEP_MAX_PROTO_FILTERS          5
+#define BNEP_MAX_MULTICAST_FILTERS      20
+
+/* UUIDs */
+#define BNEP_BASE_UUID  0x0000000000001000800000805F9B34FB
+#define BNEP_UUID16     0x02
+#define BNEP_UUID32     0x04
+#define BNEP_UUID128    0x16
+
+#define BNEP_SVC_PANU   0x1115
+#define BNEP_SVC_NAP    0x1116
+#define BNEP_SVC_GN     0x1117
+
+/* Packet types */
+#define BNEP_GENERAL                    0x00
+#define BNEP_CONTROL                    0x01
+#define BNEP_COMPRESSED                 0x02
+#define BNEP_COMPRESSED_SRC_ONLY        0x03
+#define BNEP_COMPRESSED_DST_ONLY        0x04
+
+/* Control types */
+#define BNEP_CMD_NOT_UNDERSTOOD         0x00
+#define BNEP_SETUP_CONN_REQ             0x01
+#define BNEP_SETUP_CONN_RSP             0x02
+#define BNEP_FILTER_NET_TYPE_SET        0x03
+#define BNEP_FILTER_NET_TYPE_RSP        0x04
+#define BNEP_FILTER_MULTI_ADDR_SET      0x05
+#define BNEP_FILTER_MULTI_ADDR_RSP      0x06
+
+/* Extension types */
+#define BNEP_EXT_CONTROL 0x00
+
+/* Response messages */
+#define BNEP_SUCCESS 0x00
+
+#define BNEP_CONN_INVALID_DST 0x01
+#define BNEP_CONN_INVALID_SRC 0x02
+#define BNEP_CONN_INVALID_SVC 0x03
+#define BNEP_CONN_NOT_ALLOWED 0x04
+
+#define BNEP_FILTER_UNSUPPORTED_REQ     0x01
+#define BNEP_FILTER_INVALID_RANGE       0x02
+#define BNEP_FILTER_INVALID_MCADDR      0x02
+#define BNEP_FILTER_LIMIT_REACHED       0x03
+#define BNEP_FILTER_DENIED_SECURITY     0x04
+
+/* L2CAP settings */
+#define BNEP_MTU        1691
+#define BNEP_PSM        0x0f
+#define BNEP_FLUSH_TO   0xffff
+#define BNEP_CONNECT_TO 15
+#define BNEP_FILTER_TO  15
+
+/* Headers */
+#define BNEP_TYPE_MASK  0x7f
+#define BNEP_EXT_HEADER 0x80
 
 struct bnep_setup_conn_req {
-        __u8  type;
-        __u8  ctrl;
-        __u8  uuid_size;
-        __u8  service[0];
+        __u8 type;
+        __u8 ctrl;
+        __u8 uuid_size;
+        __u8 service[0];
 } __packed;
 
 struct bnep_set_filter_req {
-        __u8  type;
-        __u8  ctrl;
+        __u8 type;
+        __u8 ctrl;
         __be16 len;
-        __u8  list[0];
+        __u8 list[0];
 } __packed;
 
 struct bnep_control_rsp {
-        __u8  type;
-        __u8  ctrl;
+        __u8 type;
+        __u8 ctrl;
         __be16 resp;
 } __packed;
 
 struct bnep_ext_hdr {
-        __u8  type;
-        __u8  len;
-        __u8  data[0];
+        __u8 type;
+        __u8 len;
+        __u8 data[0];
 } __packed;
 
 /* BNEP ioctl defines */
@@ -114,10 +114,10 @@ struct bnep_ext_hdr {
 #define BNEPGETCONNINFO _IOR('B', 211, int)
 
 struct bnep_connadd_req {
-        int   sock;       // Connected socket
+        int   sock;             /* Connected socket */
         __u32 flags;
         __u16 role;
-        char  device[16]; // Name of the Ethernet device
+        char  device[16];       /* Name of the Ethernet device */
 };
 
 struct bnep_conndel_req {
@@ -148,14 +148,14 @@ int bnep_del_connection(struct bnep_conndel_req *req);
 int bnep_get_connlist(struct bnep_connlist_req *req);
 int bnep_get_conninfo(struct bnep_conninfo *ci);
 
-// BNEP sessions
+/* BNEP sessions */
 struct bnep_session {
         struct list_head list;
 
         unsigned int  role;
         unsigned long state;
         unsigned long flags;
-        atomic_t      killed;
+        struct task_struct *task;
 
         struct ethhdr eh;
         struct msghdr msg;
@@ -173,7 +173,7 @@ void bnep_sock_cleanup(void);
 
 static inline int bnep_mc_hash(__u8 *addr)
 {
-        return (crc32_be(~0, addr, ETH_ALEN) >> 26);
+        return crc32_be(~0, addr, ETH_ALEN) >> 26;
 }
 
 #endif
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 03d4d1245d58..ca39fcf010ce 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -36,6 +36,7 @@
 #include <linux/errno.h>
 #include <linux/net.h>
 #include <linux/slab.h>
+#include <linux/kthread.h>
 #include <net/sock.h>
 
 #include <linux/socket.h>
@@ -131,7 +132,8 @@ static int bnep_ctrl_set_netfilter(struct bnep_session *s, __be16 *data, int len
                 return -EILSEQ;
 
         n = get_unaligned_be16(data);
-        data++; len -= 2;
+        data++;
+        len -= 2;
 
         if (len < n)
                 return -EILSEQ;
@@ -176,7 +178,8 @@ static int bnep_ctrl_set_mcfilter(struct bnep_session *s, u8 *data, int len)
                 return -EILSEQ;
 
         n = get_unaligned_be16(data);
-        data += 2; len -= 2;
+        data += 2;
+        len -= 2;
 
         if (len < n)
                 return -EILSEQ;
@@ -187,6 +190,8 @@ static int bnep_ctrl_set_mcfilter(struct bnep_session *s, u8 *data, int len)
         n /= (ETH_ALEN * 2);
 
         if (n > 0) {
+                int i;
+
                 s->mc_filter = 0;
 
                 /* Always send broadcast */
@@ -196,18 +201,22 @@ static int bnep_ctrl_set_mcfilter(struct bnep_session *s, u8 *data, int len)
                 for (; n > 0; n--) {
                         u8 a1[6], *a2;
 
-                        memcpy(a1, data, ETH_ALEN); data += ETH_ALEN;
-                        a2 = data; data += ETH_ALEN;
+                        memcpy(a1, data, ETH_ALEN);
+                        data += ETH_ALEN;
+                        a2 = data;
+                        data += ETH_ALEN;
 
                         BT_DBG("mc filter %s -> %s",
                                 batostr((void *) a1), batostr((void *) a2));
 
-                        #define INCA(a) { int i = 5; while (i >=0 && ++a[i--] == 0); }
-
                         /* Iterate from a1 to a2 */
                         set_bit(bnep_mc_hash(a1), (ulong *) &s->mc_filter);
                         while (memcmp(a1, a2, 6) < 0 && s->mc_filter != ~0LL) {
-                                INCA(a1);
+                                /* Increment a1 */
+                                i = 5;
+                                while (i >= 0 && ++a1[i--] == 0)
+                                        ;
+
                                 set_bit(bnep_mc_hash(a1), (ulong *) &s->mc_filter);
                         }
                 }
@@ -227,7 +236,8 @@ static int bnep_rx_control(struct bnep_session *s, void *data, int len)
         u8  cmd = *(u8 *)data;
         int err = 0;
 
-        data++; len--;
+        data++;
+        len--;
 
         switch (cmd) {
         case BNEP_CMD_NOT_UNDERSTOOD:
@@ -302,7 +312,6 @@ static u8 __bnep_rx_hlen[] = {
         ETH_ALEN + 2, /* BNEP_COMPRESSED_SRC_ONLY */
         ETH_ALEN + 2  /* BNEP_COMPRESSED_DST_ONLY */
 };
-#define BNEP_RX_TYPES   (sizeof(__bnep_rx_hlen) - 1)
 
 static inline int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
 {
@@ -312,9 +321,10 @@ static inline int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
 
         dev->stats.rx_bytes += skb->len;
 
-        type = *(u8 *) skb->data; skb_pull(skb, 1);
+        type = *(u8 *) skb->data;
+        skb_pull(skb, 1);
 
-        if ((type & BNEP_TYPE_MASK) > BNEP_RX_TYPES)
+        if ((type & BNEP_TYPE_MASK) >= sizeof(__bnep_rx_hlen))
                 goto badframe;
 
         if ((type & BNEP_TYPE_MASK) == BNEP_CONTROL) {
@@ -367,14 +377,14 @@ static inline int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
 
         case BNEP_COMPRESSED_DST_ONLY:
                 memcpy(__skb_put(nskb, ETH_ALEN), skb_mac_header(skb),
-                       ETH_ALEN);
+                                                                ETH_ALEN);
                 memcpy(__skb_put(nskb, ETH_ALEN + 2), s->eh.h_source,
-                       ETH_ALEN + 2);
+                                                                ETH_ALEN + 2);
                 break;
 
         case BNEP_GENERAL:
                 memcpy(__skb_put(nskb, ETH_ALEN * 2), skb_mac_header(skb),
-                       ETH_ALEN * 2);
+                                                                ETH_ALEN * 2);
                 put_unaligned(s->eh.h_proto, (__be16 *) __skb_put(nskb, 2));
                 break;
         }
@@ -470,15 +480,14 @@ static int bnep_session(void *arg)
 
         BT_DBG("");
 
-        daemonize("kbnepd %s", dev->name);
         set_user_nice(current, -15);
 
         init_waitqueue_entry(&wait, current);
         add_wait_queue(sk_sleep(sk), &wait);
-        while (!atomic_read(&s->killed)) {
+        while (!kthread_should_stop()) {
                 set_current_state(TASK_INTERRUPTIBLE);
 
-                // RX
+                /* RX */
                 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
                         skb_orphan(skb);
                         bnep_rx_frame(s, skb);
@@ -487,7 +496,7 @@ static int bnep_session(void *arg)
                 if (sk->sk_state != BT_CONNECTED)
                         break;
 
-                // TX
+                /* TX */
                 while ((skb = skb_dequeue(&sk->sk_write_queue)))
                         if (bnep_tx_frame(s, skb))
                                 break;
@@ -555,8 +564,8 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
 
         /* session struct allocated as private part of net_device */
         dev = alloc_netdev(sizeof(struct bnep_session),
-                           (*req->device) ? req->device : "bnep%d",
-                           bnep_net_setup);
+                                (*req->device) ? req->device : "bnep%d",
+                                bnep_net_setup);
         if (!dev)
                 return -ENOMEM;
 
@@ -571,7 +580,7 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
         s = netdev_priv(dev);
 
         /* This is rx header therefore addresses are swapped.
-         * ie eh.h_dest is our local address. */
+         * ie. eh.h_dest is our local address. */
         memcpy(s->eh.h_dest,   &src, ETH_ALEN);
         memcpy(s->eh.h_source, &dst, ETH_ALEN);
         memcpy(dev->dev_addr, s->eh.h_dest, ETH_ALEN);
@@ -597,17 +606,17 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
         SET_NETDEV_DEVTYPE(dev, &bnep_type);
 
         err = register_netdev(dev);
-        if (err) {
+        if (err)
                 goto failed;
-        }
 
         __bnep_link_session(s);
 
-        err = kernel_thread(bnep_session, s, CLONE_KERNEL);
-        if (err < 0) {
+        s->task = kthread_run(bnep_session, s, "kbnepd %s", dev->name);
+        if (IS_ERR(s->task)) {
                 /* Session thread start failed, gotta cleanup. */
                 unregister_netdev(dev);
                 __bnep_unlink_session(s);
+                err = PTR_ERR(s->task);
                 goto failed;
         }
 
@@ -631,15 +640,9 @@ int bnep_del_connection(struct bnep_conndel_req *req)
         down_read(&bnep_session_sem);
 
         s = __bnep_get_session(req->dst);
-        if (s) {
-                /* Wakeup user-space which is polling for socket errors.
-                 * This is temporary hack until we have shutdown in L2CAP */
-                s->sock->sk->sk_err = EUNATCH;
-
-                /* Kill session thread */
-                atomic_inc(&s->killed);
-                wake_up_interruptible(sk_sleep(s->sock->sk));
-        } else
+        if (s)
+                kthread_stop(s->task);
+        else
                 err = -ENOENT;
 
         up_read(&bnep_session_sem);
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
index d935da71ab3b..17800b1d28ea 100644
--- a/net/bluetooth/bnep/sock.c
+++ b/net/bluetooth/bnep/sock.c
@@ -39,10 +39,10 @@
 #include <linux/init.h>
 #include <linux/compat.h>
 #include <linux/gfp.h>
+#include <linux/uaccess.h>
 #include <net/sock.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
 
 #include "bnep.h"
 
diff --git a/net/bluetooth/cmtp/capi.c b/net/bluetooth/cmtp/capi.c
index 67cff810c77d..744233cba244 100644
--- a/net/bluetooth/cmtp/capi.c
+++ b/net/bluetooth/cmtp/capi.c
@@ -35,6 +35,7 @@
 #include <linux/ioctl.h>
 #include <linux/file.h>
 #include <linux/wait.h>
+#include <linux/kthread.h>
 #include <net/sock.h>
 
 #include <linux/isdn/capilli.h>
@@ -143,7 +144,7 @@ static void cmtp_send_capimsg(struct cmtp_session *session, struct sk_buff *skb)
 
         skb_queue_tail(&session->transmit, skb);
 
-        cmtp_schedule(session);
+        wake_up_interruptible(sk_sleep(session->sock->sk));
 }
 
 static void cmtp_send_interopmsg(struct cmtp_session *session,
@@ -386,8 +387,7 @@ static void cmtp_reset_ctr(struct capi_ctr *ctrl)
 
         capi_ctr_down(ctrl);
 
-        atomic_inc(&session->terminate);
-        cmtp_schedule(session);
+        kthread_stop(session->task);
 }
 
 static void cmtp_register_appl(struct capi_ctr *ctrl, __u16 appl, capi_register_params *rp)
diff --git a/net/bluetooth/cmtp/cmtp.h b/net/bluetooth/cmtp/cmtp.h
index 785e79e953c5..db43b54ac9af 100644
--- a/net/bluetooth/cmtp/cmtp.h
+++ b/net/bluetooth/cmtp/cmtp.h
@@ -37,7 +37,7 @@
 #define CMTP_LOOPBACK   0
 
 struct cmtp_connadd_req {
-        int   sock;     // Connected socket
+        int   sock;     /* Connected socket */
         __u32 flags;
 };
 
@@ -81,7 +81,7 @@ struct cmtp_session {
 
         char name[BTNAMSIZ];
 
-        atomic_t terminate;
+        struct task_struct *task;
 
         wait_queue_head_t wait;
 
@@ -121,13 +121,6 @@ void cmtp_detach_device(struct cmtp_session *session);
 
 void cmtp_recv_capimsg(struct cmtp_session *session, struct sk_buff *skb);
 
-static inline void cmtp_schedule(struct cmtp_session *session)
-{
-        struct sock *sk = session->sock->sk;
-
-        wake_up_interruptible(sk_sleep(sk));
-}
-
 /* CMTP init defines */
 int cmtp_init_sockets(void);
 void cmtp_cleanup_sockets(void);
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 964ea9126f9f..c5b11af908be 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -35,6 +35,7 @@
 #include <linux/ioctl.h>
 #include <linux/file.h>
 #include <linux/init.h>
+#include <linux/kthread.h>
 #include <net/sock.h>
 
 #include <linux/isdn/capilli.h>
@@ -235,9 +236,12 @@ static void cmtp_process_transmit(struct cmtp_session *session)
 
                 size = min_t(uint, ((tail < 258) ? (tail - 2) : (tail - 3)), skb->len);
 
-                if ((scb->id < 0) && ((scb->id = cmtp_alloc_block_id(session)) < 0)) {
-                        skb_queue_head(&session->transmit, skb);
-                        break;
+                if (scb->id < 0) {
+                        scb->id = cmtp_alloc_block_id(session);
+                        if (scb->id < 0) {
+                                skb_queue_head(&session->transmit, skb);
+                                break;
+                        }
                 }
 
                 if (size < 256) {
@@ -284,12 +288,11 @@ static int cmtp_session(void *arg)
 
         BT_DBG("session %p", session);
 
-        daemonize("kcmtpd_ctr_%d", session->num);
         set_user_nice(current, -15);
 
         init_waitqueue_entry(&wait, current);
         add_wait_queue(sk_sleep(sk), &wait);
-        while (!atomic_read(&session->terminate)) {
+        while (!kthread_should_stop()) {
                 set_current_state(TASK_INTERRUPTIBLE);
 
                 if (sk->sk_state != BT_CONNECTED)
@@ -343,7 +346,8 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
 
         bacpy(&session->bdaddr, &bt_sk(sock->sk)->dst);
 
-        session->mtu = min_t(uint, l2cap_pi(sock->sk)->omtu, l2cap_pi(sock->sk)->imtu);
+        session->mtu = min_t(uint, l2cap_pi(sock->sk)->chan->omtu,
+                                        l2cap_pi(sock->sk)->chan->imtu);
 
         BT_DBG("mtu %d", session->mtu);
 
@@ -367,9 +371,12 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
 
         __cmtp_link_session(session);
 
-        err = kernel_thread(cmtp_session, session, CLONE_KERNEL);
-        if (err < 0)
+        session->task = kthread_run(cmtp_session, session, "kcmtpd_ctr_%d",
+                                                                session->num);
+        if (IS_ERR(session->task)) {
+                err = PTR_ERR(session->task);
                 goto unlink;
+        }
 
         if (!(session->flags & (1 << CMTP_LOOPBACK))) {
                 err = cmtp_attach_device(session);
@@ -406,9 +413,8 @@ int cmtp_del_connection(struct cmtp_conndel_req *req)
                 /* Flush the transmit queue */
                 skb_queue_purge(&session->transmit);
 
-                /* Kill session thread */
-                atomic_inc(&session->terminate);
-                cmtp_schedule(session);
+                /* Stop session thread */
+                kthread_stop(session->task);
         } else
                 err = -ENOENT;
 
diff --git a/net/bluetooth/cmtp/sock.c b/net/bluetooth/cmtp/sock.c
index 7ea1979a8e4f..3f2dd5c25ae5 100644
--- a/net/bluetooth/cmtp/sock.c
+++ b/net/bluetooth/cmtp/sock.c
@@ -34,12 +34,12 @@
 #include <linux/file.h>
 #include <linux/compat.h>
 #include <linux/gfp.h>
+#include <linux/uaccess.h>
 #include <net/sock.h>
 
 #include <linux/isdn/capilli.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
 
 #include "cmtp.h"
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 7a6f56b2f49d..7f5ad8a2b22d 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -269,6 +269,19 @@ static void hci_conn_idle(unsigned long arg)
         hci_conn_enter_sniff_mode(conn);
 }
 
+static void hci_conn_auto_accept(unsigned long arg)
+{
+        struct hci_conn *conn = (void *) arg;
+        struct hci_dev *hdev = conn->hdev;
+
+        hci_dev_lock(hdev);
+
+        hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
+                                                                &conn->dst);
+
+        hci_dev_unlock(hdev);
+}
+
 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 {
         struct hci_conn *conn;
@@ -287,6 +300,7 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         conn->auth_type = HCI_AT_GENERAL_BONDING;
         conn->io_capability = hdev->io_capability;
         conn->remote_auth = 0xff;
+        conn->key_type = 0xff;
 
         conn->power_save = 1;
         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
@@ -311,6 +325,8 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 
         setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
+        setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
+                                                        (unsigned long) conn);
 
         atomic_set(&conn->refcnt, 0);
 
@@ -341,6 +357,8 @@ int hci_conn_del(struct hci_conn *conn)
 
         del_timer(&conn->disc_timer);
 
+        del_timer(&conn->auto_accept_timer);
+
         if (conn->type == ACL_LINK) {
                 struct hci_conn *sco = conn->link;
                 if (sco)
@@ -535,32 +553,72 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
         return 0;
 }
 
+/* Encrypt the the link */
+static void hci_conn_encrypt(struct hci_conn *conn)
+{
+        BT_DBG("conn %p", conn);
+
+        if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
+                struct hci_cp_set_conn_encrypt cp;
+                cp.handle  = cpu_to_le16(conn->handle);
+                cp.encrypt = 0x01;
+                hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
+                                                                        &cp);
+        }
+}
+
 /* Enable security */
 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 {
         BT_DBG("conn %p", conn);
 
+        /* For sdp we don't need the link key. */
         if (sec_level == BT_SECURITY_SDP)
                 return 1;
 
+        /* For non 2.1 devices and low security level we don't need the link
+           key. */
         if (sec_level == BT_SECURITY_LOW &&
                                 (!conn->ssp_mode || !conn->hdev->ssp_mode))
                 return 1;
 
-        if (conn->link_mode & HCI_LM_ENCRYPT)
-                return hci_conn_auth(conn, sec_level, auth_type);
-
+        /* For other security levels we need the link key. */
+        if (!(conn->link_mode & HCI_LM_AUTH))
+                goto auth;
+
+        /* An authenticated combination key has sufficient security for any
+           security level. */
+        if (conn->key_type == HCI_LK_AUTH_COMBINATION)
+                goto encrypt;
+
+        /* An unauthenticated combination key has sufficient security for
+           security level 1 and 2. */
+        if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
+                        (sec_level == BT_SECURITY_MEDIUM ||
+                        sec_level == BT_SECURITY_LOW))
+                goto encrypt;
+
+        /* A combination key has always sufficient security for the security
+           levels 1 or 2. High security level requires the combination key
+           is generated using maximum PIN code length (16).
+           For pre 2.1 units. */
+        if (conn->key_type == HCI_LK_COMBINATION &&
+                        (sec_level != BT_SECURITY_HIGH ||
+                        conn->pin_length == 16))
+                goto encrypt;
+
+auth:
         if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
                 return 0;
 
-        if (hci_conn_auth(conn, sec_level, auth_type)) {
-                struct hci_cp_set_conn_encrypt cp;
-                cp.handle  = cpu_to_le16(conn->handle);
-                cp.encrypt = 1;
-                hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT,
-                                                        sizeof(cp), &cp);
-        }
+        hci_conn_auth(conn, sec_level, auth_type);
+        return 0;
+
+encrypt:
+        if (conn->link_mode & HCI_LM_ENCRYPT)
+                return 1;
 
+        hci_conn_encrypt(conn);
         return 0;
 }
 EXPORT_SYMBOL(hci_conn_security);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index b5a8afc2be33..815269b07f20 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -56,7 +56,6 @@
 static void hci_cmd_task(unsigned long arg);
 static void hci_rx_task(unsigned long arg);
 static void hci_tx_task(unsigned long arg);
-static void hci_notify(struct hci_dev *hdev, int event);
 
 static DEFINE_RWLOCK(hci_task_lock);
 
@@ -1021,18 +1020,54 @@ struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
         return NULL;
 }
 
-int hci_add_link_key(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
-                                                u8 *val, u8 type, u8 pin_len)
+static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
+                                                u8 key_type, u8 old_key_type)
+{
+        /* Legacy key */
+        if (key_type < 0x03)
+                return 1;
+
+        /* Debug keys are insecure so don't store them persistently */
+        if (key_type == HCI_LK_DEBUG_COMBINATION)
+                return 0;
+
+        /* Changed combination key and there's no previous one */
+        if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
+                return 0;
+
+        /* Security mode 3 case */
+        if (!conn)
+                return 1;
+
+        /* Neither local nor remote side had no-bonding as requirement */
+        if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
+                return 1;
+
+        /* Local side had dedicated bonding as requirement */
+        if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
+                return 1;
+
+        /* Remote side had dedicated bonding as requirement */
+        if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
+                return 1;
+
+        /* If none of the above criteria match, then don't store the key
+         * persistently */
+        return 0;
+}
+
+int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
+                                bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
 {
         struct link_key *key, *old_key;
-        u8 old_key_type;
+        u8 old_key_type, persistent;
 
         old_key = hci_find_link_key(hdev, bdaddr);
         if (old_key) {
                 old_key_type = old_key->type;
                 key = old_key;
         } else {
-                old_key_type = 0xff;
+                old_key_type = conn ? conn->key_type : 0xff;
                 key = kzalloc(sizeof(*key), GFP_ATOMIC);
                 if (!key)
                         return -ENOMEM;
@@ -1041,16 +1076,37 @@ int hci_add_link_key(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
 
         BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
 
+        /* Some buggy controller combinations generate a changed
+         * combination key for legacy pairing even when there's no
+         * previous key */
+        if (type == HCI_LK_CHANGED_COMBINATION &&
+                                        (!conn || conn->remote_auth == 0xff) &&
+                                        old_key_type == 0xff) {
+                type = HCI_LK_COMBINATION;
+                if (conn)
+                        conn->key_type = type;
+        }
+
         bacpy(&key->bdaddr, bdaddr);
         memcpy(key->val, val, 16);
-        key->type = type;
         key->pin_len = pin_len;
 
-        if (new_key)
-                mgmt_new_key(hdev->id, key, old_key_type);
-
-        if (type == 0x06)
+        if (type == HCI_LK_CHANGED_COMBINATION)
                 key->type = old_key_type;
+        else
+                key->type = type;
+
+        if (!new_key)
+                return 0;
+
+        persistent = hci_persistent_key(hdev, conn, type, old_key_type);
+
+        mgmt_new_key(hdev->id, key, persistent);
+
+        if (!persistent) {
+                list_del(&key->list);
+                kfree(key);
+        }
 
         return 0;
 }
@@ -1082,6 +1138,70 @@ static void hci_cmd_timer(unsigned long arg)
         tasklet_schedule(&hdev->cmd_task);
 }
 
+struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
+                                                        bdaddr_t *bdaddr)
+{
+        struct oob_data *data;
+
+        list_for_each_entry(data, &hdev->remote_oob_data, list)
+                if (bacmp(bdaddr, &data->bdaddr) == 0)
+                        return data;
+
+        return NULL;
+}
+
+int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
+{
+        struct oob_data *data;
+
+        data = hci_find_remote_oob_data(hdev, bdaddr);
+        if (!data)
+                return -ENOENT;
+
+        BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
+
+        list_del(&data->list);
+        kfree(data);
+
+        return 0;
+}
+
+int hci_remote_oob_data_clear(struct hci_dev *hdev)
+{
+        struct oob_data *data, *n;
+
+        list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
+                list_del(&data->list);
+                kfree(data);
+        }
+
+        return 0;
+}
+
+int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
+                                                                u8 *randomizer)
+{
+        struct oob_data *data;
+
+        data = hci_find_remote_oob_data(hdev, bdaddr);
+
+        if (!data) {
+                data = kmalloc(sizeof(*data), GFP_ATOMIC);
+                if (!data)
+                        return -ENOMEM;
+
+                bacpy(&data->bdaddr, bdaddr);
+                list_add(&data->list, &hdev->remote_oob_data);
+        }
+
+        memcpy(data->hash, hash, sizeof(data->hash));
+        memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
+
+        BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
+
+        return 0;
+}
+
 /* Register HCI device */
 int hci_register_dev(struct hci_dev *hdev)
 {
@@ -1146,6 +1266,8 @@ int hci_register_dev(struct hci_dev *hdev)
 
         INIT_LIST_HEAD(&hdev->link_keys);
 
+        INIT_LIST_HEAD(&hdev->remote_oob_data);
+
         INIT_WORK(&hdev->power_on, hci_power_on);
         INIT_WORK(&hdev->power_off, hci_power_off);
         setup_timer(&hdev->off_timer, hci_auto_off, (unsigned long) hdev);
@@ -1225,6 +1347,7 @@ int hci_unregister_dev(struct hci_dev *hdev)
         hci_blacklist_clear(hdev);
         hci_uuids_clear(hdev);
         hci_link_keys_clear(hdev);
+        hci_remote_oob_data_clear(hdev);
         hci_dev_unlock_bh(hdev);
 
         __hci_dev_put(hdev);
@@ -1274,7 +1397,7 @@ int hci_recv_frame(struct sk_buff *skb)
 EXPORT_SYMBOL(hci_recv_frame);
 
 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
-                          int count, __u8 index, gfp_t gfp_mask)
+                                                  int count, __u8 index)
 {
         int len = 0;
         int hlen = 0;
@@ -1304,7 +1427,7 @@ static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
                         break;
                 }
 
-                skb = bt_skb_alloc(len, gfp_mask);
+                skb = bt_skb_alloc(len, GFP_ATOMIC);
                 if (!skb)
                         return -ENOMEM;
 
@@ -1390,8 +1513,7 @@ int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
                 return -EILSEQ;
 
         while (count) {
-                rem = hci_reassembly(hdev, type, data, count,
-                                                type - 1, GFP_ATOMIC);
+                rem = hci_reassembly(hdev, type, data, count, type - 1);
                 if (rem < 0)
                         return rem;
 
@@ -1425,8 +1547,8 @@ int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
                 } else
                         type = bt_cb(skb)->pkt_type;
 
-                rem = hci_reassembly(hdev, type, data,
-                                        count, STREAM_REASSEMBLY, GFP_ATOMIC);
+                rem = hci_reassembly(hdev, type, data, count,
+                                                        STREAM_REASSEMBLY);
                 if (rem < 0)
                         return rem;
 
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index b2570159a044..d5aa97ee6ffa 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -56,7 +56,9 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
         if (status)
                 return;
 
-        clear_bit(HCI_INQUIRY, &hdev->flags);
+        if (test_bit(HCI_MGMT, &hdev->flags) &&
+                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+                mgmt_discovering(hdev->id, 0);
 
         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
 
@@ -72,7 +74,9 @@ static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
         if (status)
                 return;
 
-        clear_bit(HCI_INQUIRY, &hdev->flags);
+        if (test_bit(HCI_MGMT, &hdev->flags) &&
+                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+                mgmt_discovering(hdev->id, 0);
 
         hci_conn_check_pending(hdev);
 }
@@ -195,14 +199,17 @@ static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s status 0x%x", hdev->name, status);
 
-        if (status)
-                return;
-
         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
         if (!sent)
                 return;
 
-        memcpy(hdev->dev_name, sent, 248);
+        if (test_bit(HCI_MGMT, &hdev->flags))
+                mgmt_set_local_name_complete(hdev->id, sent, status);
+
+        if (status)
+                return;
+
+        memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 }
 
 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
@@ -214,7 +221,7 @@ static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
         if (rp->status)
                 return;
 
-        memcpy(hdev->dev_name, rp->name, 248);
+        memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 }
 
 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
@@ -821,16 +828,31 @@ static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
                                                                 rp->status);
 }
 
+static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
+                                                        struct sk_buff *skb)
+{
+        struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        mgmt_read_local_oob_data_reply_complete(hdev->id, rp->hash,
+                                                rp->randomizer, rp->status);
+}
+
 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 {
         BT_DBG("%s status 0x%x", hdev->name, status);
 
         if (status) {
                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
-
                 hci_conn_check_pending(hdev);
-        } else
-                set_bit(HCI_INQUIRY, &hdev->flags);
+                return;
+        }
+
+        if (test_bit(HCI_MGMT, &hdev->flags) &&
+                                        !test_and_set_bit(HCI_INQUIRY,
+                                                        &hdev->flags))
+                mgmt_discovering(hdev->id, 1);
 }
 
 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
@@ -999,12 +1021,19 @@ static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
-        if (conn && hci_outgoing_auth_needed(hdev, conn)) {
+        if (!conn)
+                goto unlock;
+
+        if (!hci_outgoing_auth_needed(hdev, conn))
+                goto unlock;
+
+        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
                 struct hci_cp_auth_requested cp;
                 cp.handle = __cpu_to_le16(conn->handle);
                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
         }
 
+unlock:
         hci_dev_unlock(hdev);
 }
 
@@ -1194,7 +1223,9 @@ static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff
 
         BT_DBG("%s status %d", hdev->name, status);
 
-        clear_bit(HCI_INQUIRY, &hdev->flags);
+        if (test_bit(HCI_MGMT, &hdev->flags) &&
+                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+                mgmt_discovering(hdev->id, 0);
 
         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
 
@@ -1214,7 +1245,13 @@ static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *
 
         hci_dev_lock(hdev);
 
-        for (; num_rsp; num_rsp--) {
+        if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
+
+                if (test_bit(HCI_MGMT, &hdev->flags))
+                        mgmt_discovering(hdev->id, 1);
+        }
+
+        for (; num_rsp; num_rsp--, info++) {
                 bacpy(&data.bdaddr, &info->bdaddr);
                 data.pscan_rep_mode     = info->pscan_rep_mode;
                 data.pscan_period_mode  = info->pscan_period_mode;
@@ -1223,8 +1260,9 @@ static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *
                 data.clock_offset       = info->clock_offset;
                 data.rssi               = 0x00;
                 data.ssp_mode           = 0x00;
-                info++;
                 hci_inquiry_cache_update(hdev, &data);
+                mgmt_device_found(hdev->id, &info->bdaddr, info->dev_class, 0,
+                                                                        NULL);
         }
 
         hci_dev_unlock(hdev);
@@ -1428,7 +1466,6 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                         conn->sec_level = conn->pending_sec_level;
                 } else {
                         mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
-                        conn->sec_level = BT_SECURITY_LOW;
                 }
 
                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
@@ -1482,13 +1519,23 @@ static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb
 
         hci_dev_lock(hdev);
 
+        if (ev->status == 0 && test_bit(HCI_MGMT, &hdev->flags))
+                mgmt_remote_name(hdev->id, &ev->bdaddr, ev->name);
+
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
-        if (conn && hci_outgoing_auth_needed(hdev, conn)) {
+        if (!conn)
+                goto unlock;
+
+        if (!hci_outgoing_auth_needed(hdev, conn))
+                goto unlock;
+
+        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
                 struct hci_cp_auth_requested cp;
                 cp.handle = __cpu_to_le16(conn->handle);
                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
         }
 
+unlock:
         hci_dev_unlock(hdev);
 }
 
@@ -1751,6 +1798,10 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
                 hci_cc_pin_code_neg_reply(hdev, skb);
                 break;
 
+        case HCI_OP_READ_LOCAL_OOB_DATA:
+                hci_cc_read_local_oob_data_reply(hdev, skb);
+                break;
+
         case HCI_OP_LE_READ_BUFFER_SIZE:
                 hci_cc_le_read_buffer_size(hdev, skb);
                 break;
@@ -1984,9 +2035,16 @@ static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff
         if (!test_bit(HCI_PAIRABLE, &hdev->flags))
                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
                                         sizeof(ev->bdaddr), &ev->bdaddr);
+        else if (test_bit(HCI_MGMT, &hdev->flags)) {
+                u8 secure;
 
-        if (test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_pin_code_request(hdev->id, &ev->bdaddr);
+                if (conn->pending_sec_level == BT_SECURITY_HIGH)
+                        secure = 1;
+                else
+                        secure = 0;
+
+                mgmt_pin_code_request(hdev->id, &ev->bdaddr, secure);
+        }
 
         hci_dev_unlock(hdev);
 }
@@ -2015,17 +2073,30 @@ static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff
         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
                                                         batostr(&ev->bdaddr));
 
-        if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) && key->type == 0x03) {
+        if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) &&
+                                key->type == HCI_LK_DEBUG_COMBINATION) {
                 BT_DBG("%s ignoring debug key", hdev->name);
                 goto not_found;
         }
 
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+        if (conn) {
+                if (key->type == HCI_LK_UNAUTH_COMBINATION &&
+                                conn->auth_type != 0xff &&
+                                (conn->auth_type & 0x01)) {
+                        BT_DBG("%s ignoring unauthenticated key", hdev->name);
+                        goto not_found;
+                }
 
-        if (key->type == 0x04 && conn && conn->auth_type != 0xff &&
-                                                (conn->auth_type & 0x01)) {
-                BT_DBG("%s ignoring unauthenticated key", hdev->name);
-                goto not_found;
+                if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
+                                conn->pending_sec_level == BT_SECURITY_HIGH) {
+                        BT_DBG("%s ignoring key unauthenticated for high \
+                                                        security", hdev->name);
+                        goto not_found;
+                }
+
+                conn->key_type = key->type;
+                conn->pin_length = key->pin_len;
         }
 
         bacpy(&cp.bdaddr, &ev->bdaddr);
@@ -2057,11 +2128,15 @@ static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff
                 hci_conn_hold(conn);
                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
                 pin_len = conn->pin_length;
+
+                if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
+                        conn->key_type = ev->key_type;
+
                 hci_conn_put(conn);
         }
 
         if (test_bit(HCI_LINK_KEYS, &hdev->flags))
-                hci_add_link_key(hdev, 1, &ev->bdaddr, ev->link_key,
+                hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
                                                         ev->key_type, pin_len);
 
         hci_dev_unlock(hdev);
@@ -2136,11 +2211,17 @@ static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct
 
         hci_dev_lock(hdev);
 
+        if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
+
+                if (test_bit(HCI_MGMT, &hdev->flags))
+                        mgmt_discovering(hdev->id, 1);
+        }
+
         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
                 struct inquiry_info_with_rssi_and_pscan_mode *info;
                 info = (void *) (skb->data + 1);
 
-                for (; num_rsp; num_rsp--) {
+                for (; num_rsp; num_rsp--, info++) {
                         bacpy(&data.bdaddr, &info->bdaddr);
                         data.pscan_rep_mode     = info->pscan_rep_mode;
                         data.pscan_period_mode  = info->pscan_period_mode;
@@ -2149,13 +2230,15 @@ static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct
                         data.clock_offset       = info->clock_offset;
                         data.rssi               = info->rssi;
                         data.ssp_mode           = 0x00;
-                        info++;
                         hci_inquiry_cache_update(hdev, &data);
+                        mgmt_device_found(hdev->id, &info->bdaddr,
+                                                info->dev_class, info->rssi,
+                                                NULL);
                 }
         } else {
                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
 
-                for (; num_rsp; num_rsp--) {
+                for (; num_rsp; num_rsp--, info++) {
                         bacpy(&data.bdaddr, &info->bdaddr);
                         data.pscan_rep_mode     = info->pscan_rep_mode;
                         data.pscan_period_mode  = info->pscan_period_mode;
@@ -2164,8 +2247,10 @@ static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct
                         data.clock_offset       = info->clock_offset;
                         data.rssi               = info->rssi;
                         data.ssp_mode           = 0x00;
-                        info++;
                         hci_inquiry_cache_update(hdev, &data);
+                        mgmt_device_found(hdev->id, &info->bdaddr,
+                                                info->dev_class, info->rssi,
+                                                NULL);
                 }
         }
 
@@ -2294,9 +2379,15 @@ static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct
         if (!num_rsp)
                 return;
 
+        if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
+
+                if (test_bit(HCI_MGMT, &hdev->flags))
+                        mgmt_discovering(hdev->id, 1);
+        }
+
         hci_dev_lock(hdev);
 
-        for (; num_rsp; num_rsp--) {
+        for (; num_rsp; num_rsp--, info++) {
                 bacpy(&data.bdaddr, &info->bdaddr);
                 data.pscan_rep_mode     = info->pscan_rep_mode;
                 data.pscan_period_mode  = info->pscan_period_mode;
@@ -2305,8 +2396,9 @@ static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct
                 data.clock_offset       = info->clock_offset;
                 data.rssi               = info->rssi;
                 data.ssp_mode           = 0x01;
-                info++;
                 hci_inquiry_cache_update(hdev, &data);
+                mgmt_device_found(hdev->id, &info->bdaddr, info->dev_class,
+                                                info->rssi, info->data);
         }
 
         hci_dev_unlock(hdev);
@@ -2326,7 +2418,7 @@ static inline u8 hci_get_auth_req(struct hci_conn *conn)
 
         /* If remote requests no-bonding follow that lead */
         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
-                return 0x00;
+                return conn->remote_auth | (conn->auth_type & 0x01);
 
         return conn->auth_type;
 }
@@ -2355,8 +2447,14 @@ static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff
 
                 bacpy(&cp.bdaddr, &ev->bdaddr);
                 cp.capability = conn->io_capability;
-                cp.oob_data = 0;
-                cp.authentication = hci_get_auth_req(conn);
+                conn->auth_type = hci_get_auth_req(conn);
+                cp.authentication = conn->auth_type;
+
+                if ((conn->out == 0x01 || conn->remote_oob == 0x01) &&
+                                hci_find_remote_oob_data(hdev, &conn->dst))
+                        cp.oob_data = 0x01;
+                else
+                        cp.oob_data = 0x00;
 
                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
                                                         sizeof(cp), &cp);
@@ -2364,7 +2462,7 @@ static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff
                 struct hci_cp_io_capability_neg_reply cp;
 
                 bacpy(&cp.bdaddr, &ev->bdaddr);
-                cp.reason = 0x16; /* Pairing not allowed */
+                cp.reason = 0x18; /* Pairing not allowed */
 
                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
                                                         sizeof(cp), &cp);
@@ -2399,14 +2497,67 @@ static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
                                                         struct sk_buff *skb)
 {
         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
+        int loc_mitm, rem_mitm, confirm_hint = 0;
+        struct hci_conn *conn;
 
         BT_DBG("%s", hdev->name);
 
         hci_dev_lock(hdev);
 
-        if (test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_user_confirm_request(hdev->id, &ev->bdaddr, ev->passkey);
+        if (!test_bit(HCI_MGMT, &hdev->flags))
+                goto unlock;
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+        if (!conn)
+                goto unlock;
+
+        loc_mitm = (conn->auth_type & 0x01);
+        rem_mitm = (conn->remote_auth & 0x01);
+
+        /* If we require MITM but the remote device can't provide that
+         * (it has NoInputNoOutput) then reject the confirmation
+         * request. The only exception is when we're dedicated bonding
+         * initiators (connect_cfm_cb set) since then we always have the MITM
+         * bit set. */
+        if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
+                BT_DBG("Rejecting request: remote device can't provide MITM");
+                hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
+                                        sizeof(ev->bdaddr), &ev->bdaddr);
+                goto unlock;
+        }
+
+        /* If no side requires MITM protection; auto-accept */
+        if ((!loc_mitm || conn->remote_cap == 0x03) &&
+                                (!rem_mitm || conn->io_capability == 0x03)) {
+
+                /* If we're not the initiators request authorization to
+                 * proceed from user space (mgmt_user_confirm with
+                 * confirm_hint set to 1). */
+                if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
+                        BT_DBG("Confirming auto-accept as acceptor");
+                        confirm_hint = 1;
+                        goto confirm;
+                }
+
+                BT_DBG("Auto-accept of user confirmation with %ums delay",
+                                                hdev->auto_accept_delay);
+
+                if (hdev->auto_accept_delay > 0) {
+                        int delay = msecs_to_jiffies(hdev->auto_accept_delay);
+                        mod_timer(&conn->auto_accept_timer, jiffies + delay);
+                        goto unlock;
+                }
+
+                hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
+                                                sizeof(ev->bdaddr), &ev->bdaddr);
+                goto unlock;
+        }
 
+confirm:
+        mgmt_user_confirm_request(hdev->id, &ev->bdaddr, ev->passkey,
+                                                                confirm_hint);
+
+unlock:
         hci_dev_unlock(hdev);
 }
 
@@ -2453,6 +2604,41 @@ static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_
         hci_dev_unlock(hdev);
 }
 
+static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
+                                                        struct sk_buff *skb)
+{
+        struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
+        struct oob_data *data;
+
+        BT_DBG("%s", hdev->name);
+
+        hci_dev_lock(hdev);
+
+        if (!test_bit(HCI_MGMT, &hdev->flags))
+                goto unlock;
+
+        data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
+        if (data) {
+                struct hci_cp_remote_oob_data_reply cp;
+
+                bacpy(&cp.bdaddr, &ev->bdaddr);
+                memcpy(cp.hash, data->hash, sizeof(cp.hash));
+                memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
+
+                hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
+                                                                        &cp);
+        } else {
+                struct hci_cp_remote_oob_data_neg_reply cp;
+
+                bacpy(&cp.bdaddr, &ev->bdaddr);
+                hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
+                                                                        &cp);
+        }
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
 static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
@@ -2655,6 +2841,10 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_le_meta_evt(hdev, skb);
                 break;
 
+        case HCI_EV_REMOTE_OOB_DATA_REQUEST:
+                hci_remote_oob_data_request_evt(hdev, skb);
+                break;
+
         default:
                 BT_DBG("%s event 0x%x", hdev->name, event);
                 break;
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 3c838a65a75a..a6c3aa8be1f7 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -216,13 +216,13 @@ static ssize_t show_type(struct device *dev, struct device_attribute *attr, char
 static ssize_t show_name(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
-        char name[249];
+        char name[HCI_MAX_NAME_LENGTH + 1];
         int i;
 
-        for (i = 0; i < 248; i++)
+        for (i = 0; i < HCI_MAX_NAME_LENGTH; i++)
                 name[i] = hdev->dev_name[i];
 
-        name[248] = '\0';
+        name[HCI_MAX_NAME_LENGTH] = '\0';
         return sprintf(buf, "%s\n", name);
 }
 
@@ -277,10 +277,12 @@ static ssize_t show_idle_timeout(struct device *dev, struct device_attribute *at
 static ssize_t store_idle_timeout(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
-        unsigned long val;
+        unsigned int val;
+        int rv;
 
-        if (strict_strtoul(buf, 0, &val) < 0)
-                return -EINVAL;
+        rv = kstrtouint(buf, 0, &val);
+        if (rv < 0)
+                return rv;
 
         if (val != 0 && (val < 500 || val > 3600000))
                 return -EINVAL;
@@ -299,15 +301,14 @@ static ssize_t show_sniff_max_interval(struct device *dev, struct device_attribu
 static ssize_t store_sniff_max_interval(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
-        unsigned long val;
-
-        if (strict_strtoul(buf, 0, &val) < 0)
-                return -EINVAL;
+        u16 val;
+        int rv;
 
-        if (val < 0x0002 || val > 0xFFFE || val % 2)
-                return -EINVAL;
+        rv = kstrtou16(buf, 0, &val);
+        if (rv < 0)
+                return rv;
 
-        if (val < hdev->sniff_min_interval)
+        if (val == 0 || val % 2 || val < hdev->sniff_min_interval)
                 return -EINVAL;
 
         hdev->sniff_max_interval = val;
@@ -324,15 +325,14 @@ static ssize_t show_sniff_min_interval(struct device *dev, struct device_attribu
 static ssize_t store_sniff_min_interval(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
-        unsigned long val;
+        u16 val;
+        int rv;
 
-        if (strict_strtoul(buf, 0, &val) < 0)
-                return -EINVAL;
-
-        if (val < 0x0002 || val > 0xFFFE || val % 2)
-                return -EINVAL;
+        rv = kstrtou16(buf, 0, &val);
+        if (rv < 0)
+                return rv;
 
-        if (val > hdev->sniff_max_interval)
+        if (val == 0 || val % 2 || val > hdev->sniff_max_interval)
                 return -EINVAL;
 
         hdev->sniff_min_interval = val;
@@ -511,6 +511,35 @@ static const struct file_operations uuids_fops = {
         .release        = single_release,
 };
 
+static int auto_accept_delay_set(void *data, u64 val)
+{
+        struct hci_dev *hdev = data;
+
+        hci_dev_lock_bh(hdev);
+
+        hdev->auto_accept_delay = val;
+
+        hci_dev_unlock_bh(hdev);
+
+        return 0;
+}
+
+static int auto_accept_delay_get(void *data, u64 *val)
+{
+        struct hci_dev *hdev = data;
+
+        hci_dev_lock_bh(hdev);
+
+        *val = hdev->auto_accept_delay;
+
+        hci_dev_unlock_bh(hdev);
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(auto_accept_delay_fops, auto_accept_delay_get,
+                                        auto_accept_delay_set, "%llu\n");
+
 int hci_register_sysfs(struct hci_dev *hdev)
 {
         struct device *dev = &hdev->dev;
@@ -545,6 +574,8 @@ int hci_register_sysfs(struct hci_dev *hdev)
 
         debugfs_create_file("uuids", 0444, hdev->debugfs, hdev, &uuids_fops);
 
+        debugfs_create_file("auto_accept_delay", 0444, hdev->debugfs, hdev,
+                                                &auto_accept_delay_fops);
         return 0;
 }
 
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 5ec12971af6b..c405a954a603 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -37,6 +37,7 @@
 #include <linux/init.h>
 #include <linux/wait.h>
 #include <linux/mutex.h>
+#include <linux/kthread.h>
 #include <net/sock.h>
 
 #include <linux/input.h>
@@ -55,22 +56,24 @@ static DECLARE_RWSEM(hidp_session_sem);
 static LIST_HEAD(hidp_session_list);
 
 static unsigned char hidp_keycode[256] = {
-          0,  0,  0,  0, 30, 48, 46, 32, 18, 33, 34, 35, 23, 36, 37, 38,
-         50, 49, 24, 25, 16, 19, 31, 20, 22, 47, 17, 45, 21, 44,  2,  3,
-          4,  5,  6,  7,  8,  9, 10, 11, 28,  1, 14, 15, 57, 12, 13, 26,
-         27, 43, 43, 39, 40, 41, 51, 52, 53, 58, 59, 60, 61, 62, 63, 64,
-         65, 66, 67, 68, 87, 88, 99, 70,119,110,102,104,111,107,109,106,
-        105,108,103, 69, 98, 55, 74, 78, 96, 79, 80, 81, 75, 76, 77, 71,
-         72, 73, 82, 83, 86,127,116,117,183,184,185,186,187,188,189,190,
-        191,192,193,194,134,138,130,132,128,129,131,137,133,135,136,113,
-        115,114,  0,  0,  0,121,  0, 89, 93,124, 92, 94, 95,  0,  0,  0,
-        122,123, 90, 91, 85,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
-          0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
-          0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
-          0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
-          0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
-         29, 42, 56,125, 97, 54,100,126,164,166,165,163,161,115,114,113,
-        150,158,159,128,136,177,178,176,142,152,173,140
+          0,   0,   0,   0,  30,  48,  46,  32,  18,  33,  34,  35,  23,  36,
+         37,  38,  50,  49,  24,  25,  16,  19,  31,  20,  22,  47,  17,  45,
+         21,  44,   2,   3,   4,   5,   6,   7,   8,   9,  10,  11,  28,   1,
+         14,  15,  57,  12,  13,  26,  27,  43,  43,  39,  40,  41,  51,  52,
+         53,  58,  59,  60,  61,  62,  63,  64,  65,  66,  67,  68,  87,  88,
+         99,  70, 119, 110, 102, 104, 111, 107, 109, 106, 105, 108, 103,  69,
+         98,  55,  74,  78,  96,  79,  80,  81,  75,  76,  77,  71,  72,  73,
+         82,  83,  86, 127, 116, 117, 183, 184, 185, 186, 187, 188, 189, 190,
+        191, 192, 193, 194, 134, 138, 130, 132, 128, 129, 131, 137, 133, 135,
+        136, 113, 115, 114,   0,   0,   0, 121,   0,  89,  93, 124,  92,  94,
+         95,   0,   0,   0, 122, 123,  90,  91,  85,   0,   0,   0,   0,   0,
+          0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
+          0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
+          0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
+          0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
+          0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
+         29,  42,  56, 125,  97,  54, 100, 126, 164, 166, 165, 163, 161, 115,
+        114, 113, 150, 158, 159, 128, 136, 177, 178, 176, 142, 152, 173, 140
 };
 
 static unsigned char hidp_mkeyspat[] = { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01 };
@@ -461,8 +464,7 @@ static void hidp_idle_timeout(unsigned long arg)
 {
         struct hidp_session *session = (struct hidp_session *) arg;
 
-        atomic_inc(&session->terminate);
-        hidp_schedule(session);
+        kthread_stop(session->task);
 }
 
 static void hidp_set_timer(struct hidp_session *session)
@@ -533,9 +535,7 @@ static void hidp_process_hid_control(struct hidp_session *session,
                 skb_queue_purge(&session->ctrl_transmit);
                 skb_queue_purge(&session->intr_transmit);
 
-                /* Kill session thread */
-                atomic_inc(&session->terminate);
-                hidp_schedule(session);
+                kthread_stop(session->task);
         }
 }
 
@@ -694,22 +694,10 @@ static int hidp_session(void *arg)
         struct sock *ctrl_sk = session->ctrl_sock->sk;
         struct sock *intr_sk = session->intr_sock->sk;
         struct sk_buff *skb;
-        int vendor = 0x0000, product = 0x0000;
         wait_queue_t ctrl_wait, intr_wait;
 
         BT_DBG("session %p", session);
 
-        if (session->input) {
-                vendor  = session->input->id.vendor;
-                product = session->input->id.product;
-        }
-
-        if (session->hid) {
-                vendor  = session->hid->vendor;
-                product = session->hid->product;
-        }
-
-        daemonize("khidpd_%04x%04x", vendor, product);
         set_user_nice(current, -15);
 
         init_waitqueue_entry(&ctrl_wait, current);
@@ -718,10 +706,11 @@ static int hidp_session(void *arg)
         add_wait_queue(sk_sleep(intr_sk), &intr_wait);
         session->waiting_for_startup = 0;
         wake_up_interruptible(&session->startup_queue);
-        while (!atomic_read(&session->terminate)) {
+        while (!kthread_should_stop()) {
                 set_current_state(TASK_INTERRUPTIBLE);
 
-                if (ctrl_sk->sk_state != BT_CONNECTED || intr_sk->sk_state != BT_CONNECTED)
+                if (ctrl_sk->sk_state != BT_CONNECTED ||
+                                intr_sk->sk_state != BT_CONNECTED)
                         break;
 
                 while ((skb = skb_dequeue(&ctrl_sk->sk_receive_queue))) {
@@ -965,6 +954,7 @@ fault:
 int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock)
 {
         struct hidp_session *session, *s;
+        int vendor, product;
         int err;
 
         BT_DBG("");
@@ -989,8 +979,10 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
 
         bacpy(&session->bdaddr, &bt_sk(ctrl_sock->sk)->dst);
 
-        session->ctrl_mtu = min_t(uint, l2cap_pi(ctrl_sock->sk)->omtu, l2cap_pi(ctrl_sock->sk)->imtu);
-        session->intr_mtu = min_t(uint, l2cap_pi(intr_sock->sk)->omtu, l2cap_pi(intr_sock->sk)->imtu);
+        session->ctrl_mtu = min_t(uint, l2cap_pi(ctrl_sock->sk)->chan->omtu,
+                                        l2cap_pi(ctrl_sock->sk)->chan->imtu);
+        session->intr_mtu = min_t(uint, l2cap_pi(intr_sock->sk)->chan->omtu,
+                                        l2cap_pi(intr_sock->sk)->chan->imtu);
 
         BT_DBG("ctrl mtu %d intr mtu %d", session->ctrl_mtu, session->intr_mtu);
 
@@ -1026,9 +1018,24 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
 
         hidp_set_timer(session);
 
-        err = kernel_thread(hidp_session, session, CLONE_KERNEL);
-        if (err < 0)
+        if (session->hid) {
+                vendor  = session->hid->vendor;
+                product = session->hid->product;
+        } else if (session->input) {
+                vendor  = session->input->id.vendor;
+                product = session->input->id.product;
+        } else {
+                vendor = 0x0000;
+                product = 0x0000;
+        }
+
+        session->task = kthread_run(hidp_session, session, "khidpd_%04x%04x",
+                                                        vendor, product);
+        if (IS_ERR(session->task)) {
+                err = PTR_ERR(session->task);
                 goto unlink;
+        }
+
         while (session->waiting_for_startup) {
                 wait_event_interruptible(session->startup_queue,
                         !session->waiting_for_startup);
@@ -1053,8 +1060,7 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
 err_add_device:
         hid_destroy_device(session->hid);
         session->hid = NULL;
-        atomic_inc(&session->terminate);
-        hidp_schedule(session);
+        kthread_stop(session->task);
 
 unlink:
         hidp_del_timer(session);
@@ -1105,13 +1111,7 @@ int hidp_del_connection(struct hidp_conndel_req *req)
                         skb_queue_purge(&session->ctrl_transmit);
                         skb_queue_purge(&session->intr_transmit);
 
-                        /* Wakeup user-space polling for socket errors */
-                        session->intr_sock->sk->sk_err = EUNATCH;
-                        session->ctrl_sock->sk->sk_err = EUNATCH;
-
-                        /* Kill session thread */
-                        atomic_inc(&session->terminate);
-                        hidp_schedule(session);
+                        kthread_stop(session->task);
                 }
         } else
                 err = -ENOENT;
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index 13de5fa03480..12822cde4b49 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -84,8 +84,8 @@
 #define HIDP_WAITING_FOR_SEND_ACK       11
 
 struct hidp_connadd_req {
-        int   ctrl_sock;        // Connected control socket
-        int   intr_sock;        // Connteted interrupt socket
+        int   ctrl_sock;        /* Connected control socket */
+        int   intr_sock;        /* Connected interrupt socket */
         __u16 parser;
         __u16 rd_size;
         __u8 __user *rd_data;
@@ -142,7 +142,7 @@ struct hidp_session {
         uint ctrl_mtu;
         uint intr_mtu;
 
-        atomic_t terminate;
+        struct task_struct *task;
 
         unsigned char keys[8];
         unsigned char leds;
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 250dfd46237d..178ac7f127ad 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -85,7 +85,8 @@ static int hidp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
                         return err;
                 }
 
-                if (csock->sk->sk_state != BT_CONNECTED || isock->sk->sk_state != BT_CONNECTED) {
+                if (csock->sk->sk_state != BT_CONNECTED ||
+                                isock->sk->sk_state != BT_CONNECTED) {
                         sockfd_put(csock);
                         sockfd_put(isock);
                         return -EBADFD;
@@ -140,8 +141,8 @@ static int hidp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
 
 #ifdef CONFIG_COMPAT
 struct compat_hidp_connadd_req {
-        int   ctrl_sock;        // Connected control socket
-        int   intr_sock;        // Connteted interrupt socket
+        int   ctrl_sock;        /* Connected control socket */
+        int   intr_sock;        /* Connected interrupt socket */
         __u16 parser;
         __u16 rd_size;
         compat_uptr_t rd_data;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 2c8dd4494c63..a378acc491ec 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -70,160 +70,160 @@ static void l2cap_busy_work(struct work_struct *work);
 
 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
                                 u8 code, u8 ident, u16 dlen, void *data);
+static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
 
 static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb);
 
 /* ---- L2CAP channels ---- */
-static struct sock *__l2cap_get_chan_by_dcid(struct l2cap_chan_list *l, u16 cid)
+static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid)
 {
-        struct sock *s;
-        for (s = l->head; s; s = l2cap_pi(s)->next_c) {
-                if (l2cap_pi(s)->dcid == cid)
-                        break;
+        struct l2cap_chan *c;
+
+        list_for_each_entry(c, &conn->chan_l, list) {
+                if (c->dcid == cid)
+                        return c;
         }
-        return s;
+        return NULL;
+
 }
 
-static struct sock *__l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
+static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
 {
-        struct sock *s;
-        for (s = l->head; s; s = l2cap_pi(s)->next_c) {
-                if (l2cap_pi(s)->scid == cid)
-                        break;
+        struct l2cap_chan *c;
+
+        list_for_each_entry(c, &conn->chan_l, list) {
+                if (c->scid == cid)
+                        return c;
         }
-        return s;
+        return NULL;
 }
 
 /* Find channel with given SCID.
  * Returns locked socket */
-static inline struct sock *l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
+static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
 {
-        struct sock *s;
-        read_lock(&l->lock);
-        s = __l2cap_get_chan_by_scid(l, cid);
-        if (s)
-                bh_lock_sock(s);
-        read_unlock(&l->lock);
-        return s;
+        struct l2cap_chan *c;
+
+        read_lock(&conn->chan_lock);
+        c = __l2cap_get_chan_by_scid(conn, cid);
+        if (c)
+                bh_lock_sock(c->sk);
+        read_unlock(&conn->chan_lock);
+        return c;
 }
 
-static struct sock *__l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
+static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
 {
-        struct sock *s;
-        for (s = l->head; s; s = l2cap_pi(s)->next_c) {
-                if (l2cap_pi(s)->ident == ident)
-                        break;
+        struct l2cap_chan *c;
+
+        list_for_each_entry(c, &conn->chan_l, list) {
+                if (c->ident == ident)
+                        return c;
         }
-        return s;
+        return NULL;
 }
 
-static inline struct sock *l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
+static inline struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
 {
-        struct sock *s;
-        read_lock(&l->lock);
-        s = __l2cap_get_chan_by_ident(l, ident);
-        if (s)
-                bh_lock_sock(s);
-        read_unlock(&l->lock);
-        return s;
+        struct l2cap_chan *c;
+
+        read_lock(&conn->chan_lock);
+        c = __l2cap_get_chan_by_ident(conn, ident);
+        if (c)
+                bh_lock_sock(c->sk);
+        read_unlock(&conn->chan_lock);
+        return c;
 }
 
-static u16 l2cap_alloc_cid(struct l2cap_chan_list *l)
+static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
 {
         u16 cid = L2CAP_CID_DYN_START;
 
         for (; cid < L2CAP_CID_DYN_END; cid++) {
-                if (!__l2cap_get_chan_by_scid(l, cid))
+                if (!__l2cap_get_chan_by_scid(conn, cid))
                         return cid;
         }
 
         return 0;
 }
 
-static inline void __l2cap_chan_link(struct l2cap_chan_list *l, struct sock *sk)
+struct l2cap_chan *l2cap_chan_alloc(struct sock *sk)
 {
-        sock_hold(sk);
+        struct l2cap_chan *chan;
+
+        chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
+        if (!chan)
+                return NULL;
 
-        if (l->head)
-                l2cap_pi(l->head)->prev_c = sk;
+        chan->sk = sk;
 
-        l2cap_pi(sk)->next_c = l->head;
-        l2cap_pi(sk)->prev_c = NULL;
-        l->head = sk;
+        return chan;
 }
 
-static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
+void l2cap_chan_free(struct l2cap_chan *chan)
 {
-        struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
-
-        write_lock_bh(&l->lock);
-        if (sk == l->head)
-                l->head = next;
-
-        if (next)
-                l2cap_pi(next)->prev_c = prev;
-        if (prev)
-                l2cap_pi(prev)->next_c = next;
-        write_unlock_bh(&l->lock);
-
-        __sock_put(sk);
+        kfree(chan);
 }
 
-static void __l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
+static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 {
-        struct l2cap_chan_list *l = &conn->chan_list;
+        struct sock *sk = chan->sk;
 
         BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
-                        l2cap_pi(sk)->psm, l2cap_pi(sk)->dcid);
+                        chan->psm, chan->dcid);
 
         conn->disc_reason = 0x13;
 
-        l2cap_pi(sk)->conn = conn;
+        chan->conn = conn;
 
         if (sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM) {
                 if (conn->hcon->type == LE_LINK) {
                         /* LE connection */
-                        l2cap_pi(sk)->omtu = L2CAP_LE_DEFAULT_MTU;
-                        l2cap_pi(sk)->scid = L2CAP_CID_LE_DATA;
-                        l2cap_pi(sk)->dcid = L2CAP_CID_LE_DATA;
+                        chan->omtu = L2CAP_LE_DEFAULT_MTU;
+                        chan->scid = L2CAP_CID_LE_DATA;
+                        chan->dcid = L2CAP_CID_LE_DATA;
                 } else {
                         /* Alloc CID for connection-oriented socket */
-                        l2cap_pi(sk)->scid = l2cap_alloc_cid(l);
-                        l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
+                        chan->scid = l2cap_alloc_cid(conn);
+                        chan->omtu = L2CAP_DEFAULT_MTU;
                 }
         } else if (sk->sk_type == SOCK_DGRAM) {
                 /* Connectionless socket */
-                l2cap_pi(sk)->scid = L2CAP_CID_CONN_LESS;
-                l2cap_pi(sk)->dcid = L2CAP_CID_CONN_LESS;
-                l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
+                chan->scid = L2CAP_CID_CONN_LESS;
+                chan->dcid = L2CAP_CID_CONN_LESS;
+                chan->omtu = L2CAP_DEFAULT_MTU;
         } else {
                 /* Raw socket can send/recv signalling messages only */
-                l2cap_pi(sk)->scid = L2CAP_CID_SIGNALING;
-                l2cap_pi(sk)->dcid = L2CAP_CID_SIGNALING;
-                l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
+                chan->scid = L2CAP_CID_SIGNALING;
+                chan->dcid = L2CAP_CID_SIGNALING;
+                chan->omtu = L2CAP_DEFAULT_MTU;
         }
 
-        __l2cap_chan_link(l, sk);
+        sock_hold(sk);
 
-        if (parent)
-                bt_accept_enqueue(parent, sk);
+        list_add(&chan->list, &conn->chan_l);
 }
 
 /* Delete channel.
  * Must be called on the locked socket. */
-void l2cap_chan_del(struct sock *sk, int err)
+void l2cap_chan_del(struct l2cap_chan *chan, int err)
 {
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        struct sock *sk = chan->sk;
+        struct l2cap_conn *conn = chan->conn;
         struct sock *parent = bt_sk(sk)->parent;
 
         l2cap_sock_clear_timer(sk);
 
-        BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
+        BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
 
         if (conn) {
-                /* Unlink from channel list */
-                l2cap_chan_unlink(&conn->chan_list, sk);
-                l2cap_pi(sk)->conn = NULL;
+                /* Delete from channel list */
+                write_lock_bh(&conn->chan_lock);
+                list_del(&chan->list);
+                write_unlock_bh(&conn->chan_lock);
+                __sock_put(sk);
+
+                chan->conn = NULL;
                 hci_conn_put(conn->hcon);
         }
 
@@ -239,29 +239,35 @@ void l2cap_chan_del(struct sock *sk, int err)
         } else
                 sk->sk_state_change(sk);
 
-        skb_queue_purge(TX_QUEUE(sk));
+        if (!(chan->conf_state & L2CAP_CONF_OUTPUT_DONE &&
+                        chan->conf_state & L2CAP_CONF_INPUT_DONE))
+                return;
+
+        skb_queue_purge(&chan->tx_q);
 
-        if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
+        if (chan->mode == L2CAP_MODE_ERTM) {
                 struct srej_list *l, *tmp;
 
-                del_timer(&l2cap_pi(sk)->retrans_timer);
-                del_timer(&l2cap_pi(sk)->monitor_timer);
-                del_timer(&l2cap_pi(sk)->ack_timer);
+                del_timer(&chan->retrans_timer);
+                del_timer(&chan->monitor_timer);
+                del_timer(&chan->ack_timer);
 
-                skb_queue_purge(SREJ_QUEUE(sk));
-                skb_queue_purge(BUSY_QUEUE(sk));
+                skb_queue_purge(&chan->srej_q);
+                skb_queue_purge(&chan->busy_q);
 
-                list_for_each_entry_safe(l, tmp, SREJ_LIST(sk), list) {
+                list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
                         list_del(&l->list);
                         kfree(l);
                 }
         }
 }
 
-static inline u8 l2cap_get_auth_type(struct sock *sk)
+static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
 {
+        struct sock *sk = chan->sk;
+
         if (sk->sk_type == SOCK_RAW) {
-                switch (l2cap_pi(sk)->sec_level) {
+                switch (chan->sec_level) {
                 case BT_SECURITY_HIGH:
                         return HCI_AT_DEDICATED_BONDING_MITM;
                 case BT_SECURITY_MEDIUM:
@@ -269,16 +275,16 @@ static inline u8 l2cap_get_auth_type(struct sock *sk)
                 default:
                         return HCI_AT_NO_BONDING;
                 }
-        } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
+        } else if (chan->psm == cpu_to_le16(0x0001)) {
+                if (chan->sec_level == BT_SECURITY_LOW)
+                        chan->sec_level = BT_SECURITY_SDP;
 
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
+                if (chan->sec_level == BT_SECURITY_HIGH)
                         return HCI_AT_NO_BONDING_MITM;
                 else
                         return HCI_AT_NO_BONDING;
         } else {
-                switch (l2cap_pi(sk)->sec_level) {
+                switch (chan->sec_level) {
                 case BT_SECURITY_HIGH:
                         return HCI_AT_GENERAL_BONDING_MITM;
                 case BT_SECURITY_MEDIUM:
@@ -290,15 +296,14 @@ static inline u8 l2cap_get_auth_type(struct sock *sk)
 }
 
 /* Service level security */
-static inline int l2cap_check_security(struct sock *sk)
+static inline int l2cap_check_security(struct l2cap_chan *chan)
 {
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        struct l2cap_conn *conn = chan->conn;
         __u8 auth_type;
 
-        auth_type = l2cap_get_auth_type(sk);
+        auth_type = l2cap_get_auth_type(chan);
 
-        return hci_conn_security(conn->hcon, l2cap_pi(sk)->sec_level,
-                                                                auth_type);
+        return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
 }
 
 u8 l2cap_get_ident(struct l2cap_conn *conn)
@@ -341,11 +346,12 @@ void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *d
         hci_send_acl(conn->hcon, skb, flags);
 }
 
-static inline void l2cap_send_sframe(struct l2cap_pinfo *pi, u16 control)
+static inline void l2cap_send_sframe(struct l2cap_chan *chan, u16 control)
 {
         struct sk_buff *skb;
         struct l2cap_hdr *lh;
-        struct l2cap_conn *conn = pi->conn;
+        struct l2cap_pinfo *pi = l2cap_pi(chan->sk);
+        struct l2cap_conn *conn = chan->conn;
         struct sock *sk = (struct sock *)pi;
         int count, hlen = L2CAP_HDR_SIZE + 2;
         u8 flags;
@@ -353,22 +359,22 @@ static inline void l2cap_send_sframe(struct l2cap_pinfo *pi, u16 control)
         if (sk->sk_state != BT_CONNECTED)
                 return;
 
-        if (pi->fcs == L2CAP_FCS_CRC16)
+        if (chan->fcs == L2CAP_FCS_CRC16)
                 hlen += 2;
 
-        BT_DBG("pi %p, control 0x%2.2x", pi, control);
+        BT_DBG("chan %p, control 0x%2.2x", chan, control);
 
         count = min_t(unsigned int, conn->mtu, hlen);
         control |= L2CAP_CTRL_FRAME_TYPE;
 
-        if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
+        if (chan->conn_state & L2CAP_CONN_SEND_FBIT) {
                 control |= L2CAP_CTRL_FINAL;
-                pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
+                chan->conn_state &= ~L2CAP_CONN_SEND_FBIT;
         }
 
-        if (pi->conn_state & L2CAP_CONN_SEND_PBIT) {
+        if (chan->conn_state & L2CAP_CONN_SEND_PBIT) {
                 control |= L2CAP_CTRL_POLL;
-                pi->conn_state &= ~L2CAP_CONN_SEND_PBIT;
+                chan->conn_state &= ~L2CAP_CONN_SEND_PBIT;
         }
 
         skb = bt_skb_alloc(count, GFP_ATOMIC);
@@ -377,10 +383,10 @@ static inline void l2cap_send_sframe(struct l2cap_pinfo *pi, u16 control)
 
         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
         lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
-        lh->cid = cpu_to_le16(pi->dcid);
+        lh->cid = cpu_to_le16(chan->dcid);
         put_unaligned_le16(control, skb_put(skb, 2));
 
-        if (pi->fcs == L2CAP_FCS_CRC16) {
+        if (chan->fcs == L2CAP_FCS_CRC16) {
                 u16 fcs = crc16(0, (u8 *)lh, count - 2);
                 put_unaligned_le16(fcs, skb_put(skb, 2));
         }
@@ -390,45 +396,46 @@ static inline void l2cap_send_sframe(struct l2cap_pinfo *pi, u16 control)
         else
                 flags = ACL_START;
 
-        hci_send_acl(pi->conn->hcon, skb, flags);
+        hci_send_acl(chan->conn->hcon, skb, flags);
 }
 
-static inline void l2cap_send_rr_or_rnr(struct l2cap_pinfo *pi, u16 control)
+static inline void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, u16 control)
 {
-        if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
+        if (chan->conn_state & L2CAP_CONN_LOCAL_BUSY) {
                 control |= L2CAP_SUPER_RCV_NOT_READY;
-                pi->conn_state |= L2CAP_CONN_RNR_SENT;
+                chan->conn_state |= L2CAP_CONN_RNR_SENT;
         } else
                 control |= L2CAP_SUPER_RCV_READY;
 
-        control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+        control |= chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
 
-        l2cap_send_sframe(pi, control);
+        l2cap_send_sframe(chan, control);
 }
 
-static inline int __l2cap_no_conn_pending(struct sock *sk)
+static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
 {
-        return !(l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND);
+        return !(chan->conf_state & L2CAP_CONF_CONNECT_PEND);
 }
 
-static void l2cap_do_start(struct sock *sk)
+static void l2cap_do_start(struct l2cap_chan *chan)
 {
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        struct l2cap_conn *conn = chan->conn;
 
         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
                 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
                         return;
 
-                if (l2cap_check_security(sk) && __l2cap_no_conn_pending(sk)) {
+                if (l2cap_check_security(chan) &&
+                                __l2cap_no_conn_pending(chan)) {
                         struct l2cap_conn_req req;
-                        req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
-                        req.psm  = l2cap_pi(sk)->psm;
+                        req.scid = cpu_to_le16(chan->scid);
+                        req.psm  = chan->psm;
 
-                        l2cap_pi(sk)->ident = l2cap_get_ident(conn);
-                        l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
+                        chan->ident = l2cap_get_ident(conn);
+                        chan->conf_state |= L2CAP_CONF_CONNECT_PEND;
 
-                        l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
-                                        L2CAP_CONN_REQ, sizeof(req), &req);
+                        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ,
+                                                        sizeof(req), &req);
                 }
         } else {
                 struct l2cap_info_req req;
@@ -461,23 +468,24 @@ static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
         }
 }
 
-void l2cap_send_disconn_req(struct l2cap_conn *conn, struct sock *sk, int err)
+void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err)
 {
+        struct sock *sk;
         struct l2cap_disconn_req req;
 
         if (!conn)
                 return;
 
-        skb_queue_purge(TX_QUEUE(sk));
+        sk = chan->sk;
 
-        if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
-                del_timer(&l2cap_pi(sk)->retrans_timer);
-                del_timer(&l2cap_pi(sk)->monitor_timer);
-                del_timer(&l2cap_pi(sk)->ack_timer);
+        if (chan->mode == L2CAP_MODE_ERTM) {
+                del_timer(&chan->retrans_timer);
+                del_timer(&chan->monitor_timer);
+                del_timer(&chan->ack_timer);
         }
 
-        req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
-        req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
+        req.dcid = cpu_to_le16(chan->dcid);
+        req.scid = cpu_to_le16(chan->scid);
         l2cap_send_cmd(conn, l2cap_get_ident(conn),
                         L2CAP_DISCONN_REQ, sizeof(req), &req);
 
@@ -488,17 +496,15 @@ void l2cap_send_disconn_req(struct l2cap_conn *conn, struct sock *sk, int err)
 /* ---- L2CAP connections ---- */
 static void l2cap_conn_start(struct l2cap_conn *conn)
 {
-        struct l2cap_chan_list *l = &conn->chan_list;
-        struct sock_del_list del, *tmp1, *tmp2;
-        struct sock *sk;
+        struct l2cap_chan *chan, *tmp;
 
         BT_DBG("conn %p", conn);
 
-        INIT_LIST_HEAD(&del.list);
+        read_lock(&conn->chan_lock);
 
-        read_lock(&l->lock);
+        list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
+                struct sock *sk = chan->sk;
 
-        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
                 bh_lock_sock(sk);
 
                 if (sk->sk_type != SOCK_SEQPACKET &&
@@ -510,40 +516,41 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
                 if (sk->sk_state == BT_CONNECT) {
                         struct l2cap_conn_req req;
 
-                        if (!l2cap_check_security(sk) ||
-                                        !__l2cap_no_conn_pending(sk)) {
+                        if (!l2cap_check_security(chan) ||
+                                        !__l2cap_no_conn_pending(chan)) {
                                 bh_unlock_sock(sk);
                                 continue;
                         }
 
-                        if (!l2cap_mode_supported(l2cap_pi(sk)->mode,
+                        if (!l2cap_mode_supported(chan->mode,
                                         conn->feat_mask)
-                                        && l2cap_pi(sk)->conf_state &
+                                        && chan->conf_state &
                                         L2CAP_CONF_STATE2_DEVICE) {
-                                tmp1 = kzalloc(sizeof(struct sock_del_list),
-                                                GFP_ATOMIC);
-                                tmp1->sk = sk;
-                                list_add_tail(&tmp1->list, &del.list);
+                                /* __l2cap_sock_close() calls list_del(chan)
+                                 * so release the lock */
+                                read_unlock_bh(&conn->chan_lock);
+                                 __l2cap_sock_close(sk, ECONNRESET);
+                                read_lock_bh(&conn->chan_lock);
                                 bh_unlock_sock(sk);
                                 continue;
                         }
 
-                        req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
-                        req.psm  = l2cap_pi(sk)->psm;
+                        req.scid = cpu_to_le16(chan->scid);
+                        req.psm  = chan->psm;
 
-                        l2cap_pi(sk)->ident = l2cap_get_ident(conn);
-                        l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
+                        chan->ident = l2cap_get_ident(conn);
+                        chan->conf_state |= L2CAP_CONF_CONNECT_PEND;
 
-                        l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
-                                L2CAP_CONN_REQ, sizeof(req), &req);
+                        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ,
+                                                        sizeof(req), &req);
 
                 } else if (sk->sk_state == BT_CONNECT2) {
                         struct l2cap_conn_rsp rsp;
                         char buf[128];
-                        rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
-                        rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
+                        rsp.scid = cpu_to_le16(chan->dcid);
+                        rsp.dcid = cpu_to_le16(chan->scid);
 
-                        if (l2cap_check_security(sk)) {
+                        if (l2cap_check_security(chan)) {
                                 if (bt_sk(sk)->defer_setup) {
                                         struct sock *parent = bt_sk(sk)->parent;
                                         rsp.result = cpu_to_le16(L2CAP_CR_PEND);
@@ -560,33 +567,25 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
                                 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
                         }
 
-                        l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
-                                        L2CAP_CONN_RSP, sizeof(rsp), &rsp);
+                        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
+                                                        sizeof(rsp), &rsp);
 
-                        if (l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT ||
+                        if (chan->conf_state & L2CAP_CONF_REQ_SENT ||
                                         rsp.result != L2CAP_CR_SUCCESS) {
                                 bh_unlock_sock(sk);
                                 continue;
                         }
 
-                        l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
+                        chan->conf_state |= L2CAP_CONF_REQ_SENT;
                         l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                                                l2cap_build_conf_req(sk, buf), buf);
-                        l2cap_pi(sk)->num_conf_req++;
+                                                l2cap_build_conf_req(chan, buf), buf);
+                        chan->num_conf_req++;
                 }
 
                 bh_unlock_sock(sk);
         }
 
-        read_unlock(&l->lock);
-
-        list_for_each_entry_safe(tmp1, tmp2, &del.list, list) {
-                bh_lock_sock(tmp1->sk);
-                __l2cap_sock_close(tmp1->sk, ECONNRESET);
-                bh_unlock_sock(tmp1->sk);
-                list_del(&tmp1->list);
-                kfree(tmp1);
-        }
+        read_unlock(&conn->chan_lock);
 }
 
 /* Find socket with cid and source bdaddr.
@@ -594,16 +593,18 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
  */
 static struct sock *l2cap_get_sock_by_scid(int state, __le16 cid, bdaddr_t *src)
 {
-        struct sock *s, *sk = NULL, *sk1 = NULL;
+        struct sock *sk = NULL, *sk1 = NULL;
         struct hlist_node *node;
 
         read_lock(&l2cap_sk_list.lock);
 
         sk_for_each(sk, node, &l2cap_sk_list.head) {
+                struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+
                 if (state && sk->sk_state != state)
                         continue;
 
-                if (l2cap_pi(sk)->scid == cid) {
+                if (chan->scid == cid) {
                         /* Exact match. */
                         if (!bacmp(&bt_sk(sk)->src, src))
                                 break;
@@ -613,18 +614,16 @@ static struct sock *l2cap_get_sock_by_scid(int state, __le16 cid, bdaddr_t *src)
                                 sk1 = sk;
                 }
         }
-        s = node ? sk : sk1;
-        if (s)
-                bh_lock_sock(s);
+
         read_unlock(&l2cap_sk_list.lock);
 
-        return s;
+        return node ? sk : sk1;
 }
 
 static void l2cap_le_conn_ready(struct l2cap_conn *conn)
 {
-        struct l2cap_chan_list *list = &conn->chan_list;
-        struct sock *parent, *uninitialized_var(sk);
+        struct sock *parent, *sk;
+        struct l2cap_chan *chan;
 
         BT_DBG("");
 
@@ -634,6 +633,8 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
         if (!parent)
                 return;
 
+        bh_lock_sock(parent);
+
         /* Check for backlog size */
         if (sk_acceptq_is_full(parent)) {
                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
@@ -644,22 +645,33 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
         if (!sk)
                 goto clean;
 
-        write_lock_bh(&list->lock);
+        chan = l2cap_chan_alloc(sk);
+        if (!chan) {
+                l2cap_sock_kill(sk);
+                goto clean;
+        }
+
+        l2cap_pi(sk)->chan = chan;
+
+        write_lock_bh(&conn->chan_lock);
 
         hci_conn_hold(conn->hcon);
 
         l2cap_sock_init(sk, parent);
+
         bacpy(&bt_sk(sk)->src, conn->src);
         bacpy(&bt_sk(sk)->dst, conn->dst);
 
-        __l2cap_chan_add(conn, sk, parent);
+        bt_accept_enqueue(parent, sk);
+
+        __l2cap_chan_add(conn, chan);
 
         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
 
         sk->sk_state = BT_CONNECTED;
         parent->sk_data_ready(parent, 0);
 
-        write_unlock_bh(&list->lock);
+        write_unlock_bh(&conn->chan_lock);
 
 clean:
         bh_unlock_sock(parent);
@@ -667,17 +679,18 @@ clean:
 
 static void l2cap_conn_ready(struct l2cap_conn *conn)
 {
-        struct l2cap_chan_list *l = &conn->chan_list;
-        struct sock *sk;
+        struct l2cap_chan *chan;
 
         BT_DBG("conn %p", conn);
 
         if (!conn->hcon->out && conn->hcon->type == LE_LINK)
                 l2cap_le_conn_ready(conn);
 
-        read_lock(&l->lock);
+        read_lock(&conn->chan_lock);
+
+        list_for_each_entry(chan, &conn->chan_l, list) {
+                struct sock *sk = chan->sk;
 
-        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
                 bh_lock_sock(sk);
 
                 if (conn->hcon->type == LE_LINK) {
@@ -692,30 +705,31 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
                         sk->sk_state = BT_CONNECTED;
                         sk->sk_state_change(sk);
                 } else if (sk->sk_state == BT_CONNECT)
-                        l2cap_do_start(sk);
+                        l2cap_do_start(chan);
 
                 bh_unlock_sock(sk);
         }
 
-        read_unlock(&l->lock);
+        read_unlock(&conn->chan_lock);
 }
 
 /* Notify sockets that we cannot guaranty reliability anymore */
 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
 {
-        struct l2cap_chan_list *l = &conn->chan_list;
-        struct sock *sk;
+        struct l2cap_chan *chan;
 
         BT_DBG("conn %p", conn);
 
-        read_lock(&l->lock);
+        read_lock(&conn->chan_lock);
+
+        list_for_each_entry(chan, &conn->chan_l, list) {
+                struct sock *sk = chan->sk;
 
-        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
-                if (l2cap_pi(sk)->force_reliable)
+                if (chan->force_reliable)
                         sk->sk_err = err;
         }
 
-        read_unlock(&l->lock);
+        read_unlock(&conn->chan_lock);
 }
 
 static void l2cap_info_timeout(unsigned long arg)
@@ -755,7 +769,9 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
         conn->feat_mask = 0;
 
         spin_lock_init(&conn->lock);
-        rwlock_init(&conn->chan_list.lock);
+        rwlock_init(&conn->chan_lock);
+
+        INIT_LIST_HEAD(&conn->chan_l);
 
         if (hcon->type != LE_LINK)
                 setup_timer(&conn->info_timer, l2cap_info_timeout,
@@ -769,6 +785,7 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
 static void l2cap_conn_del(struct hci_conn *hcon, int err)
 {
         struct l2cap_conn *conn = hcon->l2cap_data;
+        struct l2cap_chan *chan, *l;
         struct sock *sk;
 
         if (!conn)
@@ -779,9 +796,10 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
         kfree_skb(conn->rx_skb);
 
         /* Kill channels */
-        while ((sk = conn->chan_list.head)) {
+        list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
+                sk = chan->sk;
                 bh_lock_sock(sk);
-                l2cap_chan_del(sk, err);
+                l2cap_chan_del(chan, err);
                 bh_unlock_sock(sk);
                 l2cap_sock_kill(sk);
         }
@@ -793,12 +811,11 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
         kfree(conn);
 }
 
-static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
+static inline void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 {
-        struct l2cap_chan_list *l = &conn->chan_list;
-        write_lock_bh(&l->lock);
-        __l2cap_chan_add(conn, sk, parent);
-        write_unlock_bh(&l->lock);
+        write_lock_bh(&conn->chan_lock);
+        __l2cap_chan_add(conn, chan);
+        write_unlock_bh(&conn->chan_lock);
 }
 
 /* ---- Socket interface ---- */
@@ -814,10 +831,12 @@ static struct sock *l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
         read_lock(&l2cap_sk_list.lock);
 
         sk_for_each(sk, node, &l2cap_sk_list.head) {
+                struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+
                 if (state && sk->sk_state != state)
                         continue;
 
-                if (l2cap_pi(sk)->psm == psm) {
+                if (chan->psm == psm) {
                         /* Exact match. */
                         if (!bacmp(&bt_sk(sk)->src, src))
                                 break;
@@ -833,8 +852,9 @@ static struct sock *l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
         return node ? sk : sk1;
 }
 
-int l2cap_do_connect(struct sock *sk)
+int l2cap_chan_connect(struct l2cap_chan *chan)
 {
+        struct sock *sk = chan->sk;
         bdaddr_t *src = &bt_sk(sk)->src;
         bdaddr_t *dst = &bt_sk(sk)->dst;
         struct l2cap_conn *conn;
@@ -844,7 +864,7 @@ int l2cap_do_connect(struct sock *sk)
         int err;
 
         BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst),
-                                                        l2cap_pi(sk)->psm);
+                                                        chan->psm);
 
         hdev = hci_get_route(dst, src);
         if (!hdev)
@@ -852,14 +872,14 @@ int l2cap_do_connect(struct sock *sk)
 
         hci_dev_lock_bh(hdev);
 
-        auth_type = l2cap_get_auth_type(sk);
+        auth_type = l2cap_get_auth_type(chan);
 
-        if (l2cap_pi(sk)->dcid == L2CAP_CID_LE_DATA)
+        if (chan->dcid == L2CAP_CID_LE_DATA)
                 hcon = hci_connect(hdev, LE_LINK, dst,
-                                        l2cap_pi(sk)->sec_level, auth_type);
+                                        chan->sec_level, auth_type);
         else
                 hcon = hci_connect(hdev, ACL_LINK, dst,
-                                        l2cap_pi(sk)->sec_level, auth_type);
+                                        chan->sec_level, auth_type);
 
         if (IS_ERR(hcon)) {
                 err = PTR_ERR(hcon);
@@ -876,7 +896,7 @@ int l2cap_do_connect(struct sock *sk)
         /* Update source addr of the socket */
         bacpy(src, conn->src);
 
-        l2cap_chan_add(conn, sk, NULL);
+        l2cap_chan_add(conn, chan);
 
         sk->sk_state = BT_CONNECT;
         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
@@ -885,10 +905,10 @@ int l2cap_do_connect(struct sock *sk)
                 if (sk->sk_type != SOCK_SEQPACKET &&
                                 sk->sk_type != SOCK_STREAM) {
                         l2cap_sock_clear_timer(sk);
-                        if (l2cap_check_security(sk))
+                        if (l2cap_check_security(chan))
                                 sk->sk_state = BT_CONNECTED;
                 } else
-                        l2cap_do_start(sk);
+                        l2cap_do_start(chan);
         }
 
         err = 0;
@@ -901,12 +921,13 @@ done:
 
 int __l2cap_wait_ack(struct sock *sk)
 {
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         DECLARE_WAITQUEUE(wait, current);
         int err = 0;
         int timeo = HZ/5;
 
         add_wait_queue(sk_sleep(sk), &wait);
-        while ((l2cap_pi(sk)->unacked_frames > 0 && l2cap_pi(sk)->conn)) {
+        while ((chan->unacked_frames > 0 && chan->conn)) {
                 set_current_state(TASK_INTERRUPTIBLE);
 
                 if (!timeo)
@@ -932,68 +953,69 @@ int __l2cap_wait_ack(struct sock *sk)
 
 static void l2cap_monitor_timeout(unsigned long arg)
 {
-        struct sock *sk = (void *) arg;
+        struct l2cap_chan *chan = (void *) arg;
+        struct sock *sk = chan->sk;
 
-        BT_DBG("sk %p", sk);
+        BT_DBG("chan %p", chan);
 
         bh_lock_sock(sk);
-        if (l2cap_pi(sk)->retry_count >= l2cap_pi(sk)->remote_max_tx) {
-                l2cap_send_disconn_req(l2cap_pi(sk)->conn, sk, ECONNABORTED);
+        if (chan->retry_count >= chan->remote_max_tx) {
+                l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
                 bh_unlock_sock(sk);
                 return;
         }
 
-        l2cap_pi(sk)->retry_count++;
+        chan->retry_count++;
         __mod_monitor_timer();
 
-        l2cap_send_rr_or_rnr(l2cap_pi(sk), L2CAP_CTRL_POLL);
+        l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
         bh_unlock_sock(sk);
 }
 
 static void l2cap_retrans_timeout(unsigned long arg)
 {
-        struct sock *sk = (void *) arg;
+        struct l2cap_chan *chan = (void *) arg;
+        struct sock *sk = chan->sk;
 
-        BT_DBG("sk %p", sk);
+        BT_DBG("chan %p", chan);
 
         bh_lock_sock(sk);
-        l2cap_pi(sk)->retry_count = 1;
+        chan->retry_count = 1;
         __mod_monitor_timer();
 
-        l2cap_pi(sk)->conn_state |= L2CAP_CONN_WAIT_F;
+        chan->conn_state |= L2CAP_CONN_WAIT_F;
 
-        l2cap_send_rr_or_rnr(l2cap_pi(sk), L2CAP_CTRL_POLL);
+        l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
         bh_unlock_sock(sk);
 }
 
-static void l2cap_drop_acked_frames(struct sock *sk)
+static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
 {
         struct sk_buff *skb;
 
-        while ((skb = skb_peek(TX_QUEUE(sk))) &&
-                        l2cap_pi(sk)->unacked_frames) {
-                if (bt_cb(skb)->tx_seq == l2cap_pi(sk)->expected_ack_seq)
+        while ((skb = skb_peek(&chan->tx_q)) &&
+                        chan->unacked_frames) {
+                if (bt_cb(skb)->tx_seq == chan->expected_ack_seq)
                         break;
 
-                skb = skb_dequeue(TX_QUEUE(sk));
+                skb = skb_dequeue(&chan->tx_q);
                 kfree_skb(skb);
 
-                l2cap_pi(sk)->unacked_frames--;
+                chan->unacked_frames--;
         }
 
-        if (!l2cap_pi(sk)->unacked_frames)
-                del_timer(&l2cap_pi(sk)->retrans_timer);
+        if (!chan->unacked_frames)
+                del_timer(&chan->retrans_timer);
 }
 
-void l2cap_do_send(struct sock *sk, struct sk_buff *skb)
+void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        struct hci_conn *hcon = pi->conn->hcon;
+        struct hci_conn *hcon = chan->conn->hcon;
         u16 flags;
 
-        BT_DBG("sk %p, skb %p len %d", sk, skb, skb->len);
+        BT_DBG("chan %p, skb %p len %d", chan, skb, skb->len);
 
-        if (!pi->flushable && lmp_no_flush_capable(hcon->hdev))
+        if (!chan->flushable && lmp_no_flush_capable(hcon->hdev))
                 flags = ACL_START_NO_FLUSH;
         else
                 flags = ACL_START;
@@ -1001,35 +1023,33 @@ void l2cap_do_send(struct sock *sk, struct sk_buff *skb)
         hci_send_acl(hcon, skb, flags);
 }
 
-void l2cap_streaming_send(struct sock *sk)
+void l2cap_streaming_send(struct l2cap_chan *chan)
 {
         struct sk_buff *skb;
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         u16 control, fcs;
 
-        while ((skb = skb_dequeue(TX_QUEUE(sk)))) {
+        while ((skb = skb_dequeue(&chan->tx_q))) {
                 control = get_unaligned_le16(skb->data + L2CAP_HDR_SIZE);
-                control |= pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT;
+                control |= chan->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT;
                 put_unaligned_le16(control, skb->data + L2CAP_HDR_SIZE);
 
-                if (pi->fcs == L2CAP_FCS_CRC16) {
+                if (chan->fcs == L2CAP_FCS_CRC16) {
                         fcs = crc16(0, (u8 *)skb->data, skb->len - 2);
                         put_unaligned_le16(fcs, skb->data + skb->len - 2);
                 }
 
-                l2cap_do_send(sk, skb);
+                l2cap_do_send(chan, skb);
 
-                pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
+                chan->next_tx_seq = (chan->next_tx_seq + 1) % 64;
         }
 }
 
-static void l2cap_retransmit_one_frame(struct sock *sk, u8 tx_seq)
+static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u8 tx_seq)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         struct sk_buff *skb, *tx_skb;
         u16 control, fcs;
 
-        skb = skb_peek(TX_QUEUE(sk));
+        skb = skb_peek(&chan->tx_q);
         if (!skb)
                 return;
 
@@ -1037,14 +1057,14 @@ static void l2cap_retransmit_one_frame(struct sock *sk, u8 tx_seq)
                 if (bt_cb(skb)->tx_seq == tx_seq)
                         break;
 
-                if (skb_queue_is_last(TX_QUEUE(sk), skb))
+                if (skb_queue_is_last(&chan->tx_q, skb))
                         return;
 
-        } while ((skb = skb_queue_next(TX_QUEUE(sk), skb)));
+        } while ((skb = skb_queue_next(&chan->tx_q, skb)));
 
-        if (pi->remote_max_tx &&
-                        bt_cb(skb)->retries == pi->remote_max_tx) {
-                l2cap_send_disconn_req(pi->conn, sk, ECONNABORTED);
+        if (chan->remote_max_tx &&
+                        bt_cb(skb)->retries == chan->remote_max_tx) {
+                l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
                 return;
         }
 
@@ -1053,39 +1073,39 @@ static void l2cap_retransmit_one_frame(struct sock *sk, u8 tx_seq)
         control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
         control &= L2CAP_CTRL_SAR;
 
-        if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
+        if (chan->conn_state & L2CAP_CONN_SEND_FBIT) {
                 control |= L2CAP_CTRL_FINAL;
-                pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
+                chan->conn_state &= ~L2CAP_CONN_SEND_FBIT;
         }
 
-        control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
+        control |= (chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
                         | (tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
 
         put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
 
-        if (pi->fcs == L2CAP_FCS_CRC16) {
+        if (chan->fcs == L2CAP_FCS_CRC16) {
                 fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2);
                 put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2);
         }
 
-        l2cap_do_send(sk, tx_skb);
+        l2cap_do_send(chan, tx_skb);
 }
 
-int l2cap_ertm_send(struct sock *sk)
+int l2cap_ertm_send(struct l2cap_chan *chan)
 {
         struct sk_buff *skb, *tx_skb;
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        struct sock *sk = chan->sk;
         u16 control, fcs;
         int nsent = 0;
 
         if (sk->sk_state != BT_CONNECTED)
                 return -ENOTCONN;
 
-        while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk))) {
+        while ((skb = chan->tx_send_head) && (!l2cap_tx_window_full(chan))) {
 
-                if (pi->remote_max_tx &&
-                                bt_cb(skb)->retries == pi->remote_max_tx) {
-                        l2cap_send_disconn_req(pi->conn, sk, ECONNABORTED);
+                if (chan->remote_max_tx &&
+                                bt_cb(skb)->retries == chan->remote_max_tx) {
+                        l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
                         break;
                 }
 
@@ -1096,36 +1116,36 @@ int l2cap_ertm_send(struct sock *sk)
                 control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
                 control &= L2CAP_CTRL_SAR;
 
-                if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
+                if (chan->conn_state & L2CAP_CONN_SEND_FBIT) {
                         control |= L2CAP_CTRL_FINAL;
-                        pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
+                        chan->conn_state &= ~L2CAP_CONN_SEND_FBIT;
                 }
-                control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
-                                | (pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
+                control |= (chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
+                                | (chan->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
                 put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
 
 
-                if (pi->fcs == L2CAP_FCS_CRC16) {
+                if (chan->fcs == L2CAP_FCS_CRC16) {
                         fcs = crc16(0, (u8 *)skb->data, tx_skb->len - 2);
                         put_unaligned_le16(fcs, skb->data + tx_skb->len - 2);
                 }
 
-                l2cap_do_send(sk, tx_skb);
+                l2cap_do_send(chan, tx_skb);
 
                 __mod_retrans_timer();
 
-                bt_cb(skb)->tx_seq = pi->next_tx_seq;
-                pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
+                bt_cb(skb)->tx_seq = chan->next_tx_seq;
+                chan->next_tx_seq = (chan->next_tx_seq + 1) % 64;
 
                 if (bt_cb(skb)->retries == 1)
-                        pi->unacked_frames++;
+                        chan->unacked_frames++;
 
-                pi->frames_sent++;
+                chan->frames_sent++;
 
-                if (skb_queue_is_last(TX_QUEUE(sk), skb))
-                        sk->sk_send_head = NULL;
+                if (skb_queue_is_last(&chan->tx_q, skb))
+                        chan->tx_send_head = NULL;
                 else
-                        sk->sk_send_head = skb_queue_next(TX_QUEUE(sk), skb);
+                        chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
 
                 nsent++;
         }
@@ -1133,41 +1153,39 @@ int l2cap_ertm_send(struct sock *sk)
         return nsent;
 }
 
-static int l2cap_retransmit_frames(struct sock *sk)
+static int l2cap_retransmit_frames(struct l2cap_chan *chan)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         int ret;
 
-        if (!skb_queue_empty(TX_QUEUE(sk)))
-                sk->sk_send_head = TX_QUEUE(sk)->next;
+        if (!skb_queue_empty(&chan->tx_q))
+                chan->tx_send_head = chan->tx_q.next;
 
-        pi->next_tx_seq = pi->expected_ack_seq;
-        ret = l2cap_ertm_send(sk);
+        chan->next_tx_seq = chan->expected_ack_seq;
+        ret = l2cap_ertm_send(chan);
         return ret;
 }
 
-static void l2cap_send_ack(struct l2cap_pinfo *pi)
+static void l2cap_send_ack(struct l2cap_chan *chan)
 {
-        struct sock *sk = (struct sock *)pi;
         u16 control = 0;
 
-        control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+        control |= chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
 
-        if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
+        if (chan->conn_state & L2CAP_CONN_LOCAL_BUSY) {
                 control |= L2CAP_SUPER_RCV_NOT_READY;
-                pi->conn_state |= L2CAP_CONN_RNR_SENT;
-                l2cap_send_sframe(pi, control);
+                chan->conn_state |= L2CAP_CONN_RNR_SENT;
+                l2cap_send_sframe(chan, control);
                 return;
         }
 
-        if (l2cap_ertm_send(sk) > 0)
+        if (l2cap_ertm_send(chan) > 0)
                 return;
 
         control |= L2CAP_SUPER_RCV_READY;
-        l2cap_send_sframe(pi, control);
+        l2cap_send_sframe(chan, control);
 }
 
-static void l2cap_send_srejtail(struct sock *sk)
+static void l2cap_send_srejtail(struct l2cap_chan *chan)
 {
         struct srej_list *tail;
         u16 control;
@@ -1175,15 +1193,15 @@ static void l2cap_send_srejtail(struct sock *sk)
         control = L2CAP_SUPER_SELECT_REJECT;
         control |= L2CAP_CTRL_FINAL;
 
-        tail = list_entry(SREJ_LIST(sk)->prev, struct srej_list, list);
+        tail = list_entry((&chan->srej_l)->prev, struct srej_list, list);
         control |= tail->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
 
-        l2cap_send_sframe(l2cap_pi(sk), control);
+        l2cap_send_sframe(chan, control);
 }
 
 static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, int len, int count, struct sk_buff *skb)
 {
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
         struct sk_buff **frag;
         int err, sent = 0;
 
@@ -1213,9 +1231,10 @@ static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, in
         return sent;
 }
 
-struct sk_buff *l2cap_create_connless_pdu(struct sock *sk, struct msghdr *msg, size_t len)
+struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
 {
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        struct sock *sk = chan->sk;
+        struct l2cap_conn *conn = chan->conn;
         struct sk_buff *skb;
         int err, count, hlen = L2CAP_HDR_SIZE + 2;
         struct l2cap_hdr *lh;
@@ -1230,9 +1249,9 @@ struct sk_buff *l2cap_create_connless_pdu(struct sock *sk, struct msghdr *msg, s
 
         /* Create L2CAP header */
         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
-        lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
+        lh->cid = cpu_to_le16(chan->dcid);
         lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
-        put_unaligned_le16(l2cap_pi(sk)->psm, skb_put(skb, 2));
+        put_unaligned_le16(chan->psm, skb_put(skb, 2));
 
         err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
         if (unlikely(err < 0)) {
@@ -1242,9 +1261,10 @@ struct sk_buff *l2cap_create_connless_pdu(struct sock *sk, struct msghdr *msg, s
         return skb;
 }
 
-struct sk_buff *l2cap_create_basic_pdu(struct sock *sk, struct msghdr *msg, size_t len)
+struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
 {
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        struct sock *sk = chan->sk;
+        struct l2cap_conn *conn = chan->conn;
         struct sk_buff *skb;
         int err, count, hlen = L2CAP_HDR_SIZE;
         struct l2cap_hdr *lh;
@@ -1259,7 +1279,7 @@ struct sk_buff *l2cap_create_basic_pdu(struct sock *sk, struct msghdr *msg, size
 
         /* Create L2CAP header */
         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
-        lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
+        lh->cid = cpu_to_le16(chan->dcid);
         lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
 
         err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
@@ -1270,9 +1290,10 @@ struct sk_buff *l2cap_create_basic_pdu(struct sock *sk, struct msghdr *msg, size
         return skb;
 }
 
-struct sk_buff *l2cap_create_iframe_pdu(struct sock *sk, struct msghdr *msg, size_t len, u16 control, u16 sdulen)
+struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len, u16 control, u16 sdulen)
 {
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        struct sock *sk = chan->sk;
+        struct l2cap_conn *conn = chan->conn;
         struct sk_buff *skb;
         int err, count, hlen = L2CAP_HDR_SIZE + 2;
         struct l2cap_hdr *lh;
@@ -1285,7 +1306,7 @@ struct sk_buff *l2cap_create_iframe_pdu(struct sock *sk, struct msghdr *msg, siz
         if (sdulen)
                 hlen += 2;
 
-        if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16)
+        if (chan->fcs == L2CAP_FCS_CRC16)
                 hlen += 2;
 
         count = min_t(unsigned int, (conn->mtu - hlen), len);
@@ -1296,7 +1317,7 @@ struct sk_buff *l2cap_create_iframe_pdu(struct sock *sk, struct msghdr *msg, siz
 
         /* Create L2CAP header */
         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
-        lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
+        lh->cid = cpu_to_le16(chan->dcid);
         lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
         put_unaligned_le16(control, skb_put(skb, 2));
         if (sdulen)
@@ -1308,16 +1329,15 @@ struct sk_buff *l2cap_create_iframe_pdu(struct sock *sk, struct msghdr *msg, siz
                 return ERR_PTR(err);
         }
 
-        if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16)
+        if (chan->fcs == L2CAP_FCS_CRC16)
                 put_unaligned_le16(0, skb_put(skb, 2));
 
         bt_cb(skb)->retries = 0;
         return skb;
 }
 
-int l2cap_sar_segment_sdu(struct sock *sk, struct msghdr *msg, size_t len)
+int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         struct sk_buff *skb;
         struct sk_buff_head sar_queue;
         u16 control;
@@ -1325,26 +1345,26 @@ int l2cap_sar_segment_sdu(struct sock *sk, struct msghdr *msg, size_t len)
 
         skb_queue_head_init(&sar_queue);
         control = L2CAP_SDU_START;
-        skb = l2cap_create_iframe_pdu(sk, msg, pi->remote_mps, control, len);
+        skb = l2cap_create_iframe_pdu(chan, msg, chan->remote_mps, control, len);
         if (IS_ERR(skb))
                 return PTR_ERR(skb);
 
         __skb_queue_tail(&sar_queue, skb);
-        len -= pi->remote_mps;
-        size += pi->remote_mps;
+        len -= chan->remote_mps;
+        size += chan->remote_mps;
 
         while (len > 0) {
                 size_t buflen;
 
-                if (len > pi->remote_mps) {
+                if (len > chan->remote_mps) {
                         control = L2CAP_SDU_CONTINUE;
-                        buflen = pi->remote_mps;
+                        buflen = chan->remote_mps;
                 } else {
                         control = L2CAP_SDU_END;
                         buflen = len;
                 }
 
-                skb = l2cap_create_iframe_pdu(sk, msg, buflen, control, 0);
+                skb = l2cap_create_iframe_pdu(chan, msg, buflen, control, 0);
                 if (IS_ERR(skb)) {
                         skb_queue_purge(&sar_queue);
                         return PTR_ERR(skb);
@@ -1354,9 +1374,9 @@ int l2cap_sar_segment_sdu(struct sock *sk, struct msghdr *msg, size_t len)
                 len -= buflen;
                 size += buflen;
         }
-        skb_queue_splice_tail(&sar_queue, TX_QUEUE(sk));
-        if (sk->sk_send_head == NULL)
-                sk->sk_send_head = sar_queue.next;
+        skb_queue_splice_tail(&sar_queue, &chan->tx_q);
+        if (chan->tx_send_head == NULL)
+                chan->tx_send_head = sar_queue.next;
 
         return size;
 }
@@ -1364,10 +1384,11 @@ int l2cap_sar_segment_sdu(struct sock *sk, struct msghdr *msg, size_t len)
 static void l2cap_chan_ready(struct sock *sk)
 {
         struct sock *parent = bt_sk(sk)->parent;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 
         BT_DBG("sk %p, parent %p", sk, parent);
 
-        l2cap_pi(sk)->conf_state = 0;
+        chan->conf_state = 0;
         l2cap_sock_clear_timer(sk);
 
         if (!parent) {
@@ -1387,14 +1408,14 @@ static void l2cap_chan_ready(struct sock *sk)
 /* Copy frame to all raw sockets on that connection */
 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
 {
-        struct l2cap_chan_list *l = &conn->chan_list;
         struct sk_buff *nskb;
-        struct sock *sk;
+        struct l2cap_chan *chan;
 
         BT_DBG("conn %p", conn);
 
-        read_lock(&l->lock);
-        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
+        read_lock(&conn->chan_lock);
+        list_for_each_entry(chan, &conn->chan_l, list) {
+                struct sock *sk = chan->sk;
                 if (sk->sk_type != SOCK_RAW)
                         continue;
 
@@ -1408,7 +1429,7 @@ static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
                 if (sock_queue_rcv_skb(sk, nskb))
                         kfree_skb(nskb);
         }
-        read_unlock(&l->lock);
+        read_unlock(&conn->chan_lock);
 }
 
 /* ---- L2CAP signalling commands ---- */
@@ -1540,32 +1561,35 @@ static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
 
 static void l2cap_ack_timeout(unsigned long arg)
 {
-        struct sock *sk = (void *) arg;
+        struct l2cap_chan *chan = (void *) arg;
 
-        bh_lock_sock(sk);
-        l2cap_send_ack(l2cap_pi(sk));
-        bh_unlock_sock(sk);
+        bh_lock_sock(chan->sk);
+        l2cap_send_ack(chan);
+        bh_unlock_sock(chan->sk);
 }
 
-static inline void l2cap_ertm_init(struct sock *sk)
+static inline void l2cap_ertm_init(struct l2cap_chan *chan)
 {
-        l2cap_pi(sk)->expected_ack_seq = 0;
-        l2cap_pi(sk)->unacked_frames = 0;
-        l2cap_pi(sk)->buffer_seq = 0;
-        l2cap_pi(sk)->num_acked = 0;
-        l2cap_pi(sk)->frames_sent = 0;
+        struct sock *sk = chan->sk;
+
+        chan->expected_ack_seq = 0;
+        chan->unacked_frames = 0;
+        chan->buffer_seq = 0;
+        chan->num_acked = 0;
+        chan->frames_sent = 0;
+
+        setup_timer(&chan->retrans_timer, l2cap_retrans_timeout,
+                                                        (unsigned long) chan);
+        setup_timer(&chan->monitor_timer, l2cap_monitor_timeout,
+                                                        (unsigned long) chan);
+        setup_timer(&chan->ack_timer, l2cap_ack_timeout, (unsigned long) chan);
 
-        setup_timer(&l2cap_pi(sk)->retrans_timer,
-                        l2cap_retrans_timeout, (unsigned long) sk);
-        setup_timer(&l2cap_pi(sk)->monitor_timer,
-                        l2cap_monitor_timeout, (unsigned long) sk);
-        setup_timer(&l2cap_pi(sk)->ack_timer,
-                        l2cap_ack_timeout, (unsigned long) sk);
+        skb_queue_head_init(&chan->srej_q);
+        skb_queue_head_init(&chan->busy_q);
 
-        __skb_queue_head_init(SREJ_QUEUE(sk));
-        __skb_queue_head_init(BUSY_QUEUE(sk));
+        INIT_LIST_HEAD(&chan->srej_l);
 
-        INIT_WORK(&l2cap_pi(sk)->busy_work, l2cap_busy_work);
+        INIT_WORK(&chan->busy_work, l2cap_busy_work);
 
         sk->sk_backlog_rcv = l2cap_ertm_data_rcv;
 }
@@ -1583,38 +1607,37 @@ static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
         }
 }
 
-int l2cap_build_conf_req(struct sock *sk, void *data)
+static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         struct l2cap_conf_req *req = data;
-        struct l2cap_conf_rfc rfc = { .mode = pi->mode };
+        struct l2cap_conf_rfc rfc = { .mode = chan->mode };
         void *ptr = req->data;
 
-        BT_DBG("sk %p", sk);
+        BT_DBG("chan %p", chan);
 
-        if (pi->num_conf_req || pi->num_conf_rsp)
+        if (chan->num_conf_req || chan->num_conf_rsp)
                 goto done;
 
-        switch (pi->mode) {
+        switch (chan->mode) {
         case L2CAP_MODE_STREAMING:
         case L2CAP_MODE_ERTM:
-                if (pi->conf_state & L2CAP_CONF_STATE2_DEVICE)
+                if (chan->conf_state & L2CAP_CONF_STATE2_DEVICE)
                         break;
 
                 /* fall through */
         default:
-                pi->mode = l2cap_select_mode(rfc.mode, pi->conn->feat_mask);
+                chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
                 break;
         }
 
 done:
-        if (pi->imtu != L2CAP_DEFAULT_MTU)
-                l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
+        if (chan->imtu != L2CAP_DEFAULT_MTU)
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
 
-        switch (pi->mode) {
+        switch (chan->mode) {
         case L2CAP_MODE_BASIC:
-                if (!(pi->conn->feat_mask & L2CAP_FEAT_ERTM) &&
-                                !(pi->conn->feat_mask & L2CAP_FEAT_STREAMING))
+                if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
+                                !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
                         break;
 
                 rfc.mode            = L2CAP_MODE_BASIC;
@@ -1630,24 +1653,24 @@ done:
 
         case L2CAP_MODE_ERTM:
                 rfc.mode            = L2CAP_MODE_ERTM;
-                rfc.txwin_size      = pi->tx_win;
-                rfc.max_transmit    = pi->max_tx;
+                rfc.txwin_size      = chan->tx_win;
+                rfc.max_transmit    = chan->max_tx;
                 rfc.retrans_timeout = 0;
                 rfc.monitor_timeout = 0;
                 rfc.max_pdu_size    = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
-                if (L2CAP_DEFAULT_MAX_PDU_SIZE > pi->conn->mtu - 10)
-                        rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
+                if (L2CAP_DEFAULT_MAX_PDU_SIZE > chan->conn->mtu - 10)
+                        rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10);
 
                 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
                                                         (unsigned long) &rfc);
 
-                if (!(pi->conn->feat_mask & L2CAP_FEAT_FCS))
+                if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
                         break;
 
-                if (pi->fcs == L2CAP_FCS_NONE ||
-                                pi->conf_state & L2CAP_CONF_NO_FCS_RECV) {
-                        pi->fcs = L2CAP_FCS_NONE;
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, pi->fcs);
+                if (chan->fcs == L2CAP_FCS_NONE ||
+                                chan->conf_state & L2CAP_CONF_NO_FCS_RECV) {
+                        chan->fcs = L2CAP_FCS_NONE;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
                 }
                 break;
 
@@ -1658,43 +1681,42 @@ done:
                 rfc.retrans_timeout = 0;
                 rfc.monitor_timeout = 0;
                 rfc.max_pdu_size    = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
-                if (L2CAP_DEFAULT_MAX_PDU_SIZE > pi->conn->mtu - 10)
-                        rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
+                if (L2CAP_DEFAULT_MAX_PDU_SIZE > chan->conn->mtu - 10)
+                        rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10);
 
                 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
                                                         (unsigned long) &rfc);
 
-                if (!(pi->conn->feat_mask & L2CAP_FEAT_FCS))
+                if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
                         break;
 
-                if (pi->fcs == L2CAP_FCS_NONE ||
-                                pi->conf_state & L2CAP_CONF_NO_FCS_RECV) {
-                        pi->fcs = L2CAP_FCS_NONE;
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, pi->fcs);
+                if (chan->fcs == L2CAP_FCS_NONE ||
+                                chan->conf_state & L2CAP_CONF_NO_FCS_RECV) {
+                        chan->fcs = L2CAP_FCS_NONE;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
                 }
                 break;
         }
 
-        req->dcid  = cpu_to_le16(pi->dcid);
+        req->dcid  = cpu_to_le16(chan->dcid);
         req->flags = cpu_to_le16(0);
 
         return ptr - data;
 }
 
-static int l2cap_parse_conf_req(struct sock *sk, void *data)
+static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         struct l2cap_conf_rsp *rsp = data;
         void *ptr = rsp->data;
-        void *req = pi->conf_req;
-        int len = pi->conf_len;
+        void *req = chan->conf_req;
+        int len = chan->conf_len;
         int type, hint, olen;
         unsigned long val;
         struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
         u16 mtu = L2CAP_DEFAULT_MTU;
         u16 result = L2CAP_CONF_SUCCESS;
 
-        BT_DBG("sk %p", sk);
+        BT_DBG("chan %p", chan);
 
         while (len >= L2CAP_CONF_OPT_SIZE) {
                 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
@@ -1708,7 +1730,7 @@ static int l2cap_parse_conf_req(struct sock *sk, void *data)
                         break;
 
                 case L2CAP_CONF_FLUSH_TO:
-                        pi->flush_to = val;
+                        chan->flush_to = val;
                         break;
 
                 case L2CAP_CONF_QOS:
@@ -1721,7 +1743,7 @@ static int l2cap_parse_conf_req(struct sock *sk, void *data)
 
                 case L2CAP_CONF_FCS:
                         if (val == L2CAP_FCS_NONE)
-                                pi->conf_state |= L2CAP_CONF_NO_FCS_RECV;
+                                chan->conf_state |= L2CAP_CONF_NO_FCS_RECV;
 
                         break;
 
@@ -1735,30 +1757,30 @@ static int l2cap_parse_conf_req(struct sock *sk, void *data)
                 }
         }
 
-        if (pi->num_conf_rsp || pi->num_conf_req > 1)
+        if (chan->num_conf_rsp || chan->num_conf_req > 1)
                 goto done;
 
-        switch (pi->mode) {
+        switch (chan->mode) {
         case L2CAP_MODE_STREAMING:
         case L2CAP_MODE_ERTM:
-                if (!(pi->conf_state & L2CAP_CONF_STATE2_DEVICE)) {
-                        pi->mode = l2cap_select_mode(rfc.mode,
-                                        pi->conn->feat_mask);
+                if (!(chan->conf_state & L2CAP_CONF_STATE2_DEVICE)) {
+                        chan->mode = l2cap_select_mode(rfc.mode,
+                                        chan->conn->feat_mask);
                         break;
                 }
 
-                if (pi->mode != rfc.mode)
+                if (chan->mode != rfc.mode)
                         return -ECONNREFUSED;
 
                 break;
         }
 
 done:
-        if (pi->mode != rfc.mode) {
+        if (chan->mode != rfc.mode) {
                 result = L2CAP_CONF_UNACCEPT;
-                rfc.mode = pi->mode;
+                rfc.mode = chan->mode;
 
-                if (pi->num_conf_rsp == 1)
+                if (chan->num_conf_rsp == 1)
                         return -ECONNREFUSED;
 
                 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
@@ -1773,32 +1795,32 @@ done:
                 if (mtu < L2CAP_DEFAULT_MIN_MTU)
                         result = L2CAP_CONF_UNACCEPT;
                 else {
-                        pi->omtu = mtu;
-                        pi->conf_state |= L2CAP_CONF_MTU_DONE;
+                        chan->omtu = mtu;
+                        chan->conf_state |= L2CAP_CONF_MTU_DONE;
                 }
-                l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
 
                 switch (rfc.mode) {
                 case L2CAP_MODE_BASIC:
-                        pi->fcs = L2CAP_FCS_NONE;
-                        pi->conf_state |= L2CAP_CONF_MODE_DONE;
+                        chan->fcs = L2CAP_FCS_NONE;
+                        chan->conf_state |= L2CAP_CONF_MODE_DONE;
                         break;
 
                 case L2CAP_MODE_ERTM:
-                        pi->remote_tx_win = rfc.txwin_size;
-                        pi->remote_max_tx = rfc.max_transmit;
+                        chan->remote_tx_win = rfc.txwin_size;
+                        chan->remote_max_tx = rfc.max_transmit;
 
-                        if (le16_to_cpu(rfc.max_pdu_size) > pi->conn->mtu - 10)
-                                rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
+                        if (le16_to_cpu(rfc.max_pdu_size) > chan->conn->mtu - 10)
+                                rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10);
 
-                        pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
+                        chan->remote_mps = le16_to_cpu(rfc.max_pdu_size);
 
                         rfc.retrans_timeout =
                                 le16_to_cpu(L2CAP_DEFAULT_RETRANS_TO);
                         rfc.monitor_timeout =
                                 le16_to_cpu(L2CAP_DEFAULT_MONITOR_TO);
 
-                        pi->conf_state |= L2CAP_CONF_MODE_DONE;
+                        chan->conf_state |= L2CAP_CONF_MODE_DONE;
 
                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
                                         sizeof(rfc), (unsigned long) &rfc);
@@ -1806,12 +1828,12 @@ done:
                         break;
 
                 case L2CAP_MODE_STREAMING:
-                        if (le16_to_cpu(rfc.max_pdu_size) > pi->conn->mtu - 10)
-                                rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
+                        if (le16_to_cpu(rfc.max_pdu_size) > chan->conn->mtu - 10)
+                                rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10);
 
-                        pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
+                        chan->remote_mps = le16_to_cpu(rfc.max_pdu_size);
 
-                        pi->conf_state |= L2CAP_CONF_MODE_DONE;
+                        chan->conf_state |= L2CAP_CONF_MODE_DONE;
 
                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
                                         sizeof(rfc), (unsigned long) &rfc);
@@ -1822,29 +1844,28 @@ done:
                         result = L2CAP_CONF_UNACCEPT;
 
                         memset(&rfc, 0, sizeof(rfc));
-                        rfc.mode = pi->mode;
+                        rfc.mode = chan->mode;
                 }
 
                 if (result == L2CAP_CONF_SUCCESS)
-                        pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
+                        chan->conf_state |= L2CAP_CONF_OUTPUT_DONE;
         }
-        rsp->scid   = cpu_to_le16(pi->dcid);
+        rsp->scid   = cpu_to_le16(chan->dcid);
         rsp->result = cpu_to_le16(result);
         rsp->flags  = cpu_to_le16(0x0000);
 
         return ptr - data;
 }
 
-static int l2cap_parse_conf_rsp(struct sock *sk, void *rsp, int len, void *data, u16 *result)
+static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, void *data, u16 *result)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         struct l2cap_conf_req *req = data;
         void *ptr = req->data;
         int type, olen;
         unsigned long val;
         struct l2cap_conf_rfc rfc;
 
-        BT_DBG("sk %p, rsp %p, len %d, req %p", sk, rsp, len, data);
+        BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
 
         while (len >= L2CAP_CONF_OPT_SIZE) {
                 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
@@ -1853,27 +1874,27 @@ static int l2cap_parse_conf_rsp(struct sock *sk, void *rsp, int len, void *data,
                 case L2CAP_CONF_MTU:
                         if (val < L2CAP_DEFAULT_MIN_MTU) {
                                 *result = L2CAP_CONF_UNACCEPT;
-                                pi->imtu = L2CAP_DEFAULT_MIN_MTU;
+                                chan->imtu = L2CAP_DEFAULT_MIN_MTU;
                         } else
-                                pi->imtu = val;
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
+                                chan->imtu = val;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
                         break;
 
                 case L2CAP_CONF_FLUSH_TO:
-                        pi->flush_to = val;
+                        chan->flush_to = val;
                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
-                                                        2, pi->flush_to);
+                                                        2, chan->flush_to);
                         break;
 
                 case L2CAP_CONF_RFC:
                         if (olen == sizeof(rfc))
                                 memcpy(&rfc, (void *)val, olen);
 
-                        if ((pi->conf_state & L2CAP_CONF_STATE2_DEVICE) &&
-                                                        rfc.mode != pi->mode)
+                        if ((chan->conf_state & L2CAP_CONF_STATE2_DEVICE) &&
+                                                        rfc.mode != chan->mode)
                                 return -ECONNREFUSED;
 
-                        pi->fcs = 0;
+                        chan->fcs = 0;
 
                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
                                         sizeof(rfc), (unsigned long) &rfc);
@@ -1881,53 +1902,74 @@ static int l2cap_parse_conf_rsp(struct sock *sk, void *rsp, int len, void *data,
                 }
         }
 
-        if (pi->mode == L2CAP_MODE_BASIC && pi->mode != rfc.mode)
+        if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
                 return -ECONNREFUSED;
 
-        pi->mode = rfc.mode;
+        chan->mode = rfc.mode;
 
         if (*result == L2CAP_CONF_SUCCESS) {
                 switch (rfc.mode) {
                 case L2CAP_MODE_ERTM:
-                        pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
-                        pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
-                        pi->mps    = le16_to_cpu(rfc.max_pdu_size);
+                        chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
+                        chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
+                        chan->mps    = le16_to_cpu(rfc.max_pdu_size);
                         break;
                 case L2CAP_MODE_STREAMING:
-                        pi->mps    = le16_to_cpu(rfc.max_pdu_size);
+                        chan->mps    = le16_to_cpu(rfc.max_pdu_size);
                 }
         }
 
-        req->dcid   = cpu_to_le16(pi->dcid);
+        req->dcid   = cpu_to_le16(chan->dcid);
         req->flags  = cpu_to_le16(0x0000);
 
         return ptr - data;
 }
 
-static int l2cap_build_conf_rsp(struct sock *sk, void *data, u16 result, u16 flags)
+static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, u16 result, u16 flags)
 {
         struct l2cap_conf_rsp *rsp = data;
         void *ptr = rsp->data;
 
-        BT_DBG("sk %p", sk);
+        BT_DBG("chan %p", chan);
 
-        rsp->scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
+        rsp->scid   = cpu_to_le16(chan->dcid);
         rsp->result = cpu_to_le16(result);
         rsp->flags  = cpu_to_le16(flags);
 
         return ptr - data;
 }
 
-static void l2cap_conf_rfc_get(struct sock *sk, void *rsp, int len)
+void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
+{
+        struct l2cap_conn_rsp rsp;
+        struct l2cap_conn *conn = chan->conn;
+        u8 buf[128];
+
+        rsp.scid   = cpu_to_le16(chan->dcid);
+        rsp.dcid   = cpu_to_le16(chan->scid);
+        rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
+        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
+        l2cap_send_cmd(conn, chan->ident,
+                                L2CAP_CONN_RSP, sizeof(rsp), &rsp);
+
+        if (chan->conf_state & L2CAP_CONF_REQ_SENT)
+                return;
+
+        chan->conf_state |= L2CAP_CONF_REQ_SENT;
+        l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
+                        l2cap_build_conf_req(chan, buf), buf);
+        chan->num_conf_req++;
+}
+
+static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         int type, olen;
         unsigned long val;
         struct l2cap_conf_rfc rfc;
 
-        BT_DBG("sk %p, rsp %p, len %d", sk, rsp, len);
+        BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
 
-        if ((pi->mode != L2CAP_MODE_ERTM) && (pi->mode != L2CAP_MODE_STREAMING))
+        if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
                 return;
 
         while (len >= L2CAP_CONF_OPT_SIZE) {
@@ -1944,12 +1986,12 @@ static void l2cap_conf_rfc_get(struct sock *sk, void *rsp, int len)
 done:
         switch (rfc.mode) {
         case L2CAP_MODE_ERTM:
-                pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
-                pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
-                pi->mps    = le16_to_cpu(rfc.max_pdu_size);
+                chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
+                chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
+                chan->mps    = le16_to_cpu(rfc.max_pdu_size);
                 break;
         case L2CAP_MODE_STREAMING:
-                pi->mps    = le16_to_cpu(rfc.max_pdu_size);
+                chan->mps    = le16_to_cpu(rfc.max_pdu_size);
         }
 }
 
@@ -1975,9 +2017,9 @@ static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hd
 
 static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
 {
-        struct l2cap_chan_list *list = &conn->chan_list;
         struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
         struct l2cap_conn_rsp rsp;
+        struct l2cap_chan *chan = NULL;
         struct sock *parent, *sk = NULL;
         int result, status = L2CAP_CS_NO_INFO;
 
@@ -2015,11 +2057,19 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
         if (!sk)
                 goto response;
 
-        write_lock_bh(&list->lock);
+        chan = l2cap_chan_alloc(sk);
+        if (!chan) {
+                l2cap_sock_kill(sk);
+                goto response;
+        }
+
+        l2cap_pi(sk)->chan = chan;
+
+        write_lock_bh(&conn->chan_lock);
 
         /* Check if we already have channel with that dcid */
-        if (__l2cap_get_chan_by_dcid(list, scid)) {
-                write_unlock_bh(&list->lock);
+        if (__l2cap_get_chan_by_dcid(conn, scid)) {
+                write_unlock_bh(&conn->chan_lock);
                 sock_set_flag(sk, SOCK_ZAPPED);
                 l2cap_sock_kill(sk);
                 goto response;
@@ -2030,18 +2080,21 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
         l2cap_sock_init(sk, parent);
         bacpy(&bt_sk(sk)->src, conn->src);
         bacpy(&bt_sk(sk)->dst, conn->dst);
-        l2cap_pi(sk)->psm  = psm;
-        l2cap_pi(sk)->dcid = scid;
+        chan->psm  = psm;
+        chan->dcid = scid;
+
+        bt_accept_enqueue(parent, sk);
 
-        __l2cap_chan_add(conn, sk, parent);
-        dcid = l2cap_pi(sk)->scid;
+        __l2cap_chan_add(conn, chan);
+
+        dcid = chan->scid;
 
         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
 
-        l2cap_pi(sk)->ident = cmd->ident;
+        chan->ident = cmd->ident;
 
         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
-                if (l2cap_check_security(sk)) {
+                if (l2cap_check_security(chan)) {
                         if (bt_sk(sk)->defer_setup) {
                                 sk->sk_state = BT_CONNECT2;
                                 result = L2CAP_CR_PEND;
@@ -2063,7 +2116,7 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
                 status = L2CAP_CS_NO_INFO;
         }
 
-        write_unlock_bh(&list->lock);
+        write_unlock_bh(&conn->chan_lock);
 
 response:
         bh_unlock_sock(parent);
@@ -2089,13 +2142,13 @@ sendresp:
                                         L2CAP_INFO_REQ, sizeof(info), &info);
         }
 
-        if (sk && !(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT) &&
+        if (chan && !(chan->conf_state & L2CAP_CONF_REQ_SENT) &&
                                 result == L2CAP_CR_SUCCESS) {
                 u8 buf[128];
-                l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
+                chan->conf_state |= L2CAP_CONF_REQ_SENT;
                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                                        l2cap_build_conf_req(sk, buf), buf);
-                l2cap_pi(sk)->num_conf_req++;
+                                        l2cap_build_conf_req(chan, buf), buf);
+                chan->num_conf_req++;
         }
 
         return 0;
@@ -2105,6 +2158,7 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
 {
         struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
         u16 scid, dcid, result, status;
+        struct l2cap_chan *chan;
         struct sock *sk;
         u8 req[128];
 
@@ -2116,34 +2170,36 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
         BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
 
         if (scid) {
-                sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
-                if (!sk)
+                chan = l2cap_get_chan_by_scid(conn, scid);
+                if (!chan)
                         return -EFAULT;
         } else {
-                sk = l2cap_get_chan_by_ident(&conn->chan_list, cmd->ident);
-                if (!sk)
+                chan = l2cap_get_chan_by_ident(conn, cmd->ident);
+                if (!chan)
                         return -EFAULT;
         }
 
+        sk = chan->sk;
+
         switch (result) {
         case L2CAP_CR_SUCCESS:
                 sk->sk_state = BT_CONFIG;
-                l2cap_pi(sk)->ident = 0;
-                l2cap_pi(sk)->dcid = dcid;
-                l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_CONNECT_PEND;
+                chan->ident = 0;
+                chan->dcid = dcid;
+                chan->conf_state &= ~L2CAP_CONF_CONNECT_PEND;
 
-                if (l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)
+                if (chan->conf_state & L2CAP_CONF_REQ_SENT)
                         break;
 
-                l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
+                chan->conf_state |= L2CAP_CONF_REQ_SENT;
 
                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                                        l2cap_build_conf_req(sk, req), req);
-                l2cap_pi(sk)->num_conf_req++;
+                                        l2cap_build_conf_req(chan, req), req);
+                chan->num_conf_req++;
                 break;
 
         case L2CAP_CR_PEND:
-                l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
+                chan->conf_state |= L2CAP_CONF_CONNECT_PEND;
                 break;
 
         default:
@@ -2155,7 +2211,7 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
                         break;
                 }
 
-                l2cap_chan_del(sk, ECONNREFUSED);
+                l2cap_chan_del(chan, ECONNREFUSED);
                 break;
         }
 
@@ -2163,15 +2219,17 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
         return 0;
 }
 
-static inline void set_default_fcs(struct l2cap_pinfo *pi)
+static inline void set_default_fcs(struct l2cap_chan *chan)
 {
+        struct l2cap_pinfo *pi = l2cap_pi(chan->sk);
+
         /* FCS is enabled only in ERTM or streaming mode, if one or both
          * sides request it.
          */
-        if (pi->mode != L2CAP_MODE_ERTM && pi->mode != L2CAP_MODE_STREAMING)
-                pi->fcs = L2CAP_FCS_NONE;
-        else if (!(pi->conf_state & L2CAP_CONF_NO_FCS_RECV))
-                pi->fcs = L2CAP_FCS_CRC16;
+        if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
+                chan->fcs = L2CAP_FCS_NONE;
+        else if (!(pi->chan->conf_state & L2CAP_CONF_NO_FCS_RECV))
+                chan->fcs = L2CAP_FCS_CRC16;
 }
 
 static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
@@ -2179,6 +2237,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
         u16 dcid, flags;
         u8 rsp[64];
+        struct l2cap_chan *chan;
         struct sock *sk;
         int len;
 
@@ -2187,10 +2246,12 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
         BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
 
-        sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid);
-        if (!sk)
+        chan = l2cap_get_chan_by_scid(conn, dcid);
+        if (!chan)
                 return -ENOENT;
 
+        sk = chan->sk;
+
         if (sk->sk_state != BT_CONFIG) {
                 struct l2cap_cmd_rej rej;
 
@@ -2202,62 +2263,62 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
         /* Reject if config buffer is too small. */
         len = cmd_len - sizeof(*req);
-        if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
+        if (chan->conf_len + len > sizeof(chan->conf_req)) {
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
-                                l2cap_build_conf_rsp(sk, rsp,
+                                l2cap_build_conf_rsp(chan, rsp,
                                         L2CAP_CONF_REJECT, flags), rsp);
                 goto unlock;
         }
 
         /* Store config. */
-        memcpy(l2cap_pi(sk)->conf_req + l2cap_pi(sk)->conf_len, req->data, len);
-        l2cap_pi(sk)->conf_len += len;
+        memcpy(chan->conf_req + chan->conf_len, req->data, len);
+        chan->conf_len += len;
 
         if (flags & 0x0001) {
                 /* Incomplete config. Send empty response. */
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
-                                l2cap_build_conf_rsp(sk, rsp,
+                                l2cap_build_conf_rsp(chan, rsp,
                                         L2CAP_CONF_SUCCESS, 0x0001), rsp);
                 goto unlock;
         }
 
         /* Complete config. */
-        len = l2cap_parse_conf_req(sk, rsp);
+        len = l2cap_parse_conf_req(chan, rsp);
         if (len < 0) {
-                l2cap_send_disconn_req(conn, sk, ECONNRESET);
+                l2cap_send_disconn_req(conn, chan, ECONNRESET);
                 goto unlock;
         }
 
         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
-        l2cap_pi(sk)->num_conf_rsp++;
+        chan->num_conf_rsp++;
 
         /* Reset config buffer. */
-        l2cap_pi(sk)->conf_len = 0;
+        chan->conf_len = 0;
 
-        if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE))
+        if (!(chan->conf_state & L2CAP_CONF_OUTPUT_DONE))
                 goto unlock;
 
-        if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
-                set_default_fcs(l2cap_pi(sk));
+        if (chan->conf_state & L2CAP_CONF_INPUT_DONE) {
+                set_default_fcs(chan);
 
                 sk->sk_state = BT_CONNECTED;
 
-                l2cap_pi(sk)->next_tx_seq = 0;
-                l2cap_pi(sk)->expected_tx_seq = 0;
-                __skb_queue_head_init(TX_QUEUE(sk));
-                if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM)
-                        l2cap_ertm_init(sk);
+                chan->next_tx_seq = 0;
+                chan->expected_tx_seq = 0;
+                skb_queue_head_init(&chan->tx_q);
+                if (chan->mode == L2CAP_MODE_ERTM)
+                        l2cap_ertm_init(chan);
 
                 l2cap_chan_ready(sk);
                 goto unlock;
         }
 
-        if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
+        if (!(chan->conf_state & L2CAP_CONF_REQ_SENT)) {
                 u8 buf[64];
-                l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
+                chan->conf_state |= L2CAP_CONF_REQ_SENT;
                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                                        l2cap_build_conf_req(sk, buf), buf);
-                l2cap_pi(sk)->num_conf_req++;
+                                        l2cap_build_conf_req(chan, buf), buf);
+                chan->num_conf_req++;
         }
 
 unlock:
@@ -2269,6 +2330,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 {
         struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
         u16 scid, flags, result;
+        struct l2cap_chan *chan;
         struct sock *sk;
         int len = cmd->len - sizeof(*rsp);
 
@@ -2279,36 +2341,38 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x",
                         scid, flags, result);
 
-        sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
-        if (!sk)
+        chan = l2cap_get_chan_by_scid(conn, scid);
+        if (!chan)
                 return 0;
 
+        sk = chan->sk;
+
         switch (result) {
         case L2CAP_CONF_SUCCESS:
-                l2cap_conf_rfc_get(sk, rsp->data, len);
+                l2cap_conf_rfc_get(chan, rsp->data, len);
                 break;
 
         case L2CAP_CONF_UNACCEPT:
-                if (l2cap_pi(sk)->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
+                if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
                         char req[64];
 
                         if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
-                                l2cap_send_disconn_req(conn, sk, ECONNRESET);
+                                l2cap_send_disconn_req(conn, chan, ECONNRESET);
                                 goto done;
                         }
 
                         /* throw out any old stored conf requests */
                         result = L2CAP_CONF_SUCCESS;
-                        len = l2cap_parse_conf_rsp(sk, rsp->data,
-                                                        len, req, &result);
+                        len = l2cap_parse_conf_rsp(chan, rsp->data, len,
+                                                                req, &result);
                         if (len < 0) {
-                                l2cap_send_disconn_req(conn, sk, ECONNRESET);
+                                l2cap_send_disconn_req(conn, chan, ECONNRESET);
                                 goto done;
                         }
 
                         l2cap_send_cmd(conn, l2cap_get_ident(conn),
                                                 L2CAP_CONF_REQ, len, req);
-                        l2cap_pi(sk)->num_conf_req++;
+                        chan->num_conf_req++;
                         if (result != L2CAP_CONF_SUCCESS)
                                 goto done;
                         break;
@@ -2317,24 +2381,24 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         default:
                 sk->sk_err = ECONNRESET;
                 l2cap_sock_set_timer(sk, HZ * 5);
-                l2cap_send_disconn_req(conn, sk, ECONNRESET);
+                l2cap_send_disconn_req(conn, chan, ECONNRESET);
                 goto done;
         }
 
         if (flags & 0x01)
                 goto done;
 
-        l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
+        chan->conf_state |= L2CAP_CONF_INPUT_DONE;
 
-        if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
-                set_default_fcs(l2cap_pi(sk));
+        if (chan->conf_state & L2CAP_CONF_OUTPUT_DONE) {
+                set_default_fcs(chan);
 
                 sk->sk_state = BT_CONNECTED;
-                l2cap_pi(sk)->next_tx_seq = 0;
-                l2cap_pi(sk)->expected_tx_seq = 0;
-                __skb_queue_head_init(TX_QUEUE(sk));
-                if (l2cap_pi(sk)->mode ==  L2CAP_MODE_ERTM)
-                        l2cap_ertm_init(sk);
+                chan->next_tx_seq = 0;
+                chan->expected_tx_seq = 0;
+                skb_queue_head_init(&chan->tx_q);
+                if (chan->mode ==  L2CAP_MODE_ERTM)
+                        l2cap_ertm_init(chan);
 
                 l2cap_chan_ready(sk);
         }
@@ -2349,6 +2413,7 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd
         struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
         struct l2cap_disconn_rsp rsp;
         u16 dcid, scid;
+        struct l2cap_chan *chan;
         struct sock *sk;
 
         scid = __le16_to_cpu(req->scid);
@@ -2356,12 +2421,14 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd
 
         BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
 
-        sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid);
-        if (!sk)
+        chan = l2cap_get_chan_by_scid(conn, dcid);
+        if (!chan)
                 return 0;
 
-        rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
-        rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
+        sk = chan->sk;
+
+        rsp.dcid = cpu_to_le16(chan->scid);
+        rsp.scid = cpu_to_le16(chan->dcid);
         l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
 
         sk->sk_shutdown = SHUTDOWN_MASK;
@@ -2375,7 +2442,7 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd
                 return 0;
         }
 
-        l2cap_chan_del(sk, ECONNRESET);
+        l2cap_chan_del(chan, ECONNRESET);
         bh_unlock_sock(sk);
 
         l2cap_sock_kill(sk);
@@ -2386,6 +2453,7 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd
 {
         struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
         u16 dcid, scid;
+        struct l2cap_chan *chan;
         struct sock *sk;
 
         scid = __le16_to_cpu(rsp->scid);
@@ -2393,10 +2461,12 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd
 
         BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
 
-        sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
-        if (!sk)
+        chan = l2cap_get_chan_by_scid(conn, scid);
+        if (!chan)
                 return 0;
 
+        sk = chan->sk;
+
         /* don't delete l2cap channel if sk is owned by user */
         if (sock_owned_by_user(sk)) {
                 sk->sk_state = BT_DISCONN;
@@ -2406,7 +2476,7 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd
                 return 0;
         }
 
-        l2cap_chan_del(sk, 0);
+        l2cap_chan_del(chan, 0);
         bh_unlock_sock(sk);
 
         l2cap_sock_kill(sk);
@@ -2463,6 +2533,11 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cm
 
         BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
 
+        /* L2CAP Info req/rsp are unbound to channels, add extra checks */
+        if (cmd->ident != conn->info_ident ||
+                        conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
+                return 0;
+
         del_timer(&conn->info_timer);
 
         if (result != L2CAP_IR_SUCCESS) {
@@ -2673,7 +2748,8 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
 
                 if (err) {
                         struct l2cap_cmd_rej rej;
-                        BT_DBG("error %d", err);
+
+                        BT_ERR("Wrong link type (%d)", err);
 
                         /* FIXME: Map err to a valid reason */
                         rej.reason = cpu_to_le16(0);
@@ -2687,12 +2763,12 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
         kfree_skb(skb);
 }
 
-static int l2cap_check_fcs(struct l2cap_pinfo *pi,  struct sk_buff *skb)
+static int l2cap_check_fcs(struct l2cap_chan *chan,  struct sk_buff *skb)
 {
         u16 our_fcs, rcv_fcs;
         int hdr_size = L2CAP_HDR_SIZE + 2;
 
-        if (pi->fcs == L2CAP_FCS_CRC16) {
+        if (chan->fcs == L2CAP_FCS_CRC16) {
                 skb_trim(skb, skb->len - 2);
                 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
                 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
@@ -2703,49 +2779,47 @@ static int l2cap_check_fcs(struct l2cap_pinfo *pi,  struct sk_buff *skb)
         return 0;
 }
 
-static inline void l2cap_send_i_or_rr_or_rnr(struct sock *sk)
+static inline void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         u16 control = 0;
 
-        pi->frames_sent = 0;
+        chan->frames_sent = 0;
 
-        control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+        control |= chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
 
-        if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
+        if (chan->conn_state & L2CAP_CONN_LOCAL_BUSY) {
                 control |= L2CAP_SUPER_RCV_NOT_READY;
-                l2cap_send_sframe(pi, control);
-                pi->conn_state |= L2CAP_CONN_RNR_SENT;
+                l2cap_send_sframe(chan, control);
+                chan->conn_state |= L2CAP_CONN_RNR_SENT;
         }
 
-        if (pi->conn_state & L2CAP_CONN_REMOTE_BUSY)
-                l2cap_retransmit_frames(sk);
+        if (chan->conn_state & L2CAP_CONN_REMOTE_BUSY)
+                l2cap_retransmit_frames(chan);
 
-        l2cap_ertm_send(sk);
+        l2cap_ertm_send(chan);
 
-        if (!(pi->conn_state & L2CAP_CONN_LOCAL_BUSY) &&
-                        pi->frames_sent == 0) {
+        if (!(chan->conn_state & L2CAP_CONN_LOCAL_BUSY) &&
+                        chan->frames_sent == 0) {
                 control |= L2CAP_SUPER_RCV_READY;
-                l2cap_send_sframe(pi, control);
+                l2cap_send_sframe(chan, control);
         }
 }
 
-static int l2cap_add_to_srej_queue(struct sock *sk, struct sk_buff *skb, u8 tx_seq, u8 sar)
+static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb, u8 tx_seq, u8 sar)
 {
         struct sk_buff *next_skb;
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         int tx_seq_offset, next_tx_seq_offset;
 
         bt_cb(skb)->tx_seq = tx_seq;
         bt_cb(skb)->sar = sar;
 
-        next_skb = skb_peek(SREJ_QUEUE(sk));
+        next_skb = skb_peek(&chan->srej_q);
         if (!next_skb) {
-                __skb_queue_tail(SREJ_QUEUE(sk), skb);
+                __skb_queue_tail(&chan->srej_q, skb);
                 return 0;
         }
 
-        tx_seq_offset = (tx_seq - pi->buffer_seq) % 64;
+        tx_seq_offset = (tx_seq - chan->buffer_seq) % 64;
         if (tx_seq_offset < 0)
                 tx_seq_offset += 64;
 
@@ -2754,53 +2828,52 @@ static int l2cap_add_to_srej_queue(struct sock *sk, struct sk_buff *skb, u8 tx_s
                         return -EINVAL;
 
                 next_tx_seq_offset = (bt_cb(next_skb)->tx_seq -
-                                                pi->buffer_seq) % 64;
+                                                chan->buffer_seq) % 64;
                 if (next_tx_seq_offset < 0)
                         next_tx_seq_offset += 64;
 
                 if (next_tx_seq_offset > tx_seq_offset) {
-                        __skb_queue_before(SREJ_QUEUE(sk), next_skb, skb);
+                        __skb_queue_before(&chan->srej_q, next_skb, skb);
                         return 0;
                 }
 
-                if (skb_queue_is_last(SREJ_QUEUE(sk), next_skb))
+                if (skb_queue_is_last(&chan->srej_q, next_skb))
                         break;
 
-        } while ((next_skb = skb_queue_next(SREJ_QUEUE(sk), next_skb)));
+        } while ((next_skb = skb_queue_next(&chan->srej_q, next_skb)));
 
-        __skb_queue_tail(SREJ_QUEUE(sk), skb);
+        __skb_queue_tail(&chan->srej_q, skb);
 
         return 0;
 }
 
-static int l2cap_ertm_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 control)
+static int l2cap_ertm_reassembly_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u16 control)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         struct sk_buff *_skb;
         int err;
 
         switch (control & L2CAP_CTRL_SAR) {
         case L2CAP_SDU_UNSEGMENTED:
-                if (pi->conn_state & L2CAP_CONN_SAR_SDU)
+                if (chan->conn_state & L2CAP_CONN_SAR_SDU)
                         goto drop;
 
-                err = sock_queue_rcv_skb(sk, skb);
+                err = sock_queue_rcv_skb(chan->sk, skb);
                 if (!err)
                         return err;
 
                 break;
 
         case L2CAP_SDU_START:
-                if (pi->conn_state & L2CAP_CONN_SAR_SDU)
+                if (chan->conn_state & L2CAP_CONN_SAR_SDU)
                         goto drop;
 
-                pi->sdu_len = get_unaligned_le16(skb->data);
+                chan->sdu_len = get_unaligned_le16(skb->data);
 
-                if (pi->sdu_len > pi->imtu)
+                if (chan->sdu_len > chan->imtu)
                         goto disconnect;
 
-                pi->sdu = bt_skb_alloc(pi->sdu_len, GFP_ATOMIC);
-                if (!pi->sdu)
+                chan->sdu = bt_skb_alloc(chan->sdu_len, GFP_ATOMIC);
+                if (!chan->sdu)
                         return -ENOMEM;
 
                 /* pull sdu_len bytes only after alloc, because of Local Busy
@@ -2808,63 +2881,63 @@ static int l2cap_ertm_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 c
                  * only once, i.e., when alloc does not fail */
                 skb_pull(skb, 2);
 
-                memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
+                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
 
-                pi->conn_state |= L2CAP_CONN_SAR_SDU;
-                pi->partial_sdu_len = skb->len;
+                chan->conn_state |= L2CAP_CONN_SAR_SDU;
+                chan->partial_sdu_len = skb->len;
                 break;
 
         case L2CAP_SDU_CONTINUE:
-                if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
+                if (!(chan->conn_state & L2CAP_CONN_SAR_SDU))
                         goto disconnect;
 
-                if (!pi->sdu)
+                if (!chan->sdu)
                         goto disconnect;
 
-                pi->partial_sdu_len += skb->len;
-                if (pi->partial_sdu_len > pi->sdu_len)
+                chan->partial_sdu_len += skb->len;
+                if (chan->partial_sdu_len > chan->sdu_len)
                         goto drop;
 
-                memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
+                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
 
                 break;
 
         case L2CAP_SDU_END:
-                if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
+                if (!(chan->conn_state & L2CAP_CONN_SAR_SDU))
                         goto disconnect;
 
-                if (!pi->sdu)
+                if (!chan->sdu)
                         goto disconnect;
 
-                if (!(pi->conn_state & L2CAP_CONN_SAR_RETRY)) {
-                        pi->partial_sdu_len += skb->len;
+                if (!(chan->conn_state & L2CAP_CONN_SAR_RETRY)) {
+                        chan->partial_sdu_len += skb->len;
 
-                        if (pi->partial_sdu_len > pi->imtu)
+                        if (chan->partial_sdu_len > chan->imtu)
                                 goto drop;
 
-                        if (pi->partial_sdu_len != pi->sdu_len)
+                        if (chan->partial_sdu_len != chan->sdu_len)
                                 goto drop;
 
-                        memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
+                        memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
                 }
 
-                _skb = skb_clone(pi->sdu, GFP_ATOMIC);
+                _skb = skb_clone(chan->sdu, GFP_ATOMIC);
                 if (!_skb) {
-                        pi->conn_state |= L2CAP_CONN_SAR_RETRY;
+                        chan->conn_state |= L2CAP_CONN_SAR_RETRY;
                         return -ENOMEM;
                 }
 
-                err = sock_queue_rcv_skb(sk, _skb);
+                err = sock_queue_rcv_skb(chan->sk, _skb);
                 if (err < 0) {
                         kfree_skb(_skb);
-                        pi->conn_state |= L2CAP_CONN_SAR_RETRY;
+                        chan->conn_state |= L2CAP_CONN_SAR_RETRY;
                         return err;
                 }
 
-                pi->conn_state &= ~L2CAP_CONN_SAR_RETRY;
-                pi->conn_state &= ~L2CAP_CONN_SAR_SDU;
+                chan->conn_state &= ~L2CAP_CONN_SAR_RETRY;
+                chan->conn_state &= ~L2CAP_CONN_SAR_SDU;
 
-                kfree_skb(pi->sdu);
+                kfree_skb(chan->sdu);
                 break;
         }
 
@@ -2872,51 +2945,50 @@ static int l2cap_ertm_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 c
         return 0;
 
 drop:
-        kfree_skb(pi->sdu);
-        pi->sdu = NULL;
+        kfree_skb(chan->sdu);
+        chan->sdu = NULL;
 
 disconnect:
-        l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
+        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
         kfree_skb(skb);
         return 0;
 }
 
-static int l2cap_try_push_rx_skb(struct sock *sk)
+static int l2cap_try_push_rx_skb(struct l2cap_chan *chan)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         struct sk_buff *skb;
         u16 control;
         int err;
 
-        while ((skb = skb_dequeue(BUSY_QUEUE(sk)))) {
+        while ((skb = skb_dequeue(&chan->busy_q))) {
                 control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
-                err = l2cap_ertm_reassembly_sdu(sk, skb, control);
+                err = l2cap_ertm_reassembly_sdu(chan, skb, control);
                 if (err < 0) {
-                        skb_queue_head(BUSY_QUEUE(sk), skb);
+                        skb_queue_head(&chan->busy_q, skb);
                         return -EBUSY;
                 }
 
-                pi->buffer_seq = (pi->buffer_seq + 1) % 64;
+                chan->buffer_seq = (chan->buffer_seq + 1) % 64;
         }
 
-        if (!(pi->conn_state & L2CAP_CONN_RNR_SENT))
+        if (!(chan->conn_state & L2CAP_CONN_RNR_SENT))
                 goto done;
 
-        control = pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+        control = chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
         control |= L2CAP_SUPER_RCV_READY | L2CAP_CTRL_POLL;
-        l2cap_send_sframe(pi, control);
-        l2cap_pi(sk)->retry_count = 1;
+        l2cap_send_sframe(chan, control);
+        chan->retry_count = 1;
 
-        del_timer(&pi->retrans_timer);
+        del_timer(&chan->retrans_timer);
         __mod_monitor_timer();
 
-        l2cap_pi(sk)->conn_state |= L2CAP_CONN_WAIT_F;
+        chan->conn_state |= L2CAP_CONN_WAIT_F;
 
 done:
-        pi->conn_state &= ~L2CAP_CONN_LOCAL_BUSY;
-        pi->conn_state &= ~L2CAP_CONN_RNR_SENT;
+        chan->conn_state &= ~L2CAP_CONN_LOCAL_BUSY;
+        chan->conn_state &= ~L2CAP_CONN_RNR_SENT;
 
-        BT_DBG("sk %p, Exit local busy", sk);
+        BT_DBG("chan %p, Exit local busy", chan);
 
         return 0;
 }
@@ -2924,21 +2996,21 @@ done:
 static void l2cap_busy_work(struct work_struct *work)
 {
         DECLARE_WAITQUEUE(wait, current);
-        struct l2cap_pinfo *pi =
-                container_of(work, struct l2cap_pinfo, busy_work);
-        struct sock *sk = (struct sock *)pi;
+        struct l2cap_chan *chan =
+                container_of(work, struct l2cap_chan, busy_work);
+        struct sock *sk = chan->sk;
         int n_tries = 0, timeo = HZ/5, err;
         struct sk_buff *skb;
 
         lock_sock(sk);
 
         add_wait_queue(sk_sleep(sk), &wait);
-        while ((skb = skb_peek(BUSY_QUEUE(sk)))) {
+        while ((skb = skb_peek(&chan->busy_q))) {
                 set_current_state(TASK_INTERRUPTIBLE);
 
                 if (n_tries++ > L2CAP_LOCAL_BUSY_TRIES) {
                         err = -EBUSY;
-                        l2cap_send_disconn_req(pi->conn, sk, EBUSY);
+                        l2cap_send_disconn_req(chan->conn, chan, EBUSY);
                         break;
                 }
 
@@ -2958,7 +3030,7 @@ static void l2cap_busy_work(struct work_struct *work)
                 if (err)
                         break;
 
-                if (l2cap_try_push_rx_skb(sk) == 0)
+                if (l2cap_try_push_rx_skb(chan) == 0)
                         break;
         }
 
@@ -2968,48 +3040,46 @@ static void l2cap_busy_work(struct work_struct *work)
         release_sock(sk);
 }
 
-static int l2cap_push_rx_skb(struct sock *sk, struct sk_buff *skb, u16 control)
+static int l2cap_push_rx_skb(struct l2cap_chan *chan, struct sk_buff *skb, u16 control)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         int sctrl, err;
 
-        if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
+        if (chan->conn_state & L2CAP_CONN_LOCAL_BUSY) {
                 bt_cb(skb)->sar = control >> L2CAP_CTRL_SAR_SHIFT;
-                __skb_queue_tail(BUSY_QUEUE(sk), skb);
-                return l2cap_try_push_rx_skb(sk);
+                __skb_queue_tail(&chan->busy_q, skb);
+                return l2cap_try_push_rx_skb(chan);
 
 
         }
 
-        err = l2cap_ertm_reassembly_sdu(sk, skb, control);
+        err = l2cap_ertm_reassembly_sdu(chan, skb, control);
         if (err >= 0) {
-                pi->buffer_seq = (pi->buffer_seq + 1) % 64;
+                chan->buffer_seq = (chan->buffer_seq + 1) % 64;
                 return err;
         }
 
         /* Busy Condition */
-        BT_DBG("sk %p, Enter local busy", sk);
+        BT_DBG("chan %p, Enter local busy", chan);
 
-        pi->conn_state |= L2CAP_CONN_LOCAL_BUSY;
+        chan->conn_state |= L2CAP_CONN_LOCAL_BUSY;
         bt_cb(skb)->sar = control >> L2CAP_CTRL_SAR_SHIFT;
-        __skb_queue_tail(BUSY_QUEUE(sk), skb);
+        __skb_queue_tail(&chan->busy_q, skb);
 
-        sctrl = pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+        sctrl = chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
         sctrl |= L2CAP_SUPER_RCV_NOT_READY;
-        l2cap_send_sframe(pi, sctrl);
+        l2cap_send_sframe(chan, sctrl);
 
-        pi->conn_state |= L2CAP_CONN_RNR_SENT;
+        chan->conn_state |= L2CAP_CONN_RNR_SENT;
 
-        del_timer(&pi->ack_timer);
+        del_timer(&chan->ack_timer);
 
-        queue_work(_busy_wq, &pi->busy_work);
+        queue_work(_busy_wq, &chan->busy_work);
 
         return err;
 }
 
-static int l2cap_streaming_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 control)
+static int l2cap_streaming_reassembly_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u16 control)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         struct sk_buff *_skb;
         int err = -EINVAL;
 
@@ -3020,80 +3090,80 @@ static int l2cap_streaming_reassembly_sdu(struct sock *sk, struct sk_buff *skb,
 
         switch (control & L2CAP_CTRL_SAR) {
         case L2CAP_SDU_UNSEGMENTED:
-                if (pi->conn_state & L2CAP_CONN_SAR_SDU) {
-                        kfree_skb(pi->sdu);
+                if (chan->conn_state & L2CAP_CONN_SAR_SDU) {
+                        kfree_skb(chan->sdu);
                         break;
                 }
 
-                err = sock_queue_rcv_skb(sk, skb);
+                err = sock_queue_rcv_skb(chan->sk, skb);
                 if (!err)
                         return 0;
 
                 break;
 
         case L2CAP_SDU_START:
-                if (pi->conn_state & L2CAP_CONN_SAR_SDU) {
-                        kfree_skb(pi->sdu);
+                if (chan->conn_state & L2CAP_CONN_SAR_SDU) {
+                        kfree_skb(chan->sdu);
                         break;
                 }
 
-                pi->sdu_len = get_unaligned_le16(skb->data);
+                chan->sdu_len = get_unaligned_le16(skb->data);
                 skb_pull(skb, 2);
 
-                if (pi->sdu_len > pi->imtu) {
+                if (chan->sdu_len > chan->imtu) {
                         err = -EMSGSIZE;
                         break;
                 }
 
-                pi->sdu = bt_skb_alloc(pi->sdu_len, GFP_ATOMIC);
-                if (!pi->sdu) {
+                chan->sdu = bt_skb_alloc(chan->sdu_len, GFP_ATOMIC);
+                if (!chan->sdu) {
                         err = -ENOMEM;
                         break;
                 }
 
-                memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
+                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
 
-                pi->conn_state |= L2CAP_CONN_SAR_SDU;
-                pi->partial_sdu_len = skb->len;
+                chan->conn_state |= L2CAP_CONN_SAR_SDU;
+                chan->partial_sdu_len = skb->len;
                 err = 0;
                 break;
 
         case L2CAP_SDU_CONTINUE:
-                if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
+                if (!(chan->conn_state & L2CAP_CONN_SAR_SDU))
                         break;
 
-                memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
+                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
 
-                pi->partial_sdu_len += skb->len;
-                if (pi->partial_sdu_len > pi->sdu_len)
-                        kfree_skb(pi->sdu);
+                chan->partial_sdu_len += skb->len;
+                if (chan->partial_sdu_len > chan->sdu_len)
+                        kfree_skb(chan->sdu);
                 else
                         err = 0;
 
                 break;
 
         case L2CAP_SDU_END:
-                if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
+                if (!(chan->conn_state & L2CAP_CONN_SAR_SDU))
                         break;
 
-                memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
+                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
 
-                pi->conn_state &= ~L2CAP_CONN_SAR_SDU;
-                pi->partial_sdu_len += skb->len;
+                chan->conn_state &= ~L2CAP_CONN_SAR_SDU;
+                chan->partial_sdu_len += skb->len;
 
-                if (pi->partial_sdu_len > pi->imtu)
+                if (chan->partial_sdu_len > chan->imtu)
                         goto drop;
 
-                if (pi->partial_sdu_len == pi->sdu_len) {
-                        _skb = skb_clone(pi->sdu, GFP_ATOMIC);
-                        err = sock_queue_rcv_skb(sk, _skb);
+                if (chan->partial_sdu_len == chan->sdu_len) {
+                        _skb = skb_clone(chan->sdu, GFP_ATOMIC);
+                        err = sock_queue_rcv_skb(chan->sk, _skb);
                         if (err < 0)
                                 kfree_skb(_skb);
                 }
                 err = 0;
 
 drop:
-                kfree_skb(pi->sdu);
+                kfree_skb(chan->sdu);
                 break;
         }
 
@@ -3101,31 +3171,30 @@ drop:
         return err;
 }
 
-static void l2cap_check_srej_gap(struct sock *sk, u8 tx_seq)
+static void l2cap_check_srej_gap(struct l2cap_chan *chan, u8 tx_seq)
 {
         struct sk_buff *skb;
         u16 control;
 
-        while ((skb = skb_peek(SREJ_QUEUE(sk)))) {
+        while ((skb = skb_peek(&chan->srej_q))) {
                 if (bt_cb(skb)->tx_seq != tx_seq)
                         break;
 
-                skb = skb_dequeue(SREJ_QUEUE(sk));
+                skb = skb_dequeue(&chan->srej_q);
                 control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
-                l2cap_ertm_reassembly_sdu(sk, skb, control);
-                l2cap_pi(sk)->buffer_seq_srej =
-                        (l2cap_pi(sk)->buffer_seq_srej + 1) % 64;
+                l2cap_ertm_reassembly_sdu(chan, skb, control);
+                chan->buffer_seq_srej =
+                        (chan->buffer_seq_srej + 1) % 64;
                 tx_seq = (tx_seq + 1) % 64;
         }
 }
 
-static void l2cap_resend_srejframe(struct sock *sk, u8 tx_seq)
+static void l2cap_resend_srejframe(struct l2cap_chan *chan, u8 tx_seq)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         struct srej_list *l, *tmp;
         u16 control;
 
-        list_for_each_entry_safe(l, tmp, SREJ_LIST(sk), list) {
+        list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
                 if (l->tx_seq == tx_seq) {
                         list_del(&l->list);
                         kfree(l);
@@ -3133,107 +3202,105 @@ static void l2cap_resend_srejframe(struct sock *sk, u8 tx_seq)
                 }
                 control = L2CAP_SUPER_SELECT_REJECT;
                 control |= l->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
-                l2cap_send_sframe(pi, control);
+                l2cap_send_sframe(chan, control);
                 list_del(&l->list);
-                list_add_tail(&l->list, SREJ_LIST(sk));
+                list_add_tail(&l->list, &chan->srej_l);
         }
 }
 
-static void l2cap_send_srejframe(struct sock *sk, u8 tx_seq)
+static void l2cap_send_srejframe(struct l2cap_chan *chan, u8 tx_seq)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         struct srej_list *new;
         u16 control;
 
-        while (tx_seq != pi->expected_tx_seq) {
+        while (tx_seq != chan->expected_tx_seq) {
                 control = L2CAP_SUPER_SELECT_REJECT;
-                control |= pi->expected_tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
-                l2cap_send_sframe(pi, control);
+                control |= chan->expected_tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+                l2cap_send_sframe(chan, control);
 
                 new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
-                new->tx_seq = pi->expected_tx_seq;
-                pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
-                list_add_tail(&new->list, SREJ_LIST(sk));
+                new->tx_seq = chan->expected_tx_seq;
+                chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64;
+                list_add_tail(&new->list, &chan->srej_l);
         }
-        pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
+        chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64;
 }
 
-static inline int l2cap_data_channel_iframe(struct sock *sk, u16 rx_control, struct sk_buff *skb)
+static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u16 rx_control, struct sk_buff *skb)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         u8 tx_seq = __get_txseq(rx_control);
         u8 req_seq = __get_reqseq(rx_control);
         u8 sar = rx_control >> L2CAP_CTRL_SAR_SHIFT;
         int tx_seq_offset, expected_tx_seq_offset;
-        int num_to_ack = (pi->tx_win/6) + 1;
+        int num_to_ack = (chan->tx_win/6) + 1;
         int err = 0;
 
-        BT_DBG("sk %p len %d tx_seq %d rx_control 0x%4.4x", sk, skb->len, tx_seq,
-                                                                rx_control);
+        BT_DBG("chan %p len %d tx_seq %d rx_control 0x%4.4x", chan, skb->len,
+                                                        tx_seq, rx_control);
 
         if (L2CAP_CTRL_FINAL & rx_control &&
-                        l2cap_pi(sk)->conn_state & L2CAP_CONN_WAIT_F) {
-                del_timer(&pi->monitor_timer);
-                if (pi->unacked_frames > 0)
+                        chan->conn_state & L2CAP_CONN_WAIT_F) {
+                del_timer(&chan->monitor_timer);
+                if (chan->unacked_frames > 0)
                         __mod_retrans_timer();
-                pi->conn_state &= ~L2CAP_CONN_WAIT_F;
+                chan->conn_state &= ~L2CAP_CONN_WAIT_F;
         }
 
-        pi->expected_ack_seq = req_seq;
-        l2cap_drop_acked_frames(sk);
+        chan->expected_ack_seq = req_seq;
+        l2cap_drop_acked_frames(chan);
 
-        if (tx_seq == pi->expected_tx_seq)
+        if (tx_seq == chan->expected_tx_seq)
                 goto expected;
 
-        tx_seq_offset = (tx_seq - pi->buffer_seq) % 64;
+        tx_seq_offset = (tx_seq - chan->buffer_seq) % 64;
         if (tx_seq_offset < 0)
                 tx_seq_offset += 64;
 
         /* invalid tx_seq */
-        if (tx_seq_offset >= pi->tx_win) {
-                l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
+        if (tx_seq_offset >= chan->tx_win) {
+                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
                 goto drop;
         }
 
-        if (pi->conn_state == L2CAP_CONN_LOCAL_BUSY)
+        if (chan->conn_state == L2CAP_CONN_LOCAL_BUSY)
                 goto drop;
 
-        if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
+        if (chan->conn_state & L2CAP_CONN_SREJ_SENT) {
                 struct srej_list *first;
 
-                first = list_first_entry(SREJ_LIST(sk),
+                first = list_first_entry(&chan->srej_l,
                                 struct srej_list, list);
                 if (tx_seq == first->tx_seq) {
-                        l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
-                        l2cap_check_srej_gap(sk, tx_seq);
+                        l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
+                        l2cap_check_srej_gap(chan, tx_seq);
 
                         list_del(&first->list);
                         kfree(first);
 
-                        if (list_empty(SREJ_LIST(sk))) {
-                                pi->buffer_seq = pi->buffer_seq_srej;
-                                pi->conn_state &= ~L2CAP_CONN_SREJ_SENT;
-                                l2cap_send_ack(pi);
-                                BT_DBG("sk %p, Exit SREJ_SENT", sk);
+                        if (list_empty(&chan->srej_l)) {
+                                chan->buffer_seq = chan->buffer_seq_srej;
+                                chan->conn_state &= ~L2CAP_CONN_SREJ_SENT;
+                                l2cap_send_ack(chan);
+                                BT_DBG("chan %p, Exit SREJ_SENT", chan);
                         }
                 } else {
                         struct srej_list *l;
 
                         /* duplicated tx_seq */
-                        if (l2cap_add_to_srej_queue(sk, skb, tx_seq, sar) < 0)
+                        if (l2cap_add_to_srej_queue(chan, skb, tx_seq, sar) < 0)
                                 goto drop;
 
-                        list_for_each_entry(l, SREJ_LIST(sk), list) {
+                        list_for_each_entry(l, &chan->srej_l, list) {
                                 if (l->tx_seq == tx_seq) {
-                                        l2cap_resend_srejframe(sk, tx_seq);
+                                        l2cap_resend_srejframe(chan, tx_seq);
                                         return 0;
                                 }
                         }
-                        l2cap_send_srejframe(sk, tx_seq);
+                        l2cap_send_srejframe(chan, tx_seq);
                 }
         } else {
                 expected_tx_seq_offset =
-                        (pi->expected_tx_seq - pi->buffer_seq) % 64;
+                        (chan->expected_tx_seq - chan->buffer_seq) % 64;
                 if (expected_tx_seq_offset < 0)
                         expected_tx_seq_offset += 64;
 
@@ -3241,51 +3308,51 @@ static inline int l2cap_data_channel_iframe(struct sock *sk, u16 rx_control, str
                 if (tx_seq_offset < expected_tx_seq_offset)
                         goto drop;
 
-                pi->conn_state |= L2CAP_CONN_SREJ_SENT;
+                chan->conn_state |= L2CAP_CONN_SREJ_SENT;
 
-                BT_DBG("sk %p, Enter SREJ", sk);
+                BT_DBG("chan %p, Enter SREJ", chan);
 
-                INIT_LIST_HEAD(SREJ_LIST(sk));
-                pi->buffer_seq_srej = pi->buffer_seq;
+                INIT_LIST_HEAD(&chan->srej_l);
+                chan->buffer_seq_srej = chan->buffer_seq;
 
-                __skb_queue_head_init(SREJ_QUEUE(sk));
-                __skb_queue_head_init(BUSY_QUEUE(sk));
-                l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
+                __skb_queue_head_init(&chan->srej_q);
+                __skb_queue_head_init(&chan->busy_q);
+                l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
 
-                pi->conn_state |= L2CAP_CONN_SEND_PBIT;
+                chan->conn_state |= L2CAP_CONN_SEND_PBIT;
 
-                l2cap_send_srejframe(sk, tx_seq);
+                l2cap_send_srejframe(chan, tx_seq);
 
-                del_timer(&pi->ack_timer);
+                del_timer(&chan->ack_timer);
         }
         return 0;
 
 expected:
-        pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
+        chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64;
 
-        if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
+        if (chan->conn_state & L2CAP_CONN_SREJ_SENT) {
                 bt_cb(skb)->tx_seq = tx_seq;
                 bt_cb(skb)->sar = sar;
-                __skb_queue_tail(SREJ_QUEUE(sk), skb);
+                __skb_queue_tail(&chan->srej_q, skb);
                 return 0;
         }
 
-        err = l2cap_push_rx_skb(sk, skb, rx_control);
+        err = l2cap_push_rx_skb(chan, skb, rx_control);
         if (err < 0)
                 return 0;
 
         if (rx_control & L2CAP_CTRL_FINAL) {
-                if (pi->conn_state & L2CAP_CONN_REJ_ACT)
-                        pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
+                if (chan->conn_state & L2CAP_CONN_REJ_ACT)
+                        chan->conn_state &= ~L2CAP_CONN_REJ_ACT;
                 else
-                        l2cap_retransmit_frames(sk);
+                        l2cap_retransmit_frames(chan);
         }
 
         __mod_ack_timer();
 
-        pi->num_acked = (pi->num_acked + 1) % num_to_ack;
-        if (pi->num_acked == num_to_ack - 1)
-                l2cap_send_ack(pi);
+        chan->num_acked = (chan->num_acked + 1) % num_to_ack;
+        if (chan->num_acked == num_to_ack - 1)
+                l2cap_send_ack(chan);
 
         return 0;
 
@@ -3294,165 +3361,160 @@ drop:
         return 0;
 }
 
-static inline void l2cap_data_channel_rrframe(struct sock *sk, u16 rx_control)
+static inline void l2cap_data_channel_rrframe(struct l2cap_chan *chan, u16 rx_control)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-
-        BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, __get_reqseq(rx_control),
+        BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, __get_reqseq(rx_control),
                                                 rx_control);
 
-        pi->expected_ack_seq = __get_reqseq(rx_control);
-        l2cap_drop_acked_frames(sk);
+        chan->expected_ack_seq = __get_reqseq(rx_control);
+        l2cap_drop_acked_frames(chan);
 
         if (rx_control & L2CAP_CTRL_POLL) {
-                pi->conn_state |= L2CAP_CONN_SEND_FBIT;
-                if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
-                        if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
-                                        (pi->unacked_frames > 0))
+                chan->conn_state |= L2CAP_CONN_SEND_FBIT;
+                if (chan->conn_state & L2CAP_CONN_SREJ_SENT) {
+                        if ((chan->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                                        (chan->unacked_frames > 0))
                                 __mod_retrans_timer();
 
-                        pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
-                        l2cap_send_srejtail(sk);
+                        chan->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+                        l2cap_send_srejtail(chan);
                 } else {
-                        l2cap_send_i_or_rr_or_rnr(sk);
+                        l2cap_send_i_or_rr_or_rnr(chan);
                 }
 
         } else if (rx_control & L2CAP_CTRL_FINAL) {
-                pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+                chan->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
 
-                if (pi->conn_state & L2CAP_CONN_REJ_ACT)
-                        pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
+                if (chan->conn_state & L2CAP_CONN_REJ_ACT)
+                        chan->conn_state &= ~L2CAP_CONN_REJ_ACT;
                 else
-                        l2cap_retransmit_frames(sk);
+                        l2cap_retransmit_frames(chan);
 
         } else {
-                if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
-                                (pi->unacked_frames > 0))
+                if ((chan->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                                (chan->unacked_frames > 0))
                         __mod_retrans_timer();
 
-                pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
-                if (pi->conn_state & L2CAP_CONN_SREJ_SENT)
-                        l2cap_send_ack(pi);
+                chan->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+                if (chan->conn_state & L2CAP_CONN_SREJ_SENT)
+                        l2cap_send_ack(chan);
                 else
-                        l2cap_ertm_send(sk);
+                        l2cap_ertm_send(chan);
         }
 }
 
-static inline void l2cap_data_channel_rejframe(struct sock *sk, u16 rx_control)
+static inline void l2cap_data_channel_rejframe(struct l2cap_chan *chan, u16 rx_control)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         u8 tx_seq = __get_reqseq(rx_control);
 
-        BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, tx_seq, rx_control);
+        BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, tx_seq, rx_control);
 
-        pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+        chan->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
 
-        pi->expected_ack_seq = tx_seq;
-        l2cap_drop_acked_frames(sk);
+        chan->expected_ack_seq = tx_seq;
+        l2cap_drop_acked_frames(chan);
 
         if (rx_control & L2CAP_CTRL_FINAL) {
-                if (pi->conn_state & L2CAP_CONN_REJ_ACT)
-                        pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
+                if (chan->conn_state & L2CAP_CONN_REJ_ACT)
+                        chan->conn_state &= ~L2CAP_CONN_REJ_ACT;
                 else
-                        l2cap_retransmit_frames(sk);
+                        l2cap_retransmit_frames(chan);
         } else {
-                l2cap_retransmit_frames(sk);
+                l2cap_retransmit_frames(chan);
 
-                if (pi->conn_state & L2CAP_CONN_WAIT_F)
-                        pi->conn_state |= L2CAP_CONN_REJ_ACT;
+                if (chan->conn_state & L2CAP_CONN_WAIT_F)
+                        chan->conn_state |= L2CAP_CONN_REJ_ACT;
         }
 }
-static inline void l2cap_data_channel_srejframe(struct sock *sk, u16 rx_control)
+static inline void l2cap_data_channel_srejframe(struct l2cap_chan *chan, u16 rx_control)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         u8 tx_seq = __get_reqseq(rx_control);
 
-        BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, tx_seq, rx_control);
+        BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, tx_seq, rx_control);
 
-        pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+        chan->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
 
         if (rx_control & L2CAP_CTRL_POLL) {
-                pi->expected_ack_seq = tx_seq;
-                l2cap_drop_acked_frames(sk);
+                chan->expected_ack_seq = tx_seq;
+                l2cap_drop_acked_frames(chan);
 
-                pi->conn_state |= L2CAP_CONN_SEND_FBIT;
-                l2cap_retransmit_one_frame(sk, tx_seq);
+                chan->conn_state |= L2CAP_CONN_SEND_FBIT;
+                l2cap_retransmit_one_frame(chan, tx_seq);
 
-                l2cap_ertm_send(sk);
+                l2cap_ertm_send(chan);
 
-                if (pi->conn_state & L2CAP_CONN_WAIT_F) {
-                        pi->srej_save_reqseq = tx_seq;
-                        pi->conn_state |= L2CAP_CONN_SREJ_ACT;
+                if (chan->conn_state & L2CAP_CONN_WAIT_F) {
+                        chan->srej_save_reqseq = tx_seq;
+                        chan->conn_state |= L2CAP_CONN_SREJ_ACT;
                 }
         } else if (rx_control & L2CAP_CTRL_FINAL) {
-                if ((pi->conn_state & L2CAP_CONN_SREJ_ACT) &&
-                                pi->srej_save_reqseq == tx_seq)
-                        pi->conn_state &= ~L2CAP_CONN_SREJ_ACT;
+                if ((chan->conn_state & L2CAP_CONN_SREJ_ACT) &&
+                                chan->srej_save_reqseq == tx_seq)
+                        chan->conn_state &= ~L2CAP_CONN_SREJ_ACT;
                 else
-                        l2cap_retransmit_one_frame(sk, tx_seq);
+                        l2cap_retransmit_one_frame(chan, tx_seq);
         } else {
-                l2cap_retransmit_one_frame(sk, tx_seq);
-                if (pi->conn_state & L2CAP_CONN_WAIT_F) {
-                        pi->srej_save_reqseq = tx_seq;
-                        pi->conn_state |= L2CAP_CONN_SREJ_ACT;
+                l2cap_retransmit_one_frame(chan, tx_seq);
+                if (chan->conn_state & L2CAP_CONN_WAIT_F) {
+                        chan->srej_save_reqseq = tx_seq;
+                        chan->conn_state |= L2CAP_CONN_SREJ_ACT;
                 }
         }
 }
 
-static inline void l2cap_data_channel_rnrframe(struct sock *sk, u16 rx_control)
+static inline void l2cap_data_channel_rnrframe(struct l2cap_chan *chan, u16 rx_control)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
         u8 tx_seq = __get_reqseq(rx_control);
 
-        BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, tx_seq, rx_control);
+        BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, tx_seq, rx_control);
 
-        pi->conn_state |= L2CAP_CONN_REMOTE_BUSY;
-        pi->expected_ack_seq = tx_seq;
-        l2cap_drop_acked_frames(sk);
+        chan->conn_state |= L2CAP_CONN_REMOTE_BUSY;
+        chan->expected_ack_seq = tx_seq;
+        l2cap_drop_acked_frames(chan);
 
         if (rx_control & L2CAP_CTRL_POLL)
-                pi->conn_state |= L2CAP_CONN_SEND_FBIT;
+                chan->conn_state |= L2CAP_CONN_SEND_FBIT;
 
-        if (!(pi->conn_state & L2CAP_CONN_SREJ_SENT)) {
-                del_timer(&pi->retrans_timer);
+        if (!(chan->conn_state & L2CAP_CONN_SREJ_SENT)) {
+                del_timer(&chan->retrans_timer);
                 if (rx_control & L2CAP_CTRL_POLL)
-                        l2cap_send_rr_or_rnr(pi, L2CAP_CTRL_FINAL);
+                        l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_FINAL);
                 return;
         }
 
         if (rx_control & L2CAP_CTRL_POLL)
-                l2cap_send_srejtail(sk);
+                l2cap_send_srejtail(chan);
         else
-                l2cap_send_sframe(pi, L2CAP_SUPER_RCV_READY);
+                l2cap_send_sframe(chan, L2CAP_SUPER_RCV_READY);
 }
 
-static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, struct sk_buff *skb)
+static inline int l2cap_data_channel_sframe(struct l2cap_chan *chan, u16 rx_control, struct sk_buff *skb)
 {
-        BT_DBG("sk %p rx_control 0x%4.4x len %d", sk, rx_control, skb->len);
+        BT_DBG("chan %p rx_control 0x%4.4x len %d", chan, rx_control, skb->len);
 
         if (L2CAP_CTRL_FINAL & rx_control &&
-                        l2cap_pi(sk)->conn_state & L2CAP_CONN_WAIT_F) {
-                del_timer(&l2cap_pi(sk)->monitor_timer);
-                if (l2cap_pi(sk)->unacked_frames > 0)
+                        chan->conn_state & L2CAP_CONN_WAIT_F) {
+                del_timer(&chan->monitor_timer);
+                if (chan->unacked_frames > 0)
                         __mod_retrans_timer();
-                l2cap_pi(sk)->conn_state &= ~L2CAP_CONN_WAIT_F;
+                chan->conn_state &= ~L2CAP_CONN_WAIT_F;
         }
 
         switch (rx_control & L2CAP_CTRL_SUPERVISE) {
         case L2CAP_SUPER_RCV_READY:
-                l2cap_data_channel_rrframe(sk, rx_control);
+                l2cap_data_channel_rrframe(chan, rx_control);
                 break;
 
         case L2CAP_SUPER_REJECT:
-                l2cap_data_channel_rejframe(sk, rx_control);
+                l2cap_data_channel_rejframe(chan, rx_control);
                 break;
 
         case L2CAP_SUPER_SELECT_REJECT:
-                l2cap_data_channel_srejframe(sk, rx_control);
+                l2cap_data_channel_srejframe(chan, rx_control);
                 break;
 
         case L2CAP_SUPER_RCV_NOT_READY:
-                l2cap_data_channel_rnrframe(sk, rx_control);
+                l2cap_data_channel_rnrframe(chan, rx_control);
                 break;
         }
 
@@ -3462,7 +3524,7 @@ static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, str
 
 static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb)
 {
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         u16 control;
         u8 req_seq;
         int len, next_tx_seq_offset, req_seq_offset;
@@ -3476,51 +3538,51 @@ static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb)
          * Receiver will miss it and start proper recovery
          * procedures and ask retransmission.
          */
-        if (l2cap_check_fcs(pi, skb))
+        if (l2cap_check_fcs(chan, skb))
                 goto drop;
 
         if (__is_sar_start(control) && __is_iframe(control))
                 len -= 2;
 
-        if (pi->fcs == L2CAP_FCS_CRC16)
+        if (chan->fcs == L2CAP_FCS_CRC16)
                 len -= 2;
 
-        if (len > pi->mps) {
-                l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
+        if (len > chan->mps) {
+                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
                 goto drop;
         }
 
         req_seq = __get_reqseq(control);
-        req_seq_offset = (req_seq - pi->expected_ack_seq) % 64;
+        req_seq_offset = (req_seq - chan->expected_ack_seq) % 64;
         if (req_seq_offset < 0)
                 req_seq_offset += 64;
 
         next_tx_seq_offset =
-                (pi->next_tx_seq - pi->expected_ack_seq) % 64;
+                (chan->next_tx_seq - chan->expected_ack_seq) % 64;
         if (next_tx_seq_offset < 0)
                 next_tx_seq_offset += 64;
 
         /* check for invalid req-seq */
         if (req_seq_offset > next_tx_seq_offset) {
-                l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
+                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
                 goto drop;
         }
 
         if (__is_iframe(control)) {
                 if (len < 0) {
-                        l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
+                        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
                         goto drop;
                 }
 
-                l2cap_data_channel_iframe(sk, control, skb);
+                l2cap_data_channel_iframe(chan, control, skb);
         } else {
                 if (len != 0) {
                         BT_ERR("%d", len);
-                        l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
+                        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
                         goto drop;
                 }
 
-                l2cap_data_channel_sframe(sk, control, skb);
+                l2cap_data_channel_sframe(chan, control, skb);
         }
 
         return 0;
@@ -3532,33 +3594,35 @@ drop:
 
 static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
 {
-        struct sock *sk;
+        struct l2cap_chan *chan;
+        struct sock *sk = NULL;
         struct l2cap_pinfo *pi;
         u16 control;
         u8 tx_seq;
         int len;
 
-        sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
-        if (!sk) {
+        chan = l2cap_get_chan_by_scid(conn, cid);
+        if (!chan) {
                 BT_DBG("unknown cid 0x%4.4x", cid);
                 goto drop;
         }
 
+        sk = chan->sk;
         pi = l2cap_pi(sk);
 
-        BT_DBG("sk %p, len %d", sk, skb->len);
+        BT_DBG("chan %p, len %d", chan, skb->len);
 
         if (sk->sk_state != BT_CONNECTED)
                 goto drop;
 
-        switch (pi->mode) {
+        switch (chan->mode) {
         case L2CAP_MODE_BASIC:
                 /* If socket recv buffers overflows we drop data here
                  * which is *bad* because L2CAP has to be reliable.
                  * But we don't have any other choice. L2CAP doesn't
                  * provide flow control mechanism. */
 
-                if (pi->imtu < skb->len)
+                if (chan->imtu < skb->len)
                         goto drop;
 
                 if (!sock_queue_rcv_skb(sk, skb))
@@ -3580,31 +3644,31 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                 skb_pull(skb, 2);
                 len = skb->len;
 
-                if (l2cap_check_fcs(pi, skb))
+                if (l2cap_check_fcs(chan, skb))
                         goto drop;
 
                 if (__is_sar_start(control))
                         len -= 2;
 
-                if (pi->fcs == L2CAP_FCS_CRC16)
+                if (chan->fcs == L2CAP_FCS_CRC16)
                         len -= 2;
 
-                if (len > pi->mps || len < 0 || __is_sframe(control))
+                if (len > chan->mps || len < 0 || __is_sframe(control))
                         goto drop;
 
                 tx_seq = __get_txseq(control);
 
-                if (pi->expected_tx_seq == tx_seq)
-                        pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
+                if (chan->expected_tx_seq == tx_seq)
+                        chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64;
                 else
-                        pi->expected_tx_seq = (tx_seq + 1) % 64;
+                        chan->expected_tx_seq = (tx_seq + 1) % 64;
 
-                l2cap_streaming_reassembly_sdu(sk, skb, control);
+                l2cap_streaming_reassembly_sdu(chan, skb, control);
 
                 goto done;
 
         default:
-                BT_DBG("sk %p: bad mode 0x%2.2x", sk, pi->mode);
+                BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
                 break;
         }
 
@@ -3633,7 +3697,37 @@ static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, str
         if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
                 goto drop;
 
-        if (l2cap_pi(sk)->imtu < skb->len)
+        if (l2cap_pi(sk)->chan->imtu < skb->len)
+                goto drop;
+
+        if (!sock_queue_rcv_skb(sk, skb))
+                goto done;
+
+drop:
+        kfree_skb(skb);
+
+done:
+        if (sk)
+                bh_unlock_sock(sk);
+        return 0;
+}
+
+static inline int l2cap_att_channel(struct l2cap_conn *conn, __le16 cid, struct sk_buff *skb)
+{
+        struct sock *sk;
+
+        sk = l2cap_get_sock_by_scid(0, cid, conn->src);
+        if (!sk)
+                goto drop;
+
+        bh_lock_sock(sk);
+
+        BT_DBG("sk %p, len %d", sk, skb->len);
+
+        if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
+                goto drop;
+
+        if (l2cap_pi(sk)->chan->imtu < skb->len)
                 goto drop;
 
         if (!sock_queue_rcv_skb(sk, skb))
@@ -3677,6 +3771,10 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
                 l2cap_conless_channel(conn, psm, skb);
                 break;
 
+        case L2CAP_CID_LE_DATA:
+                l2cap_att_channel(conn, cid, skb);
+                break;
+
         default:
                 l2cap_data_channel(conn, cid, skb);
                 break;
@@ -3699,17 +3797,19 @@ static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
         /* Find listening sockets and check their link_mode */
         read_lock(&l2cap_sk_list.lock);
         sk_for_each(sk, node, &l2cap_sk_list.head) {
+                struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+
                 if (sk->sk_state != BT_LISTEN)
                         continue;
 
                 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
                         lm1 |= HCI_LM_ACCEPT;
-                        if (l2cap_pi(sk)->role_switch)
+                        if (chan->role_switch)
                                 lm1 |= HCI_LM_MASTER;
                         exact++;
                 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
                         lm2 |= HCI_LM_ACCEPT;
-                        if (l2cap_pi(sk)->role_switch)
+                        if (chan->role_switch)
                                 lm2 |= HCI_LM_MASTER;
                 }
         }
@@ -3761,49 +3861,50 @@ static int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
         return 0;
 }
 
-static inline void l2cap_check_encryption(struct sock *sk, u8 encrypt)
+static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
 {
+        struct sock *sk = chan->sk;
+
         if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM)
                 return;
 
         if (encrypt == 0x00) {
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM) {
+                if (chan->sec_level == BT_SECURITY_MEDIUM) {
                         l2cap_sock_clear_timer(sk);
                         l2cap_sock_set_timer(sk, HZ * 5);
-                } else if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
+                } else if (chan->sec_level == BT_SECURITY_HIGH)
                         __l2cap_sock_close(sk, ECONNREFUSED);
         } else {
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM)
+                if (chan->sec_level == BT_SECURITY_MEDIUM)
                         l2cap_sock_clear_timer(sk);
         }
 }
 
 static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
 {
-        struct l2cap_chan_list *l;
         struct l2cap_conn *conn = hcon->l2cap_data;
-        struct sock *sk;
+        struct l2cap_chan *chan;
 
         if (!conn)
                 return 0;
 
-        l = &conn->chan_list;
-
         BT_DBG("conn %p", conn);
 
-        read_lock(&l->lock);
+        read_lock(&conn->chan_lock);
+
+        list_for_each_entry(chan, &conn->chan_l, list) {
+                struct sock *sk = chan->sk;
 
-        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
                 bh_lock_sock(sk);
 
-                if (l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND) {
+                if (chan->conf_state & L2CAP_CONF_CONNECT_PEND) {
                         bh_unlock_sock(sk);
                         continue;
                 }
 
                 if (!status && (sk->sk_state == BT_CONNECTED ||
                                                 sk->sk_state == BT_CONFIG)) {
-                        l2cap_check_encryption(sk, encrypt);
+                        l2cap_check_encryption(chan, encrypt);
                         bh_unlock_sock(sk);
                         continue;
                 }
@@ -3811,13 +3912,13 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                 if (sk->sk_state == BT_CONNECT) {
                         if (!status) {
                                 struct l2cap_conn_req req;
-                                req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
-                                req.psm  = l2cap_pi(sk)->psm;
+                                req.scid = cpu_to_le16(chan->scid);
+                                req.psm  = chan->psm;
 
-                                l2cap_pi(sk)->ident = l2cap_get_ident(conn);
-                                l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
+                                chan->ident = l2cap_get_ident(conn);
+                                chan->conf_state |= L2CAP_CONF_CONNECT_PEND;
 
-                                l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
+                                l2cap_send_cmd(conn, chan->ident,
                                         L2CAP_CONN_REQ, sizeof(req), &req);
                         } else {
                                 l2cap_sock_clear_timer(sk);
@@ -3836,18 +3937,18 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                 result = L2CAP_CR_SEC_BLOCK;
                         }
 
-                        rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
-                        rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
+                        rsp.scid   = cpu_to_le16(chan->dcid);
+                        rsp.dcid   = cpu_to_le16(chan->scid);
                         rsp.result = cpu_to_le16(result);
                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
-                        l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
-                                        L2CAP_CONN_RSP, sizeof(rsp), &rsp);
+                        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
+                                                        sizeof(rsp), &rsp);
                 }
 
                 bh_unlock_sock(sk);
         }
 
-        read_unlock(&l->lock);
+        read_unlock(&conn->chan_lock);
 
         return 0;
 }
@@ -3866,7 +3967,7 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
 
         if (!(flags & ACL_CONT)) {
                 struct l2cap_hdr *hdr;
-                struct sock *sk;
+                struct l2cap_chan *chan;
                 u16 cid;
                 int len;
 
@@ -3904,18 +4005,21 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
                         goto drop;
                 }
 
-                sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
+                chan = l2cap_get_chan_by_scid(conn, cid);
 
-                if (sk && l2cap_pi(sk)->imtu < len - L2CAP_HDR_SIZE) {
-                        BT_ERR("Frame exceeding recv MTU (len %d, MTU %d)",
-                                        len, l2cap_pi(sk)->imtu);
-                        bh_unlock_sock(sk);
-                        l2cap_conn_unreliable(conn, ECOMM);
-                        goto drop;
-                }
+                if (chan && chan->sk) {
+                        struct sock *sk = chan->sk;
 
-                if (sk)
+                        if (chan->imtu < len - L2CAP_HDR_SIZE) {
+                                BT_ERR("Frame exceeding recv MTU (len %d, "
+                                                        "MTU %d)", len,
+                                                        chan->imtu);
+                                bh_unlock_sock(sk);
+                                l2cap_conn_unreliable(conn, ECOMM);
+                                goto drop;
+                        }
                         bh_unlock_sock(sk);
+                }
 
                 /* Allocate skb for the complete frame (with header) */
                 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
@@ -3969,14 +4073,15 @@ static int l2cap_debugfs_show(struct seq_file *f, void *p)
 
         sk_for_each(sk, node, &l2cap_sk_list.head) {
                 struct l2cap_pinfo *pi = l2cap_pi(sk);
+                struct l2cap_chan *chan = pi->chan;
 
                 seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
                                         batostr(&bt_sk(sk)->src),
                                         batostr(&bt_sk(sk)->dst),
-                                        sk->sk_state, __le16_to_cpu(pi->psm),
-                                        pi->scid, pi->dcid,
-                                        pi->imtu, pi->omtu, pi->sec_level,
-                                        pi->mode);
+                                        sk->sk_state, __le16_to_cpu(chan->psm),
+                                        chan->scid, chan->dcid,
+                                        chan->imtu, chan->omtu, chan->sec_level,
+                                        chan->mode);
         }
 
         read_unlock_bh(&l2cap_sk_list.lock);
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 299fe56a9668..7c4a9ae9b3ce 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -30,6 +30,8 @@
 #include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/l2cap.h>
 
+static const struct proto_ops l2cap_sock_ops;
+
 /* ---- L2CAP timers ---- */
 static void l2cap_sock_timeout(unsigned long arg)
 {
@@ -51,7 +53,7 @@ static void l2cap_sock_timeout(unsigned long arg)
         if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONFIG)
                 reason = ECONNREFUSED;
         else if (sk->sk_state == BT_CONNECT &&
-                                l2cap_pi(sk)->sec_level != BT_SECURITY_SDP)
+                        l2cap_pi(sk)->chan->sec_level != BT_SECURITY_SDP)
                 reason = ECONNREFUSED;
         else
                 reason = ETIMEDOUT;
@@ -80,9 +82,13 @@ static struct sock *__l2cap_get_sock_by_addr(__le16 psm, bdaddr_t *src)
 {
         struct sock *sk;
         struct hlist_node *node;
-        sk_for_each(sk, node, &l2cap_sk_list.head)
-                if (l2cap_pi(sk)->sport == psm && !bacmp(&bt_sk(sk)->src, src))
+        sk_for_each(sk, node, &l2cap_sk_list.head) {
+                struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+
+                if (chan->sport == psm && !bacmp(&bt_sk(sk)->src, src))
                         goto found;
+        }
+
         sk = NULL;
 found:
         return sk;
@@ -91,6 +97,7 @@ found:
 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
 {
         struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         struct sockaddr_l2 la;
         int len, err = 0;
 
@@ -136,17 +143,17 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
         } else {
                 /* Save source address */
                 bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
-                l2cap_pi(sk)->psm   = la.l2_psm;
-                l2cap_pi(sk)->sport = la.l2_psm;
+                chan->psm   = la.l2_psm;
+                chan->sport = la.l2_psm;
                 sk->sk_state = BT_BOUND;
 
                 if (__le16_to_cpu(la.l2_psm) == 0x0001 ||
                                         __le16_to_cpu(la.l2_psm) == 0x0003)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
+                        chan->sec_level = BT_SECURITY_SDP;
         }
 
         if (la.l2_cid)
-                l2cap_pi(sk)->scid = la.l2_cid;
+                chan->scid = la.l2_cid;
 
         write_unlock_bh(&l2cap_sk_list.lock);
 
@@ -158,6 +165,7 @@ done:
 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 {
         struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         struct sockaddr_l2 la;
         int len, err = 0;
 
@@ -182,7 +190,7 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
                 goto done;
         }
 
-        switch (l2cap_pi(sk)->mode) {
+        switch (chan->mode) {
         case L2CAP_MODE_BASIC:
                 break;
         case L2CAP_MODE_ERTM:
@@ -226,10 +234,10 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
 
         /* Set destination address and psm */
         bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr);
-        l2cap_pi(sk)->psm = la.l2_psm;
-        l2cap_pi(sk)->dcid = la.l2_cid;
+        chan->psm = la.l2_psm;
+        chan->dcid = la.l2_cid;
 
-        err = l2cap_do_connect(sk);
+        err = l2cap_chan_connect(l2cap_pi(sk)->chan);
         if (err)
                 goto done;
 
@@ -244,6 +252,7 @@ done:
 static int l2cap_sock_listen(struct socket *sock, int backlog)
 {
         struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         int err = 0;
 
         BT_DBG("sk %p backlog %d", sk, backlog);
@@ -256,7 +265,7 @@ static int l2cap_sock_listen(struct socket *sock, int backlog)
                 goto done;
         }
 
-        switch (l2cap_pi(sk)->mode) {
+        switch (chan->mode) {
         case L2CAP_MODE_BASIC:
                 break;
         case L2CAP_MODE_ERTM:
@@ -269,7 +278,7 @@ static int l2cap_sock_listen(struct socket *sock, int backlog)
                 goto done;
         }
 
-        if (!l2cap_pi(sk)->psm && !l2cap_pi(sk)->dcid) {
+        if (!chan->psm && !chan->scid) {
                 bdaddr_t *src = &bt_sk(sk)->src;
                 u16 psm;
 
@@ -279,8 +288,8 @@ static int l2cap_sock_listen(struct socket *sock, int backlog)
 
                 for (psm = 0x1001; psm < 0x1100; psm += 2)
                         if (!__l2cap_get_sock_by_addr(cpu_to_le16(psm), src)) {
-                                l2cap_pi(sk)->psm   = cpu_to_le16(psm);
-                                l2cap_pi(sk)->sport = cpu_to_le16(psm);
+                                chan->psm   = cpu_to_le16(psm);
+                                chan->sport = cpu_to_le16(psm);
                                 err = 0;
                                 break;
                         }
@@ -360,6 +369,7 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *l
 {
         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
         struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 
         BT_DBG("sock %p, sk %p", sock, sk);
 
@@ -367,13 +377,13 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *l
         *len = sizeof(struct sockaddr_l2);
 
         if (peer) {
-                la->l2_psm = l2cap_pi(sk)->psm;
+                la->l2_psm = chan->psm;
                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
-                la->l2_cid = cpu_to_le16(l2cap_pi(sk)->dcid);
+                la->l2_cid = cpu_to_le16(chan->dcid);
         } else {
-                la->l2_psm = l2cap_pi(sk)->sport;
+                la->l2_psm = chan->sport;
                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
-                la->l2_cid = cpu_to_le16(l2cap_pi(sk)->scid);
+                la->l2_cid = cpu_to_le16(chan->scid);
         }
 
         return 0;
@@ -382,6 +392,7 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *l
 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 {
         struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         struct l2cap_options opts;
         struct l2cap_conninfo cinfo;
         int len, err = 0;
@@ -397,13 +408,13 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __us
         switch (optname) {
         case L2CAP_OPTIONS:
                 memset(&opts, 0, sizeof(opts));
-                opts.imtu     = l2cap_pi(sk)->imtu;
-                opts.omtu     = l2cap_pi(sk)->omtu;
-                opts.flush_to = l2cap_pi(sk)->flush_to;
-                opts.mode     = l2cap_pi(sk)->mode;
-                opts.fcs      = l2cap_pi(sk)->fcs;
-                opts.max_tx   = l2cap_pi(sk)->max_tx;
-                opts.txwin_size = (__u16)l2cap_pi(sk)->tx_win;
+                opts.imtu     = chan->imtu;
+                opts.omtu     = chan->omtu;
+                opts.flush_to = chan->flush_to;
+                opts.mode     = chan->mode;
+                opts.fcs      = chan->fcs;
+                opts.max_tx   = chan->max_tx;
+                opts.txwin_size = (__u16)chan->tx_win;
 
                 len = min_t(unsigned int, len, sizeof(opts));
                 if (copy_to_user(optval, (char *) &opts, len))
@@ -412,7 +423,7 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __us
                 break;
 
         case L2CAP_LM:
-                switch (l2cap_pi(sk)->sec_level) {
+                switch (chan->sec_level) {
                 case BT_SECURITY_LOW:
                         opt = L2CAP_LM_AUTH;
                         break;
@@ -428,10 +439,10 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __us
                         break;
                 }
 
-                if (l2cap_pi(sk)->role_switch)
+                if (chan->role_switch)
                         opt |= L2CAP_LM_MASTER;
 
-                if (l2cap_pi(sk)->force_reliable)
+                if (chan->force_reliable)
                         opt |= L2CAP_LM_RELIABLE;
 
                 if (put_user(opt, (u32 __user *) optval))
@@ -446,8 +457,8 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __us
                         break;
                 }
 
-                cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
-                memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
+                cinfo.hci_handle = chan->conn->hcon->handle;
+                memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 
                 len = min_t(unsigned int, len, sizeof(cinfo));
                 if (copy_to_user(optval, (char *) &cinfo, len))
@@ -467,6 +478,7 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __us
 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 {
         struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         struct bt_security sec;
         int len, err = 0;
 
@@ -491,7 +503,7 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
                         break;
                 }
 
-                sec.level = l2cap_pi(sk)->sec_level;
+                sec.level = chan->sec_level;
 
                 len = min_t(unsigned int, len, sizeof(sec));
                 if (copy_to_user(optval, (char *) &sec, len))
@@ -511,7 +523,7 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
                 break;
 
         case BT_FLUSHABLE:
-                if (put_user(l2cap_pi(sk)->flushable, (u32 __user *) optval))
+                if (put_user(chan->flushable, (u32 __user *) optval))
                         err = -EFAULT;
 
                 break;
@@ -528,6 +540,7 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
 {
         struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         struct l2cap_options opts;
         int len, err = 0;
         u32 opt;
@@ -543,13 +556,13 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
                         break;
                 }
 
-                opts.imtu     = l2cap_pi(sk)->imtu;
-                opts.omtu     = l2cap_pi(sk)->omtu;
-                opts.flush_to = l2cap_pi(sk)->flush_to;
-                opts.mode     = l2cap_pi(sk)->mode;
-                opts.fcs      = l2cap_pi(sk)->fcs;
-                opts.max_tx   = l2cap_pi(sk)->max_tx;
-                opts.txwin_size = (__u16)l2cap_pi(sk)->tx_win;
+                opts.imtu     = chan->imtu;
+                opts.omtu     = chan->omtu;
+                opts.flush_to = chan->flush_to;
+                opts.mode     = chan->mode;
+                opts.fcs      = chan->fcs;
+                opts.max_tx   = chan->max_tx;
+                opts.txwin_size = (__u16)chan->tx_win;
 
                 len = min_t(unsigned int, sizeof(opts), optlen);
                 if (copy_from_user((char *) &opts, optval, len)) {
@@ -562,10 +575,10 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
                         break;
                 }
 
-                l2cap_pi(sk)->mode = opts.mode;
-                switch (l2cap_pi(sk)->mode) {
+                chan->mode = opts.mode;
+                switch (chan->mode) {
                 case L2CAP_MODE_BASIC:
-                        l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_STATE2_DEVICE;
+                        chan->conf_state &= ~L2CAP_CONF_STATE2_DEVICE;
                         break;
                 case L2CAP_MODE_ERTM:
                 case L2CAP_MODE_STREAMING:
@@ -577,11 +590,11 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
                         break;
                 }
 
-                l2cap_pi(sk)->imtu = opts.imtu;
-                l2cap_pi(sk)->omtu = opts.omtu;
-                l2cap_pi(sk)->fcs  = opts.fcs;
-                l2cap_pi(sk)->max_tx = opts.max_tx;
-                l2cap_pi(sk)->tx_win = (__u8)opts.txwin_size;
+                chan->imtu = opts.imtu;
+                chan->omtu = opts.omtu;
+                chan->fcs  = opts.fcs;
+                chan->max_tx = opts.max_tx;
+                chan->tx_win = (__u8)opts.txwin_size;
                 break;
 
         case L2CAP_LM:
@@ -591,14 +604,14 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
                 }
 
                 if (opt & L2CAP_LM_AUTH)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_LOW;
+                        chan->sec_level = BT_SECURITY_LOW;
                 if (opt & L2CAP_LM_ENCRYPT)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
+                        chan->sec_level = BT_SECURITY_MEDIUM;
                 if (opt & L2CAP_LM_SECURE)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_HIGH;
+                        chan->sec_level = BT_SECURITY_HIGH;
 
-                l2cap_pi(sk)->role_switch    = (opt & L2CAP_LM_MASTER);
-                l2cap_pi(sk)->force_reliable = (opt & L2CAP_LM_RELIABLE);
+                chan->role_switch    = (opt & L2CAP_LM_MASTER);
+                chan->force_reliable = (opt & L2CAP_LM_RELIABLE);
                 break;
 
         default:
@@ -613,6 +626,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 {
         struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         struct bt_security sec;
         int len, err = 0;
         u32 opt;
@@ -649,7 +663,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
                         break;
                 }
 
-                l2cap_pi(sk)->sec_level = sec.level;
+                chan->sec_level = sec.level;
                 break;
 
         case BT_DEFER_SETUP:
@@ -678,7 +692,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
                 }
 
                 if (opt == BT_FLUSHABLE_OFF) {
-                        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+                        struct l2cap_conn *conn = chan->conn;
                         /* proceed further only when we have l2cap_conn and
                            No Flush support in the LM */
                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
@@ -687,7 +701,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
                         }
                 }
 
-                l2cap_pi(sk)->flushable = opt;
+                chan->flushable = opt;
                 break;
 
         default:
@@ -702,7 +716,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len)
 {
         struct sock *sk = sock->sk;
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         struct sk_buff *skb;
         u16 control;
         int err;
@@ -725,74 +739,77 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
 
         /* Connectionless channel */
         if (sk->sk_type == SOCK_DGRAM) {
-                skb = l2cap_create_connless_pdu(sk, msg, len);
+                skb = l2cap_create_connless_pdu(chan, msg, len);
                 if (IS_ERR(skb)) {
                         err = PTR_ERR(skb);
                 } else {
-                        l2cap_do_send(sk, skb);
+                        l2cap_do_send(chan, skb);
                         err = len;
                 }
                 goto done;
         }
 
-        switch (pi->mode) {
+        switch (chan->mode) {
         case L2CAP_MODE_BASIC:
                 /* Check outgoing MTU */
-                if (len > pi->omtu) {
+                if (len > chan->omtu) {
                         err = -EMSGSIZE;
                         goto done;
                 }
 
                 /* Create a basic PDU */
-                skb = l2cap_create_basic_pdu(sk, msg, len);
+                skb = l2cap_create_basic_pdu(chan, msg, len);
                 if (IS_ERR(skb)) {
                         err = PTR_ERR(skb);
                         goto done;
                 }
 
-                l2cap_do_send(sk, skb);
+                l2cap_do_send(chan, skb);
                 err = len;
                 break;
 
         case L2CAP_MODE_ERTM:
         case L2CAP_MODE_STREAMING:
                 /* Entire SDU fits into one PDU */
-                if (len <= pi->remote_mps) {
+                if (len <= chan->remote_mps) {
                         control = L2CAP_SDU_UNSEGMENTED;
-                        skb = l2cap_create_iframe_pdu(sk, msg, len, control, 0);
+                        skb = l2cap_create_iframe_pdu(chan, msg, len, control,
+                                                                        0);
                         if (IS_ERR(skb)) {
                                 err = PTR_ERR(skb);
                                 goto done;
                         }
-                        __skb_queue_tail(TX_QUEUE(sk), skb);
+                        __skb_queue_tail(&chan->tx_q, skb);
 
-                        if (sk->sk_send_head == NULL)
-                                sk->sk_send_head = skb;
+                        if (chan->tx_send_head == NULL)
+                                chan->tx_send_head = skb;
 
                 } else {
                 /* Segment SDU into multiples PDUs */
-                        err = l2cap_sar_segment_sdu(sk, msg, len);
+                        err = l2cap_sar_segment_sdu(chan, msg, len);
                         if (err < 0)
                                 goto done;
                 }
 
-                if (pi->mode == L2CAP_MODE_STREAMING) {
-                        l2cap_streaming_send(sk);
-                } else {
-                        if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
-                                        (pi->conn_state & L2CAP_CONN_WAIT_F)) {
-                                err = len;
-                                break;
-                        }
-                        err = l2cap_ertm_send(sk);
+                if (chan->mode == L2CAP_MODE_STREAMING) {
+                        l2cap_streaming_send(chan);
+                        err = len;
+                        break;
                 }
 
+                if ((chan->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                                (chan->conn_state & L2CAP_CONN_WAIT_F)) {
+                        err = len;
+                        break;
+                }
+                err = l2cap_ertm_send(chan);
+
                 if (err >= 0)
                         err = len;
                 break;
 
         default:
-                BT_DBG("bad state %1.1x", pi->mode);
+                BT_DBG("bad state %1.1x", chan->mode);
                 err = -EBADFD;
         }
 
@@ -808,29 +825,9 @@ static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct ms
         lock_sock(sk);
 
         if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
-                struct l2cap_conn_rsp rsp;
-                struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-                u8 buf[128];
-
                 sk->sk_state = BT_CONFIG;
 
-                rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
-                rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
-                rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
-                rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
-                l2cap_send_cmd(l2cap_pi(sk)->conn, l2cap_pi(sk)->ident,
-                                        L2CAP_CONN_RSP, sizeof(rsp), &rsp);
-
-                if (l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT) {
-                        release_sock(sk);
-                        return 0;
-                }
-
-                l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
-                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                                l2cap_build_conf_req(sk, buf), buf);
-                l2cap_pi(sk)->num_conf_req++;
-
+                __l2cap_connect_rsp_defer(l2cap_pi(sk)->chan);
                 release_sock(sk);
                 return 0;
         }
@@ -854,6 +851,8 @@ void l2cap_sock_kill(struct sock *sk)
         BT_DBG("sk %p state %d", sk, sk->sk_state);
 
         /* Kill poor orphan */
+
+        l2cap_chan_free(l2cap_pi(sk)->chan);
         bt_sock_unlink(&l2cap_sk_list, sk);
         sock_set_flag(sk, SOCK_DEAD);
         sock_put(sk);
@@ -885,7 +884,8 @@ static void l2cap_sock_cleanup_listen(struct sock *parent)
 
 void __l2cap_sock_close(struct sock *sk, int reason)
 {
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        struct l2cap_conn *conn = chan->conn;
 
         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 
@@ -900,9 +900,9 @@ void __l2cap_sock_close(struct sock *sk, int reason)
                                         sk->sk_type == SOCK_STREAM) &&
                                         conn->hcon->type == ACL_LINK) {
                         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
-                        l2cap_send_disconn_req(conn, sk, reason);
+                        l2cap_send_disconn_req(conn, chan, reason);
                 } else
-                        l2cap_chan_del(sk, reason);
+                        l2cap_chan_del(chan, reason);
                 break;
 
         case BT_CONNECT2:
@@ -917,20 +917,20 @@ void __l2cap_sock_close(struct sock *sk, int reason)
                         else
                                 result = L2CAP_CR_BAD_PSM;
 
-                        rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
-                        rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
+                        rsp.scid   = cpu_to_le16(chan->dcid);
+                        rsp.dcid   = cpu_to_le16(chan->scid);
                         rsp.result = cpu_to_le16(result);
                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
-                        l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
-                                        L2CAP_CONN_RSP, sizeof(rsp), &rsp);
+                        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
+                                                        sizeof(rsp), &rsp);
                 }
 
-                l2cap_chan_del(sk, reason);
+                l2cap_chan_del(chan, reason);
                 break;
 
         case BT_CONNECT:
         case BT_DISCONN:
-                l2cap_chan_del(sk, reason);
+                l2cap_chan_del(chan, reason);
                 break;
 
         default:
@@ -942,6 +942,7 @@ void __l2cap_sock_close(struct sock *sk, int reason)
 static int l2cap_sock_shutdown(struct socket *sock, int how)
 {
         struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
         int err = 0;
 
         BT_DBG("sock %p, sk %p", sock, sk);
@@ -951,7 +952,7 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
 
         lock_sock(sk);
         if (!sk->sk_shutdown) {
-                if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM)
+                if (chan->mode == L2CAP_MODE_ERTM)
                         err = __l2cap_wait_ack(sk);
 
                 sk->sk_shutdown = SHUTDOWN_MASK;
@@ -998,49 +999,47 @@ static void l2cap_sock_destruct(struct sock *sk)
 void l2cap_sock_init(struct sock *sk, struct sock *parent)
 {
         struct l2cap_pinfo *pi = l2cap_pi(sk);
+        struct l2cap_chan *chan = pi->chan;
 
         BT_DBG("sk %p", sk);
 
         if (parent) {
+                struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
+
                 sk->sk_type = parent->sk_type;
                 bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
 
-                pi->imtu = l2cap_pi(parent)->imtu;
-                pi->omtu = l2cap_pi(parent)->omtu;
-                pi->conf_state = l2cap_pi(parent)->conf_state;
-                pi->mode = l2cap_pi(parent)->mode;
-                pi->fcs  = l2cap_pi(parent)->fcs;
-                pi->max_tx = l2cap_pi(parent)->max_tx;
-                pi->tx_win = l2cap_pi(parent)->tx_win;
-                pi->sec_level = l2cap_pi(parent)->sec_level;
-                pi->role_switch = l2cap_pi(parent)->role_switch;
-                pi->force_reliable = l2cap_pi(parent)->force_reliable;
-                pi->flushable = l2cap_pi(parent)->flushable;
+                chan->imtu = pchan->imtu;
+                chan->omtu = pchan->omtu;
+                chan->conf_state = pchan->conf_state;
+                chan->mode = pchan->mode;
+                chan->fcs  = pchan->fcs;
+                chan->max_tx = pchan->max_tx;
+                chan->tx_win = pchan->tx_win;
+                chan->sec_level = pchan->sec_level;
+                chan->role_switch = pchan->role_switch;
+                chan->force_reliable = pchan->force_reliable;
+                chan->flushable = pchan->flushable;
         } else {
-                pi->imtu = L2CAP_DEFAULT_MTU;
-                pi->omtu = 0;
+                chan->imtu = L2CAP_DEFAULT_MTU;
+                chan->omtu = 0;
                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
-                        pi->mode = L2CAP_MODE_ERTM;
-                        pi->conf_state |= L2CAP_CONF_STATE2_DEVICE;
+                        chan->mode = L2CAP_MODE_ERTM;
+                        chan->conf_state |= L2CAP_CONF_STATE2_DEVICE;
                 } else {
-                        pi->mode = L2CAP_MODE_BASIC;
+                        chan->mode = L2CAP_MODE_BASIC;
                 }
-                pi->max_tx = L2CAP_DEFAULT_MAX_TX;
-                pi->fcs  = L2CAP_FCS_CRC16;
-                pi->tx_win = L2CAP_DEFAULT_TX_WINDOW;
-                pi->sec_level = BT_SECURITY_LOW;
-                pi->role_switch = 0;
-                pi->force_reliable = 0;
-                pi->flushable = BT_FLUSHABLE_OFF;
+                chan->max_tx = L2CAP_DEFAULT_MAX_TX;
+                chan->fcs  = L2CAP_FCS_CRC16;
+                chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
+                chan->sec_level = BT_SECURITY_LOW;
+                chan->role_switch = 0;
+                chan->force_reliable = 0;
+                chan->flushable = BT_FLUSHABLE_OFF;
         }
 
         /* Default config options */
-        pi->conf_len = 0;
-        pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
-        skb_queue_head_init(TX_QUEUE(sk));
-        skb_queue_head_init(SREJ_QUEUE(sk));
-        skb_queue_head_init(BUSY_QUEUE(sk));
-        INIT_LIST_HEAD(SREJ_LIST(sk));
+        chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
 }
 
 static struct proto l2cap_proto = {
@@ -1078,6 +1077,7 @@ static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
                              int kern)
 {
         struct sock *sk;
+        struct l2cap_chan *chan;
 
         BT_DBG("sock %p", sock);
 
@@ -1096,11 +1096,19 @@ static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
         if (!sk)
                 return -ENOMEM;
 
+        chan = l2cap_chan_alloc(sk);
+        if (!chan) {
+                l2cap_sock_kill(sk);
+                return -ENOMEM;
+        }
+
+        l2cap_pi(sk)->chan = chan;
+
         l2cap_sock_init(sk, NULL);
         return 0;
 }
 
-const struct proto_ops l2cap_sock_ops = {
+static const struct proto_ops l2cap_sock_ops = {
         .family         = PF_BLUETOOTH,
         .owner          = THIS_MODULE,
         .release        = l2cap_sock_release,
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 4476d8e3c0f2..2481d257ed98 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -36,7 +36,7 @@ struct pending_cmd {
         struct list_head list;
         __u16 opcode;
         int index;
-        void *cmd;
+        void *param;
         struct sock *sk;
         void *user_data;
 };
@@ -179,10 +179,12 @@ static int read_controller_info(struct sock *sk, u16 index)
 
         hci_del_off_timer(hdev);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         set_bit(HCI_MGMT, &hdev->flags);
 
+        memset(&rp, 0, sizeof(rp));
+
         rp.type = hdev->dev_type;
 
         rp.powered = test_bit(HCI_UP, &hdev->flags);
@@ -204,7 +206,9 @@ static int read_controller_info(struct sock *sk, u16 index)
         rp.hci_ver = hdev->hci_ver;
         put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
 
-        hci_dev_unlock_bh(hdev);
+        memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
+
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
 
         return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
@@ -213,7 +217,7 @@ static int read_controller_info(struct sock *sk, u16 index)
 static void mgmt_pending_free(struct pending_cmd *cmd)
 {
         sock_put(cmd->sk);
-        kfree(cmd->cmd);
+        kfree(cmd->param);
         kfree(cmd);
 }
 
@@ -229,13 +233,14 @@ static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
         cmd->opcode = opcode;
         cmd->index = index;
 
-        cmd->cmd = kmalloc(len, GFP_ATOMIC);
-        if (!cmd->cmd) {
+        cmd->param = kmalloc(len, GFP_ATOMIC);
+        if (!cmd->param) {
                 kfree(cmd);
                 return NULL;
         }
 
-        memcpy(cmd->cmd, data, len);
+        if (data)
+                memcpy(cmd->param, data, len);
 
         cmd->sk = sk;
         sock_hold(sk);
@@ -311,7 +316,7 @@ static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_SET_POWERED, ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         up = test_bit(HCI_UP, &hdev->flags);
         if ((cp->val && up) || (!cp->val && !up)) {
@@ -338,7 +343,7 @@ static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
         err = 0;
 
 failed:
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
         return err;
 }
@@ -363,7 +368,7 @@ static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
                 err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENETDOWN);
@@ -398,7 +403,7 @@ static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
                 mgmt_pending_remove(cmd);
 
 failed:
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -424,7 +429,7 @@ static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
                 err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENETDOWN);
@@ -458,7 +463,7 @@ static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
                 mgmt_pending_remove(cmd);
 
 failed:
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -517,7 +522,7 @@ static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         if (cp->val)
                 set_bit(HCI_PAIRABLE, &hdev->flags);
@@ -533,12 +538,156 @@ static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
         err = mgmt_event(MGMT_EV_PAIRABLE, index, &ev, sizeof(ev), sk);
 
 failed:
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
 
         return err;
 }
 
+#define EIR_FLAGS               0x01 /* flags */
+#define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
+#define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
+#define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
+#define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
+#define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
+#define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
+#define EIR_NAME_SHORT          0x08 /* shortened local name */
+#define EIR_NAME_COMPLETE       0x09 /* complete local name */
+#define EIR_TX_POWER            0x0A /* transmit power level */
+#define EIR_DEVICE_ID           0x10 /* device ID */
+
+#define PNP_INFO_SVCLASS_ID             0x1200
+
+static u8 bluetooth_base_uuid[] = {
+                        0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
+                        0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+};
+
+static u16 get_uuid16(u8 *uuid128)
+{
+        u32 val;
+        int i;
+
+        for (i = 0; i < 12; i++) {
+                if (bluetooth_base_uuid[i] != uuid128[i])
+                        return 0;
+        }
+
+        memcpy(&val, &uuid128[12], 4);
+
+        val = le32_to_cpu(val);
+        if (val > 0xffff)
+                return 0;
+
+        return (u16) val;
+}
+
+static void create_eir(struct hci_dev *hdev, u8 *data)
+{
+        u8 *ptr = data;
+        u16 eir_len = 0;
+        u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
+        int i, truncated = 0;
+        struct list_head *p;
+        size_t name_len;
+
+        name_len = strlen(hdev->dev_name);
+
+        if (name_len > 0) {
+                /* EIR Data type */
+                if (name_len > 48) {
+                        name_len = 48;
+                        ptr[1] = EIR_NAME_SHORT;
+                } else
+                        ptr[1] = EIR_NAME_COMPLETE;
+
+                /* EIR Data length */
+                ptr[0] = name_len + 1;
+
+                memcpy(ptr + 2, hdev->dev_name, name_len);
+
+                eir_len += (name_len + 2);
+                ptr += (name_len + 2);
+        }
+
+        memset(uuid16_list, 0, sizeof(uuid16_list));
+
+        /* Group all UUID16 types */
+        list_for_each(p, &hdev->uuids) {
+                struct bt_uuid *uuid = list_entry(p, struct bt_uuid, list);
+                u16 uuid16;
+
+                uuid16 = get_uuid16(uuid->uuid);
+                if (uuid16 == 0)
+                        return;
+
+                if (uuid16 < 0x1100)
+                        continue;
+
+                if (uuid16 == PNP_INFO_SVCLASS_ID)
+                        continue;
+
+                /* Stop if not enough space to put next UUID */
+                if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
+                        truncated = 1;
+                        break;
+                }
+
+                /* Check for duplicates */
+                for (i = 0; uuid16_list[i] != 0; i++)
+                        if (uuid16_list[i] == uuid16)
+                                break;
+
+                if (uuid16_list[i] == 0) {
+                        uuid16_list[i] = uuid16;
+                        eir_len += sizeof(u16);
+                }
+        }
+
+        if (uuid16_list[0] != 0) {
+                u8 *length = ptr;
+
+                /* EIR Data type */
+                ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
+
+                ptr += 2;
+                eir_len += 2;
+
+                for (i = 0; uuid16_list[i] != 0; i++) {
+                        *ptr++ = (uuid16_list[i] & 0x00ff);
+                        *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
+                }
+
+                /* EIR Data length */
+                *length = (i * sizeof(u16)) + 1;
+        }
+}
+
+static int update_eir(struct hci_dev *hdev)
+{
+        struct hci_cp_write_eir cp;
+
+        if (!(hdev->features[6] & LMP_EXT_INQ))
+                return 0;
+
+        if (hdev->ssp_mode == 0)
+                return 0;
+
+        if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
+                return 0;
+
+        memset(&cp, 0, sizeof(cp));
+
+        create_eir(hdev, cp.data);
+
+        if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
+                return 0;
+
+        memcpy(hdev->eir, cp.data, sizeof(cp.data));
+
+        return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
+}
+
 static u8 get_service_classes(struct hci_dev *hdev)
 {
         struct list_head *p;
@@ -590,7 +739,7 @@ static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_ADD_UUID, ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
         if (!uuid) {
@@ -607,10 +756,14 @@ static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (err < 0)
                 goto failed;
 
+        err = update_eir(hdev);
+        if (err < 0)
+                goto failed;
+
         err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 
 failed:
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -635,7 +788,7 @@ static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
                 err = hci_uuids_clear(hdev);
@@ -663,10 +816,14 @@ static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (err < 0)
                 goto unlock;
 
+        err = update_eir(hdev);
+        if (err < 0)
+                goto unlock;
+
         err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 
 unlock:
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -690,7 +847,7 @@ static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         hdev->major_class = cp->major;
         hdev->minor_class = cp->minor;
@@ -700,7 +857,7 @@ static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
         if (err == 0)
                 err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
 
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -722,7 +879,7 @@ static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         BT_DBG("hci%u enable %d", index, cp->enable);
 
@@ -732,13 +889,15 @@ static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
         } else {
                 clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
                 err = update_class(hdev);
+                if (err == 0)
+                        err = update_eir(hdev);
         }
 
         if (err == 0)
                 err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
                                                                         0);
 
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -772,7 +931,7 @@ static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
         BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
                                                                 key_count);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         hci_link_keys_clear(hdev);
 
@@ -786,11 +945,11 @@ static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
         for (i = 0; i < key_count; i++) {
                 struct mgmt_key_info *key = &cp->keys[i];
 
-                hci_add_link_key(hdev, 0, &key->bdaddr, key->val, key->type,
+                hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
                                                                 key->pin_len);
         }
 
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
 
         return 0;
@@ -812,7 +971,7 @@ static int remove_key(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_REMOVE_KEY, ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         err = hci_remove_link_key(hdev, &cp->bdaddr);
         if (err < 0) {
@@ -835,7 +994,7 @@ static int remove_key(struct sock *sk, u16 index, unsigned char *data, u16 len)
         }
 
 unlock:
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -861,7 +1020,7 @@ static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_DISCONNECT, ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENETDOWN);
@@ -893,7 +1052,7 @@ static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
                 mgmt_pending_remove(cmd);
 
 failed:
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -914,7 +1073,7 @@ static int get_connections(struct sock *sk, u16 index)
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS, ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         count = 0;
         list_for_each(p, &hdev->conn_hash.list) {
@@ -945,7 +1104,7 @@ static int get_connections(struct sock *sk, u16 index)
 
 unlock:
         kfree(rp);
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
         return err;
 }
@@ -970,7 +1129,7 @@ static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENETDOWN);
@@ -992,7 +1151,7 @@ static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
                 mgmt_pending_remove(cmd);
 
 failed:
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -1019,7 +1178,7 @@ static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
                 return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
                                                                         ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
                 err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
@@ -1040,7 +1199,7 @@ static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
                 mgmt_pending_remove(cmd);
 
 failed:
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -1063,14 +1222,14 @@ static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         hdev->io_capability = cp->io_capability;
 
         BT_DBG("%s IO capability set to 0x%02x", hdev->name,
                                                         hdev->io_capability);
 
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
 
         return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
@@ -1156,7 +1315,7 @@ static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
         if (!hdev)
                 return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         if (cp->io_cap == 0x03) {
                 sec_level = BT_SECURITY_MEDIUM;
@@ -1198,7 +1357,7 @@ static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
         err = 0;
 
 unlock:
-        hci_dev_unlock_bh(hdev);
+        hci_dev_unlock(hdev);
         hci_dev_put(hdev);
 
         return err;
@@ -1230,7 +1389,7 @@ static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, mgmt_op, ENODEV);
 
-        hci_dev_lock_bh(hdev);
+        hci_dev_lock(hdev);
 
         if (!test_bit(HCI_UP, &hdev->flags)) {
                 err = cmd_status(sk, index, mgmt_op, ENETDOWN);
@@ -1248,6 +1407,231 @@ static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
                 mgmt_pending_remove(cmd);
 
 failed:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
+                                                                u16 len)
+{
+        struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
+        struct hci_cp_write_local_name hci_cp;
+        struct hci_dev *hdev;
+        struct pending_cmd *cmd;
+        int err;
+
+        BT_DBG("");
+
+        if (len != sizeof(*mgmt_cp))
+                return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, index, data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
+        err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
+                                                                &hci_cp);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+failed:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int read_local_oob_data(struct sock *sk, u16 index)
+{
+        struct hci_dev *hdev;
+        struct pending_cmd *cmd;
+        int err;
+
+        BT_DBG("hci%u", index);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                                                        ENODEV);
+
+        hci_dev_lock(hdev);
+
+        if (!test_bit(HCI_UP, &hdev->flags)) {
+                err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                                                ENETDOWN);
+                goto unlock;
+        }
+
+        if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
+                err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                                                EOPNOTSUPP);
+                goto unlock;
+        }
+
+        if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, index)) {
+                err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA, EBUSY);
+                goto unlock;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, index, NULL, 0);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto unlock;
+        }
+
+        err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+unlock:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
+                                                                        u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
+        int err;
+
+        BT_DBG("hci%u ", index);
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
+                                                                        EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
+                                                                        ENODEV);
+
+        hci_dev_lock(hdev);
+
+        err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
+                                                                cp->randomizer);
+        if (err < 0)
+                err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, -err);
+        else
+                err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
+                                                                        0);
+
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int remove_remote_oob_data(struct sock *sk, u16 index,
+                                                unsigned char *data, u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
+        int err;
+
+        BT_DBG("hci%u ", index);
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
+                                                                        EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
+                                                                        ENODEV);
+
+        hci_dev_lock(hdev);
+
+        err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
+        if (err < 0)
+                err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
+                                                                        -err);
+        else
+                err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
+                                                                NULL, 0);
+
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int start_discovery(struct sock *sk, u16 index)
+{
+        u8 lap[3] = { 0x33, 0x8b, 0x9e };
+        struct hci_cp_inquiry cp;
+        struct pending_cmd *cmd;
+        struct hci_dev *hdev;
+        int err;
+
+        BT_DBG("hci%u", index);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENODEV);
+
+        hci_dev_lock_bh(hdev);
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, index, NULL, 0);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        memset(&cp, 0, sizeof(cp));
+        memcpy(&cp.lap, lap, 3);
+        cp.length  = 0x08;
+        cp.num_rsp = 0x00;
+
+        err = hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+failed:
+        hci_dev_unlock_bh(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int stop_discovery(struct sock *sk, u16 index)
+{
+        struct hci_dev *hdev;
+        struct pending_cmd *cmd;
+        int err;
+
+        BT_DBG("hci%u", index);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY, ENODEV);
+
+        hci_dev_lock_bh(hdev);
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, index, NULL, 0);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        err = hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+failed:
         hci_dev_unlock_bh(hdev);
         hci_dev_put(hdev);
 
@@ -1266,7 +1650,7 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
         if (msglen < sizeof(*hdr))
                 return -EINVAL;
 
-        buf = kmalloc(msglen, GFP_ATOMIC);
+        buf = kmalloc(msglen, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
 
@@ -1349,6 +1733,25 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
                 err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 0);
                 break;
+        case MGMT_OP_SET_LOCAL_NAME:
+                err = set_local_name(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_READ_LOCAL_OOB_DATA:
+                err = read_local_oob_data(sk, index);
+                break;
+        case MGMT_OP_ADD_REMOTE_OOB_DATA:
+                err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
+                err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
+                                                                        len);
+                break;
+        case MGMT_OP_START_DISCOVERY:
+                err = start_discovery(sk, index);
+                break;
+        case MGMT_OP_STOP_DISCOVERY:
+                err = stop_discovery(sk, index);
+                break;
         default:
                 BT_DBG("Unknown op %u", opcode);
                 err = cmd_status(sk, index, opcode, 0x01);
@@ -1382,7 +1785,7 @@ struct cmd_lookup {
 
 static void mode_rsp(struct pending_cmd *cmd, void *data)
 {
-        struct mgmt_mode *cp = cmd->cmd;
+        struct mgmt_mode *cp = cmd->param;
         struct cmd_lookup *match = data;
 
         if (cp->val != match->val)
@@ -1455,17 +1858,17 @@ int mgmt_connectable(u16 index, u8 connectable)
         return ret;
 }
 
-int mgmt_new_key(u16 index, struct link_key *key, u8 old_key_type)
+int mgmt_new_key(u16 index, struct link_key *key, u8 persistent)
 {
         struct mgmt_ev_new_key ev;
 
         memset(&ev, 0, sizeof(ev));
 
+        ev.store_hint = persistent;
         bacpy(&ev.key.bdaddr, &key->bdaddr);
         ev.key.type = key->type;
         memcpy(ev.key.val, key->val, 16);
         ev.key.pin_len = key->pin_len;
-        ev.old_key_type = old_key_type;
 
         return mgmt_event(MGMT_EV_NEW_KEY, index, &ev, sizeof(ev), NULL);
 }
@@ -1481,7 +1884,7 @@ int mgmt_connected(u16 index, bdaddr_t *bdaddr)
 
 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
 {
-        struct mgmt_cp_disconnect *cp = cmd->cmd;
+        struct mgmt_cp_disconnect *cp = cmd->param;
         struct sock **sk = data;
         struct mgmt_rp_disconnect rp;
 
@@ -1539,11 +1942,12 @@ int mgmt_connect_failed(u16 index, bdaddr_t *bdaddr, u8 status)
         return mgmt_event(MGMT_EV_CONNECT_FAILED, index, &ev, sizeof(ev), NULL);
 }
 
-int mgmt_pin_code_request(u16 index, bdaddr_t *bdaddr)
+int mgmt_pin_code_request(u16 index, bdaddr_t *bdaddr, u8 secure)
 {
         struct mgmt_ev_pin_code_request ev;
 
         bacpy(&ev.bdaddr, bdaddr);
+        ev.secure = secure;
 
         return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, index, &ev, sizeof(ev),
                                                                         NULL);
@@ -1591,13 +1995,15 @@ int mgmt_pin_code_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
         return err;
 }
 
-int mgmt_user_confirm_request(u16 index, bdaddr_t *bdaddr, __le32 value)
+int mgmt_user_confirm_request(u16 index, bdaddr_t *bdaddr, __le32 value,
+                                                        u8 confirm_hint)
 {
         struct mgmt_ev_user_confirm_request ev;
 
         BT_DBG("hci%u", index);
 
         bacpy(&ev.bdaddr, bdaddr);
+        ev.confirm_hint = confirm_hint;
         put_unaligned_le32(value, &ev.value);
 
         return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, index, &ev, sizeof(ev),
@@ -1645,3 +2051,110 @@ int mgmt_auth_failed(u16 index, bdaddr_t *bdaddr, u8 status)
 
         return mgmt_event(MGMT_EV_AUTH_FAILED, index, &ev, sizeof(ev), NULL);
 }
+
+int mgmt_set_local_name_complete(u16 index, u8 *name, u8 status)
+{
+        struct pending_cmd *cmd;
+        struct hci_dev *hdev;
+        struct mgmt_cp_set_local_name ev;
+        int err;
+
+        memset(&ev, 0, sizeof(ev));
+        memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
+
+        cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, index);
+        if (!cmd)
+                goto send_event;
+
+        if (status) {
+                err = cmd_status(cmd->sk, index, MGMT_OP_SET_LOCAL_NAME, EIO);
+                goto failed;
+        }
+
+        hdev = hci_dev_get(index);
+        if (hdev) {
+                hci_dev_lock_bh(hdev);
+                update_eir(hdev);
+                hci_dev_unlock_bh(hdev);
+                hci_dev_put(hdev);
+        }
+
+        err = cmd_complete(cmd->sk, index, MGMT_OP_SET_LOCAL_NAME, &ev,
+                                                                sizeof(ev));
+        if (err < 0)
+                goto failed;
+
+send_event:
+        err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, index, &ev, sizeof(ev),
+                                                        cmd ? cmd->sk : NULL);
+
+failed:
+        if (cmd)
+                mgmt_pending_remove(cmd);
+        return err;
+}
+
+int mgmt_read_local_oob_data_reply_complete(u16 index, u8 *hash, u8 *randomizer,
+                                                                u8 status)
+{
+        struct pending_cmd *cmd;
+        int err;
+
+        BT_DBG("hci%u status %u", index, status);
+
+        cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, index);
+        if (!cmd)
+                return -ENOENT;
+
+        if (status) {
+                err = cmd_status(cmd->sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                                                        EIO);
+        } else {
+                struct mgmt_rp_read_local_oob_data rp;
+
+                memcpy(rp.hash, hash, sizeof(rp.hash));
+                memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
+
+                err = cmd_complete(cmd->sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                                        &rp, sizeof(rp));
+        }
+
+        mgmt_pending_remove(cmd);
+
+        return err;
+}
+
+int mgmt_device_found(u16 index, bdaddr_t *bdaddr, u8 *dev_class, s8 rssi,
+                                                                u8 *eir)
+{
+        struct mgmt_ev_device_found ev;
+
+        memset(&ev, 0, sizeof(ev));
+
+        bacpy(&ev.bdaddr, bdaddr);
+        memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
+        ev.rssi = rssi;
+
+        if (eir)
+                memcpy(ev.eir, eir, sizeof(ev.eir));
+
+        return mgmt_event(MGMT_EV_DEVICE_FOUND, index, &ev, sizeof(ev), NULL);
+}
+
+int mgmt_remote_name(u16 index, bdaddr_t *bdaddr, u8 *name)
+{
+        struct mgmt_ev_remote_name ev;
+
+        memset(&ev, 0, sizeof(ev));
+
+        bacpy(&ev.bdaddr, bdaddr);
+        memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
+
+        return mgmt_event(MGMT_EV_REMOTE_NAME, index, &ev, sizeof(ev), NULL);
+}
+
+int mgmt_discovering(u16 index, u8 discovering)
+{
+        return mgmt_event(MGMT_EV_DISCOVERING, index, &discovering,
+                                                sizeof(discovering), NULL);
+}
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index c9973932456f..121a5c13b989 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -232,6 +232,8 @@ static int rfcomm_l2sock_create(struct socket **sock)
 static inline int rfcomm_check_security(struct rfcomm_dlc *d)
 {
         struct sock *sk = d->session->sock->sk;
+        struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
+
         __u8 auth_type;
 
         switch (d->sec_level) {
@@ -246,8 +248,7 @@ static inline int rfcomm_check_security(struct rfcomm_dlc *d)
                 break;
         }
 
-        return hci_conn_security(l2cap_pi(sk)->conn->hcon, d->sec_level,
-                                                                auth_type);
+        return hci_conn_security(conn->hcon, d->sec_level, auth_type);
 }
 
 static void rfcomm_session_timeout(unsigned long arg)
@@ -710,10 +711,10 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
         /* Set L2CAP options */
         sk = sock->sk;
         lock_sock(sk);
-        l2cap_pi(sk)->imtu = l2cap_mtu;
-        l2cap_pi(sk)->sec_level = sec_level;
+        l2cap_pi(sk)->chan->imtu = l2cap_mtu;
+        l2cap_pi(sk)->chan->sec_level = sec_level;
         if (l2cap_ertm)
-                l2cap_pi(sk)->mode = L2CAP_MODE_ERTM;
+                l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM;
         release_sock(sk);
 
         s = rfcomm_session_add(sock, BT_BOUND);
@@ -1241,6 +1242,7 @@ static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
 {
         struct sock *sk = d->session->sock->sk;
+        struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
 
         BT_DBG("dlc %p", d);
 
@@ -1254,7 +1256,7 @@ void rfcomm_dlc_accept(struct rfcomm_dlc *d)
         rfcomm_dlc_unlock(d);
 
         if (d->role_switch)
-                hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00);
+                hci_conn_switch_role(conn->hcon, 0x00);
 
         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
 }
@@ -1890,7 +1892,8 @@ static inline void rfcomm_accept_connection(struct rfcomm_session *s)
 
                 /* We should adjust MTU on incoming sessions.
                  * L2CAP MTU minus UIH header and FCS. */
-                s->mtu = min(l2cap_pi(nsock->sk)->omtu, l2cap_pi(nsock->sk)->imtu) - 5;
+                s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
+                                l2cap_pi(nsock->sk)->chan->imtu) - 5;
 
                 rfcomm_schedule();
         } else
@@ -1909,7 +1912,7 @@ static inline void rfcomm_check_connection(struct rfcomm_session *s)
 
                 /* We can adjust MTU on outgoing sessions.
                  * L2CAP MTU minus UIH header and FCS. */
-                s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
+                s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5;
 
                 rfcomm_send_sabm(s, 0);
                 break;
@@ -1992,7 +1995,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
         /* Set L2CAP options */
         sk = sock->sk;
         lock_sock(sk);
-        l2cap_pi(sk)->imtu = l2cap_mtu;
+        l2cap_pi(sk)->chan->imtu = l2cap_mtu;
         release_sock(sk);
 
         /* Start listening on the socket */
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 66cc1f0c3df8..386cfaffd4b7 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -743,6 +743,7 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
         struct sock *sk = sock->sk;
         struct sock *l2cap_sk;
         struct rfcomm_conninfo cinfo;
+        struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
         int len, err = 0;
         u32 opt;
 
@@ -787,8 +788,8 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
 
                 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
 
-                cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
-                memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
+                cinfo.hci_handle = conn->hcon->handle;
+                memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
 
                 len = min_t(unsigned int, len, sizeof(cinfo));
                 if (copy_to_user(optval, (char *) &cinfo, len))
diff --git a/net/bridge/br.c b/net/bridge/br.c
index 84bbb82599b2..f20c4fd915a8 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -104,3 +104,4 @@ module_init(br_init)
 module_exit(br_deinit)
 MODULE_LICENSE("GPL");
 MODULE_VERSION(BR_VERSION);
+MODULE_ALIAS_RTNL_LINK("bridge");
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 21e5901186ea..a6b2f86378c7 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -74,13 +74,23 @@ out:
         return NETDEV_TX_OK;
 }
 
+static int br_dev_init(struct net_device *dev)
+{
+        struct net_bridge *br = netdev_priv(dev);
+
+        br->stats = alloc_percpu(struct br_cpu_netstats);
+        if (!br->stats)
+                return -ENOMEM;
+
+        return 0;
+}
+
 static int br_dev_open(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
 
         netif_carrier_off(dev);
-
-        br_features_recompute(br);
+        netdev_update_features(dev);
         netif_start_queue(dev);
         br_stp_enable_bridge(br);
         br_multicast_open(br);
@@ -177,48 +187,11 @@ static void br_getinfo(struct net_device *dev, struct ethtool_drvinfo *info)
         strcpy(info->bus_info, "N/A");
 }
 
-static int br_set_sg(struct net_device *dev, u32 data)
-{
-        struct net_bridge *br = netdev_priv(dev);
-
-        if (data)
-                br->feature_mask |= NETIF_F_SG;
-        else
-                br->feature_mask &= ~NETIF_F_SG;
-
-        br_features_recompute(br);
-        return 0;
-}
-
-static int br_set_tso(struct net_device *dev, u32 data)
-{
-        struct net_bridge *br = netdev_priv(dev);
-
-        if (data)
-                br->feature_mask |= NETIF_F_TSO;
-        else
-                br->feature_mask &= ~NETIF_F_TSO;
-
-        br_features_recompute(br);
-        return 0;
-}
-
-static int br_set_tx_csum(struct net_device *dev, u32 data)
+static u32 br_fix_features(struct net_device *dev, u32 features)
 {
         struct net_bridge *br = netdev_priv(dev);
 
-        if (data)
-                br->feature_mask |= NETIF_F_NO_CSUM;
-        else
-                br->feature_mask &= ~NETIF_F_ALL_CSUM;
-
-        br_features_recompute(br);
-        return 0;
-}
-
-static int br_set_flags(struct net_device *netdev, u32 data)
-{
-        return ethtool_op_set_flags(netdev, data, ETH_FLAG_TXVLAN);
+        return br_features_recompute(br, features);
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -319,21 +292,12 @@ static int br_del_slave(struct net_device *dev, struct net_device *slave_dev)
 static const struct ethtool_ops br_ethtool_ops = {
         .get_drvinfo    = br_getinfo,
         .get_link       = ethtool_op_get_link,
-        .get_tx_csum    = ethtool_op_get_tx_csum,
-        .set_tx_csum    = br_set_tx_csum,
-        .get_sg         = ethtool_op_get_sg,
-        .set_sg         = br_set_sg,
-        .get_tso        = ethtool_op_get_tso,
-        .set_tso        = br_set_tso,
-        .get_ufo        = ethtool_op_get_ufo,
-        .set_ufo        = ethtool_op_set_ufo,
-        .get_flags      = ethtool_op_get_flags,
-        .set_flags      = br_set_flags,
 };
 
 static const struct net_device_ops br_netdev_ops = {
         .ndo_open                = br_dev_open,
         .ndo_stop                = br_dev_stop,
+        .ndo_init                = br_dev_init,
         .ndo_start_xmit          = br_dev_xmit,
         .ndo_get_stats64         = br_get_stats64,
         .ndo_set_mac_address     = br_set_mac_address,
@@ -347,6 +311,7 @@ static const struct net_device_ops br_netdev_ops = {
 #endif
         .ndo_add_slave           = br_add_slave,
         .ndo_del_slave           = br_del_slave,
+        .ndo_fix_features        = br_fix_features,
 };
 
 static void br_dev_free(struct net_device *dev)
@@ -357,18 +322,49 @@ static void br_dev_free(struct net_device *dev)
         free_netdev(dev);
 }
 
+static struct device_type br_type = {
+        .name   = "bridge",
+};
+
 void br_dev_setup(struct net_device *dev)
 {
+        struct net_bridge *br = netdev_priv(dev);
+
         random_ether_addr(dev->dev_addr);
         ether_setup(dev);
 
         dev->netdev_ops = &br_netdev_ops;
         dev->destructor = br_dev_free;
         SET_ETHTOOL_OPS(dev, &br_ethtool_ops);
+        SET_NETDEV_DEVTYPE(dev, &br_type);
         dev->tx_queue_len = 0;
         dev->priv_flags = IFF_EBRIDGE;
 
         dev->features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
                         NETIF_F_GSO_MASK | NETIF_F_NO_CSUM | NETIF_F_LLTX |
-                        NETIF_F_NETNS_LOCAL | NETIF_F_GSO | NETIF_F_HW_VLAN_TX;
+                        NETIF_F_NETNS_LOCAL | NETIF_F_HW_VLAN_TX;
+        dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
+                           NETIF_F_GSO_MASK | NETIF_F_NO_CSUM |
+                           NETIF_F_HW_VLAN_TX;
+
+        br->dev = dev;
+        spin_lock_init(&br->lock);
+        INIT_LIST_HEAD(&br->port_list);
+        spin_lock_init(&br->hash_lock);
+
+        br->bridge_id.prio[0] = 0x80;
+        br->bridge_id.prio[1] = 0x00;
+
+        memcpy(br->group_addr, br_group_address, ETH_ALEN);
+
+        br->stp_enabled = BR_NO_STP;
+        br->designated_root = br->bridge_id;
+        br->bridge_max_age = br->max_age = 20 * HZ;
+        br->bridge_hello_time = br->hello_time = 2 * HZ;
+        br->bridge_forward_delay = br->forward_delay = 15 * HZ;
+        br->ageing_time = 300 * HZ;
+
+        br_netfilter_rtable_init(br);
+        br_stp_timer_init(br);
+        br_multicast_init(br);
 }
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index cc4d3c5ab1c6..e0dfbc151dd7 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -28,6 +28,7 @@
 static struct kmem_cache *br_fdb_cache __read_mostly;
 static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
                       const unsigned char *addr);
+static void fdb_notify(const struct net_bridge_fdb_entry *, int);
 
 static u32 fdb_salt __read_mostly;
 
@@ -62,7 +63,7 @@ static inline int has_expired(const struct net_bridge *br,
                                   const struct net_bridge_fdb_entry *fdb)
 {
         return !fdb->is_static &&
-                time_before_eq(fdb->ageing_timer + hold_time(br), jiffies);
+                time_before_eq(fdb->updated + hold_time(br), jiffies);
 }
 
 static inline int br_mac_hash(const unsigned char *mac)
@@ -81,6 +82,7 @@ static void fdb_rcu_free(struct rcu_head *head)
 
 static inline void fdb_delete(struct net_bridge_fdb_entry *f)
 {
+        fdb_notify(f, RTM_DELNEIGH);
         hlist_del_rcu(&f->hlist);
         call_rcu(&f->rcu, fdb_rcu_free);
 }
@@ -140,7 +142,7 @@ void br_fdb_cleanup(unsigned long _data)
                         unsigned long this_timer;
                         if (f->is_static)
                                 continue;
-                        this_timer = f->ageing_timer + delay;
+                        this_timer = f->updated + delay;
                         if (time_before_eq(this_timer, jiffies))
                                 fdb_delete(f);
                         else if (time_before(this_timer, next_timer))
@@ -293,7 +295,7 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf,
 
                         fe->is_local = f->is_local;
                         if (!f->is_static)
-                                fe->ageing_timer_value = jiffies_to_clock_t(jiffies - f->ageing_timer);
+                                fe->ageing_timer_value = jiffies_to_clock_t(jiffies - f->updated);
                         ++fe;
                         ++num;
                 }
@@ -305,8 +307,21 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf,
         return num;
 }
 
-static inline struct net_bridge_fdb_entry *fdb_find(struct hlist_head *head,
-                                                    const unsigned char *addr)
+static struct net_bridge_fdb_entry *fdb_find(struct hlist_head *head,
+                                             const unsigned char *addr)
+{
+        struct hlist_node *h;
+        struct net_bridge_fdb_entry *fdb;
+
+        hlist_for_each_entry(fdb, h, head, hlist) {
+                if (!compare_ether_addr(fdb->addr.addr, addr))
+                        return fdb;
+        }
+        return NULL;
+}
+
+static struct net_bridge_fdb_entry *fdb_find_rcu(struct hlist_head *head,
+                                                 const unsigned char *addr)
 {
         struct hlist_node *h;
         struct net_bridge_fdb_entry *fdb;
@@ -320,8 +335,7 @@ static inline struct net_bridge_fdb_entry *fdb_find(struct hlist_head *head,
 
 static struct net_bridge_fdb_entry *fdb_create(struct hlist_head *head,
                                                struct net_bridge_port *source,
-                                               const unsigned char *addr,
-                                               int is_local)
+                                               const unsigned char *addr)
 {
         struct net_bridge_fdb_entry *fdb;
 
@@ -329,11 +343,11 @@ static struct net_bridge_fdb_entry *fdb_create(struct hlist_head *head,
         if (fdb) {
                 memcpy(fdb->addr.addr, addr, ETH_ALEN);
                 fdb->dst = source;
-                fdb->is_local = is_local;
-                fdb->is_static = is_local;
-                fdb->ageing_timer = jiffies;
-
+                fdb->is_local = 0;
+                fdb->is_static = 0;
+                fdb->updated = fdb->used = jiffies;
                 hlist_add_head_rcu(&fdb->hlist, head);
+                fdb_notify(fdb, RTM_NEWNEIGH);
         }
         return fdb;
 }
@@ -360,12 +374,15 @@ static int fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
                 fdb_delete(fdb);
         }
 
-        if (!fdb_create(head, source, addr, 1))
+        fdb = fdb_create(head, source, addr);
+        if (!fdb)
                 return -ENOMEM;
 
+        fdb->is_local = fdb->is_static = 1;
         return 0;
 }
 
+/* Add entry for local address of interface */
 int br_fdb_insert(struct net_bridge *br, struct net_bridge_port *source,
                   const unsigned char *addr)
 {
@@ -392,7 +409,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
               source->state == BR_STATE_FORWARDING))
                 return;
 
-        fdb = fdb_find(head, addr);
+        fdb = fdb_find_rcu(head, addr);
         if (likely(fdb)) {
                 /* attempt to update an entry for a local interface */
                 if (unlikely(fdb->is_local)) {
@@ -403,15 +420,277 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
                 } else {
                         /* fastpath: update of existing entry */
                         fdb->dst = source;
-                        fdb->ageing_timer = jiffies;
+                        fdb->updated = jiffies;
                 }
         } else {
                 spin_lock(&br->hash_lock);
-                if (!fdb_find(head, addr))
-                        fdb_create(head, source, addr, 0);
+                if (likely(!fdb_find(head, addr)))
+                        fdb_create(head, source, addr);
+
                 /* else  we lose race and someone else inserts
                  * it first, don't bother updating
                  */
                 spin_unlock(&br->hash_lock);
         }
 }
+
+static int fdb_to_nud(const struct net_bridge_fdb_entry *fdb)
+{
+        if (fdb->is_local)
+                return NUD_PERMANENT;
+        else if (fdb->is_static)
+                return NUD_NOARP;
+        else if (has_expired(fdb->dst->br, fdb))
+                return NUD_STALE;
+        else
+                return NUD_REACHABLE;
+}
+
+static int fdb_fill_info(struct sk_buff *skb,
+                         const struct net_bridge_fdb_entry *fdb,
+                         u32 pid, u32 seq, int type, unsigned int flags)
+{
+        unsigned long now = jiffies;
+        struct nda_cacheinfo ci;
+        struct nlmsghdr *nlh;
+        struct ndmsg *ndm;
+
+        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), flags);
+        if (nlh == NULL)
+                return -EMSGSIZE;
+
+
+        ndm = nlmsg_data(nlh);
+        ndm->ndm_family  = AF_BRIDGE;
+        ndm->ndm_pad1    = 0;
+        ndm->ndm_pad2    = 0;
+        ndm->ndm_flags   = 0;
+        ndm->ndm_type    = 0;
+        ndm->ndm_ifindex = fdb->dst->dev->ifindex;
+        ndm->ndm_state   = fdb_to_nud(fdb);
+
+        NLA_PUT(skb, NDA_LLADDR, ETH_ALEN, &fdb->addr);
+
+        ci.ndm_used      = jiffies_to_clock_t(now - fdb->used);
+        ci.ndm_confirmed = 0;
+        ci.ndm_updated   = jiffies_to_clock_t(now - fdb->updated);
+        ci.ndm_refcnt    = 0;
+        NLA_PUT(skb, NDA_CACHEINFO, sizeof(ci), &ci);
+
+        return nlmsg_end(skb, nlh);
+
+nla_put_failure:
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
+}
+
+static inline size_t fdb_nlmsg_size(void)
+{
+        return NLMSG_ALIGN(sizeof(struct ndmsg))
+                + nla_total_size(ETH_ALEN) /* NDA_LLADDR */
+                + nla_total_size(sizeof(struct nda_cacheinfo));
+}
+
+static void fdb_notify(const struct net_bridge_fdb_entry *fdb, int type)
+{
+        struct net *net = dev_net(fdb->dst->dev);
+        struct sk_buff *skb;
+        int err = -ENOBUFS;
+
+        skb = nlmsg_new(fdb_nlmsg_size(), GFP_ATOMIC);
+        if (skb == NULL)
+                goto errout;
+
+        err = fdb_fill_info(skb, fdb, 0, 0, type, 0);
+        if (err < 0) {
+                /* -EMSGSIZE implies BUG in fdb_nlmsg_size() */
+                WARN_ON(err == -EMSGSIZE);
+                kfree_skb(skb);
+                goto errout;
+        }
+        rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
+        return;
+errout:
+        if (err < 0)
+                rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
+}
+
+/* Dump information about entries, in response to GETNEIGH */
+int br_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        struct net *net = sock_net(skb->sk);
+        struct net_device *dev;
+        int idx = 0;
+
+        rcu_read_lock();
+        for_each_netdev_rcu(net, dev) {
+                struct net_bridge *br = netdev_priv(dev);
+                int i;
+
+                if (!(dev->priv_flags & IFF_EBRIDGE))
+                        continue;
+
+                for (i = 0; i < BR_HASH_SIZE; i++) {
+                        struct hlist_node *h;
+                        struct net_bridge_fdb_entry *f;
+
+                        hlist_for_each_entry_rcu(f, h, &br->hash[i], hlist) {
+                                if (idx < cb->args[0])
+                                        goto skip;
+
+                                if (fdb_fill_info(skb, f,
+                                                  NETLINK_CB(cb->skb).pid,
+                                                  cb->nlh->nlmsg_seq,
+                                                  RTM_NEWNEIGH,
+                                                  NLM_F_MULTI) < 0)
+                                        break;
+skip:
+                                ++idx;
+                        }
+                }
+        }
+        rcu_read_unlock();
+
+        cb->args[0] = idx;
+
+        return skb->len;
+}
+
+/* Create new static fdb entry */
+static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr,
+                         __u16 state)
+{
+        struct net_bridge *br = source->br;
+        struct hlist_head *head = &br->hash[br_mac_hash(addr)];
+        struct net_bridge_fdb_entry *fdb;
+
+        fdb = fdb_find(head, addr);
+        if (fdb)
+                return -EEXIST;
+
+        fdb = fdb_create(head, source, addr);
+        if (!fdb)
+                return -ENOMEM;
+
+        if (state & NUD_PERMANENT)
+                fdb->is_local = fdb->is_static = 1;
+        else if (state & NUD_NOARP)
+                fdb->is_static = 1;
+        return 0;
+}
+
+/* Add new permanent fdb entry with RTM_NEWNEIGH */
+int br_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
+{
+        struct net *net = sock_net(skb->sk);
+        struct ndmsg *ndm;
+        struct nlattr *tb[NDA_MAX+1];
+        struct net_device *dev;
+        struct net_bridge_port *p;
+        const __u8 *addr;
+        int err;
+
+        ASSERT_RTNL();
+        err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL);
+        if (err < 0)
+                return err;
+
+        ndm = nlmsg_data(nlh);
+        if (ndm->ndm_ifindex == 0) {
+                pr_info("bridge: RTM_NEWNEIGH with invalid ifindex\n");
+                return -EINVAL;
+        }
+
+        dev = __dev_get_by_index(net, ndm->ndm_ifindex);
+        if (dev == NULL) {
+                pr_info("bridge: RTM_NEWNEIGH with unknown ifindex\n");
+                return -ENODEV;
+        }
+
+        if (!tb[NDA_LLADDR] || nla_len(tb[NDA_LLADDR]) != ETH_ALEN) {
+                pr_info("bridge: RTM_NEWNEIGH with invalid address\n");
+                return -EINVAL;
+        }
+
+        addr = nla_data(tb[NDA_LLADDR]);
+        if (!is_valid_ether_addr(addr)) {
+                pr_info("bridge: RTM_NEWNEIGH with invalid ether address\n");
+                return -EINVAL;
+        }
+
+        p = br_port_get_rtnl(dev);
+        if (p == NULL) {
+                pr_info("bridge: RTM_NEWNEIGH %s not a bridge port\n",
+                        dev->name);
+                return -EINVAL;
+        }
+
+        spin_lock_bh(&p->br->hash_lock);
+        err = fdb_add_entry(p, addr, ndm->ndm_state);
+        spin_unlock_bh(&p->br->hash_lock);
+
+        return err;
+}
+
+static int fdb_delete_by_addr(struct net_bridge_port *p, const u8 *addr)
+{
+        struct net_bridge *br = p->br;
+        struct hlist_head *head = &br->hash[br_mac_hash(addr)];
+        struct net_bridge_fdb_entry *fdb;
+
+        fdb = fdb_find(head, addr);
+        if (!fdb)
+                return -ENOENT;
+
+        fdb_delete(fdb);
+        return 0;
+}
+
+/* Remove neighbor entry with RTM_DELNEIGH */
+int br_fdb_delete(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
+{
+        struct net *net = sock_net(skb->sk);
+        struct ndmsg *ndm;
+        struct net_bridge_port *p;
+        struct nlattr *llattr;
+        const __u8 *addr;
+        struct net_device *dev;
+        int err;
+
+        ASSERT_RTNL();
+        if (nlmsg_len(nlh) < sizeof(*ndm))
+                return -EINVAL;
+
+        ndm = nlmsg_data(nlh);
+        if (ndm->ndm_ifindex == 0) {
+                pr_info("bridge: RTM_DELNEIGH with invalid ifindex\n");
+                return -EINVAL;
+        }
+
+        dev = __dev_get_by_index(net, ndm->ndm_ifindex);
+        if (dev == NULL) {
+                pr_info("bridge: RTM_DELNEIGH with unknown ifindex\n");
+                return -ENODEV;
+        }
+
+        llattr = nlmsg_find_attr(nlh, sizeof(*ndm), NDA_LLADDR);
+        if (llattr == NULL || nla_len(llattr) != ETH_ALEN) {
+                pr_info("bridge: RTM_DELNEIGH with invalid address\n");
+                return -EINVAL;
+        }
+
+        addr = nla_data(llattr);
+
+        p = br_port_get_rtnl(dev);
+        if (p == NULL) {
+                pr_info("bridge: RTM_DELNEIGH %s not a bridge port\n",
+                        dev->name);
+                return -EINVAL;
+        }
+
+        spin_lock_bh(&p->br->hash_lock);
+        err = fdb_delete_by_addr(p, addr);
+        spin_unlock_bh(&p->br->hash_lock);
+
+        return err;
+}
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 718b60366dfe..5dbdfdfc3a34 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -36,8 +36,8 @@ static int port_cost(struct net_device *dev)
         if (dev->ethtool_ops && dev->ethtool_ops->get_settings) {
                 struct ethtool_cmd ecmd = { .cmd = ETHTOOL_GSET, };
 
-                if (!dev->ethtool_ops->get_settings(dev, &ecmd)) {
-                        switch(ecmd.speed) {
+                if (!dev_ethtool_get_settings(dev, &ecmd)) {
+                        switch (ethtool_cmd_speed(&ecmd)) {
                         case SPEED_10000:
                                 return 2;
                         case SPEED_1000:
@@ -175,56 +175,6 @@ static void del_br(struct net_bridge *br, struct list_head *head)
         unregister_netdevice_queue(br->dev, head);
 }
 
-static struct net_device *new_bridge_dev(struct net *net, const char *name)
-{
-        struct net_bridge *br;
-        struct net_device *dev;
-
-        dev = alloc_netdev(sizeof(struct net_bridge), name,
-                           br_dev_setup);
-
-        if (!dev)
-                return NULL;
-        dev_net_set(dev, net);
-
-        br = netdev_priv(dev);
-        br->dev = dev;
-
-        br->stats = alloc_percpu(struct br_cpu_netstats);
-        if (!br->stats) {
-                free_netdev(dev);
-                return NULL;
-        }
-
-        spin_lock_init(&br->lock);
-        INIT_LIST_HEAD(&br->port_list);
-        spin_lock_init(&br->hash_lock);
-
-        br->bridge_id.prio[0] = 0x80;
-        br->bridge_id.prio[1] = 0x00;
-
-        memcpy(br->group_addr, br_group_address, ETH_ALEN);
-
-        br->feature_mask = dev->features;
-        br->stp_enabled = BR_NO_STP;
-        br->designated_root = br->bridge_id;
-        br->root_path_cost = 0;
-        br->root_port = 0;
-        br->bridge_max_age = br->max_age = 20 * HZ;
-        br->bridge_hello_time = br->hello_time = 2 * HZ;
-        br->bridge_forward_delay = br->forward_delay = 15 * HZ;
-        br->topology_change = 0;
-        br->topology_change_detected = 0;
-        br->ageing_time = 300 * HZ;
-
-        br_netfilter_rtable_init(br);
-
-        br_stp_timer_init(br);
-        br_multicast_init(br);
-
-        return dev;
-}
-
 /* find an available port number */
 static int find_portno(struct net_bridge *br)
 {
@@ -277,42 +227,19 @@ static struct net_bridge_port *new_nbp(struct net_bridge *br,
         return p;
 }
 
-static struct device_type br_type = {
-        .name   = "bridge",
-};
-
 int br_add_bridge(struct net *net, const char *name)
 {
         struct net_device *dev;
-        int ret;
 
-        dev = new_bridge_dev(net, name);
+        dev = alloc_netdev(sizeof(struct net_bridge), name,
+                           br_dev_setup);
+
         if (!dev)
                 return -ENOMEM;
 
-        rtnl_lock();
-        if (strchr(dev->name, '%')) {
-                ret = dev_alloc_name(dev, dev->name);
-                if (ret < 0)
-                        goto out_free;
-        }
-
-        SET_NETDEV_DEVTYPE(dev, &br_type);
-
-        ret = register_netdevice(dev);
-        if (ret)
-                goto out_free;
-
-        ret = br_sysfs_addbr(dev);
-        if (ret)
-                unregister_netdevice(dev);
- out:
-        rtnl_unlock();
-        return ret;
+        dev_net_set(dev, net);
 
-out_free:
-        free_netdev(dev);
-        goto out;
+        return register_netdev(dev);
 }
 
 int br_del_bridge(struct net *net, const char *name)
@@ -364,15 +291,15 @@ int br_min_mtu(const struct net_bridge *br)
 /*
  * Recomputes features using slave's features
  */
-void br_features_recompute(struct net_bridge *br)
+u32 br_features_recompute(struct net_bridge *br, u32 features)
 {
         struct net_bridge_port *p;
-        u32 features, mask;
+        u32 mask;
 
-        features = mask = br->feature_mask;
         if (list_empty(&br->port_list))
-                goto done;
+                return features;
 
+        mask = features;
         features &= ~NETIF_F_ONE_FOR_ALL;
 
         list_for_each_entry(p, &br->port_list, list) {
@@ -380,8 +307,7 @@ void br_features_recompute(struct net_bridge *br)
                                                      p->dev->features, mask);
         }
 
-done:
-        br->dev->features = netdev_fix_features(br->dev, features);
+        return features;
 }
 
 /* called with RTNL */
@@ -446,9 +372,10 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 
         list_add_rcu(&p->list, &br->port_list);
 
+        netdev_update_features(br->dev);
+
         spin_lock_bh(&br->lock);
         changed_addr = br_stp_recalculate_bridge_id(br);
-        br_features_recompute(br);
 
         if ((dev->flags & IFF_UP) && netif_carrier_ok(dev) &&
             (br->dev->flags & IFF_UP))
@@ -496,9 +423,10 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
 
         spin_lock_bh(&br->lock);
         br_stp_recalculate_bridge_id(br);
-        br_features_recompute(br);
         spin_unlock_bh(&br->lock);
 
+        netdev_update_features(br->dev);
+
         return 0;
 }
 
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 0c7badad62af..f3ac1e858ee1 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -98,9 +98,10 @@ int br_handle_frame_finish(struct sk_buff *skb)
         }
 
         if (skb) {
-                if (dst)
+                if (dst) {
+                        dst->used = jiffies;
                         br_forward(dst->dst, skb, skb2);
-                else
+                } else
                         br_flood_forward(br, skb, skb2);
         }
 
diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
index 3d9fca0e3370..7222fe1d5460 100644
--- a/net/bridge/br_ioctl.c
+++ b/net/bridge/br_ioctl.c
@@ -181,40 +181,19 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
 
-                spin_lock_bh(&br->lock);
-                br->bridge_forward_delay = clock_t_to_jiffies(args[1]);
-                if (br_is_root_bridge(br))
-                        br->forward_delay = br->bridge_forward_delay;
-                spin_unlock_bh(&br->lock);
-                return 0;
+                return br_set_forward_delay(br, args[1]);
 
         case BRCTL_SET_BRIDGE_HELLO_TIME:
-        {
-                unsigned long t = clock_t_to_jiffies(args[1]);
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
 
-                if (t < HZ)
-                        return -EINVAL;
-
-                spin_lock_bh(&br->lock);
-                br->bridge_hello_time = t;
-                if (br_is_root_bridge(br))
-                        br->hello_time = br->bridge_hello_time;
-                spin_unlock_bh(&br->lock);
-                return 0;
-        }
+                return br_set_hello_time(br, args[1]);
 
         case BRCTL_SET_BRIDGE_MAX_AGE:
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
 
-                spin_lock_bh(&br->lock);
-                br->bridge_max_age = clock_t_to_jiffies(args[1]);
-                if (br_is_root_bridge(br))
-                        br->max_age = br->bridge_max_age;
-                spin_unlock_bh(&br->lock);
-                return 0;
+                return br_set_max_age(br, args[1]);
 
         case BRCTL_SET_AGEING_TIME:
                 if (!capable(CAP_NET_ADMIN))
@@ -275,19 +254,16 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
         case BRCTL_SET_PORT_PRIORITY:
         {
                 struct net_bridge_port *p;
-                int ret = 0;
+                int ret;
 
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
 
-                if (args[2] >= (1<<(16-BR_PORT_BITS)))
-                        return -ERANGE;
-
                 spin_lock_bh(&br->lock);
                 if ((p = br_get_port(br, args[1])) == NULL)
                         ret = -EINVAL;
                 else
-                        br_stp_set_port_priority(p, args[2]);
+                        ret = br_stp_set_port_priority(p, args[2]);
                 spin_unlock_bh(&br->lock);
                 return ret;
         }
@@ -295,15 +271,17 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
         case BRCTL_SET_PATH_COST:
         {
                 struct net_bridge_port *p;
-                int ret = 0;
+                int ret;
 
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
 
+                spin_lock_bh(&br->lock);
                 if ((p = br_get_port(br, args[1])) == NULL)
                         ret = -EINVAL;
                 else
-                        br_stp_set_path_cost(p, args[2]);
+                        ret = br_stp_set_path_cost(p, args[2]);
+                spin_unlock_bh(&br->lock);
 
                 return ret;
         }
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 59660c909a7c..2f14eafdeeab 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -413,7 +413,7 @@ out:
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
-                                                    struct in6_addr *group)
+                                                    const struct in6_addr *group)
 {
         struct sk_buff *skb;
         struct ipv6hdr *ip6h;
@@ -1115,7 +1115,7 @@ static int br_ip4_multicast_query(struct net_bridge *br,
                                   struct net_bridge_port *port,
                                   struct sk_buff *skb)
 {
-        struct iphdr *iph = ip_hdr(skb);
+        const struct iphdr *iph = ip_hdr(skb);
         struct igmphdr *ih = igmp_hdr(skb);
         struct net_bridge_mdb_entry *mp;
         struct igmpv3_query *ih3;
@@ -1190,7 +1190,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                                   struct net_bridge_port *port,
                                   struct sk_buff *skb)
 {
-        struct ipv6hdr *ip6h = ipv6_hdr(skb);
+        const struct ipv6hdr *ip6h = ipv6_hdr(skb);
         struct mld_msg *mld = (struct mld_msg *) icmp6_hdr(skb);
         struct net_bridge_mdb_entry *mp;
         struct mld2_query *mld2q;
@@ -1198,7 +1198,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
         struct net_bridge_port_group __rcu **pp;
         unsigned long max_delay;
         unsigned long now = jiffies;
-        struct in6_addr *group = NULL;
+        const struct in6_addr *group = NULL;
         int err = 0;
 
         spin_lock(&br->multicast_lock);
@@ -1356,7 +1356,7 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
                                  struct sk_buff *skb)
 {
         struct sk_buff *skb2 = skb;
-        struct iphdr *iph;
+        const struct iphdr *iph;
         struct igmphdr *ih;
         unsigned len;
         unsigned offset;
@@ -1452,7 +1452,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                                  struct sk_buff *skb)
 {
         struct sk_buff *skb2;
-        struct ipv6hdr *ip6h;
+        const struct ipv6hdr *ip6h;
         struct icmp6hdr *icmp6h;
         u8 nexthdr;
         unsigned len;
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index f3bc322c5891..5614907525e1 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -219,7 +219,7 @@ static inline void nf_bridge_update_protocol(struct sk_buff *skb)
 static int br_parse_ip_options(struct sk_buff *skb)
 {
         struct ip_options *opt;
-        struct iphdr *iph;
+        const struct iphdr *iph;
         struct net_device *dev = skb->dev;
         u32 len;
 
@@ -554,7 +554,7 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
                                            const struct net_device *out,
                                            int (*okfn)(struct sk_buff *))
 {
-        struct ipv6hdr *hdr;
+        const struct ipv6hdr *hdr;
         u32 pkt_len;
 
         if (skb->len < sizeof(struct ipv6hdr))
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index f8bf4c7f842c..ffb0dc4cc0e8 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -12,9 +12,11 @@
 
 #include <linux/kernel.h>
 #include <linux/slab.h>
+#include <linux/etherdevice.h>
 #include <net/rtnetlink.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
+
 #include "br_private.h"
 
 static inline size_t br_nlmsg_size(void)
@@ -118,8 +120,9 @@ static int br_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         int idx;
 
         idx = 0;
-        for_each_netdev(net, dev) {
-                struct net_bridge_port *port = br_port_get_rtnl(dev);
+        rcu_read_lock();
+        for_each_netdev_rcu(net, dev) {
+                struct net_bridge_port *port = br_port_get_rcu(dev);
 
                 /* not a bridge port */
                 if (!port || idx < cb->args[0])
@@ -133,7 +136,7 @@ static int br_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
 skip:
                 ++idx;
         }
-
+        rcu_read_unlock();
         cb->args[0] = idx;
 
         return skb->len;
@@ -188,20 +191,61 @@ static int br_rtm_setlink(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
         return 0;
 }
 
+static int br_validate(struct nlattr *tb[], struct nlattr *data[])
+{
+        if (tb[IFLA_ADDRESS]) {
+                if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
+                        return -EINVAL;
+                if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
+                        return -EADDRNOTAVAIL;
+        }
+
+        return 0;
+}
+
+static struct rtnl_link_ops br_link_ops __read_mostly = {
+        .kind           = "bridge",
+        .priv_size      = sizeof(struct net_bridge),
+        .setup          = br_dev_setup,
+        .validate       = br_validate,
+};
 
 int __init br_netlink_init(void)
 {
-        if (__rtnl_register(PF_BRIDGE, RTM_GETLINK, NULL, br_dump_ifinfo))
-                return -ENOBUFS;
+        int err;
 
-        /* Only the first call to __rtnl_register can fail */
-        __rtnl_register(PF_BRIDGE, RTM_SETLINK, br_rtm_setlink, NULL);
+        err = rtnl_link_register(&br_link_ops);
+        if (err < 0)
+                goto err1;
+
+        err = __rtnl_register(PF_BRIDGE, RTM_GETLINK, NULL, br_dump_ifinfo);
+        if (err)
+                goto err2;
+        err = __rtnl_register(PF_BRIDGE, RTM_SETLINK, br_rtm_setlink, NULL);
+        if (err)
+                goto err3;
+        err = __rtnl_register(PF_BRIDGE, RTM_NEWNEIGH, br_fdb_add, NULL);
+        if (err)
+                goto err3;
+        err = __rtnl_register(PF_BRIDGE, RTM_DELNEIGH, br_fdb_delete, NULL);
+        if (err)
+                goto err3;
+        err = __rtnl_register(PF_BRIDGE, RTM_GETNEIGH, NULL, br_fdb_dump);
+        if (err)
+                goto err3;
 
         return 0;
+
+err3:
+        rtnl_unregister_all(PF_BRIDGE);
+err2:
+        rtnl_link_unregister(&br_link_ops);
+err1:
+        return err;
 }
 
 void __exit br_netlink_fini(void)
 {
+        rtnl_link_unregister(&br_link_ops);
         rtnl_unregister_all(PF_BRIDGE);
 }
-
diff --git a/net/bridge/br_notify.c b/net/bridge/br_notify.c
index 7d337c9b6082..6545ee9591d1 100644
--- a/net/bridge/br_notify.c
+++ b/net/bridge/br_notify.c
@@ -36,6 +36,12 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
         struct net_bridge *br;
         int err;
 
+        /* register of bridge completed, add sysfs entries */
+        if ((dev->priv_flags & IFF_EBRIDGE) && event == NETDEV_REGISTER) {
+                br_sysfs_addbr(dev);
+                return NOTIFY_DONE;
+        }
+
         /* not a port of a bridge */
         p = br_port_get_rtnl(dev);
         if (!p)
@@ -60,10 +66,7 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
                 break;
 
         case NETDEV_FEAT_CHANGE:
-                spin_lock_bh(&br->lock);
-                if (netif_running(br->dev))
-                        br_features_recompute(br);
-                spin_unlock_bh(&br->lock);
+                netdev_update_features(br->dev);
                 break;
 
         case NETDEV_DOWN:
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 387013d33745..54578f274d85 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -64,7 +64,8 @@ struct net_bridge_fdb_entry
         struct net_bridge_port          *dst;
 
         struct rcu_head                 rcu;
-        unsigned long                   ageing_timer;
+        unsigned long                   updated;
+        unsigned long                   used;
         mac_addr                        addr;
         unsigned char                   is_local;
         unsigned char                   is_static;
@@ -182,7 +183,6 @@ struct net_bridge
         struct br_cpu_netstats __percpu *stats;
         spinlock_t                      hash_lock;
         struct hlist_head               hash[BR_HASH_SIZE];
-        u32                             feature_mask;
 #ifdef CONFIG_BRIDGE_NETFILTER
         struct rtable                   fake_rtable;
         bool                            nf_call_iptables;
@@ -353,6 +353,9 @@ extern int br_fdb_insert(struct net_bridge *br,
 extern void br_fdb_update(struct net_bridge *br,
                           struct net_bridge_port *source,
                           const unsigned char *addr);
+extern int br_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb);
+extern int br_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg);
+extern int br_fdb_delete(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg);
 
 /* br_forward.c */
 extern void br_deliver(const struct net_bridge_port *to,
@@ -375,7 +378,7 @@ extern int br_add_if(struct net_bridge *br,
 extern int br_del_if(struct net_bridge *br,
               struct net_device *dev);
 extern int br_min_mtu(const struct net_bridge *br);
-extern void br_features_recompute(struct net_bridge *br);
+extern u32 br_features_recompute(struct net_bridge *br, u32 features);
 
 /* br_input.c */
 extern int br_handle_frame_finish(struct sk_buff *skb);
@@ -491,6 +494,11 @@ extern struct net_bridge_port *br_get_port(struct net_bridge *br,
 extern void br_init_port(struct net_bridge_port *p);
 extern void br_become_designated_port(struct net_bridge_port *p);
 
+extern int br_set_forward_delay(struct net_bridge *br, unsigned long x);
+extern int br_set_hello_time(struct net_bridge *br, unsigned long x);
+extern int br_set_max_age(struct net_bridge *br, unsigned long x);
+
+
 /* br_stp_if.c */
 extern void br_stp_enable_bridge(struct net_bridge *br);
 extern void br_stp_disable_bridge(struct net_bridge *br);
@@ -501,10 +509,10 @@ extern bool br_stp_recalculate_bridge_id(struct net_bridge *br);
 extern void br_stp_change_bridge_id(struct net_bridge *br, const unsigned char *a);
 extern void br_stp_set_bridge_priority(struct net_bridge *br,
                                        u16 newprio);
-extern void br_stp_set_port_priority(struct net_bridge_port *p,
-                                     u8 newprio);
-extern void br_stp_set_path_cost(struct net_bridge_port *p,
-                                 u32 path_cost);
+extern int br_stp_set_port_priority(struct net_bridge_port *p,
+                                    unsigned long newprio);
+extern int br_stp_set_path_cost(struct net_bridge_port *p,
+                                unsigned long path_cost);
 extern ssize_t br_show_bridge_id(char *buf, const struct bridge_id *id);
 
 /* br_stp_bpdu.c */
diff --git a/net/bridge/br_private_stp.h b/net/bridge/br_private_stp.h
index 8b650f7fbfa0..642ef47a867e 100644
--- a/net/bridge/br_private_stp.h
+++ b/net/bridge/br_private_stp.h
@@ -16,6 +16,19 @@
 #define BPDU_TYPE_CONFIG 0
 #define BPDU_TYPE_TCN 0x80
 
+/* IEEE 802.1D-1998 timer values */
+#define BR_MIN_HELLO_TIME       (1*HZ)
+#define BR_MAX_HELLO_TIME       (10*HZ)
+
+#define BR_MIN_FORWARD_DELAY    (2*HZ)
+#define BR_MAX_FORWARD_DELAY    (30*HZ)
+
+#define BR_MIN_MAX_AGE          (6*HZ)
+#define BR_MAX_MAX_AGE          (40*HZ)
+
+#define BR_MIN_PATH_COST        1
+#define BR_MAX_PATH_COST        65535
+
 struct br_config_bpdu
 {
         unsigned        topology_change:1;
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index 7370d14f634d..bb4383e84de9 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -484,3 +484,51 @@ void br_received_tcn_bpdu(struct net_bridge_port *p)
                 br_topology_change_acknowledge(p);
         }
 }
+
+/* Change bridge STP parameter */
+int br_set_hello_time(struct net_bridge *br, unsigned long val)
+{
+        unsigned long t = clock_t_to_jiffies(val);
+
+        if (t < BR_MIN_HELLO_TIME || t > BR_MAX_HELLO_TIME)
+                return -ERANGE;
+
+        spin_lock_bh(&br->lock);
+        br->bridge_hello_time = t;
+        if (br_is_root_bridge(br))
+                br->hello_time = br->bridge_hello_time;
+        spin_unlock_bh(&br->lock);
+        return 0;
+}
+
+int br_set_max_age(struct net_bridge *br, unsigned long val)
+{
+        unsigned long t = clock_t_to_jiffies(val);
+
+        if (t < BR_MIN_MAX_AGE || t > BR_MAX_MAX_AGE)
+                return -ERANGE;
+
+        spin_lock_bh(&br->lock);
+        br->bridge_max_age = t;
+        if (br_is_root_bridge(br))
+                br->max_age = br->bridge_max_age;
+        spin_unlock_bh(&br->lock);
+        return 0;
+
+}
+
+int br_set_forward_delay(struct net_bridge *br, unsigned long val)
+{
+        unsigned long t = clock_t_to_jiffies(val);
+
+        if (br->stp_enabled != BR_NO_STP &&
+            (t < BR_MIN_FORWARD_DELAY || t > BR_MAX_FORWARD_DELAY))
+                return -ERANGE;
+
+        spin_lock_bh(&br->lock);
+        br->bridge_forward_delay = t;
+        if (br_is_root_bridge(br))
+                br->forward_delay = br->bridge_forward_delay;
+        spin_unlock_bh(&br->lock);
+        return 0;
+}
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 9b61d09de9b9..6f615b8192f4 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -20,7 +20,7 @@
 
 
 /* Port id is composed of priority and port number.
- * NB: least significant bits of priority are dropped to
+ * NB: some bits of priority are dropped to
  *     make room for more ports.
  */
 static inline port_id br_make_port_id(__u8 priority, __u16 port_no)
@@ -29,6 +29,8 @@ static inline port_id br_make_port_id(__u8 priority, __u16 port_no)
                 | (port_no & ((1<<BR_PORT_BITS)-1));
 }
 
+#define BR_MAX_PORT_PRIORITY ((u16)~0 >> BR_PORT_BITS)
+
 /* called under bridge lock */
 void br_init_port(struct net_bridge_port *p)
 {
@@ -255,10 +257,14 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
 }
 
 /* called under bridge lock */
-void br_stp_set_port_priority(struct net_bridge_port *p, u8 newprio)
+int br_stp_set_port_priority(struct net_bridge_port *p, unsigned long newprio)
 {
-        port_id new_port_id = br_make_port_id(newprio, p->port_no);
+        port_id new_port_id;
+
+        if (newprio > BR_MAX_PORT_PRIORITY)
+                return -ERANGE;
 
+        new_port_id = br_make_port_id(newprio, p->port_no);
         if (br_is_designated_port(p))
                 p->designated_port = new_port_id;
 
@@ -269,14 +275,21 @@ void br_stp_set_port_priority(struct net_bridge_port *p, u8 newprio)
                 br_become_designated_port(p);
                 br_port_state_selection(p->br);
         }
+
+        return 0;
 }
 
 /* called under bridge lock */
-void br_stp_set_path_cost(struct net_bridge_port *p, u32 path_cost)
+int br_stp_set_path_cost(struct net_bridge_port *p, unsigned long path_cost)
 {
+        if (path_cost < BR_MIN_PATH_COST ||
+            path_cost > BR_MAX_PATH_COST)
+                return -ERANGE;
+
         p->path_cost = path_cost;
         br_configuration_update(p->br);
         br_port_state_selection(p->br);
+        return 0;
 }
 
 ssize_t br_show_bridge_id(char *buf, const struct bridge_id *id)
diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index 5c1e5559ebba..68b893ea8c3a 100644
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -43,9 +43,7 @@ static ssize_t store_bridge_parm(struct device *d,
         if (endp == buf)
                 return -EINVAL;
 
-        spin_lock_bh(&br->lock);
         err = (*set)(br, val);
-        spin_unlock_bh(&br->lock);
         return err ? err : len;
 }
 
@@ -57,20 +55,11 @@ static ssize_t show_forward_delay(struct device *d,
         return sprintf(buf, "%lu\n", jiffies_to_clock_t(br->forward_delay));
 }
 
-static int set_forward_delay(struct net_bridge *br, unsigned long val)
-{
-        unsigned long delay = clock_t_to_jiffies(val);
-        br->forward_delay = delay;
-        if (br_is_root_bridge(br))
-                br->bridge_forward_delay = delay;
-        return 0;
-}
-
 static ssize_t store_forward_delay(struct device *d,
                                    struct device_attribute *attr,
                                    const char *buf, size_t len)
 {
-        return store_bridge_parm(d, buf, len, set_forward_delay);
+        return store_bridge_parm(d, buf, len, br_set_forward_delay);
 }
 static DEVICE_ATTR(forward_delay, S_IRUGO | S_IWUSR,
                    show_forward_delay, store_forward_delay);
@@ -82,24 +71,11 @@ static ssize_t show_hello_time(struct device *d, struct device_attribute *attr,
                        jiffies_to_clock_t(to_bridge(d)->hello_time));
 }
 
-static int set_hello_time(struct net_bridge *br, unsigned long val)
-{
-        unsigned long t = clock_t_to_jiffies(val);
-
-        if (t < HZ)
-                return -EINVAL;
-
-        br->hello_time = t;
-        if (br_is_root_bridge(br))
-                br->bridge_hello_time = t;
-        return 0;
-}
-
 static ssize_t store_hello_time(struct device *d,
                                 struct device_attribute *attr, const char *buf,
                                 size_t len)
 {
-        return store_bridge_parm(d, buf, len, set_hello_time);
+        return store_bridge_parm(d, buf, len, br_set_hello_time);
 }
 static DEVICE_ATTR(hello_time, S_IRUGO | S_IWUSR, show_hello_time,
                    store_hello_time);
@@ -111,19 +87,10 @@ static ssize_t show_max_age(struct device *d, struct device_attribute *attr,
                        jiffies_to_clock_t(to_bridge(d)->max_age));
 }
 
-static int set_max_age(struct net_bridge *br, unsigned long val)
-{
-        unsigned long t = clock_t_to_jiffies(val);
-        br->max_age = t;
-        if (br_is_root_bridge(br))
-                br->bridge_max_age = t;
-        return 0;
-}
-
 static ssize_t store_max_age(struct device *d, struct device_attribute *attr,
                              const char *buf, size_t len)
 {
-        return store_bridge_parm(d, buf, len, set_max_age);
+        return store_bridge_parm(d, buf, len, br_set_max_age);
 }
 static DEVICE_ATTR(max_age, S_IRUGO | S_IWUSR, show_max_age, store_max_age);
 
diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
index fd5799c9bc8d..6229b62749e8 100644
--- a/net/bridge/br_sysfs_if.c
+++ b/net/bridge/br_sysfs_if.c
@@ -23,7 +23,7 @@
 struct brport_attribute {
         struct attribute        attr;
         ssize_t (*show)(struct net_bridge_port *, char *);
-        ssize_t (*store)(struct net_bridge_port *, unsigned long);
+        int (*store)(struct net_bridge_port *, unsigned long);
 };
 
 #define BRPORT_ATTR(_name,_mode,_show,_store)                   \
@@ -38,27 +38,17 @@ static ssize_t show_path_cost(struct net_bridge_port *p, char *buf)
 {
         return sprintf(buf, "%d\n", p->path_cost);
 }
-static ssize_t store_path_cost(struct net_bridge_port *p, unsigned long v)
-{
-        br_stp_set_path_cost(p, v);
-        return 0;
-}
+
 static BRPORT_ATTR(path_cost, S_IRUGO | S_IWUSR,
-                   show_path_cost, store_path_cost);
+                   show_path_cost, br_stp_set_path_cost);
 
 static ssize_t show_priority(struct net_bridge_port *p, char *buf)
 {
         return sprintf(buf, "%d\n", p->priority);
 }
-static ssize_t store_priority(struct net_bridge_port *p, unsigned long v)
-{
-        if (v >= (1<<(16-BR_PORT_BITS)))
-                return -ERANGE;
-        br_stp_set_port_priority(p, v);
-        return 0;
-}
+
 static BRPORT_ATTR(priority, S_IRUGO | S_IWUSR,
-                         show_priority, store_priority);
+                         show_priority, br_stp_set_port_priority);
 
 static ssize_t show_designated_root(struct net_bridge_port *p, char *buf)
 {
@@ -136,7 +126,7 @@ static ssize_t show_hold_timer(struct net_bridge_port *p,
 }
 static BRPORT_ATTR(hold_timer, S_IRUGO, show_hold_timer, NULL);
 
-static ssize_t store_flush(struct net_bridge_port *p, unsigned long v)
+static int store_flush(struct net_bridge_port *p, unsigned long v)
 {
         br_fdb_delete_by_port(p->br, p, 0); // Don't delete local entry
         return 0;
@@ -148,7 +138,7 @@ static ssize_t show_hairpin_mode(struct net_bridge_port *p, char *buf)
         int hairpin_mode = (p->flags & BR_HAIRPIN_MODE) ? 1 : 0;
         return sprintf(buf, "%d\n", hairpin_mode);
 }
-static ssize_t store_hairpin_mode(struct net_bridge_port *p, unsigned long v)
+static int store_hairpin_mode(struct net_bridge_port *p, unsigned long v)
 {
         if (v)
                 p->flags |= BR_HAIRPIN_MODE;
@@ -165,7 +155,7 @@ static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)
         return sprintf(buf, "%d\n", p->multicast_router);
 }
 
-static ssize_t store_multicast_router(struct net_bridge_port *p,
+static int store_multicast_router(struct net_bridge_port *p,
                                       unsigned long v)
 {
         return br_multicast_set_port_router(p, v);
diff --git a/net/caif/caif_config_util.c b/net/caif/caif_config_util.c
index d522d8c1703e..9b63e4e3910e 100644
--- a/net/caif/caif_config_util.c
+++ b/net/caif/caif_config_util.c
@@ -10,9 +10,9 @@
 #include <net/caif/cfcnfg.h>
 #include <net/caif/caif_dev.h>
 
-int connect_req_to_link_param(struct cfcnfg *cnfg,
-                                struct caif_connect_request *s,
-                                struct cfctrl_link_param *l)
+int caif_connect_req_to_link_param(struct cfcnfg *cnfg,
+                                   struct caif_connect_request *s,
+                                   struct cfctrl_link_param *l)
 {
         struct dev_info *dev_info;
         enum cfcnfg_phy_preference pref;
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index a42a408306e4..75e00d59eb49 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -120,25 +120,12 @@ static int transmit(struct cflayer *layer, struct cfpkt *pkt)
 {
         struct caif_device_entry *caifd =
             container_of(layer, struct caif_device_entry, layer);
-        struct sk_buff *skb, *skb2;
-        int ret = -EINVAL;
+        struct sk_buff *skb;
+
         skb = cfpkt_tonative(pkt);
         skb->dev = caifd->netdev;
-        /*
-         * Don't allow SKB to be destroyed upon error, but signal resend
-         * notification to clients. We can't rely on the return value as
-         * congestion (NET_XMIT_CN) sometimes drops the packet, sometimes don't.
-         */
-        if (netif_queue_stopped(caifd->netdev))
-                return -EAGAIN;
-        skb2 = skb_get(skb);
-
-        ret = dev_queue_xmit(skb2);
-
-        if (!ret)
-                kfree_skb(skb);
-        else
-                return -EAGAIN;
+
+        dev_queue_xmit(skb);
 
         return 0;
 }
@@ -146,9 +133,7 @@ static int transmit(struct cflayer *layer, struct cfpkt *pkt)
 static int modemcmd(struct cflayer *layr, enum caif_modemcmd ctrl)
 {
         struct caif_device_entry *caifd;
-        struct caif_dev_common *caifdev;
         caifd = container_of(layr, struct caif_device_entry, layer);
-        caifdev = netdev_priv(caifd->netdev);
         if (ctrl == _CAIF_MODEMCMD_PHYIF_USEFULL) {
                 atomic_set(&caifd->in_use, 1);
                 wake_up_interruptible(&caifd->event);
@@ -167,10 +152,8 @@ static int modemcmd(struct cflayer *layr, enum caif_modemcmd ctrl)
 static int receive(struct sk_buff *skb, struct net_device *dev,
                    struct packet_type *pkttype, struct net_device *orig_dev)
 {
-        struct net *net;
         struct cfpkt *pkt;
         struct caif_device_entry *caifd;
-        net = dev_net(dev);
         pkt = cfpkt_fromnative(CAIF_DIR_IN, skb);
         caifd = caif_get(dev);
         if (!caifd || !caifd->layer.up || !caifd->layer.up->receive)
@@ -208,7 +191,6 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
         struct caif_device_entry *caifd = NULL;
         struct caif_dev_common *caifdev;
         enum cfcnfg_phy_preference pref;
-        int res = -EINVAL;
         enum cfcnfg_phy_type phy_type;
 
         if (dev->type != ARPHRD_CAIF)
@@ -223,7 +205,6 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
                 caifdev = netdev_priv(dev);
                 caifdev->flowctrl = dev_flowctrl;
                 atomic_set(&caifd->state, what);
-                res = 0;
                 break;
 
         case NETDEV_UP:
@@ -257,7 +238,7 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
                         break;
                 }
                 dev_hold(dev);
-                cfcnfg_add_phy_layer(get_caif_conf(),
+                cfcnfg_add_phy_layer(cfg,
                                      phy_type,
                                      dev,
                                      &caifd->layer,
@@ -287,7 +268,7 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
                                          _CAIF_CTRLCMD_PHYIF_DOWN_IND,
                                          caifd->layer.id);
                 might_sleep();
-                res = wait_event_interruptible_timeout(caifd->event,
+                wait_event_interruptible_timeout(caifd->event,
                                         atomic_read(&caifd->in_use) == 0,
                                         TIMEOUT);
                 break;
@@ -300,7 +281,7 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
                 if (atomic_read(&caifd->in_use))
                         netdev_warn(dev,
                                     "Unregistering an active CAIF device\n");
-                cfcnfg_del_phy_layer(get_caif_conf(), &caifd->layer);
+                cfcnfg_del_phy_layer(cfg, &caifd->layer);
                 dev_put(dev);
                 atomic_set(&caifd->state, what);
                 break;
@@ -322,24 +303,18 @@ static struct notifier_block caif_device_notifier = {
         .priority = 0,
 };
 
-
-struct cfcnfg *get_caif_conf(void)
-{
-        return cfg;
-}
-EXPORT_SYMBOL(get_caif_conf);
-
 int caif_connect_client(struct caif_connect_request *conn_req,
                         struct cflayer *client_layer, int *ifindex,
                         int *headroom, int *tailroom)
 {
         struct cfctrl_link_param param;
         int ret;
-        ret = connect_req_to_link_param(get_caif_conf(), conn_req, &param);
+
+        ret = caif_connect_req_to_link_param(cfg, conn_req, &param);
         if (ret)
                 return ret;
         /* Hook up the adaptation layer. */
-        return cfcnfg_add_adaptation_layer(get_caif_conf(), &param,
+        return cfcnfg_add_adaptation_layer(cfg, &param,
                                         client_layer, ifindex,
                                         headroom, tailroom);
 }
@@ -347,16 +322,10 @@ EXPORT_SYMBOL(caif_connect_client);
 
 int caif_disconnect_client(struct cflayer *adap_layer)
 {
-       return cfcnfg_disconn_adapt_layer(get_caif_conf(), adap_layer);
+        return cfcnfg_disconn_adapt_layer(cfg, adap_layer);
 }
 EXPORT_SYMBOL(caif_disconnect_client);
 
-void caif_release_client(struct cflayer *adap_layer)
-{
-       cfcnfg_release_adap_layer(adap_layer);
-}
-EXPORT_SYMBOL(caif_release_client);
-
 /* Per-namespace Caif devices handling */
 static int caif_init_net(struct net *net)
 {
@@ -369,12 +338,11 @@ static int caif_init_net(struct net *net)
 static void caif_exit_net(struct net *net)
 {
         struct net_device *dev;
-        int res;
         rtnl_lock();
         for_each_netdev(net, dev) {
                 if (dev->type != ARPHRD_CAIF)
                         continue;
-                res = dev_close(dev);
+                dev_close(dev);
                 caif_device_destroy(dev);
         }
         rtnl_unlock();
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 37a4034dfc29..20212424e2e8 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -519,43 +519,14 @@ static int transmit_skb(struct sk_buff *skb, struct caifsock *cf_sk,
                         int noblock, long timeo)
 {
         struct cfpkt *pkt;
-        int ret, loopcnt = 0;
 
         pkt = cfpkt_fromnative(CAIF_DIR_OUT, skb);
         memset(cfpkt_info(pkt), 0, sizeof(struct caif_payload_info));
-        do {
-
-                ret = -ETIMEDOUT;
 
-                /* Slight paranoia, probably not needed. */
-                if (unlikely(loopcnt++ > 1000)) {
-                        pr_warn("transmit retries failed, error = %d\n", ret);
-                        break;
-                }
+        if (cf_sk->layer.dn == NULL)
+                return -EINVAL;
 
-                if (cf_sk->layer.dn != NULL)
-                        ret = cf_sk->layer.dn->transmit(cf_sk->layer.dn, pkt);
-                if (likely(ret >= 0))
-                        break;
-                /* if transmit return -EAGAIN, then retry */
-                if (noblock && ret == -EAGAIN)
-                        break;
-                timeo = caif_wait_for_flow_on(cf_sk, 0, timeo, &ret);
-                if (signal_pending(current)) {
-                        ret = sock_intr_errno(timeo);
-                        break;
-                }
-                if (ret)
-                        break;
-                if (cf_sk->sk.sk_state != CAIF_CONNECTED ||
-                        sock_flag(&cf_sk->sk, SOCK_DEAD) ||
-                        (cf_sk->sk.sk_shutdown & RCV_SHUTDOWN)) {
-                        ret = -EPIPE;
-                        cf_sk->sk.sk_err = EPIPE;
-                        break;
-                }
-        } while (ret == -EAGAIN);
-        return ret;
+        return cf_sk->layer.dn->transmit(cf_sk->layer.dn, pkt);
 }
 
 /* Copied from af_unix:unix_dgram_sendmsg, and adapted to CAIF */
diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
index f1f98d967d8a..25c0b198e285 100644
--- a/net/caif/cfcnfg.c
+++ b/net/caif/cfcnfg.c
@@ -253,7 +253,7 @@ static void cfcnfg_linkdestroy_rsp(struct cflayer *layer, u8 channel_id)
 {
 }
 
-int protohead[CFCTRL_SRV_MASK] = {
+static const int protohead[CFCTRL_SRV_MASK] = {
         [CFCTRL_SRV_VEI] = 4,
         [CFCTRL_SRV_DATAGRAM] = 7,
         [CFCTRL_SRV_UTIL] = 4,
diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
index 3cd8f978e309..397a2c099e2c 100644
--- a/net/caif/cfctrl.c
+++ b/net/caif/cfctrl.c
@@ -58,7 +58,8 @@ struct cflayer *cfctrl_create(void)
         return &this->serv.layer;
 }
 
-static bool param_eq(struct cfctrl_link_param *p1, struct cfctrl_link_param *p2)
+static bool param_eq(const struct cfctrl_link_param *p1,
+                        const struct cfctrl_link_param *p2)
 {
         bool eq =
             p1->linktype == p2->linktype &&
@@ -100,8 +101,8 @@ static bool param_eq(struct cfctrl_link_param *p1, struct cfctrl_link_param *p2)
         return false;
 }
 
-bool cfctrl_req_eq(struct cfctrl_request_info *r1,
-                   struct cfctrl_request_info *r2)
+static bool cfctrl_req_eq(const struct cfctrl_request_info *r1,
+                          const struct cfctrl_request_info *r2)
 {
         if (r1->cmd != r2->cmd)
                 return false;
@@ -112,7 +113,7 @@ bool cfctrl_req_eq(struct cfctrl_request_info *r1,
 }
 
 /* Insert request at the end */
-void cfctrl_insert_req(struct cfctrl *ctrl,
+static void cfctrl_insert_req(struct cfctrl *ctrl,
                               struct cfctrl_request_info *req)
 {
         spin_lock(&ctrl->info_list_lock);
@@ -123,8 +124,8 @@ void cfctrl_insert_req(struct cfctrl *ctrl,
 }
 
 /* Compare and remove request */
-struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl,
-                                              struct cfctrl_request_info *req)
+static struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl,
+                                                struct cfctrl_request_info *req)
 {
         struct cfctrl_request_info *p, *tmp, *first;
 
@@ -154,16 +155,6 @@ struct cfctrl_rsp *cfctrl_get_respfuncs(struct cflayer *layer)
         return &this->res;
 }
 
-void cfctrl_set_dnlayer(struct cflayer *this, struct cflayer *dn)
-{
-        this->dn = dn;
-}
-
-void cfctrl_set_uplayer(struct cflayer *this, struct cflayer *up)
-{
-        this->up = up;
-}
-
 static void init_info(struct caif_payload_info *info, struct cfctrl *cfctrl)
 {
         info->hdr_len = 0;
@@ -304,58 +295,6 @@ int cfctrl_linkdown_req(struct cflayer *layer, u8 channelid,
         return ret;
 }
 
-void cfctrl_sleep_req(struct cflayer *layer)
-{
-        int ret;
-        struct cfctrl *cfctrl = container_obj(layer);
-        struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
-        if (!pkt) {
-                pr_warn("Out of memory\n");
-                return;
-        }
-        cfpkt_addbdy(pkt, CFCTRL_CMD_SLEEP);
-        init_info(cfpkt_info(pkt), cfctrl);
-        ret =
-            cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
-        if (ret < 0)
-                cfpkt_destroy(pkt);
-}
-
-void cfctrl_wake_req(struct cflayer *layer)
-{
-        int ret;
-        struct cfctrl *cfctrl = container_obj(layer);
-        struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
-        if (!pkt) {
-                pr_warn("Out of memory\n");
-                return;
-        }
-        cfpkt_addbdy(pkt, CFCTRL_CMD_WAKE);
-        init_info(cfpkt_info(pkt), cfctrl);
-        ret =
-            cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
-        if (ret < 0)
-                cfpkt_destroy(pkt);
-}
-
-void cfctrl_getstartreason_req(struct cflayer *layer)
-{
-        int ret;
-        struct cfctrl *cfctrl = container_obj(layer);
-        struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
-        if (!pkt) {
-                pr_warn("Out of memory\n");
-                return;
-        }
-        cfpkt_addbdy(pkt, CFCTRL_CMD_START_REASON);
-        init_info(cfpkt_info(pkt), cfctrl);
-        ret =
-            cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
-        if (ret < 0)
-                cfpkt_destroy(pkt);
-}
-
-
 void cfctrl_cancel_req(struct cflayer *layr, struct cflayer *adap_layer)
 {
         struct cfctrl_request_info *p, *tmp;
diff --git a/net/caif/cfdgml.c b/net/caif/cfdgml.c
index 054fdb5aeb88..0382dec84fdc 100644
--- a/net/caif/cfdgml.c
+++ b/net/caif/cfdgml.c
@@ -108,10 +108,5 @@ static int cfdgml_transmit(struct cflayer *layr, struct cfpkt *pkt)
          */
         info->hdr_len = 4;
         info->dev_info = &service->dev_info;
-        ret = layr->dn->transmit(layr->dn, pkt);
-        if (ret < 0) {
-                u32 tmp32;
-                cfpkt_extr_head(pkt, &tmp32, 4);
-        }
-        return ret;
+        return layr->dn->transmit(layr->dn, pkt);
 }
diff --git a/net/caif/cffrml.c b/net/caif/cffrml.c
index a445043931ae..2423fed8e26c 100644
--- a/net/caif/cffrml.c
+++ b/net/caif/cffrml.c
@@ -120,7 +120,6 @@ static int cffrml_transmit(struct cflayer *layr, struct cfpkt *pkt)
         int tmp;
         u16 chks;
         u16 len;
-        int ret;
         struct cffrml *this = container_obj(layr);
         if (this->dofcs) {
                 chks = cfpkt_iterate(pkt, cffrml_checksum, 0xffff);
@@ -137,12 +136,7 @@ static int cffrml_transmit(struct cflayer *layr, struct cfpkt *pkt)
                 pr_err("Packet is erroneous!\n");
                 return -EPROTO;
         }
-        ret = layr->dn->transmit(layr->dn, pkt);
-        if (ret < 0) {
-                /* Remove header on faulty packet. */
-                cfpkt_extr_head(pkt, &tmp, 2);
-        }
-        return ret;
+        return layr->dn->transmit(layr->dn, pkt);
 }
 
 static void cffrml_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
diff --git a/net/caif/cfmuxl.c b/net/caif/cfmuxl.c
index 24f1ffa74b06..fc2497468571 100644
--- a/net/caif/cfmuxl.c
+++ b/net/caif/cfmuxl.c
@@ -71,41 +71,6 @@ int cfmuxl_set_uplayer(struct cflayer *layr, struct cflayer *up, u8 linkid)
         return 0;
 }
 
-bool cfmuxl_is_phy_inuse(struct cflayer *layr, u8 phyid)
-{
-        struct list_head *node;
-        struct cflayer *layer;
-        struct cfmuxl *muxl = container_obj(layr);
-        bool match = false;
-        spin_lock(&muxl->receive_lock);
-
-        list_for_each(node, &muxl->srvl_list) {
-                layer = list_entry(node, struct cflayer, node);
-                if (cfsrvl_phyid_match(layer, phyid)) {
-                        match = true;
-                        break;
-                }
-
-        }
-        spin_unlock(&muxl->receive_lock);
-        return match;
-}
-
-u8 cfmuxl_get_phyid(struct cflayer *layr, u8 channel_id)
-{
-        struct cflayer *up;
-        int phyid;
-        struct cfmuxl *muxl = container_obj(layr);
-        spin_lock(&muxl->receive_lock);
-        up = get_up(muxl, channel_id);
-        if (up != NULL)
-                phyid = cfsrvl_getphyid(up);
-        else
-                phyid = 0;
-        spin_unlock(&muxl->receive_lock);
-        return phyid;
-}
-
 int cfmuxl_set_dnlayer(struct cflayer *layr, struct cflayer *dn, u8 phyid)
 {
         struct cfmuxl *muxl = (struct cfmuxl *) layr;
@@ -219,12 +184,12 @@ static int cfmuxl_receive(struct cflayer *layr, struct cfpkt *pkt)
 
 static int cfmuxl_transmit(struct cflayer *layr, struct cfpkt *pkt)
 {
-        int ret;
         struct cfmuxl *muxl = container_obj(layr);
         u8 linkid;
         struct cflayer *dn;
         struct caif_payload_info *info = cfpkt_info(pkt);
-        dn = get_dn(muxl, cfpkt_info(pkt)->dev_info);
+        BUG_ON(!info);
+        dn = get_dn(muxl, info->dev_info);
         if (dn == NULL) {
                 pr_warn("Send data on unknown phy ID = %d (0x%x)\n",
                         info->dev_info->id, info->dev_info->id);
@@ -233,11 +198,7 @@ static int cfmuxl_transmit(struct cflayer *layr, struct cfpkt *pkt)
         info->hdr_len += 1;
         linkid = info->channel_id;
         cfpkt_add_head(pkt, &linkid, 1);
-        ret = dn->transmit(dn, pkt);
-        /* Remove MUX protocol header upon error. */
-        if (ret < 0)
-                cfpkt_extr_head(pkt, &linkid, 1);
-        return ret;
+        return dn->transmit(dn, pkt);
 }
 
 static void cfmuxl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c
index d7e865e2ff65..20c6cb3522e0 100644
--- a/net/caif/cfpkt_skbuff.c
+++ b/net/caif/cfpkt_skbuff.c
@@ -42,22 +42,22 @@ struct cfpkt_priv_data {
         bool erronous;
 };
 
-inline struct cfpkt_priv_data *cfpkt_priv(struct cfpkt *pkt)
+static inline struct cfpkt_priv_data *cfpkt_priv(struct cfpkt *pkt)
 {
         return (struct cfpkt_priv_data *) pkt->skb.cb;
 }
 
-inline bool is_erronous(struct cfpkt *pkt)
+static inline bool is_erronous(struct cfpkt *pkt)
 {
         return cfpkt_priv(pkt)->erronous;
 }
 
-inline struct sk_buff *pkt_to_skb(struct cfpkt *pkt)
+static inline struct sk_buff *pkt_to_skb(struct cfpkt *pkt)
 {
         return &pkt->skb;
 }
 
-inline struct cfpkt *skb_to_pkt(struct sk_buff *skb)
+static inline struct cfpkt *skb_to_pkt(struct sk_buff *skb)
 {
         return (struct cfpkt *) skb;
 }
@@ -317,17 +317,6 @@ int cfpkt_setlen(struct cfpkt *pkt, u16 len)
 }
 EXPORT_SYMBOL(cfpkt_setlen);
 
-struct cfpkt *cfpkt_create_uplink(const unsigned char *data, unsigned int len)
-{
-        struct cfpkt *pkt = cfpkt_create_pfx(len + PKT_POSTFIX, PKT_PREFIX);
-        if (!pkt)
-                return NULL;
-        if (unlikely(data != NULL))
-                cfpkt_add_body(pkt, data, len);
-        return pkt;
-}
-EXPORT_SYMBOL(cfpkt_create_uplink);
-
 struct cfpkt *cfpkt_append(struct cfpkt *dstpkt,
                              struct cfpkt *addpkt,
                              u16 expectlen)
@@ -408,169 +397,12 @@ struct cfpkt *cfpkt_split(struct cfpkt *pkt, u16 pos)
 }
 EXPORT_SYMBOL(cfpkt_split);
 
-char *cfpkt_log_pkt(struct cfpkt *pkt, char *buf, int buflen)
-{
-        struct sk_buff *skb = pkt_to_skb(pkt);
-        char *p = buf;
-        int i;
-
-        /*
-         * Sanity check buffer length, it needs to be at least as large as
-         * the header info: ~=50+ bytes
-         */
-        if (buflen < 50)
-                return NULL;
-
-        snprintf(buf, buflen, "%s: pkt:%p len:%ld(%ld+%ld) {%ld,%ld} data: [",
-                is_erronous(pkt) ? "ERRONOUS-SKB" :
-                 (skb->data_len != 0 ? "COMPLEX-SKB" : "SKB"),
-                 skb,
-                 (long) skb->len,
-                 (long) (skb_tail_pointer(skb) - skb->data),
-                 (long) skb->data_len,
-                 (long) (skb->data - skb->head),
-                 (long) (skb_tail_pointer(skb) - skb->head));
-        p = buf + strlen(buf);
-
-        for (i = 0; i < skb_tail_pointer(skb) - skb->data && i < 300; i++) {
-                if (p > buf + buflen - 10) {
-                        sprintf(p, "...");
-                        p = buf + strlen(buf);
-                        break;
-                }
-                sprintf(p, "%02x,", skb->data[i]);
-                p = buf + strlen(buf);
-        }
-        sprintf(p, "]\n");
-        return buf;
-}
-EXPORT_SYMBOL(cfpkt_log_pkt);
-
-int cfpkt_raw_append(struct cfpkt *pkt, void **buf, unsigned int buflen)
-{
-        struct sk_buff *skb = pkt_to_skb(pkt);
-        struct sk_buff *lastskb;
-
-        caif_assert(buf != NULL);
-        if (unlikely(is_erronous(pkt)))
-                return -EPROTO;
-        /* Make sure SKB is writable */
-        if (unlikely(skb_cow_data(skb, 0, &lastskb) < 0)) {
-                PKT_ERROR(pkt, "skb_cow_data failed\n");
-                return -EPROTO;
-        }
-
-        if (unlikely(skb_linearize(skb) != 0)) {
-                PKT_ERROR(pkt, "linearize failed\n");
-                return -EPROTO;
-        }
-
-        if (unlikely(skb_tailroom(skb) < buflen)) {
-                PKT_ERROR(pkt, "buffer too short - failed\n");
-                return -EPROTO;
-        }
-
-        *buf = skb_put(skb, buflen);
-        return 1;
-}
-EXPORT_SYMBOL(cfpkt_raw_append);
-
-int cfpkt_raw_extract(struct cfpkt *pkt, void **buf, unsigned int buflen)
-{
-        struct sk_buff *skb = pkt_to_skb(pkt);
-
-        caif_assert(buf != NULL);
-        if (unlikely(is_erronous(pkt)))
-                return -EPROTO;
-
-        if (unlikely(buflen > skb->len)) {
-                PKT_ERROR(pkt, "buflen too large - failed\n");
-                return -EPROTO;
-        }
-
-        if (unlikely(buflen > skb_headlen(skb))) {
-                if (unlikely(skb_linearize(skb) != 0)) {
-                        PKT_ERROR(pkt, "linearize failed\n");
-                        return -EPROTO;
-                }
-        }
-
-        *buf = skb->data;
-        skb_pull(skb, buflen);
-
-        return 1;
-}
-EXPORT_SYMBOL(cfpkt_raw_extract);
-
-inline bool cfpkt_erroneous(struct cfpkt *pkt)
+bool cfpkt_erroneous(struct cfpkt *pkt)
 {
         return cfpkt_priv(pkt)->erronous;
 }
 EXPORT_SYMBOL(cfpkt_erroneous);
 
-struct cfpktq *cfpktq_create(void)
-{
-        struct cfpktq *q = kmalloc(sizeof(struct cfpktq), GFP_ATOMIC);
-        if (!q)
-                return NULL;
-        skb_queue_head_init(&q->head);
-        atomic_set(&q->count, 0);
-        spin_lock_init(&q->lock);
-        return q;
-}
-EXPORT_SYMBOL(cfpktq_create);
-
-void cfpkt_queue(struct cfpktq *pktq, struct cfpkt *pkt, unsigned short prio)
-{
-        atomic_inc(&pktq->count);
-        spin_lock(&pktq->lock);
-        skb_queue_tail(&pktq->head, pkt_to_skb(pkt));
-        spin_unlock(&pktq->lock);
-
-}
-EXPORT_SYMBOL(cfpkt_queue);
-
-struct cfpkt *cfpkt_qpeek(struct cfpktq *pktq)
-{
-        struct cfpkt *tmp;
-        spin_lock(&pktq->lock);
-        tmp = skb_to_pkt(skb_peek(&pktq->head));
-        spin_unlock(&pktq->lock);
-        return tmp;
-}
-EXPORT_SYMBOL(cfpkt_qpeek);
-
-struct cfpkt *cfpkt_dequeue(struct cfpktq *pktq)
-{
-        struct cfpkt *pkt;
-        spin_lock(&pktq->lock);
-        pkt = skb_to_pkt(skb_dequeue(&pktq->head));
-        if (pkt) {
-                atomic_dec(&pktq->count);
-                caif_assert(atomic_read(&pktq->count) >= 0);
-        }
-        spin_unlock(&pktq->lock);
-        return pkt;
-}
-EXPORT_SYMBOL(cfpkt_dequeue);
-
-int cfpkt_qcount(struct cfpktq *pktq)
-{
-        return atomic_read(&pktq->count);
-}
-EXPORT_SYMBOL(cfpkt_qcount);
-
-struct cfpkt *cfpkt_clone_release(struct cfpkt *pkt)
-{
-        struct cfpkt *clone;
-        clone  = skb_to_pkt(skb_clone(pkt_to_skb(pkt), GFP_ATOMIC));
-        /* Free original packet. */
-        cfpkt_destroy(pkt);
-        if (!clone)
-                return NULL;
-        return clone;
-}
-EXPORT_SYMBOL(cfpkt_clone_release);
 
 struct caif_payload_info *cfpkt_info(struct cfpkt *pkt)
 {
diff --git a/net/caif/cfserl.c b/net/caif/cfserl.c
index 8303fe3ebf89..2715c84cfa87 100644
--- a/net/caif/cfserl.c
+++ b/net/caif/cfserl.c
@@ -179,15 +179,10 @@ static int cfserl_receive(struct cflayer *l, struct cfpkt *newpkt)
 static int cfserl_transmit(struct cflayer *layer, struct cfpkt *newpkt)
 {
         struct cfserl *layr = container_obj(layer);
-        int ret;
         u8 tmp8 = CFSERL_STX;
         if (layr->usestx)
                 cfpkt_add_head(newpkt, &tmp8, 1);
-        ret = layer->dn->transmit(layer->dn, newpkt);
-        if (ret < 0)
-                cfpkt_extr_head(newpkt, &tmp8, 1);
-
-        return ret;
+        return layer->dn->transmit(layer->dn, newpkt);
 }
 
 static void cfserl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
diff --git a/net/caif/cfsrvl.c b/net/caif/cfsrvl.c
index ab5e542526bf..24ba392f203b 100644
--- a/net/caif/cfsrvl.c
+++ b/net/caif/cfsrvl.c
@@ -151,12 +151,7 @@ static int cfservl_modemcmd(struct cflayer *layr, enum caif_modemcmd ctrl)
         return -EINVAL;
 }
 
-void cfservl_destroy(struct cflayer *layer)
-{
-        kfree(layer);
-}
-
-void cfsrvl_release(struct kref *kref)
+static void cfsrvl_release(struct kref *kref)
 {
         struct cfsrvl *service = container_of(kref, struct cfsrvl, ref);
         kfree(service);
diff --git a/net/caif/cfutill.c b/net/caif/cfutill.c
index 315c0d601368..98e027db18ed 100644
--- a/net/caif/cfutill.c
+++ b/net/caif/cfutill.c
@@ -100,10 +100,5 @@ static int cfutill_transmit(struct cflayer *layr, struct cfpkt *pkt)
          */
         info->hdr_len = 1;
         info->dev_info = &service->dev_info;
-        ret = layr->dn->transmit(layr->dn, pkt);
-        if (ret < 0) {
-                u32 tmp32;
-                cfpkt_extr_head(pkt, &tmp32, 4);
-        }
-        return ret;
+        return layr->dn->transmit(layr->dn, pkt);
 }
diff --git a/net/caif/cfveil.c b/net/caif/cfveil.c
index c3b1dec4acf6..1a588cd818ea 100644
--- a/net/caif/cfveil.c
+++ b/net/caif/cfveil.c
@@ -96,8 +96,5 @@ static int cfvei_transmit(struct cflayer *layr, struct cfpkt *pkt)
         info->channel_id = service->layer.id;
         info->hdr_len = 1;
         info->dev_info = &service->dev_info;
-        ret = layr->dn->transmit(layr->dn, pkt);
-        if (ret < 0)
-                cfpkt_extr_head(pkt, &tmp, 1);
-        return ret;
+        return layr->dn->transmit(layr->dn, pkt);
 }
diff --git a/net/caif/cfvidl.c b/net/caif/cfvidl.c
index bf6fef2a0eff..b2f5989ad455 100644
--- a/net/caif/cfvidl.c
+++ b/net/caif/cfvidl.c
@@ -60,8 +60,5 @@ static int cfvidl_transmit(struct cflayer *layr, struct cfpkt *pkt)
         info = cfpkt_info(pkt);
         info->channel_id = service->layer.id;
         info->dev_info = &service->dev_info;
-        ret = layr->dn->transmit(layr->dn, pkt);
-        if (ret < 0)
-                cfpkt_extr_head(pkt, &videoheader, 4);
-        return ret;
+        return layr->dn->transmit(layr->dn, pkt);
 }
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 733d66f1b05a..094fc5332d42 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -84,8 +84,8 @@ static DEFINE_SPINLOCK(can_rcvlists_lock);
 static struct kmem_cache *rcv_cache __read_mostly;
 
 /* table of registered CAN protocols */
-static struct can_proto *proto_tab[CAN_NPROTO] __read_mostly;
-static DEFINE_SPINLOCK(proto_tab_lock);
+static const struct can_proto *proto_tab[CAN_NPROTO] __read_mostly;
+static DEFINE_MUTEX(proto_tab_lock);
 
 struct timer_list can_stattimer;   /* timer for statistics update */
 struct s_stats    can_stats;       /* packet statistics */
@@ -115,11 +115,29 @@ static void can_sock_destruct(struct sock *sk)
         skb_queue_purge(&sk->sk_receive_queue);
 }
 
+static const struct can_proto *can_get_proto(int protocol)
+{
+        const struct can_proto *cp;
+
+        rcu_read_lock();
+        cp = rcu_dereference(proto_tab[protocol]);
+        if (cp && !try_module_get(cp->prot->owner))
+                cp = NULL;
+        rcu_read_unlock();
+
+        return cp;
+}
+
+static inline void can_put_proto(const struct can_proto *cp)
+{
+        module_put(cp->prot->owner);
+}
+
 static int can_create(struct net *net, struct socket *sock, int protocol,
                       int kern)
 {
         struct sock *sk;
-        struct can_proto *cp;
+        const struct can_proto *cp;
         int err = 0;
 
         sock->state = SS_UNCONNECTED;
@@ -130,9 +148,12 @@ static int can_create(struct net *net, struct socket *sock, int protocol,
         if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
+        cp = can_get_proto(protocol);
+
 #ifdef CONFIG_MODULES
-        /* try to load protocol module kernel is modular */
-        if (!proto_tab[protocol]) {
+        if (!cp) {
+                /* try to load protocol module if kernel is modular */
+
                 err = request_module("can-proto-%d", protocol);
 
                 /*
@@ -143,22 +164,18 @@ static int can_create(struct net *net, struct socket *sock, int protocol,
                 if (err && printk_ratelimit())
                         printk(KERN_ERR "can: request_module "
                                "(can-proto-%d) failed.\n", protocol);
+
+                cp = can_get_proto(protocol);
         }
 #endif
 
-        spin_lock(&proto_tab_lock);
-        cp = proto_tab[protocol];
-        if (cp && !try_module_get(cp->prot->owner))
-                cp = NULL;
-        spin_unlock(&proto_tab_lock);
-
         /* check for available protocol and correct usage */
 
         if (!cp)
                 return -EPROTONOSUPPORT;
 
         if (cp->type != sock->type) {
-                err = -EPROTONOSUPPORT;
+                err = -EPROTOTYPE;
                 goto errout;
         }
 
@@ -183,7 +200,7 @@ static int can_create(struct net *net, struct socket *sock, int protocol,
         }
 
  errout:
-        module_put(cp->prot->owner);
+        can_put_proto(cp);
         return err;
 }
 
@@ -679,7 +696,7 @@ drop:
  *  -EBUSY  protocol already in use
  *  -ENOBUF if proto_register() fails
  */
-int can_proto_register(struct can_proto *cp)
+int can_proto_register(const struct can_proto *cp)
 {
         int proto = cp->protocol;
         int err = 0;
@@ -694,15 +711,16 @@ int can_proto_register(struct can_proto *cp)
         if (err < 0)
                 return err;
 
-        spin_lock(&proto_tab_lock);
+        mutex_lock(&proto_tab_lock);
+
         if (proto_tab[proto]) {
                 printk(KERN_ERR "can: protocol %d already registered\n",
                        proto);
                 err = -EBUSY;
         } else
-                proto_tab[proto] = cp;
+                rcu_assign_pointer(proto_tab[proto], cp);
 
-        spin_unlock(&proto_tab_lock);
+        mutex_unlock(&proto_tab_lock);
 
         if (err < 0)
                 proto_unregister(cp->prot);
@@ -715,17 +733,16 @@ EXPORT_SYMBOL(can_proto_register);
  * can_proto_unregister - unregister CAN transport protocol
  * @cp: pointer to CAN protocol structure
  */
-void can_proto_unregister(struct can_proto *cp)
+void can_proto_unregister(const struct can_proto *cp)
 {
         int proto = cp->protocol;
 
-        spin_lock(&proto_tab_lock);
-        if (!proto_tab[proto]) {
-                printk(KERN_ERR "BUG: can: protocol %d is not registered\n",
-                       proto);
-        }
-        proto_tab[proto] = NULL;
-        spin_unlock(&proto_tab_lock);
+        mutex_lock(&proto_tab_lock);
+        BUG_ON(proto_tab[proto] != cp);
+        rcu_assign_pointer(proto_tab[proto], NULL);
+        mutex_unlock(&proto_tab_lock);
+
+        synchronize_rcu();
 
         proto_unregister(cp->prot);
 }
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 8a6a05e7c3c8..cced806098a9 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1601,7 +1601,7 @@ static struct proto bcm_proto __read_mostly = {
         .init       = bcm_init,
 };
 
-static struct can_proto bcm_can_proto __read_mostly = {
+static const struct can_proto bcm_can_proto = {
         .type       = SOCK_DGRAM,
         .protocol   = CAN_BCM,
         .ops        = &bcm_ops,
diff --git a/net/can/raw.c b/net/can/raw.c
index 0eb39a7fdf64..dea99a6e596c 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -774,7 +774,7 @@ static struct proto raw_proto __read_mostly = {
         .init       = raw_init,
 };
 
-static struct can_proto raw_can_proto __read_mostly = {
+static const struct can_proto raw_can_proto = {
         .type       = SOCK_RAW,
         .protocol   = CAN_RAW,
         .ops        = &raw_ops,
diff --git a/net/compat.c b/net/compat.c
index 3649d5895361..c578d9382e19 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -722,11 +722,11 @@ EXPORT_SYMBOL(compat_mc_getsockopt);
 
 /* Argument list sizes for compat_sys_socketcall */
 #define AL(x) ((x) * sizeof(u32))
-static unsigned char nas[20] = {
+static unsigned char nas[21] = {
         AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
         AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
         AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
-        AL(4), AL(5)
+        AL(4), AL(5), AL(4)
 };
 #undef AL
 
@@ -735,6 +735,13 @@ asmlinkage long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, uns
         return sys_sendmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
 }
 
+asmlinkage long compat_sys_sendmmsg(int fd, struct compat_mmsghdr __user *mmsg,
+                                    unsigned vlen, unsigned int flags)
+{
+        return __sys_sendmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
+                              flags | MSG_CMSG_COMPAT);
+}
+
 asmlinkage long compat_sys_recvmsg(int fd, struct compat_msghdr __user *msg, unsigned int flags)
 {
         return sys_recvmsg(fd, (struct msghdr __user *)msg, flags | MSG_CMSG_COMPAT);
@@ -780,7 +787,7 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
         u32 a[6];
         u32 a0, a1;
 
-        if (call < SYS_SOCKET || call > SYS_RECVMMSG)
+        if (call < SYS_SOCKET || call > SYS_SENDMMSG)
                 return -EINVAL;
         if (copy_from_user(a, args, nas[call]))
                 return -EFAULT;
@@ -839,6 +846,9 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
         case SYS_SENDMSG:
                 ret = compat_sys_sendmsg(a0, compat_ptr(a1), a[2]);
                 break;
+        case SYS_SENDMMSG:
+                ret = compat_sys_sendmmsg(a0, compat_ptr(a1), a[2], a[3]);
+                break;
         case SYS_RECVMSG:
                 ret = compat_sys_recvmsg(a0, compat_ptr(a1), a[2]);
                 break;
diff --git a/net/core/dev.c b/net/core/dev.c
index 856b6ee9a1d5..44ef8f8998ca 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -948,7 +948,7 @@ int dev_alloc_name(struct net_device *dev, const char *name)
 }
 EXPORT_SYMBOL(dev_alloc_name);
 
-static int dev_get_valid_name(struct net_device *dev, const char *name, bool fmt)
+static int dev_get_valid_name(struct net_device *dev, const char *name)
 {
         struct net *net;
 
@@ -958,7 +958,7 @@ static int dev_get_valid_name(struct net_device *dev, const char *name, bool fmt
         if (!dev_valid_name(name))
                 return -EINVAL;
 
-        if (fmt && strchr(name, '%'))
+        if (strchr(name, '%'))
                 return dev_alloc_name(dev, name);
         else if (__dev_get_by_name(net, name))
                 return -EEXIST;
@@ -995,7 +995,7 @@ int dev_change_name(struct net_device *dev, const char *newname)
 
         memcpy(oldname, dev->name, IFNAMSIZ);
 
-        err = dev_get_valid_name(dev, newname, 1);
+        err = dev_get_valid_name(dev, newname);
         if (err < 0)
                 return err;
 
@@ -1315,7 +1315,8 @@ void dev_disable_lro(struct net_device *dev)
                 return;
 
         __ethtool_set_flags(dev, flags & ~ETH_FLAG_LRO);
-        WARN_ON(dev->features & NETIF_F_LRO);
+        if (unlikely(dev->features & NETIF_F_LRO))
+                netdev_WARN(dev, "failed to disable LRO!\n");
 }
 EXPORT_SYMBOL(dev_disable_lro);
 
@@ -2502,8 +2503,8 @@ static inline void ____napi_schedule(struct softnet_data *sd,
 __u32 __skb_get_rxhash(struct sk_buff *skb)
 {
         int nhoff, hash = 0, poff;
-        struct ipv6hdr *ip6;
-        struct iphdr *ip;
+        const struct ipv6hdr *ip6;
+        const struct iphdr *ip;
         u8 ip_proto;
         u32 addr1, addr2, ihl;
         union {
@@ -2518,7 +2519,7 @@ __u32 __skb_get_rxhash(struct sk_buff *skb)
                 if (!pskb_may_pull(skb, sizeof(*ip) + nhoff))
                         goto done;
 
-                ip = (struct iphdr *) (skb->data + nhoff);
+                ip = (const struct iphdr *) (skb->data + nhoff);
                 if (ip->frag_off & htons(IP_MF | IP_OFFSET))
                         ip_proto = 0;
                 else
@@ -2531,7 +2532,7 @@ __u32 __skb_get_rxhash(struct sk_buff *skb)
                 if (!pskb_may_pull(skb, sizeof(*ip6) + nhoff))
                         goto done;
 
-                ip6 = (struct ipv6hdr *) (skb->data + nhoff);
+                ip6 = (const struct ipv6hdr *) (skb->data + nhoff);
                 ip_proto = ip6->nexthdr;
                 addr1 = (__force u32) ip6->saddr.s6_addr32[3];
                 addr2 = (__force u32) ip6->daddr.s6_addr32[3];
@@ -3076,25 +3077,6 @@ void netdev_rx_handler_unregister(struct net_device *dev)
 }
 EXPORT_SYMBOL_GPL(netdev_rx_handler_unregister);
 
-static void vlan_on_bond_hook(struct sk_buff *skb)
-{
-        /*
-         * Make sure ARP frames received on VLAN interfaces stacked on
-         * bonding interfaces still make their way to any base bonding
-         * device that may have registered for a specific ptype.
-         */
-        if (skb->dev->priv_flags & IFF_802_1Q_VLAN &&
-            vlan_dev_real_dev(skb->dev)->priv_flags & IFF_BONDING &&
-            skb->protocol == htons(ETH_P_ARP)) {
-                struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
-
-                if (!skb2)
-                        return;
-                skb2->dev = vlan_dev_real_dev(skb->dev);
-                netif_rx(skb2);
-        }
-}
-
 static int __netif_receive_skb(struct sk_buff *skb)
 {
         struct packet_type *ptype, *pt_prev;
@@ -3130,6 +3112,12 @@ another_round:
 
         __this_cpu_inc(softnet_data.processed);
 
+        if (skb->protocol == cpu_to_be16(ETH_P_8021Q)) {
+                skb = vlan_untag(skb);
+                if (unlikely(!skb))
+                        goto out;
+        }
+
 #ifdef CONFIG_NET_CLS_ACT
         if (skb->tc_verd & TC_NCLS) {
                 skb->tc_verd = CLR_TC_NCLS(skb->tc_verd);
@@ -3177,15 +3165,13 @@ ncls:
                         ret = deliver_skb(skb, pt_prev, orig_dev);
                         pt_prev = NULL;
                 }
-                if (vlan_hwaccel_do_receive(&skb)) {
+                if (vlan_do_receive(&skb)) {
                         ret = __netif_receive_skb(skb);
                         goto out;
                 } else if (unlikely(!skb))
                         goto out;
         }
 
-        vlan_on_bond_hook(skb);
-
         /* deliver only exact match when indicated */
         null_or_dev = deliver_exact ? skb->dev : NULL;
 
@@ -4510,6 +4496,30 @@ void dev_set_rx_mode(struct net_device *dev)
 }
 
 /**
+ *      dev_ethtool_get_settings - call device's ethtool_ops::get_settings()
+ *      @dev: device
+ *      @cmd: memory area for ethtool_ops::get_settings() result
+ *
+ *      The cmd arg is initialized properly (cleared and
+ *      ethtool_cmd::cmd field set to ETHTOOL_GSET).
+ *
+ *      Return device's ethtool_ops::get_settings() result value or
+ *      -EOPNOTSUPP when device doesn't expose
+ *      ethtool_ops::get_settings() operation.
+ */
+int dev_ethtool_get_settings(struct net_device *dev,
+                             struct ethtool_cmd *cmd)
+{
+        if (!dev->ethtool_ops || !dev->ethtool_ops->get_settings)
+                return -EOPNOTSUPP;
+
+        memset(cmd, 0, sizeof(struct ethtool_cmd));
+        cmd->cmd = ETHTOOL_GSET;
+        return dev->ethtool_ops->get_settings(dev, cmd);
+}
+EXPORT_SYMBOL(dev_ethtool_get_settings);
+
+/**
  *      dev_get_flags - get flags reported to userspace
  *      @dev: device
  *
@@ -5240,11 +5250,13 @@ u32 netdev_fix_features(struct net_device *dev, u32 features)
 }
 EXPORT_SYMBOL(netdev_fix_features);
 
-void netdev_update_features(struct net_device *dev)
+int __netdev_update_features(struct net_device *dev)
 {
         u32 features;
         int err = 0;
 
+        ASSERT_RTNL();
+
         features = netdev_get_wanted_features(dev);
 
         if (dev->netdev_ops->ndo_fix_features)
@@ -5254,7 +5266,7 @@ void netdev_update_features(struct net_device *dev)
         features = netdev_fix_features(dev, features);
 
         if (dev->features == features)
-                return;
+                return 0;
 
         netdev_info(dev, "Features changed: 0x%08x -> 0x%08x\n",
                 dev->features, features);
@@ -5262,12 +5274,23 @@ void netdev_update_features(struct net_device *dev)
         if (dev->netdev_ops->ndo_set_features)
                 err = dev->netdev_ops->ndo_set_features(dev, features);
 
-        if (!err)
-                dev->features = features;
-        else if (err < 0)
+        if (unlikely(err < 0)) {
                 netdev_err(dev,
                         "set_features() failed (%d); wanted 0x%08x, left 0x%08x\n",
                         err, features, dev->features);
+                return -1;
+        }
+
+        if (!err)
+                dev->features = features;
+
+        return 1;
+}
+
+void netdev_update_features(struct net_device *dev)
+{
+        if (__netdev_update_features(dev))
+                netdev_features_change(dev);
 }
 EXPORT_SYMBOL(netdev_update_features);
 
@@ -5397,8 +5420,8 @@ int register_netdevice(struct net_device *dev)
                 }
         }
 
-        ret = dev_get_valid_name(dev, dev->name, 0);
-        if (ret)
+        ret = dev_get_valid_name(dev, dev->name);
+        if (ret < 0)
                 goto err_uninit;
 
         dev->ifindex = dev_new_index(net);
@@ -5418,6 +5441,14 @@ int register_netdevice(struct net_device *dev)
                 dev->features &= ~NETIF_F_GSO;
         }
 
+        /* Turn on no cache copy if HW is doing checksum */
+        dev->hw_features |= NETIF_F_NOCACHE_COPY;
+        if ((dev->features & NETIF_F_ALL_CSUM) &&
+            !(dev->features & NETIF_F_NO_CSUM)) {
+                dev->wanted_features |= NETIF_F_NOCACHE_COPY;
+                dev->features |= NETIF_F_NOCACHE_COPY;
+        }
+
         /* Enable GRO and NETIF_F_HIGHDMA for vlans by default,
          * vlan_dev_init() will do the dev->features check, so these features
          * are enabled only if supported by underlying device.
@@ -5434,7 +5465,7 @@ int register_netdevice(struct net_device *dev)
                 goto err_uninit;
         dev->reg_state = NETREG_REGISTERED;
 
-        netdev_update_features(dev);
+        __netdev_update_features(dev);
 
         /*
          *      Default initial state at registry is that the
@@ -5531,19 +5562,7 @@ int register_netdev(struct net_device *dev)
         int err;
 
         rtnl_lock();
-
-        /*
-         * If the name is a format string the caller wants us to do a
-         * name allocation.
-         */
-        if (strchr(dev->name, '%')) {
-                err = dev_alloc_name(dev, dev->name);
-                if (err < 0)
-                        goto out;
-        }
-
         err = register_netdevice(dev);
-out:
         rtnl_unlock();
         return err;
 }
@@ -6025,7 +6044,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
                 /* We get here if we can't use the current device name */
                 if (!pat)
                         goto out;
-                if (dev_get_valid_name(dev, pat, 1))
+                if (dev_get_valid_name(dev, pat) < 0)
                         goto out;
         }
 
@@ -6157,29 +6176,20 @@ static int dev_cpu_callback(struct notifier_block *nfb,
  */
 u32 netdev_increment_features(u32 all, u32 one, u32 mask)
 {
-        /* If device needs checksumming, downgrade to it. */
-        if (all & NETIF_F_NO_CSUM && !(one & NETIF_F_NO_CSUM))
-                all ^= NETIF_F_NO_CSUM | (one & NETIF_F_ALL_CSUM);
-        else if (mask & NETIF_F_ALL_CSUM) {
-                /* If one device supports v4/v6 checksumming, set for all. */
-                if (one & (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM) &&
-                    !(all & NETIF_F_GEN_CSUM)) {
-                        all &= ~NETIF_F_ALL_CSUM;
-                        all |= one & (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM);
-                }
+        if (mask & NETIF_F_GEN_CSUM)
+                mask |= NETIF_F_ALL_CSUM;
+        mask |= NETIF_F_VLAN_CHALLENGED;
 
-                /* If one device supports hw checksumming, set for all. */
-                if (one & NETIF_F_GEN_CSUM && !(all & NETIF_F_GEN_CSUM)) {
-                        all &= ~NETIF_F_ALL_CSUM;
-                        all |= NETIF_F_HW_CSUM;
-                }
-        }
+        all |= one & (NETIF_F_ONE_FOR_ALL|NETIF_F_ALL_CSUM) & mask;
+        all &= one | ~NETIF_F_ALL_FOR_ALL;
 
-        one |= NETIF_F_ALL_CSUM;
+        /* If device needs checksumming, downgrade to it. */
+        if (all & (NETIF_F_ALL_CSUM & ~NETIF_F_NO_CSUM))
+                all &= ~NETIF_F_NO_CSUM;
 
-        one |= all & NETIF_F_ONE_FOR_ALL;
-        all &= one | NETIF_F_LLTX | NETIF_F_GSO | NETIF_F_UFO;
-        all |= one & mask & NETIF_F_ONE_FOR_ALL;
+        /* If one device supports hw checksumming, set for all. */
+        if (all & NETIF_F_GEN_CSUM)
+                all &= ~(NETIF_F_ALL_CSUM & ~NETIF_F_GEN_CSUM);
 
         return all;
 }
diff --git a/net/core/dst.c b/net/core/dst.c
index 91104d35de7d..30f009327b62 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -166,7 +166,8 @@ EXPORT_SYMBOL(dst_discard);
 
 const u32 dst_default_metrics[RTAX_MAX];
 
-void *dst_alloc(struct dst_ops *ops, int initial_ref)
+void *dst_alloc(struct dst_ops *ops, struct net_device *dev,
+                int initial_ref, int initial_obsolete, int flags)
 {
         struct dst_entry *dst;
 
@@ -174,15 +175,36 @@ void *dst_alloc(struct dst_ops *ops, int initial_ref)
                 if (ops->gc(ops))
                         return NULL;
         }
-        dst = kmem_cache_zalloc(ops->kmem_cachep, GFP_ATOMIC);
+        dst = kmem_cache_alloc(ops->kmem_cachep, GFP_ATOMIC);
         if (!dst)
                 return NULL;
-        atomic_set(&dst->__refcnt, initial_ref);
+        dst->child = NULL;
+        dst->dev = dev;
+        if (dev)
+                dev_hold(dev);
         dst->ops = ops;
-        dst->lastuse = jiffies;
-        dst->path = dst;
-        dst->input = dst->output = dst_discard;
         dst_init_metrics(dst, dst_default_metrics, true);
+        dst->expires = 0UL;
+        dst->path = dst;
+        dst->neighbour = NULL;
+        dst->hh = NULL;
+#ifdef CONFIG_XFRM
+        dst->xfrm = NULL;
+#endif
+        dst->input = dst_discard;
+        dst->output = dst_discard;
+        dst->error = 0;
+        dst->obsolete = initial_obsolete;
+        dst->header_len = 0;
+        dst->trailer_len = 0;
+#ifdef CONFIG_IP_ROUTE_CLASSID
+        dst->tclassid = 0;
+#endif
+        atomic_set(&dst->__refcnt, initial_ref);
+        dst->__use = 0;
+        dst->lastuse = jiffies;
+        dst->flags = flags;
+        dst->next = NULL;
 #if RT_CACHE_DEBUG >= 2
         atomic_inc(&dst_total);
 #endif
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 74ead9eca126..d8b1a8d85a96 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -21,6 +21,8 @@
 #include <linux/uaccess.h>
 #include <linux/vmalloc.h>
 #include <linux/slab.h>
+#include <linux/rtnetlink.h>
+#include <linux/sched.h>
 
 /*
  * Some useful ethtool_ops methods that're device independent.
@@ -317,7 +319,7 @@ static int ethtool_set_features(struct net_device *dev, void __user *useraddr)
 
         dev->wanted_features &= ~features[0].valid;
         dev->wanted_features |= features[0].valid & features[0].requested;
-        netdev_update_features(dev);
+        __netdev_update_features(dev);
 
         if ((dev->wanted_features ^ dev->features) & features[0].valid)
                 ret |= ETHTOOL_F_WISH;
@@ -359,7 +361,7 @@ static const char netdev_features_strings[ETHTOOL_DEV_FEATURE_WORDS * 32][ETH_GS
         /* NETIF_F_NTUPLE */          "rx-ntuple-filter",
         /* NETIF_F_RXHASH */          "rx-hashing",
         /* NETIF_F_RXCSUM */          "rx-checksum",
-        "",
+        /* NETIF_F_NOCACHE_COPY */    "tx-nocache-copy"
         "",
 };
 
@@ -499,7 +501,7 @@ static int ethtool_set_one_feature(struct net_device *dev,
                 else
                         dev->wanted_features &= ~mask;
 
-                netdev_update_features(dev);
+                __netdev_update_features(dev);
                 return 0;
         }
 
@@ -544,14 +546,14 @@ int __ethtool_set_flags(struct net_device *dev, u32 data)
         }
 
         /* allow changing only bits set in hw_features */
-        changed = (data ^ dev->wanted_features) & flags_dup_features;
+        changed = (data ^ dev->features) & flags_dup_features;
         if (changed & ~dev->hw_features)
                 return (changed & dev->hw_features) ? -EINVAL : -EOPNOTSUPP;
 
         dev->wanted_features =
-                (dev->wanted_features & ~changed) | data;
+                (dev->wanted_features & ~changed) | (data & dev->hw_features);
 
-        netdev_update_features(dev);
+        __netdev_update_features(dev);
 
         return 0;
 }
@@ -908,6 +910,9 @@ static noinline_for_stack int ethtool_set_rx_ntuple(struct net_device *dev,
         struct ethtool_rx_ntuple_flow_spec_container *fsc = NULL;
         int ret;
 
+        if (!ops->set_rx_ntuple)
+                return -EOPNOTSUPP;
+
         if (!(dev->features & NETIF_F_NTUPLE))
                 return -EINVAL;
 
@@ -1441,6 +1446,35 @@ static int ethtool_set_ringparam(struct net_device *dev, void __user *useraddr)
         return dev->ethtool_ops->set_ringparam(dev, &ringparam);
 }
 
+static noinline_for_stack int ethtool_get_channels(struct net_device *dev,
+                                                   void __user *useraddr)
+{
+        struct ethtool_channels channels = { .cmd = ETHTOOL_GCHANNELS };
+
+        if (!dev->ethtool_ops->get_channels)
+                return -EOPNOTSUPP;
+
+        dev->ethtool_ops->get_channels(dev, &channels);
+
+        if (copy_to_user(useraddr, &channels, sizeof(channels)))
+                return -EFAULT;
+        return 0;
+}
+
+static noinline_for_stack int ethtool_set_channels(struct net_device *dev,
+                                                   void __user *useraddr)
+{
+        struct ethtool_channels channels;
+
+        if (!dev->ethtool_ops->set_channels)
+                return -EOPNOTSUPP;
+
+        if (copy_from_user(&channels, useraddr, sizeof(channels)))
+                return -EFAULT;
+
+        return dev->ethtool_ops->set_channels(dev, &channels);
+}
+
 static int ethtool_get_pauseparam(struct net_device *dev, void __user *useraddr)
 {
         struct ethtool_pauseparam pauseparam = { ETHTOOL_GPAUSEPARAM };
@@ -1618,14 +1652,64 @@ out:
 static int ethtool_phys_id(struct net_device *dev, void __user *useraddr)
 {
         struct ethtool_value id;
+        static bool busy;
+        int rc;
 
-        if (!dev->ethtool_ops->phys_id)
+        if (!dev->ethtool_ops->set_phys_id && !dev->ethtool_ops->phys_id)
                 return -EOPNOTSUPP;
 
+        if (busy)
+                return -EBUSY;
+
         if (copy_from_user(&id, useraddr, sizeof(id)))
                 return -EFAULT;
 
-        return dev->ethtool_ops->phys_id(dev, id.data);
+        if (!dev->ethtool_ops->set_phys_id)
+                /* Do it the old way */
+                return dev->ethtool_ops->phys_id(dev, id.data);
+
+        rc = dev->ethtool_ops->set_phys_id(dev, ETHTOOL_ID_ACTIVE);
+        if (rc < 0)
+                return rc;
+
+        /* Drop the RTNL lock while waiting, but prevent reentry or
+         * removal of the device.
+         */
+        busy = true;
+        dev_hold(dev);
+        rtnl_unlock();
+
+        if (rc == 0) {
+                /* Driver will handle this itself */
+                schedule_timeout_interruptible(
+                        id.data ? (id.data * HZ) : MAX_SCHEDULE_TIMEOUT);
+        } else {
+                /* Driver expects to be called at twice the frequency in rc */
+                int n = rc * 2, i, interval = HZ / n;
+
+                /* Count down seconds */
+                do {
+                        /* Count down iterations per second */
+                        i = n;
+                        do {
+                                rtnl_lock();
+                                rc = dev->ethtool_ops->set_phys_id(dev,
+                                    (i & 1) ? ETHTOOL_ID_OFF : ETHTOOL_ID_ON);
+                                rtnl_unlock();
+                                if (rc)
+                                        break;
+                                schedule_timeout_interruptible(interval);
+                        } while (!signal_pending(current) && --i != 0);
+                } while (!signal_pending(current) &&
+                         (id.data == 0 || --id.data != 0));
+        }
+
+        rtnl_lock();
+        dev_put(dev);
+        busy = false;
+
+        (void)dev->ethtool_ops->set_phys_id(dev, ETHTOOL_ID_INACTIVE);
+        return rc;
 }
 
 static int ethtool_get_stats(struct net_device *dev, void __user *useraddr)
@@ -1953,6 +2037,12 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_SGRO:
                 rc = ethtool_set_one_feature(dev, useraddr, ethcmd);
                 break;
+        case ETHTOOL_GCHANNELS:
+                rc = ethtool_get_channels(dev, useraddr);
+                break;
+        case ETHTOOL_SCHANNELS:
+                rc = ethtool_set_channels(dev, useraddr);
+                break;
         default:
                 rc = -EOPNOTSUPP;
         }
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 8248ebb5891d..3911586e12e4 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -590,7 +590,8 @@ static int dump_rules(struct sk_buff *skb, struct netlink_callback *cb,
         int idx = 0;
         struct fib_rule *rule;
 
-        list_for_each_entry(rule, &ops->rules_list, list) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(rule, &ops->rules_list, list) {
                 if (idx < cb->args[1])
                         goto skip;
 
diff --git a/net/core/filter.c b/net/core/filter.c
index afb8afb066bb..0eb8c4466eaa 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -39,65 +39,6 @@
 #include <linux/filter.h>
 #include <linux/reciprocal_div.h>
 
-enum {
-        BPF_S_RET_K = 1,
-        BPF_S_RET_A,
-        BPF_S_ALU_ADD_K,
-        BPF_S_ALU_ADD_X,
-        BPF_S_ALU_SUB_K,
-        BPF_S_ALU_SUB_X,
-        BPF_S_ALU_MUL_K,
-        BPF_S_ALU_MUL_X,
-        BPF_S_ALU_DIV_X,
-        BPF_S_ALU_AND_K,
-        BPF_S_ALU_AND_X,
-        BPF_S_ALU_OR_K,
-        BPF_S_ALU_OR_X,
-        BPF_S_ALU_LSH_K,
-        BPF_S_ALU_LSH_X,
-        BPF_S_ALU_RSH_K,
-        BPF_S_ALU_RSH_X,
-        BPF_S_ALU_NEG,
-        BPF_S_LD_W_ABS,
-        BPF_S_LD_H_ABS,
-        BPF_S_LD_B_ABS,
-        BPF_S_LD_W_LEN,
-        BPF_S_LD_W_IND,
-        BPF_S_LD_H_IND,
-        BPF_S_LD_B_IND,
-        BPF_S_LD_IMM,
-        BPF_S_LDX_W_LEN,
-        BPF_S_LDX_B_MSH,
-        BPF_S_LDX_IMM,
-        BPF_S_MISC_TAX,
-        BPF_S_MISC_TXA,
-        BPF_S_ALU_DIV_K,
-        BPF_S_LD_MEM,
-        BPF_S_LDX_MEM,
-        BPF_S_ST,
-        BPF_S_STX,
-        BPF_S_JMP_JA,
-        BPF_S_JMP_JEQ_K,
-        BPF_S_JMP_JEQ_X,
-        BPF_S_JMP_JGE_K,
-        BPF_S_JMP_JGE_X,
-        BPF_S_JMP_JGT_K,
-        BPF_S_JMP_JGT_X,
-        BPF_S_JMP_JSET_K,
-        BPF_S_JMP_JSET_X,
-        /* Ancillary data */
-        BPF_S_ANC_PROTOCOL,
-        BPF_S_ANC_PKTTYPE,
-        BPF_S_ANC_IFINDEX,
-        BPF_S_ANC_NLATTR,
-        BPF_S_ANC_NLATTR_NEST,
-        BPF_S_ANC_MARK,
-        BPF_S_ANC_QUEUE,
-        BPF_S_ANC_HATYPE,
-        BPF_S_ANC_RXHASH,
-        BPF_S_ANC_CPU,
-};
-
 /* No hurry in this branch */
 static void *__load_pointer(const struct sk_buff *skb, int k, unsigned int size)
 {
@@ -145,7 +86,7 @@ int sk_filter(struct sock *sk, struct sk_buff *skb)
         rcu_read_lock();
         filter = rcu_dereference(sk->sk_filter);
         if (filter) {
-                unsigned int pkt_len = sk_run_filter(skb, filter->insns);
+                unsigned int pkt_len = SK_RUN_FILTER(filter, skb);
 
                 err = pkt_len ? pskb_trim(skb, pkt_len) : -EPERM;
         }
@@ -638,6 +579,7 @@ void sk_filter_release_rcu(struct rcu_head *rcu)
 {
         struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
 
+        bpf_jit_free(fp);
         kfree(fp);
 }
 EXPORT_SYMBOL(sk_filter_release_rcu);
@@ -672,6 +614,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
 
         atomic_set(&fp->refcnt, 1);
         fp->len = fprog->len;
+        fp->bpf_func = sk_run_filter;
 
         err = sk_chk_filter(fp->insns, fp->len);
         if (err) {
@@ -679,6 +622,8 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
                 return err;
         }
 
+        bpf_jit_compile(fp);
+
         old_fp = rcu_dereference_protected(sk->sk_filter,
                                            sock_owned_by_user(sk));
         rcu_assign_pointer(sk->sk_filter, fp);
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 5ceb257e860c..381813eae46c 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -28,6 +28,7 @@
 static const char fmt_hex[] = "%#x\n";
 static const char fmt_long_hex[] = "%#lx\n";
 static const char fmt_dec[] = "%d\n";
+static const char fmt_udec[] = "%u\n";
 static const char fmt_ulong[] = "%lu\n";
 static const char fmt_u64[] = "%llu\n";
 
@@ -145,13 +146,10 @@ static ssize_t show_speed(struct device *dev,
         if (!rtnl_trylock())
                 return restart_syscall();
 
-        if (netif_running(netdev) &&
-            netdev->ethtool_ops &&
-            netdev->ethtool_ops->get_settings) {
-                struct ethtool_cmd cmd = { ETHTOOL_GSET };
-
-                if (!netdev->ethtool_ops->get_settings(netdev, &cmd))
-                        ret = sprintf(buf, fmt_dec, ethtool_cmd_speed(&cmd));
+        if (netif_running(netdev)) {
+                struct ethtool_cmd cmd;
+                if (!dev_ethtool_get_settings(netdev, &cmd))
+                        ret = sprintf(buf, fmt_udec, ethtool_cmd_speed(&cmd));
         }
         rtnl_unlock();
         return ret;
@@ -166,13 +164,11 @@ static ssize_t show_duplex(struct device *dev,
         if (!rtnl_trylock())
                 return restart_syscall();
 
-        if (netif_running(netdev) &&
-            netdev->ethtool_ops &&
-            netdev->ethtool_ops->get_settings) {
-                struct ethtool_cmd cmd = { ETHTOOL_GSET };
-
-                if (!netdev->ethtool_ops->get_settings(netdev, &cmd))
-                        ret = sprintf(buf, "%s\n", cmd.duplex ? "full" : "half");
+        if (netif_running(netdev)) {
+                struct ethtool_cmd cmd;
+                if (!dev_ethtool_get_settings(netdev, &cmd))
+                        ret = sprintf(buf, "%s\n",
+                                      cmd.duplex ? "full" : "half");
         }
         rtnl_unlock();
         return ret;
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 3f860261c5ee..1abb50841046 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -216,11 +216,14 @@ static void net_free(struct net *net)
         kmem_cache_free(net_cachep, net);
 }
 
-static struct net *net_create(void)
+struct net *copy_net_ns(unsigned long flags, struct net *old_net)
 {
         struct net *net;
         int rv;
 
+        if (!(flags & CLONE_NEWNET))
+                return get_net(old_net);
+
         net = net_alloc();
         if (!net)
                 return ERR_PTR(-ENOMEM);
@@ -239,13 +242,6 @@ static struct net *net_create(void)
         return net;
 }
 
-struct net *copy_net_ns(unsigned long flags, struct net *old_net)
-{
-        if (!(flags & CLONE_NEWNET))
-                return get_net(old_net);
-        return net_create();
-}
-
 static DEFINE_SPINLOCK(cleanup_list_lock);
 static LIST_HEAD(cleanup_list);  /* Must hold cleanup_list_lock to touch */
 
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 06be2431753e..46d9c3a4de2f 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -539,7 +539,7 @@ int __netpoll_rx(struct sk_buff *skb)
 {
         int proto, len, ulen;
         int hits = 0;
-        struct iphdr *iph;
+        const struct iphdr *iph;
         struct udphdr *uh;
         struct netpoll_info *npinfo = skb->dev->npinfo;
         struct netpoll *np, *tmp;
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index aeeece72b72f..ff79d94b5944 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2514,7 +2514,6 @@ static int pktgen_output_ipsec(struct sk_buff *skb, struct pktgen_dev *pkt_dev)
 {
         struct xfrm_state *x = pkt_dev->flows[pkt_dev->curfl].x;
         int err = 0;
-        struct iphdr *iph;
 
         if (!x)
                 return 0;
@@ -2524,7 +2523,6 @@ static int pktgen_output_ipsec(struct sk_buff *skb, struct pktgen_dev *pkt_dev)
                 return 0;
 
         spin_lock(&x->lock);
-        iph = ip_hdr(skb);
 
         err = x->outer_mode->output(x, skb);
         if (err)
@@ -2624,6 +2622,7 @@ static void pktgen_finalize_skb(struct pktgen_dev *pkt_dev, struct sk_buff *skb,
         } else {
                 int frags = pkt_dev->nfrags;
                 int i, len;
+                int frag_len;
 
 
                 if (frags > MAX_SKB_FRAGS)
@@ -2635,6 +2634,8 @@ static void pktgen_finalize_skb(struct pktgen_dev *pkt_dev, struct sk_buff *skb,
                 }
 
                 i = 0;
+                frag_len = (datalen/frags) < PAGE_SIZE ?
+                           (datalen/frags) : PAGE_SIZE;
                 while (datalen > 0) {
                         if (unlikely(!pkt_dev->page)) {
                                 int node = numa_node_id();
@@ -2648,38 +2649,18 @@ static void pktgen_finalize_skb(struct pktgen_dev *pkt_dev, struct sk_buff *skb,
                         skb_shinfo(skb)->frags[i].page = pkt_dev->page;
                         get_page(pkt_dev->page);
                         skb_shinfo(skb)->frags[i].page_offset = 0;
-                        skb_shinfo(skb)->frags[i].size =
-                            (datalen < PAGE_SIZE ? datalen : PAGE_SIZE);
+                        /*last fragment, fill rest of data*/
+                        if (i == (frags - 1))
+                                skb_shinfo(skb)->frags[i].size =
+                                    (datalen < PAGE_SIZE ? datalen : PAGE_SIZE);
+                        else
+                                skb_shinfo(skb)->frags[i].size = frag_len;
                         datalen -= skb_shinfo(skb)->frags[i].size;
                         skb->len += skb_shinfo(skb)->frags[i].size;
                         skb->data_len += skb_shinfo(skb)->frags[i].size;
                         i++;
                         skb_shinfo(skb)->nr_frags = i;
                 }
-
-                while (i < frags) {
-                        int rem;
-
-                        if (i == 0)
-                                break;
-
-                        rem = skb_shinfo(skb)->frags[i - 1].size / 2;
-                        if (rem == 0)
-                                break;
-
-                        skb_shinfo(skb)->frags[i - 1].size -= rem;
-
-                        skb_shinfo(skb)->frags[i] =
-                            skb_shinfo(skb)->frags[i - 1];
-                        get_page(skb_shinfo(skb)->frags[i].page);
-                        skb_shinfo(skb)->frags[i].page =
-                            skb_shinfo(skb)->frags[i - 1].page;
-                        skb_shinfo(skb)->frags[i].page_offset +=
-                            skb_shinfo(skb)->frags[i - 1].size;
-                        skb_shinfo(skb)->frags[i].size = rem;
-                        i++;
-                        skb_shinfo(skb)->nr_frags = i;
-                }
         }
 
         /* Stamp the time, and sequence number,
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index d7c4bb4b1820..5a160f4a1ba0 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1007,10 +1007,11 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         s_h = cb->args[0];
         s_idx = cb->args[1];
 
+        rcu_read_lock();
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
                 head = &net->dev_index_head[h];
-                hlist_for_each_entry(dev, node, head, index_hlist) {
+                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
                         if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
@@ -1023,6 +1024,7 @@ cont:
                 }
         }
 out:
+        rcu_read_unlock();
         cb->args[1] = idx;
         cb->args[0] = h;
 
@@ -1570,12 +1572,6 @@ struct net_device *rtnl_create_link(struct net *src_net, struct net *net,
         dev->rtnl_link_state = RTNL_LINK_INITIALIZING;
         dev->real_num_tx_queues = real_num_queues;
 
-        if (strchr(dev->name, '%')) {
-                err = dev_alloc_name(dev, dev->name);
-                if (err < 0)
-                        goto err_free;
-        }
-
         if (tb[IFLA_MTU])
                 dev->mtu = nla_get_u32(tb[IFLA_MTU]);
         if (tb[IFLA_ADDRESS])
@@ -1595,8 +1591,6 @@ struct net_device *rtnl_create_link(struct net *src_net, struct net *net,
 
         return dev;
 
-err_free:
-        free_netdev(dev);
 err:
         return ERR_PTR(err);
 }
@@ -1879,7 +1873,6 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
         int min_len;
         int family;
         int type;
-        int err;
 
         type = nlh->nlmsg_type;
         if (type > RTM_MAX)
@@ -1906,11 +1899,8 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 if (dumpit == NULL)
                         return -EOPNOTSUPP;
 
-                __rtnl_unlock();
                 rtnl = net->rtnl;
-                err = netlink_dump_start(rtnl, skb, nlh, dumpit, NULL);
-                rtnl_lock();
-                return err;
+                return netlink_dump_start(rtnl, skb, nlh, dumpit, NULL);
         }
 
         memset(rta_buf, 0, (rtattr_max * sizeof(struct rtattr *)));
@@ -1980,7 +1970,7 @@ static int __net_init rtnetlink_net_init(struct net *net)
 {
         struct sock *sk;
         sk = netlink_kernel_create(net, NETLINK_ROUTE, RTNLGRP_MAX,
-                                   rtnetlink_rcv, &rtnl_mutex, THIS_MODULE);
+                                   rtnetlink_rcv, NULL, THIS_MODULE);
         if (!sk)
                 return -ENOMEM;
         net->rtnl = sk;
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 385b6095fdc4..a829e3f60aeb 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -122,6 +122,15 @@ static struct ctl_table net_core_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
+#ifdef CONFIG_BPF_JIT
+        {
+                .procname       = "bpf_jit_enable",
+                .data           = &bpf_jit_enable,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+#endif
         {
                 .procname       = "netdev_tstamp_prequeue",
                 .data           = &netdev_tstamp_prequeue,
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index ae451c6d83ba..36700a46b245 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -40,13 +40,15 @@
 
 int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
+        const struct sockaddr_in *usin = (struct sockaddr_in *)uaddr;
         struct inet_sock *inet = inet_sk(sk);
         struct dccp_sock *dp = dccp_sk(sk);
-        const struct sockaddr_in *usin = (struct sockaddr_in *)uaddr;
         __be16 orig_sport, orig_dport;
-        struct rtable *rt;
         __be32 daddr, nexthop;
+        struct flowi4 fl4;
+        struct rtable *rt;
         int err;
+        struct ip_options_rcu *inet_opt;
 
         dp->dccps_role = DCCP_ROLE_CLIENT;
 
@@ -57,15 +59,18 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 return -EAFNOSUPPORT;
 
         nexthop = daddr = usin->sin_addr.s_addr;
-        if (inet->opt != NULL && inet->opt->srr) {
+
+        inet_opt = rcu_dereference_protected(inet->inet_opt,
+                                             sock_owned_by_user(sk));
+        if (inet_opt != NULL && inet_opt->opt.srr) {
                 if (daddr == 0)
                         return -EINVAL;
-                nexthop = inet->opt->faddr;
+                nexthop = inet_opt->opt.faddr;
         }
 
         orig_sport = inet->inet_sport;
         orig_dport = usin->sin_port;
-        rt = ip_route_connect(nexthop, inet->inet_saddr,
+        rt = ip_route_connect(&fl4, nexthop, inet->inet_saddr,
                               RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
                               IPPROTO_DCCP,
                               orig_sport, orig_dport, sk, true);
@@ -77,19 +82,19 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 return -ENETUNREACH;
         }
 
-        if (inet->opt == NULL || !inet->opt->srr)
-                daddr = rt->rt_dst;
+        if (inet_opt == NULL || !inet_opt->opt.srr)
+                daddr = fl4.daddr;
 
         if (inet->inet_saddr == 0)
-                inet->inet_saddr = rt->rt_src;
+                inet->inet_saddr = fl4.saddr;
         inet->inet_rcv_saddr = inet->inet_saddr;
 
         inet->inet_dport = usin->sin_port;
         inet->inet_daddr = daddr;
 
         inet_csk(sk)->icsk_ext_hdr_len = 0;
-        if (inet->opt != NULL)
-                inet_csk(sk)->icsk_ext_hdr_len = inet->opt->optlen;
+        if (inet_opt)
+                inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
         /*
          * Socket identity is still unknown (sport may be zero).
          * However we set state to DCCP_REQUESTING and not releasing socket
@@ -101,8 +106,7 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (err != 0)
                 goto failure;
 
-        rt = ip_route_newports(rt, IPPROTO_DCCP,
-                               orig_sport, orig_dport,
+        rt = ip_route_newports(&fl4, rt, orig_sport, orig_dport,
                                inet->inet_sport, inet->inet_dport, sk);
         if (IS_ERR(rt)) {
                 rt = NULL;
@@ -405,7 +409,7 @@ struct sock *dccp_v4_request_recv_sock(struct sock *sk, struct sk_buff *skb,
         newinet->inet_daddr     = ireq->rmt_addr;
         newinet->inet_rcv_saddr = ireq->loc_addr;
         newinet->inet_saddr     = ireq->loc_addr;
-        newinet->opt       = ireq->opt;
+        newinet->inet_opt       = ireq->opt;
         ireq->opt          = NULL;
         newinet->mc_index  = inet_iif(skb);
         newinet->mc_ttl    = ip_hdr(skb)->ttl;
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index de1b7e37ad5b..8dc4348774a5 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -54,8 +54,8 @@ static void dccp_v6_hash(struct sock *sk)
 
 /* add pseudo-header to DCCP checksum stored in skb->csum */
 static inline __sum16 dccp_v6_csum_finish(struct sk_buff *skb,
-                                      struct in6_addr *saddr,
-                                      struct in6_addr *daddr)
+                                      const struct in6_addr *saddr,
+                                      const struct in6_addr *daddr)
 {
         return csum_ipv6_magic(saddr, daddr, skb->len, IPPROTO_DCCP, skb->csum);
 }
@@ -87,7 +87,7 @@ static inline __u32 dccp_v6_init_sequence(struct sk_buff *skb)
 static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                         u8 type, u8 code, int offset, __be32 info)
 {
-        struct ipv6hdr *hdr = (struct ipv6hdr *)skb->data;
+        const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
         const struct dccp_hdr *dh = (struct dccp_hdr *)(skb->data + offset);
         struct dccp_sock *dp;
         struct ipv6_pinfo *np;
@@ -296,7 +296,7 @@ static void dccp_v6_reqsk_destructor(struct request_sock *req)
 
 static void dccp_v6_ctl_send_reset(struct sock *sk, struct sk_buff *rxskb)
 {
-        struct ipv6hdr *rxip6h;
+        const struct ipv6hdr *rxip6h;
         struct sk_buff *skb;
         struct flowi6 fl6;
         struct net *net = dev_net(skb_dst(rxskb)->dev);
@@ -573,7 +573,7 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
 
            First: no IPv4 options.
          */
-        newinet->opt = NULL;
+        newinet->inet_opt = NULL;
 
         /* Clone RX bits */
         newnp->rxopt.all = np->rxopt.all;
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index 0dcaa903e00e..404fa1591027 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -752,7 +752,8 @@ static int dn_nl_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
         skip_naddr = cb->args[1];
 
         idx = 0;
-        for_each_netdev(&init_net, dev) {
+        rcu_read_lock();
+        for_each_netdev_rcu(&init_net, dev) {
                 if (idx < skip_ndevs)
                         goto cont;
                 else if (idx > skip_ndevs) {
@@ -761,11 +762,11 @@ static int dn_nl_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
                         skip_naddr = 0;
                 }
 
-                if ((dn_db = rtnl_dereference(dev->dn_ptr)) == NULL)
+                if ((dn_db = rcu_dereference(dev->dn_ptr)) == NULL)
                         goto cont;
 
-                for (ifa = rtnl_dereference(dn_db->ifa_list), dn_idx = 0; ifa;
-                     ifa = rtnl_dereference(ifa->ifa_next), dn_idx++) {
+                for (ifa = rcu_dereference(dn_db->ifa_list), dn_idx = 0; ifa;
+                     ifa = rcu_dereference(ifa->ifa_next), dn_idx++) {
                         if (dn_idx < skip_naddr)
                                 continue;
 
@@ -778,6 +779,7 @@ cont:
                 idx++;
         }
 done:
+        rcu_read_unlock();
         cb->args[0] = idx;
         cb->args[1] = dn_idx;
 
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 9f09d4fc2880..74544bc6fdec 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -1125,13 +1125,11 @@ make_route:
         if (dev_out->flags & IFF_LOOPBACK)
                 flags |= RTCF_LOCAL;
 
-        rt = dst_alloc(&dn_dst_ops, 0);
+        rt = dst_alloc(&dn_dst_ops, dev_out, 1, 0, DST_HOST);
         if (rt == NULL)
                 goto e_nobufs;
 
-        atomic_set(&rt->dst.__refcnt, 1);
-        rt->dst.flags   = DST_HOST;
-
+        memset(&rt->fld, 0, sizeof(rt->fld));
         rt->fld.saddr        = oldflp->saddr;
         rt->fld.daddr        = oldflp->daddr;
         rt->fld.flowidn_oif  = oldflp->flowidn_oif;
@@ -1146,8 +1144,6 @@ make_route:
         rt->rt_dst_map    = fld.daddr;
         rt->rt_src_map    = fld.saddr;
 
-        rt->dst.dev = dev_out;
-        dev_hold(dev_out);
         rt->dst.neighbour = neigh;
         neigh = NULL;
 
@@ -1399,10 +1395,11 @@ static int dn_route_input_slow(struct sk_buff *skb)
         }
 
 make_route:
-        rt = dst_alloc(&dn_dst_ops, 0);
+        rt = dst_alloc(&dn_dst_ops, out_dev, 0, 0, DST_HOST);
         if (rt == NULL)
                 goto e_nobufs;
 
+        memset(&rt->fld, 0, sizeof(rt->fld));
         rt->rt_saddr      = fld.saddr;
         rt->rt_daddr      = fld.daddr;
         rt->rt_gateway    = fld.daddr;
@@ -1419,9 +1416,7 @@ make_route:
         rt->fld.flowidn_iif  = in_dev->ifindex;
         rt->fld.flowidn_mark = fld.flowidn_mark;
 
-        rt->dst.flags = DST_HOST;
         rt->dst.neighbour = neigh;
-        rt->dst.dev = out_dev;
         rt->dst.lastuse = jiffies;
         rt->dst.output = dn_rt_bug;
         switch(res.type) {
@@ -1440,8 +1435,6 @@ make_route:
                         rt->dst.input = dst_discard;
         }
         rt->rt_flags = flags;
-        if (rt->dst.dev)
-                dev_hold(rt->dst.dev);
 
         err = dn_rt_set_next_hop(rt, &res);
         if (err)
diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
index 99d8d3a40998..bd0a52dd1d40 100644
--- a/net/decnet/dn_table.c
+++ b/net/decnet/dn_table.c
@@ -123,11 +123,11 @@ static inline void dn_rebuild_zone(struct dn_zone *dz,
                                    struct dn_fib_node **old_ht,
                                    int old_divisor)
 {
-        int i;
         struct dn_fib_node *f, **fp, *next;
+        int i;
 
         for(i = 0; i < old_divisor; i++) {
-                for(f = old_ht[i]; f; f = f->fn_next) {
+                for(f = old_ht[i]; f; f = next) {
                         next = f->fn_next;
                         for(fp = dn_chain_p(f->fn_key, dz);
                                 *fp && dn_key_leq((*fp)->fn_key, f->fn_key);
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 64ca2a6fa0d4..0a47b6c37038 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -288,7 +288,6 @@ static const struct ethtool_ops dsa_slave_ethtool_ops = {
         .get_drvinfo            = dsa_slave_get_drvinfo,
         .nway_reset             = dsa_slave_nway_reset,
         .get_link               = dsa_slave_get_link,
-        .set_sg                 = ethtool_op_set_sg,
         .get_strings            = dsa_slave_get_strings,
         .get_ethtool_stats      = dsa_slave_get_ethtool_stats,
         .get_sset_count         = dsa_slave_get_sset_count,
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 116d3fd3d669..a1d9f3787dd5 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -935,7 +935,6 @@ static void aun_data_available(struct sock *sk, int slen)
         struct sk_buff *skb;
         unsigned char *data;
         struct aunhdr *ah;
-        struct iphdr *ip;
         size_t len;
 
         while ((skb = skb_recv_datagram(sk, 0, 1, &err)) == NULL) {
@@ -949,7 +948,6 @@ static void aun_data_available(struct sock *sk, int slen)
         data = skb_transport_header(skb) + sizeof(struct udphdr);
         ah = (struct aunhdr *)data;
         len = skb->len - sizeof(struct udphdr);
-        ip = ip_hdr(skb);
 
         switch (ah->code)
         {
@@ -962,12 +960,6 @@ static void aun_data_available(struct sock *sk, int slen)
         case 4:
                 aun_tx_ack(ah->handle, ECTYPE_TRANSMIT_NOT_LISTENING);
                 break;
-#if 0
-                /* This isn't quite right yet. */
-        case 5:
-                aun_send_response(ip->saddr, ah->handle, 6, ah->cb);
-                break;
-#endif
         default:
                 printk(KERN_DEBUG "unknown AUN packet (type %d)\n", data[0]);
         }
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 807d83c02ef6..7b91fa8bf83c 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -153,7 +153,7 @@ void inet_sock_destruct(struct sock *sk)
         WARN_ON(sk->sk_wmem_queued);
         WARN_ON(sk->sk_forward_alloc);
 
-        kfree(inet->opt);
+        kfree(rcu_dereference_protected(inet->inet_opt, 1));
         dst_release(rcu_dereference_check(sk->sk_dst_cache, 1));
         sk_refcnt_debug_dec(sk);
 }
@@ -1103,14 +1103,18 @@ static int inet_sk_reselect_saddr(struct sock *sk)
         struct inet_sock *inet = inet_sk(sk);
         __be32 old_saddr = inet->inet_saddr;
         __be32 daddr = inet->inet_daddr;
+        struct flowi4 fl4;
         struct rtable *rt;
         __be32 new_saddr;
+        struct ip_options_rcu *inet_opt;
 
-        if (inet->opt && inet->opt->srr)
-                daddr = inet->opt->faddr;
+        inet_opt = rcu_dereference_protected(inet->inet_opt,
+                                             sock_owned_by_user(sk));
+        if (inet_opt && inet_opt->opt.srr)
+                daddr = inet_opt->opt.faddr;
 
         /* Query new route. */
-        rt = ip_route_connect(daddr, 0, RT_CONN_FLAGS(sk),
+        rt = ip_route_connect(&fl4, daddr, 0, RT_CONN_FLAGS(sk),
                               sk->sk_bound_dev_if, sk->sk_protocol,
                               inet->inet_sport, inet->inet_dport, sk, false);
         if (IS_ERR(rt))
@@ -1118,7 +1122,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
 
         sk_setup_caps(sk, &rt->dst);
 
-        new_saddr = rt->rt_src;
+        new_saddr = fl4.saddr;
 
         if (new_saddr == old_saddr)
                 return 0;
@@ -1147,6 +1151,8 @@ int inet_sk_rebuild_header(struct sock *sk)
         struct inet_sock *inet = inet_sk(sk);
         struct rtable *rt = (struct rtable *)__sk_dst_check(sk, 0);
         __be32 daddr;
+        struct ip_options_rcu *inet_opt;
+        struct flowi4 fl4;
         int err;
 
         /* Route is OK, nothing to do. */
@@ -1154,10 +1160,13 @@ int inet_sk_rebuild_header(struct sock *sk)
                 return 0;
 
         /* Reroute. */
+        rcu_read_lock();
+        inet_opt = rcu_dereference(inet->inet_opt);
         daddr = inet->inet_daddr;
-        if (inet->opt && inet->opt->srr)
-                daddr = inet->opt->faddr;
-        rt = ip_route_output_ports(sock_net(sk), sk, daddr, inet->inet_saddr,
+        if (inet_opt && inet_opt->opt.srr)
+                daddr = inet_opt->opt.faddr;
+        rcu_read_unlock();
+        rt = ip_route_output_ports(sock_net(sk), &fl4, sk, daddr, inet->inet_saddr,
                                    inet->inet_dport, inet->inet_sport,
                                    sk->sk_protocol, RT_CONN_FLAGS(sk),
                                    sk->sk_bound_dev_if);
@@ -1186,7 +1195,7 @@ EXPORT_SYMBOL(inet_sk_rebuild_header);
 
 static int inet_gso_send_check(struct sk_buff *skb)
 {
-        struct iphdr *iph;
+        const struct iphdr *iph;
         const struct net_protocol *ops;
         int proto;
         int ihl;
@@ -1293,7 +1302,7 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
         const struct net_protocol *ops;
         struct sk_buff **pp = NULL;
         struct sk_buff *p;
-        struct iphdr *iph;
+        const struct iphdr *iph;
         unsigned int hlen;
         unsigned int off;
         unsigned int id;
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 4286fd3cc0e2..c1f4154552fc 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -73,7 +73,7 @@ static inline struct scatterlist *ah_req_sg(struct crypto_ahash *ahash,
  * into IP header for icv calculation. Options are already checked
  * for validity, so paranoia is not required. */
 
-static int ip_clear_mutable_options(struct iphdr *iph, __be32 *daddr)
+static int ip_clear_mutable_options(const struct iphdr *iph, __be32 *daddr)
 {
         unsigned char * optptr = (unsigned char*)(iph+1);
         int  l = iph->ihl*4 - sizeof(struct iphdr);
@@ -396,7 +396,7 @@ out:
 static void ah4_err(struct sk_buff *skb, u32 info)
 {
         struct net *net = dev_net(skb->dev);
-        struct iphdr *iph = (struct iphdr *)skb->data;
+        const struct iphdr *iph = (const struct iphdr *)skb->data;
         struct ip_auth_hdr *ah = (struct ip_auth_hdr *)(skb->data+(iph->ihl<<2));
         struct xfrm_state *x;
 
@@ -404,7 +404,8 @@ static void ah4_err(struct sk_buff *skb, u32 info)
             icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
                 return;
 
-        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET);
+        x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
+                              ah->spi, IPPROTO_AH, AF_INET);
         if (!x)
                 return;
         printk(KERN_DEBUG "pmtu discovery on SA AH/%08x/%08x\n",
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index a0af7ea87870..2b3c23c287cd 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1857,6 +1857,11 @@ static int cipso_v4_genopt(unsigned char *buf, u32 buf_len,
         return CIPSO_V4_HDR_LEN + ret_val;
 }
 
+static void opt_kfree_rcu(struct rcu_head *head)
+{
+        kfree(container_of(head, struct ip_options_rcu, rcu));
+}
+
 /**
  * cipso_v4_sock_setattr - Add a CIPSO option to a socket
  * @sk: the socket
@@ -1879,7 +1884,7 @@ int cipso_v4_sock_setattr(struct sock *sk,
         unsigned char *buf = NULL;
         u32 buf_len;
         u32 opt_len;
-        struct ip_options *opt = NULL;
+        struct ip_options_rcu *old, *opt = NULL;
         struct inet_sock *sk_inet;
         struct inet_connection_sock *sk_conn;
 
@@ -1915,22 +1920,25 @@ int cipso_v4_sock_setattr(struct sock *sk,
                 ret_val = -ENOMEM;
                 goto socket_setattr_failure;
         }
-        memcpy(opt->__data, buf, buf_len);
-        opt->optlen = opt_len;
-        opt->cipso = sizeof(struct iphdr);
+        memcpy(opt->opt.__data, buf, buf_len);
+        opt->opt.optlen = opt_len;
+        opt->opt.cipso = sizeof(struct iphdr);
         kfree(buf);
         buf = NULL;
 
         sk_inet = inet_sk(sk);
+
+        old = rcu_dereference_protected(sk_inet->inet_opt, sock_owned_by_user(sk));
         if (sk_inet->is_icsk) {
                 sk_conn = inet_csk(sk);
-                if (sk_inet->opt)
-                        sk_conn->icsk_ext_hdr_len -= sk_inet->opt->optlen;
-                sk_conn->icsk_ext_hdr_len += opt->optlen;
+                if (old)
+                        sk_conn->icsk_ext_hdr_len -= old->opt.optlen;
+                sk_conn->icsk_ext_hdr_len += opt->opt.optlen;
                 sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
         }
-        opt = xchg(&sk_inet->opt, opt);
-        kfree(opt);
+        rcu_assign_pointer(sk_inet->inet_opt, opt);
+        if (old)
+                call_rcu(&old->rcu, opt_kfree_rcu);
 
         return 0;
 
@@ -1960,7 +1968,7 @@ int cipso_v4_req_setattr(struct request_sock *req,
         unsigned char *buf = NULL;
         u32 buf_len;
         u32 opt_len;
-        struct ip_options *opt = NULL;
+        struct ip_options_rcu *opt = NULL;
         struct inet_request_sock *req_inet;
 
         /* We allocate the maximum CIPSO option size here so we are probably
@@ -1988,15 +1996,16 @@ int cipso_v4_req_setattr(struct request_sock *req,
                 ret_val = -ENOMEM;
                 goto req_setattr_failure;
         }
-        memcpy(opt->__data, buf, buf_len);
-        opt->optlen = opt_len;
-        opt->cipso = sizeof(struct iphdr);
+        memcpy(opt->opt.__data, buf, buf_len);
+        opt->opt.optlen = opt_len;
+        opt->opt.cipso = sizeof(struct iphdr);
         kfree(buf);
         buf = NULL;
 
         req_inet = inet_rsk(req);
         opt = xchg(&req_inet->opt, opt);
-        kfree(opt);
+        if (opt)
+                call_rcu(&opt->rcu, opt_kfree_rcu);
 
         return 0;
 
@@ -2016,34 +2025,34 @@ req_setattr_failure:
  * values on failure.
  *
  */
-static int cipso_v4_delopt(struct ip_options **opt_ptr)
+static int cipso_v4_delopt(struct ip_options_rcu **opt_ptr)
 {
         int hdr_delta = 0;
-        struct ip_options *opt = *opt_ptr;
+        struct ip_options_rcu *opt = *opt_ptr;
 
-        if (opt->srr || opt->rr || opt->ts || opt->router_alert) {
+        if (opt->opt.srr || opt->opt.rr || opt->opt.ts || opt->opt.router_alert) {
                 u8 cipso_len;
                 u8 cipso_off;
                 unsigned char *cipso_ptr;
                 int iter;
                 int optlen_new;
 
-                cipso_off = opt->cipso - sizeof(struct iphdr);
-                cipso_ptr = &opt->__data[cipso_off];
+                cipso_off = opt->opt.cipso - sizeof(struct iphdr);
+                cipso_ptr = &opt->opt.__data[cipso_off];
                 cipso_len = cipso_ptr[1];
 
-                if (opt->srr > opt->cipso)
-                        opt->srr -= cipso_len;
-                if (opt->rr > opt->cipso)
-                        opt->rr -= cipso_len;
-                if (opt->ts > opt->cipso)
-                        opt->ts -= cipso_len;
-                if (opt->router_alert > opt->cipso)
-                        opt->router_alert -= cipso_len;
-                opt->cipso = 0;
+                if (opt->opt.srr > opt->opt.cipso)
+                        opt->opt.srr -= cipso_len;
+                if (opt->opt.rr > opt->opt.cipso)
+                        opt->opt.rr -= cipso_len;
+                if (opt->opt.ts > opt->opt.cipso)
+                        opt->opt.ts -= cipso_len;
+                if (opt->opt.router_alert > opt->opt.cipso)
+                        opt->opt.router_alert -= cipso_len;
+                opt->opt.cipso = 0;
 
                 memmove(cipso_ptr, cipso_ptr + cipso_len,
-                        opt->optlen - cipso_off - cipso_len);
+                        opt->opt.optlen - cipso_off - cipso_len);
 
                 /* determining the new total option length is tricky because of
                  * the padding necessary, the only thing i can think to do at
@@ -2052,21 +2061,21 @@ static int cipso_v4_delopt(struct ip_options **opt_ptr)
                  * from there we can determine the new total option length */
                 iter = 0;
                 optlen_new = 0;
-                while (iter < opt->optlen)
-                        if (opt->__data[iter] != IPOPT_NOP) {
-                                iter += opt->__data[iter + 1];
+                while (iter < opt->opt.optlen)
+                        if (opt->opt.__data[iter] != IPOPT_NOP) {
+                                iter += opt->opt.__data[iter + 1];
                                 optlen_new = iter;
                         } else
                                 iter++;
-                hdr_delta = opt->optlen;
-                opt->optlen = (optlen_new + 3) & ~3;
-                hdr_delta -= opt->optlen;
+                hdr_delta = opt->opt.optlen;
+                opt->opt.optlen = (optlen_new + 3) & ~3;
+                hdr_delta -= opt->opt.optlen;
         } else {
                 /* only the cipso option was present on the socket so we can
                  * remove the entire option struct */
                 *opt_ptr = NULL;
-                hdr_delta = opt->optlen;
-                kfree(opt);
+                hdr_delta = opt->opt.optlen;
+                call_rcu(&opt->rcu, opt_kfree_rcu);
         }
 
         return hdr_delta;
@@ -2083,15 +2092,15 @@ static int cipso_v4_delopt(struct ip_options **opt_ptr)
 void cipso_v4_sock_delattr(struct sock *sk)
 {
         int hdr_delta;
-        struct ip_options *opt;
+        struct ip_options_rcu *opt;
         struct inet_sock *sk_inet;
 
         sk_inet = inet_sk(sk);
-        opt = sk_inet->opt;
-        if (opt == NULL || opt->cipso == 0)
+        opt = rcu_dereference_protected(sk_inet->inet_opt, 1);
+        if (opt == NULL || opt->opt.cipso == 0)
                 return;
 
-        hdr_delta = cipso_v4_delopt(&sk_inet->opt);
+        hdr_delta = cipso_v4_delopt(&sk_inet->inet_opt);
         if (sk_inet->is_icsk && hdr_delta > 0) {
                 struct inet_connection_sock *sk_conn = inet_csk(sk);
                 sk_conn->icsk_ext_hdr_len -= hdr_delta;
@@ -2109,12 +2118,12 @@ void cipso_v4_sock_delattr(struct sock *sk)
  */
 void cipso_v4_req_delattr(struct request_sock *req)
 {
-        struct ip_options *opt;
+        struct ip_options_rcu *opt;
         struct inet_request_sock *req_inet;
 
         req_inet = inet_rsk(req);
         opt = req_inet->opt;
-        if (opt == NULL || opt->cipso == 0)
+        if (opt == NULL || opt->opt.cipso == 0)
                 return;
 
         cipso_v4_delopt(&req_inet->opt);
@@ -2184,14 +2193,18 @@ getattr_return:
  */
 int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
 {
-        struct ip_options *opt;
+        struct ip_options_rcu *opt;
+        int res = -ENOMSG;
 
-        opt = inet_sk(sk)->opt;
-        if (opt == NULL || opt->cipso == 0)
-                return -ENOMSG;
-
-        return cipso_v4_getattr(opt->__data + opt->cipso - sizeof(struct iphdr),
-                                secattr);
+        rcu_read_lock();
+        opt = rcu_dereference(inet_sk(sk)->inet_opt);
+        if (opt && opt->opt.cipso)
+                res = cipso_v4_getattr(opt->opt.__data +
+                                                opt->opt.cipso -
+                                                sizeof(struct iphdr),
+                                       secattr);
+        rcu_read_unlock();
+        return res;
 }
 
 /**
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 85bd24ca4f6d..d5a2e6995bae 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -24,6 +24,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct sockaddr_in *usin = (struct sockaddr_in *) uaddr;
+        struct flowi4 fl4;
         struct rtable *rt;
         __be32 saddr;
         int oif;
@@ -46,7 +47,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 if (!saddr)
                         saddr = inet->mc_addr;
         }
-        rt = ip_route_connect(usin->sin_addr.s_addr, saddr,
+        rt = ip_route_connect(&fl4, usin->sin_addr.s_addr, saddr,
                               RT_CONN_FLAGS(sk), oif,
                               sk->sk_protocol,
                               inet->inet_sport, usin->sin_port, sk, true);
@@ -62,13 +63,13 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 return -EACCES;
         }
         if (!inet->inet_saddr)
-                inet->inet_saddr = rt->rt_src;  /* Update source address */
+                inet->inet_saddr = fl4.saddr;   /* Update source address */
         if (!inet->inet_rcv_saddr) {
-                inet->inet_rcv_saddr = rt->rt_src;
+                inet->inet_rcv_saddr = fl4.saddr;
                 if (sk->sk_prot->rehash)
                         sk->sk_prot->rehash(sk);
         }
-        inet->inet_daddr = rt->rt_dst;
+        inet->inet_daddr = fl4.daddr;
         inet->inet_dport = usin->sin_port;
         sk->sk_state = TCP_ESTABLISHED;
         inet->inet_id = jiffies;
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 03f994bcf7de..a5b413416da3 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -276,7 +276,7 @@ error:
 
 static int esp_input_done2(struct sk_buff *skb, int err)
 {
-        struct iphdr *iph;
+        const struct iphdr *iph;
         struct xfrm_state *x = xfrm_input_state(skb);
         struct esp_data *esp = x->data;
         struct crypto_aead *aead = esp->aead;
@@ -484,7 +484,7 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu)
 static void esp4_err(struct sk_buff *skb, u32 info)
 {
         struct net *net = dev_net(skb->dev);
-        struct iphdr *iph = (struct iphdr *)skb->data;
+        const struct iphdr *iph = (const struct iphdr *)skb->data;
         struct ip_esp_hdr *esph = (struct ip_esp_hdr *)(skb->data+(iph->ihl<<2));
         struct xfrm_state *x;
 
@@ -492,7 +492,8 @@ static void esp4_err(struct sk_buff *skb, u32 info)
             icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
                 return;
 
-        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET);
+        x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
+                              esph->spi, IPPROTO_ESP, AF_INET);
         if (!x)
                 return;
         NETDEBUG(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%08x\n",
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 451088330bbb..22524716fe70 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -44,6 +44,7 @@
 #include <net/arp.h>
 #include <net/ip_fib.h>
 #include <net/rtnetlink.h>
+#include <net/xfrm.h>
 
 #ifndef CONFIG_IP_MULTIPLE_TABLES
 
@@ -188,9 +189,9 @@ EXPORT_SYMBOL(inet_dev_addr_type);
  * - check, that packet arrived from expected physical interface.
  * called with rcu_read_lock()
  */
-int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
-                        struct net_device *dev, __be32 *spec_dst,
-                        u32 *itag, u32 mark)
+int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, u8 tos,
+                        int oif, struct net_device *dev, __be32 *spec_dst,
+                        u32 *itag)
 {
         struct in_device *in_dev;
         struct flowi4 fl4;
@@ -202,7 +203,6 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
 
         fl4.flowi4_oif = 0;
         fl4.flowi4_iif = oif;
-        fl4.flowi4_mark = mark;
         fl4.daddr = src;
         fl4.saddr = dst;
         fl4.flowi4_tos = tos;
@@ -212,10 +212,12 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
         in_dev = __in_dev_get_rcu(dev);
         if (in_dev) {
                 no_addr = in_dev->ifa_list == NULL;
-                rpf = IN_DEV_RPFILTER(in_dev);
+
+                /* Ignore rp_filter for packets protected by IPsec. */
+                rpf = secpath_exists(skb) ? 0 : IN_DEV_RPFILTER(in_dev);
+
                 accept_local = IN_DEV_ACCEPT_LOCAL(in_dev);
-                if (mark && !IN_DEV_SRC_VMARK(in_dev))
-                        fl4.flowi4_mark = 0;
+                fl4.flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0;
         }
 
         if (in_dev == NULL)
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 5fe9b8b41df3..6375c1c5f642 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -126,7 +126,7 @@ struct tnode {
                 struct work_struct work;
                 struct tnode *tnode_free;
         };
-        struct rt_trie_node *child[0];
+        struct rt_trie_node __rcu *child[0];
 };
 
 #ifdef CONFIG_IP_FIB_TRIE_STATS
@@ -151,7 +151,7 @@ struct trie_stat {
 };
 
 struct trie {
-        struct rt_trie_node *trie;
+        struct rt_trie_node __rcu *trie;
 #ifdef CONFIG_IP_FIB_TRIE_STATS
         struct trie_use_stats stats;
 #endif
@@ -177,16 +177,29 @@ static const int sync_pages = 128;
 static struct kmem_cache *fn_alias_kmem __read_mostly;
 static struct kmem_cache *trie_leaf_kmem __read_mostly;
 
-static inline struct tnode *node_parent(struct rt_trie_node *node)
+/*
+ * caller must hold RTNL
+ */
+static inline struct tnode *node_parent(const struct rt_trie_node *node)
 {
-        return (struct tnode *)(node->parent & ~NODE_TYPE_MASK);
+        unsigned long parent;
+
+        parent = rcu_dereference_index_check(node->parent, lockdep_rtnl_is_held());
+
+        return (struct tnode *)(parent & ~NODE_TYPE_MASK);
 }
 
-static inline struct tnode *node_parent_rcu(struct rt_trie_node *node)
+/*
+ * caller must hold RCU read lock or RTNL
+ */
+static inline struct tnode *node_parent_rcu(const struct rt_trie_node *node)
 {
-        struct tnode *ret = node_parent(node);
+        unsigned long parent;
+
+        parent = rcu_dereference_index_check(node->parent, rcu_read_lock_held() ||
+                                                           lockdep_rtnl_is_held());
 
-        return rcu_dereference_rtnl(ret);
+        return (struct tnode *)(parent & ~NODE_TYPE_MASK);
 }
 
 /* Same as rcu_assign_pointer
@@ -198,18 +211,24 @@ static inline void node_set_parent(struct rt_trie_node *node, struct tnode *ptr)
         node->parent = (unsigned long)ptr | NODE_TYPE(node);
 }
 
-static inline struct rt_trie_node *tnode_get_child(struct tnode *tn, unsigned int i)
+/*
+ * caller must hold RTNL
+ */
+static inline struct rt_trie_node *tnode_get_child(const struct tnode *tn, unsigned int i)
 {
         BUG_ON(i >= 1U << tn->bits);
 
-        return tn->child[i];
+        return rtnl_dereference(tn->child[i]);
 }
 
-static inline struct rt_trie_node *tnode_get_child_rcu(struct tnode *tn, unsigned int i)
+/*
+ * caller must hold RCU read lock or RTNL
+ */
+static inline struct rt_trie_node *tnode_get_child_rcu(const struct tnode *tn, unsigned int i)
 {
-        struct rt_trie_node *ret = tnode_get_child(tn, i);
+        BUG_ON(i >= 1U << tn->bits);
 
-        return rcu_dereference_rtnl(ret);
+        return rcu_dereference_rtnl(tn->child[i]);
 }
 
 static inline int tnode_child_length(const struct tnode *tn)
@@ -487,7 +506,7 @@ static inline void put_child(struct trie *t, struct tnode *tn, int i,
 static void tnode_put_child_reorg(struct tnode *tn, int i, struct rt_trie_node *n,
                                   int wasfull)
 {
-        struct rt_trie_node *chi = tn->child[i];
+        struct rt_trie_node *chi = rtnl_dereference(tn->child[i]);
         int isfull;
 
         BUG_ON(i >= 1<<tn->bits);
@@ -665,7 +684,7 @@ one_child:
                 for (i = 0; i < tnode_child_length(tn); i++) {
                         struct rt_trie_node *n;
 
-                        n = tn->child[i];
+                        n = rtnl_dereference(tn->child[i]);
                         if (!n)
                                 continue;
 
@@ -679,6 +698,20 @@ one_child:
         return (struct rt_trie_node *) tn;
 }
 
+
+static void tnode_clean_free(struct tnode *tn)
+{
+        int i;
+        struct tnode *tofree;
+
+        for (i = 0; i < tnode_child_length(tn); i++) {
+                tofree = (struct tnode *)rtnl_dereference(tn->child[i]);
+                if (tofree)
+                        tnode_free(tofree);
+        }
+        tnode_free(tn);
+}
+
 static struct tnode *inflate(struct trie *t, struct tnode *tn)
 {
         struct tnode *oldtnode = tn;
@@ -755,8 +788,8 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn)
                 inode = (struct tnode *) node;
 
                 if (inode->bits == 1) {
-                        put_child(t, tn, 2*i, inode->child[0]);
-                        put_child(t, tn, 2*i+1, inode->child[1]);
+                        put_child(t, tn, 2*i, rtnl_dereference(inode->child[0]));
+                        put_child(t, tn, 2*i+1, rtnl_dereference(inode->child[1]));
 
                         tnode_free_safe(inode);
                         continue;
@@ -797,8 +830,8 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn)
 
                 size = tnode_child_length(left);
                 for (j = 0; j < size; j++) {
-                        put_child(t, left, j, inode->child[j]);
-                        put_child(t, right, j, inode->child[j + size]);
+                        put_child(t, left, j, rtnl_dereference(inode->child[j]));
+                        put_child(t, right, j, rtnl_dereference(inode->child[j + size]));
                 }
                 put_child(t, tn, 2*i, resize(t, left));
                 put_child(t, tn, 2*i+1, resize(t, right));
@@ -808,18 +841,8 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn)
         tnode_free_safe(oldtnode);
         return tn;
 nomem:
-        {
-                int size = tnode_child_length(tn);
-                int j;
-
-                for (j = 0; j < size; j++)
-                        if (tn->child[j])
-                                tnode_free((struct tnode *)tn->child[j]);
-
-                tnode_free(tn);
-
-                return ERR_PTR(-ENOMEM);
-        }
+        tnode_clean_free(tn);
+        return ERR_PTR(-ENOMEM);
 }
 
 static struct tnode *halve(struct trie *t, struct tnode *tn)
@@ -890,18 +913,8 @@ static struct tnode *halve(struct trie *t, struct tnode *tn)
         tnode_free_safe(oldtnode);
         return tn;
 nomem:
-        {
-                int size = tnode_child_length(tn);
-                int j;
-
-                for (j = 0; j < size; j++)
-                        if (tn->child[j])
-                                tnode_free((struct tnode *)tn->child[j]);
-
-                tnode_free(tn);
-
-                return ERR_PTR(-ENOMEM);
-        }
+        tnode_clean_free(tn);
+        return ERR_PTR(-ENOMEM);
 }
 
 /* readside must use rcu_read_lock currently dump routines
@@ -1033,7 +1046,7 @@ static struct list_head *fib_insert_node(struct trie *t, u32 key, int plen)
         t_key cindex;
 
         pos = 0;
-        n = t->trie;
+        n = rtnl_dereference(t->trie);
 
         /* If we point to NULL, stop. Either the tree is empty and we should
          * just put a new leaf in if, or we have reached an empty child slot,
@@ -1319,6 +1332,9 @@ int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
                 }
         }
 
+        if (!plen)
+                tb->tb_num_default++;
+
         list_add_tail_rcu(&new_fa->fa_list,
                           (fa ? &fa->fa_list : fa_head));
 
@@ -1684,6 +1700,9 @@ int fib_table_delete(struct fib_table *tb, struct fib_config *cfg)
 
         list_del_rcu(&fa->fa_list);
 
+        if (!plen)
+                tb->tb_num_default--;
+
         if (list_empty(fa_head)) {
                 hlist_del_rcu(&li->hlist);
                 free_leaf_info(li);
@@ -1756,7 +1775,7 @@ static struct leaf *leaf_walk_rcu(struct tnode *p, struct rt_trie_node *c)
                                 continue;
 
                         if (IS_LEAF(c)) {
-                                prefetch(p->child[idx]);
+                                prefetch(rcu_dereference_rtnl(p->child[idx]));
                                 return (struct leaf *) c;
                         }
 
@@ -1974,6 +1993,7 @@ struct fib_table *fib_trie_table(u32 id)
 
         tb->tb_id = id;
         tb->tb_default = -1;
+        tb->tb_num_default = 0;
 
         t = (struct trie *) tb->tb_data;
         memset(t, 0, sizeof(*t));
@@ -2269,7 +2289,7 @@ static void *fib_trie_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 
         /* walk rest of this hash chain */
         h = tb->tb_id & (FIB_TABLE_HASHSZ - 1);
-        while ( (tb_node = rcu_dereference(tb->tb_hlist.next)) ) {
+        while ((tb_node = rcu_dereference(hlist_next_rcu(&tb->tb_hlist)))) {
                 tb = hlist_entry(tb_node, struct fib_table, tb_hlist);
                 n = fib_trie_get_first(iter, (struct trie *) tb->tb_data);
                 if (n)
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index e5f8a71d3a2a..cfeca3c2152d 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -108,8 +108,7 @@ struct icmp_bxm {
                 __be32         times[3];
         } data;
         int head_len;
-        struct ip_options replyopts;
-        unsigned char  optbuf[40];
+        struct ip_options_data replyopts;
 };
 
 /* An array of errno for error messages from dest unreach. */
@@ -333,7 +332,7 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
         struct inet_sock *inet;
         __be32 daddr;
 
-        if (ip_options_echo(&icmp_param->replyopts, skb))
+        if (ip_options_echo(&icmp_param->replyopts.opt.opt, skb))
                 return;
 
         sk = icmp_xmit_lock(net);
@@ -347,10 +346,10 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
         daddr = ipc.addr = rt->rt_src;
         ipc.opt = NULL;
         ipc.tx_flags = 0;
-        if (icmp_param->replyopts.optlen) {
-                ipc.opt = &icmp_param->replyopts;
-                if (ipc.opt->srr)
-                        daddr = icmp_param->replyopts.faddr;
+        if (icmp_param->replyopts.opt.opt.optlen) {
+                ipc.opt = &icmp_param->replyopts.opt;
+                if (ipc.opt->opt.srr)
+                        daddr = icmp_param->replyopts.opt.opt.faddr;
         }
         {
                 struct flowi4 fl4 = {
@@ -373,14 +372,14 @@ out_unlock:
 }
 
 static struct rtable *icmp_route_lookup(struct net *net, struct sk_buff *skb_in,
-                                        struct iphdr *iph,
+                                        const struct iphdr *iph,
                                         __be32 saddr, u8 tos,
                                         int type, int code,
                                         struct icmp_bxm *param)
 {
         struct flowi4 fl4 = {
-                .daddr = (param->replyopts.srr ?
-                          param->replyopts.faddr : iph->saddr),
+                .daddr = (param->replyopts.opt.opt.srr ?
+                          param->replyopts.opt.opt.faddr : iph->saddr),
                 .saddr = saddr,
                 .flowi4_tos = RT_TOS(tos),
                 .flowi4_proto = IPPROTO_ICMP,
@@ -581,7 +580,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
                                            IPTOS_PREC_INTERNETCONTROL) :
                                           iph->tos;
 
-        if (ip_options_echo(&icmp_param.replyopts, skb_in))
+        if (ip_options_echo(&icmp_param.replyopts.opt.opt, skb_in))
                 goto out_unlock;
 
 
@@ -597,7 +596,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         icmp_param.offset = skb_network_offset(skb_in);
         inet_sk(sk)->tos = tos;
         ipc.addr = iph->saddr;
-        ipc.opt = &icmp_param.replyopts;
+        ipc.opt = &icmp_param.replyopts.opt;
         ipc.tx_flags = 0;
 
         rt = icmp_route_lookup(net, skb_in, iph, saddr, tos,
@@ -613,7 +612,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         room = dst_mtu(&rt->dst);
         if (room > 576)
                 room = 576;
-        room -= sizeof(struct iphdr) + icmp_param.replyopts.optlen;
+        room -= sizeof(struct iphdr) + icmp_param.replyopts.opt.opt.optlen;
         room -= sizeof(struct icmphdr);
 
         icmp_param.data_len = skb_in->len - icmp_param.offset;
@@ -637,7 +636,7 @@ EXPORT_SYMBOL(icmp_send);
 
 static void icmp_unreach(struct sk_buff *skb)
 {
-        struct iphdr *iph;
+        const struct iphdr *iph;
         struct icmphdr *icmph;
         int hash, protocol;
         const struct net_protocol *ipprot;
@@ -656,7 +655,7 @@ static void icmp_unreach(struct sk_buff *skb)
                 goto out_err;
 
         icmph = icmp_hdr(skb);
-        iph   = (struct iphdr *)skb->data;
+        iph   = (const struct iphdr *)skb->data;
 
         if (iph->ihl < 5) /* Mangled header, drop. */
                 goto out_err;
@@ -729,7 +728,7 @@ static void icmp_unreach(struct sk_buff *skb)
         if (!pskb_may_pull(skb, iph->ihl * 4 + 8))
                 goto out;
 
-        iph = (struct iphdr *)skb->data;
+        iph = (const struct iphdr *)skb->data;
         protocol = iph->protocol;
 
         /*
@@ -758,7 +757,7 @@ out_err:
 
 static void icmp_redirect(struct sk_buff *skb)
 {
-        struct iphdr *iph;
+        const struct iphdr *iph;
 
         if (skb->len < sizeof(struct iphdr))
                 goto out_err;
@@ -769,7 +768,7 @@ static void icmp_redirect(struct sk_buff *skb)
         if (!pskb_may_pull(skb, sizeof(struct iphdr)))
                 goto out;
 
-        iph = (struct iphdr *)skb->data;
+        iph = (const struct iphdr *)skb->data;
 
         switch (icmp_hdr(skb)->code & 7) {
         case ICMP_REDIR_NET:
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 1fd3d9ce8398..ec03c2fda6ce 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -309,6 +309,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
         struct iphdr *pip;
         struct igmpv3_report *pig;
         struct net *net = dev_net(dev);
+        struct flowi4 fl4;
 
         while (1) {
                 skb = alloc_skb(size + LL_ALLOCATED_SPACE(dev),
@@ -321,18 +322,13 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
         }
         igmp_skb_size(skb) = size;
 
-        rt = ip_route_output_ports(net, NULL, IGMPV3_ALL_MCR, 0,
+        rt = ip_route_output_ports(net, &fl4, NULL, IGMPV3_ALL_MCR, 0,
                                    0, 0,
                                    IPPROTO_IGMP, 0, dev->ifindex);
         if (IS_ERR(rt)) {
                 kfree_skb(skb);
                 return NULL;
         }
-        if (rt->rt_src == 0) {
-                kfree_skb(skb);
-                ip_rt_put(rt);
-                return NULL;
-        }
 
         skb_dst_set(skb, &rt->dst);
         skb->dev = dev;
@@ -348,8 +344,8 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
         pip->tos      = 0xc0;
         pip->frag_off = htons(IP_DF);
         pip->ttl      = 1;
-        pip->daddr    = rt->rt_dst;
-        pip->saddr    = rt->rt_src;
+        pip->daddr    = fl4.daddr;
+        pip->saddr    = fl4.saddr;
         pip->protocol = IPPROTO_IGMP;
         pip->tot_len  = 0;      /* filled in later */
         ip_select_ident(pip, &rt->dst, NULL);
@@ -655,6 +651,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
         struct net_device *dev = in_dev->dev;
         struct net *net = dev_net(dev);
         __be32  group = pmc ? pmc->multiaddr : 0;
+        struct flowi4 fl4;
         __be32  dst;
 
         if (type == IGMPV3_HOST_MEMBERSHIP_REPORT)
@@ -664,17 +661,12 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
         else
                 dst = group;
 
-        rt = ip_route_output_ports(net, NULL, dst, 0,
+        rt = ip_route_output_ports(net, &fl4, NULL, dst, 0,
                                    0, 0,
                                    IPPROTO_IGMP, 0, dev->ifindex);
         if (IS_ERR(rt))
                 return -1;
 
-        if (rt->rt_src == 0) {
-                ip_rt_put(rt);
-                return -1;
-        }
-
         skb = alloc_skb(IGMP_SIZE+LL_ALLOCATED_SPACE(dev), GFP_ATOMIC);
         if (skb == NULL) {
                 ip_rt_put(rt);
@@ -695,7 +687,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
         iph->frag_off = htons(IP_DF);
         iph->ttl      = 1;
         iph->daddr    = dst;
-        iph->saddr    = rt->rt_src;
+        iph->saddr    = fl4.saddr;
         iph->protocol = IPPROTO_IGMP;
         ip_select_ident(iph, &rt->dst, NULL);
         ((u8*)&iph[1])[0] = IPOPT_RA;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 38f23e721b80..54944da2f794 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -354,26 +354,20 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
 {
         struct rtable *rt;
         const struct inet_request_sock *ireq = inet_rsk(req);
-        struct ip_options *opt = inet_rsk(req)->opt;
-        struct flowi4 fl4 = {
-                .flowi4_oif = sk->sk_bound_dev_if,
-                .flowi4_mark = sk->sk_mark,
-                .daddr = ((opt && opt->srr) ?
-                          opt->faddr : ireq->rmt_addr),
-                .saddr = ireq->loc_addr,
-                .flowi4_tos = RT_CONN_FLAGS(sk),
-                .flowi4_proto = sk->sk_protocol,
-                .flowi4_flags = inet_sk_flowi_flags(sk),
-                .fl4_sport = inet_sk(sk)->inet_sport,
-                .fl4_dport = ireq->rmt_port,
-        };
+        struct ip_options_rcu *opt = inet_rsk(req)->opt;
         struct net *net = sock_net(sk);
+        struct flowi4 fl4;
 
+        flowi4_init_output(&fl4, sk->sk_bound_dev_if, sk->sk_mark,
+                           RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
+                           sk->sk_protocol, inet_sk_flowi_flags(sk),
+                           (opt && opt->opt.srr) ? opt->opt.faddr : ireq->rmt_addr,
+                           ireq->loc_addr, ireq->rmt_port, inet_sk(sk)->inet_sport);
         security_req_classify_flow(req, flowi4_to_flowi(&fl4));
         rt = ip_route_output_flow(net, &fl4, sk);
         if (IS_ERR(rt))
                 goto no_route;
-        if (opt && opt->is_strictroute && rt->rt_dst != rt->rt_gateway)
+        if (opt && opt->opt.is_strictroute && fl4.daddr != rt->rt_gateway)
                 goto route_err;
         return &rt->dst;
 
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 2ada17129fce..6ffe94ca5bc9 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -124,7 +124,7 @@ static int inet_csk_diag_fill(struct sock *sk,
 
 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
         if (r->idiag_family == AF_INET6) {
-                struct ipv6_pinfo *np = inet6_sk(sk);
+                const struct ipv6_pinfo *np = inet6_sk(sk);
 
                 ipv6_addr_copy((struct in6_addr *)r->id.idiag_src,
                                &np->rcv_saddr);
diff --git a/net/ipv4/inet_lro.c b/net/ipv4/inet_lro.c
index 47038cb6c138..85a0f75dae64 100644
--- a/net/ipv4/inet_lro.c
+++ b/net/ipv4/inet_lro.c
@@ -51,8 +51,8 @@ MODULE_DESCRIPTION("Large Receive Offload (ipv4 / tcp)");
  * Basic tcp checks whether packet is suitable for LRO
  */
 
-static int lro_tcp_ip_check(struct iphdr *iph, struct tcphdr *tcph,
-                            int len, struct net_lro_desc *lro_desc)
+static int lro_tcp_ip_check(const struct iphdr *iph, const struct tcphdr *tcph,
+                            int len, const struct net_lro_desc *lro_desc)
 {
         /* check ip header: don't aggregate padded frames */
         if (ntohs(iph->tot_len) != len)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index da5941f18c3c..8871067560db 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -413,11 +413,6 @@ static struct ip_tunnel *ipgre_tunnel_locate(struct net *net,
 
         dev_net_set(dev, net);
 
-        if (strchr(name, '%')) {
-                if (dev_alloc_name(dev, name) < 0)
-                        goto failed_free;
-        }
-
         nt = netdev_priv(dev);
         nt->parms = *parms;
         dev->rtnl_link_ops = &ipgre_link_ops;
@@ -462,7 +457,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
    by themself???
  */
 
-        struct iphdr *iph = (struct iphdr *)skb->data;
+        const struct iphdr *iph = (const struct iphdr *)skb->data;
         __be16       *p = (__be16*)(skb->data+(iph->ihl<<2));
         int grehlen = (iph->ihl<<2) + 4;
         const int type = icmp_hdr(skb)->type;
@@ -534,7 +529,7 @@ out:
         rcu_read_unlock();
 }
 
-static inline void ipgre_ecn_decapsulate(struct iphdr *iph, struct sk_buff *skb)
+static inline void ipgre_ecn_decapsulate(const struct iphdr *iph, struct sk_buff *skb)
 {
         if (INET_ECN_is_ce(iph->tos)) {
                 if (skb->protocol == htons(ETH_P_IP)) {
@@ -546,19 +541,19 @@ static inline void ipgre_ecn_decapsulate(struct iphdr *iph, struct sk_buff *skb)
 }
 
 static inline u8
-ipgre_ecn_encapsulate(u8 tos, struct iphdr *old_iph, struct sk_buff *skb)
+ipgre_ecn_encapsulate(u8 tos, const struct iphdr *old_iph, struct sk_buff *skb)
 {
         u8 inner = 0;
         if (skb->protocol == htons(ETH_P_IP))
                 inner = old_iph->tos;
         else if (skb->protocol == htons(ETH_P_IPV6))
-                inner = ipv6_get_dsfield((struct ipv6hdr *)old_iph);
+                inner = ipv6_get_dsfield((const struct ipv6hdr *)old_iph);
         return INET_ECN_encapsulate(tos, inner);
 }
 
 static int ipgre_rcv(struct sk_buff *skb)
 {
-        struct iphdr *iph;
+        const struct iphdr *iph;
         u8     *h;
         __be16    flags;
         __sum16   csum = 0;
@@ -697,8 +692,9 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct pcpu_tstats *tstats;
-        struct iphdr  *old_iph = ip_hdr(skb);
-        struct iphdr  *tiph;
+        const struct iphdr  *old_iph = ip_hdr(skb);
+        const struct iphdr  *tiph;
+        struct flowi4 fl4;
         u8     tos;
         __be16 df;
         struct rtable *rt;                      /* Route to the other host */
@@ -714,7 +710,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
 
         if (dev->header_ops && dev->type == ARPHRD_IPGRE) {
                 gre_hlen = 0;
-                tiph = (struct iphdr *)skb->data;
+                tiph = (const struct iphdr *)skb->data;
         } else {
                 gre_hlen = tunnel->hlen;
                 tiph = &tunnel->parms.iph;
@@ -735,14 +731,14 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                 }
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                 else if (skb->protocol == htons(ETH_P_IPV6)) {
-                        struct in6_addr *addr6;
+                        const struct in6_addr *addr6;
                         int addr_type;
                         struct neighbour *neigh = skb_dst(skb)->neighbour;
 
                         if (neigh == NULL)
                                 goto tx_error;
 
-                        addr6 = (struct in6_addr *)&neigh->primary_key;
+                        addr6 = (const struct in6_addr *)&neigh->primary_key;
                         addr_type = ipv6_addr_type(addr6);
 
                         if (addr_type == IPV6_ADDR_ANY) {
@@ -766,10 +762,10 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                 if (skb->protocol == htons(ETH_P_IP))
                         tos = old_iph->tos;
                 else if (skb->protocol == htons(ETH_P_IPV6))
-                        tos = ipv6_get_dsfield((struct ipv6hdr *)old_iph);
+                        tos = ipv6_get_dsfield((const struct ipv6hdr *)old_iph);
         }
 
-        rt = ip_route_output_gre(dev_net(dev), dst, tiph->saddr,
+        rt = ip_route_output_gre(dev_net(dev), &fl4, dst, tiph->saddr,
                                  tunnel->parms.o_key, RT_TOS(tos),
                                  tunnel->parms.link);
         if (IS_ERR(rt)) {
@@ -873,15 +869,15 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
         iph->frag_off           =       df;
         iph->protocol           =       IPPROTO_GRE;
         iph->tos                =       ipgre_ecn_encapsulate(tos, old_iph, skb);
-        iph->daddr              =       rt->rt_dst;
-        iph->saddr              =       rt->rt_src;
+        iph->daddr              =       fl4.daddr;
+        iph->saddr              =       fl4.saddr;
 
         if ((iph->ttl = tiph->ttl) == 0) {
                 if (skb->protocol == htons(ETH_P_IP))
                         iph->ttl = old_iph->ttl;
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                 else if (skb->protocol == htons(ETH_P_IPV6))
-                        iph->ttl = ((struct ipv6hdr *)old_iph)->hop_limit;
+                        iph->ttl = ((const struct ipv6hdr *)old_iph)->hop_limit;
 #endif
                 else
                         iph->ttl = ip4_dst_hoplimit(&rt->dst);
@@ -927,7 +923,7 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev)
 {
         struct net_device *tdev = NULL;
         struct ip_tunnel *tunnel;
-        struct iphdr *iph;
+        const struct iphdr *iph;
         int hlen = LL_MAX_HEADER;
         int mtu = ETH_DATA_LEN;
         int addend = sizeof(struct iphdr) + 4;
@@ -938,12 +934,14 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev)
         /* Guess output device to choose reasonable mtu and needed_headroom */
 
         if (iph->daddr) {
-                struct rtable *rt = ip_route_output_gre(dev_net(dev),
-                                                        iph->daddr, iph->saddr,
-                                                        tunnel->parms.o_key,
-                                                        RT_TOS(iph->tos),
-                                                        tunnel->parms.link);
-
+                struct flowi4 fl4;
+                struct rtable *rt;
+
+                rt = ip_route_output_gre(dev_net(dev), &fl4,
+                                         iph->daddr, iph->saddr,
+                                         tunnel->parms.o_key,
+                                         RT_TOS(iph->tos),
+                                         tunnel->parms.link);
                 if (!IS_ERR(rt)) {
                         tdev = rt->dst.dev;
                         ip_rt_put(rt);
@@ -1180,7 +1178,7 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
 
 static int ipgre_header_parse(const struct sk_buff *skb, unsigned char *haddr)
 {
-        struct iphdr *iph = (struct iphdr *) skb_mac_header(skb);
+        const struct iphdr *iph = (const struct iphdr *) skb_mac_header(skb);
         memcpy(haddr, &iph->saddr, 4);
         return 4;
 }
@@ -1196,13 +1194,15 @@ static int ipgre_open(struct net_device *dev)
         struct ip_tunnel *t = netdev_priv(dev);
 
         if (ipv4_is_multicast(t->parms.iph.daddr)) {
-                struct rtable *rt = ip_route_output_gre(dev_net(dev),
-                                                        t->parms.iph.daddr,
-                                                        t->parms.iph.saddr,
-                                                        t->parms.o_key,
-                                                        RT_TOS(t->parms.iph.tos),
-                                                        t->parms.link);
-
+                struct flowi4 fl4;
+                struct rtable *rt;
+
+                rt = ip_route_output_gre(dev_net(dev), &fl4,
+                                         t->parms.iph.daddr,
+                                         t->parms.iph.saddr,
+                                         t->parms.o_key,
+                                         RT_TOS(t->parms.iph.tos),
+                                         t->parms.link);
                 if (IS_ERR(rt))
                         return -EADDRNOTAVAIL;
                 dev = rt->dst.dev;
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index d7b2b0987a3b..c8f48efc5fd3 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -268,7 +268,7 @@ int ip_local_deliver(struct sk_buff *skb)
 static inline int ip_rcv_options(struct sk_buff *skb)
 {
         struct ip_options *opt;
-        struct iphdr *iph;
+        const struct iphdr *iph;
         struct net_device *dev = skb->dev;
 
         /* It looks as overkill, because not all
@@ -374,7 +374,7 @@ drop:
  */
 int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 {
-        struct iphdr *iph;
+        const struct iphdr *iph;
         u32 len;
 
         /* When the interface is in promisc. mode, drop all the crap
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 2391b24e8251..01fc40965848 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -36,7 +36,7 @@
  * saddr is address of outgoing interface.
  */
 
-void ip_options_build(struct sk_buff * skb, struct ip_options * opt,
+void ip_options_build(struct sk_buff *skb, struct ip_options *opt,
                             __be32 daddr, struct rtable *rt, int is_frag)
 {
         unsigned char *iph = skb_network_header(skb);
@@ -83,9 +83,9 @@ void ip_options_build(struct sk_buff * skb, struct ip_options * opt,
  * NOTE: dopt cannot point to skb.
  */
 
-int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
+int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb)
 {
-        struct ip_options *sopt;
+        const struct ip_options *sopt;
         unsigned char *sptr, *dptr;
         int soffset, doffset;
         int     optlen;
@@ -95,10 +95,8 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
 
         sopt = &(IPCB(skb)->opt);
 
-        if (sopt->optlen == 0) {
-                dopt->optlen = 0;
+        if (sopt->optlen == 0)
                 return 0;
-        }
 
         sptr = skb_network_header(skb);
         dptr = dopt->__data;
@@ -157,7 +155,7 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
                 dopt->optlen += optlen;
         }
         if (sopt->srr) {
-                unsigned char * start = sptr+sopt->srr;
+                unsigned char *start = sptr+sopt->srr;
                 __be32 faddr;
 
                 optlen  = start[1];
@@ -499,19 +497,19 @@ void ip_options_undo(struct ip_options * opt)
         }
 }
 
-static struct ip_options *ip_options_get_alloc(const int optlen)
+static struct ip_options_rcu *ip_options_get_alloc(const int optlen)
 {
-        return kzalloc(sizeof(struct ip_options) + ((optlen + 3) & ~3),
+        return kzalloc(sizeof(struct ip_options_rcu) + ((optlen + 3) & ~3),
                        GFP_KERNEL);
 }
 
-static int ip_options_get_finish(struct net *net, struct ip_options **optp,
-                                 struct ip_options *opt, int optlen)
+static int ip_options_get_finish(struct net *net, struct ip_options_rcu **optp,
+                                 struct ip_options_rcu *opt, int optlen)
 {
         while (optlen & 3)
-                opt->__data[optlen++] = IPOPT_END;
-        opt->optlen = optlen;
-        if (optlen && ip_options_compile(net, opt, NULL)) {
+                opt->opt.__data[optlen++] = IPOPT_END;
+        opt->opt.optlen = optlen;
+        if (optlen && ip_options_compile(net, &opt->opt, NULL)) {
                 kfree(opt);
                 return -EINVAL;
         }
@@ -520,29 +518,29 @@ static int ip_options_get_finish(struct net *net, struct ip_options **optp,
         return 0;
 }
 
-int ip_options_get_from_user(struct net *net, struct ip_options **optp,
+int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp,
                              unsigned char __user *data, int optlen)
 {
-        struct ip_options *opt = ip_options_get_alloc(optlen);
+        struct ip_options_rcu *opt = ip_options_get_alloc(optlen);
 
         if (!opt)
                 return -ENOMEM;
-        if (optlen && copy_from_user(opt->__data, data, optlen)) {
+        if (optlen && copy_from_user(opt->opt.__data, data, optlen)) {
                 kfree(opt);
                 return -EFAULT;
         }
         return ip_options_get_finish(net, optp, opt, optlen);
 }
 
-int ip_options_get(struct net *net, struct ip_options **optp,
+int ip_options_get(struct net *net, struct ip_options_rcu **optp,
                    unsigned char *data, int optlen)
 {
-        struct ip_options *opt = ip_options_get_alloc(optlen);
+        struct ip_options_rcu *opt = ip_options_get_alloc(optlen);
 
         if (!opt)
                 return -ENOMEM;
         if (optlen)
-                memcpy(opt->__data, data, optlen);
+                memcpy(opt->opt.__data, data, optlen);
         return ip_options_get_finish(net, optp, opt, optlen);
 }
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 459c011b1d4a..db38c1822de8 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -140,14 +140,14 @@ static inline int ip_select_ttl(struct inet_sock *inet, struct dst_entry *dst)
  *
  */
 int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
-                          __be32 saddr, __be32 daddr, struct ip_options *opt)
+                          __be32 saddr, __be32 daddr, struct ip_options_rcu *opt)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct rtable *rt = skb_rtable(skb);
         struct iphdr *iph;
 
         /* Build the IP header. */
-        skb_push(skb, sizeof(struct iphdr) + (opt ? opt->optlen : 0));
+        skb_push(skb, sizeof(struct iphdr) + (opt ? opt->opt.optlen : 0));
         skb_reset_network_header(skb);
         iph = ip_hdr(skb);
         iph->version  = 4;
@@ -158,14 +158,14 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
         else
                 iph->frag_off = 0;
         iph->ttl      = ip_select_ttl(inet, &rt->dst);
-        iph->daddr    = rt->rt_dst;
-        iph->saddr    = rt->rt_src;
+        iph->daddr    = (opt && opt->opt.srr ? opt->opt.faddr : daddr);
+        iph->saddr    = saddr;
         iph->protocol = sk->sk_protocol;
         ip_select_ident(iph, &rt->dst, sk);
 
-        if (opt && opt->optlen) {
-                iph->ihl += opt->optlen>>2;
-                ip_options_build(skb, opt, daddr, rt, 0);
+        if (opt && opt->opt.optlen) {
+                iph->ihl += opt->opt.optlen>>2;
+                ip_options_build(skb, &opt->opt, daddr, rt, 0);
         }
 
         skb->priority = sk->sk_priority;
@@ -316,7 +316,7 @@ int ip_queue_xmit(struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
         struct inet_sock *inet = inet_sk(sk);
-        struct ip_options *opt = inet->opt;
+        struct ip_options_rcu *inet_opt;
         struct rtable *rt;
         struct iphdr *iph;
         int res;
@@ -325,6 +325,7 @@ int ip_queue_xmit(struct sk_buff *skb)
          * f.e. by something like SCTP.
          */
         rcu_read_lock();
+        inet_opt = rcu_dereference(inet->inet_opt);
         rt = skb_rtable(skb);
         if (rt != NULL)
                 goto packet_routed;
@@ -332,18 +333,19 @@ int ip_queue_xmit(struct sk_buff *skb)
         /* Make sure we can route this packet. */
         rt = (struct rtable *)__sk_dst_check(sk, 0);
         if (rt == NULL) {
+                struct flowi4 fl4;
                 __be32 daddr;
 
                 /* Use correct destination address if we have options. */
                 daddr = inet->inet_daddr;
-                if(opt && opt->srr)
-                        daddr = opt->faddr;
+                if (inet_opt && inet_opt->opt.srr)
+                        daddr = inet_opt->opt.faddr;
 
                 /* If this fails, retransmit mechanism of transport layer will
                  * keep trying until route appears or the connection times
                  * itself out.
                  */
-                rt = ip_route_output_ports(sock_net(sk), sk,
+                rt = ip_route_output_ports(sock_net(sk), &fl4, sk,
                                            daddr, inet->inet_saddr,
                                            inet->inet_dport,
                                            inet->inet_sport,
@@ -357,11 +359,11 @@ int ip_queue_xmit(struct sk_buff *skb)
         skb_dst_set_noref(skb, &rt->dst);
 
 packet_routed:
-        if (opt && opt->is_strictroute && rt->rt_dst != rt->rt_gateway)
+        if (inet_opt && inet_opt->opt.is_strictroute && rt->rt_dst != rt->rt_gateway)
                 goto no_route;
 
         /* OK, we know where to send it, allocate and build IP header. */
-        skb_push(skb, sizeof(struct iphdr) + (opt ? opt->optlen : 0));
+        skb_push(skb, sizeof(struct iphdr) + (inet_opt ? inet_opt->opt.optlen : 0));
         skb_reset_network_header(skb);
         iph = ip_hdr(skb);
         *((__be16 *)iph) = htons((4 << 12) | (5 << 8) | (inet->tos & 0xff));
@@ -375,9 +377,9 @@ packet_routed:
         iph->daddr    = rt->rt_dst;
         /* Transport layer set skb->h.foo itself. */
 
-        if (opt && opt->optlen) {
-                iph->ihl += opt->optlen >> 2;
-                ip_options_build(skb, opt, inet->inet_daddr, rt, 0);
+        if (inet_opt && inet_opt->opt.optlen) {
+                iph->ihl += inet_opt->opt.optlen >> 2;
+                ip_options_build(skb, &inet_opt->opt, inet->inet_daddr, rt, 0);
         }
 
         ip_select_ident_more(iph, &rt->dst, sk,
@@ -1033,7 +1035,7 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
                          struct ipcm_cookie *ipc, struct rtable **rtp)
 {
         struct inet_sock *inet = inet_sk(sk);
-        struct ip_options *opt;
+        struct ip_options_rcu *opt;
         struct rtable *rt;
 
         /*
@@ -1047,7 +1049,7 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
                         if (unlikely(cork->opt == NULL))
                                 return -ENOBUFS;
                 }
-                memcpy(cork->opt, opt, sizeof(struct ip_options) + opt->optlen);
+                memcpy(cork->opt, &opt->opt, sizeof(struct ip_options) + opt->opt.optlen);
                 cork->flags |= IPCORK_OPT;
                 cork->addr = ipc->addr;
         }
@@ -1451,39 +1453,34 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
                    unsigned int len)
 {
         struct inet_sock *inet = inet_sk(sk);
-        struct {
-                struct ip_options       opt;
-                char                    data[40];
-        } replyopts;
+        struct ip_options_data replyopts;
         struct ipcm_cookie ipc;
         __be32 daddr;
         struct rtable *rt = skb_rtable(skb);
 
-        if (ip_options_echo(&replyopts.opt, skb))
+        if (ip_options_echo(&replyopts.opt.opt, skb))
                 return;
 
         daddr = ipc.addr = rt->rt_src;
         ipc.opt = NULL;
         ipc.tx_flags = 0;
 
-        if (replyopts.opt.optlen) {
+        if (replyopts.opt.opt.optlen) {
                 ipc.opt = &replyopts.opt;
 
-                if (ipc.opt->srr)
-                        daddr = replyopts.opt.faddr;
+                if (replyopts.opt.opt.srr)
+                        daddr = replyopts.opt.opt.faddr;
         }
 
         {
-                struct flowi4 fl4 = {
-                        .flowi4_oif = arg->bound_dev_if,
-                        .daddr = daddr,
-                        .saddr = rt->rt_spec_dst,
-                        .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
-                        .fl4_sport = tcp_hdr(skb)->dest,
-                        .fl4_dport = tcp_hdr(skb)->source,
-                        .flowi4_proto = sk->sk_protocol,
-                        .flowi4_flags = ip_reply_arg_flowi_flags(arg),
-                };
+                struct flowi4 fl4;
+
+                flowi4_init_output(&fl4, arg->bound_dev_if, 0,
+                                   RT_TOS(ip_hdr(skb)->tos),
+                                   RT_SCOPE_UNIVERSE, sk->sk_protocol,
+                                   ip_reply_arg_flowi_flags(arg),
+                                   daddr, rt->rt_spec_dst,
+                                   tcp_hdr(skb)->source, tcp_hdr(skb)->dest);
                 security_skb_classify_flow(skb, flowi4_to_flowi(&fl4));
                 rt = ip_route_output_key(sock_net(sk), &fl4);
                 if (IS_ERR(rt))
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 3948c86e59ca..ab0c9efd1efa 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -131,7 +131,7 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb)
 static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
 {
         struct sockaddr_in sin;
-        struct iphdr *iph = ip_hdr(skb);
+        const struct iphdr *iph = ip_hdr(skb);
         __be16 *ports = (__be16 *)skb_transport_header(skb);
 
         if (skb_transport_offset(skb) + 4 > skb->len)
@@ -451,6 +451,11 @@ out:
 }
 
 
+static void opt_kfree_rcu(struct rcu_head *head)
+{
+        kfree(container_of(head, struct ip_options_rcu, rcu));
+}
+
 /*
  *      Socket option code for IP. This is the end of the line after any
  *      TCP,UDP etc options on an IP socket.
@@ -497,13 +502,16 @@ static int do_ip_setsockopt(struct sock *sk, int level,
         switch (optname) {
         case IP_OPTIONS:
         {
-                struct ip_options *opt = NULL;
+                struct ip_options_rcu *old, *opt = NULL;
+
                 if (optlen > 40)
                         goto e_inval;
                 err = ip_options_get_from_user(sock_net(sk), &opt,
                                                optval, optlen);
                 if (err)
                         break;
+                old = rcu_dereference_protected(inet->inet_opt,
+                                                sock_owned_by_user(sk));
                 if (inet->is_icsk) {
                         struct inet_connection_sock *icsk = inet_csk(sk);
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
@@ -512,17 +520,18 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                                (TCPF_LISTEN | TCPF_CLOSE)) &&
                              inet->inet_daddr != LOOPBACK4_IPV6)) {
 #endif
-                                if (inet->opt)
-                                        icsk->icsk_ext_hdr_len -= inet->opt->optlen;
+                                if (old)
+                                        icsk->icsk_ext_hdr_len -= old->opt.optlen;
                                 if (opt)
-                                        icsk->icsk_ext_hdr_len += opt->optlen;
+                                        icsk->icsk_ext_hdr_len += opt->opt.optlen;
                                 icsk->icsk_sync_mss(sk, icsk->icsk_pmtu_cookie);
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                         }
 #endif
                 }
-                opt = xchg(&inet->opt, opt);
-                kfree(opt);
+                rcu_assign_pointer(inet->inet_opt, opt);
+                if (old)
+                        call_rcu(&old->rcu, opt_kfree_rcu);
                 break;
         }
         case IP_PKTINFO:
@@ -1081,12 +1090,16 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
         case IP_OPTIONS:
         {
                 unsigned char optbuf[sizeof(struct ip_options)+40];
-                struct ip_options * opt = (struct ip_options *)optbuf;
+                struct ip_options *opt = (struct ip_options *)optbuf;
+                struct ip_options_rcu *inet_opt;
+
+                inet_opt = rcu_dereference_protected(inet->inet_opt,
+                                                     sock_owned_by_user(sk));
                 opt->optlen = 0;
-                if (inet->opt)
-                        memcpy(optbuf, inet->opt,
-                               sizeof(struct ip_options)+
-                               inet->opt->optlen);
+                if (inet_opt)
+                        memcpy(optbuf, &inet_opt->opt,
+                               sizeof(struct ip_options) +
+                               inet_opt->opt.optlen);
                 release_sock(sk);
 
                 if (opt->optlen == 0)
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 629067571f02..c857f6f49b03 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -27,7 +27,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
 {
         struct net *net = dev_net(skb->dev);
         __be32 spi;
-        struct iphdr *iph = (struct iphdr *)skb->data;
+        const struct iphdr *iph = (const struct iphdr *)skb->data;
         struct ip_comp_hdr *ipch = (struct ip_comp_hdr *)(skb->data+(iph->ihl<<2));
         struct xfrm_state *x;
 
@@ -36,7 +36,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
                 return;
 
         spi = htonl(ntohs(ipch->cpi));
-        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr,
+        x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
                               spi, IPPROTO_COMP, AF_INET);
         if (!x)
                 return;
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index bfc17c5914e7..378b20b7ca6e 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -276,11 +276,6 @@ static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
 
         dev_net_set(dev, net);
 
-        if (strchr(name, '%')) {
-                if (dev_alloc_name(dev, name) < 0)
-                        goto failed_free;
-        }
-
         nt = netdev_priv(dev);
         nt->parms = *parms;
 
@@ -319,7 +314,7 @@ static int ipip_err(struct sk_buff *skb, u32 info)
    8 bytes of packet payload. It means, that precise relaying of
    ICMP in the real Internet is absolutely infeasible.
  */
-        struct iphdr *iph = (struct iphdr *)skb->data;
+        const struct iphdr *iph = (const struct iphdr *)skb->data;
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
         struct ip_tunnel *t;
@@ -433,15 +428,16 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct pcpu_tstats *tstats;
-        struct iphdr  *tiph = &tunnel->parms.iph;
+        const struct iphdr  *tiph = &tunnel->parms.iph;
         u8     tos = tunnel->parms.iph.tos;
         __be16 df = tiph->frag_off;
         struct rtable *rt;                      /* Route to the other host */
         struct net_device *tdev;                /* Device to other host */
-        struct iphdr  *old_iph = ip_hdr(skb);
+        const struct iphdr  *old_iph = ip_hdr(skb);
         struct iphdr  *iph;                     /* Our new IP header */
         unsigned int max_headroom;              /* The extra header space needed */
         __be32 dst = tiph->daddr;
+        struct flowi4 fl4;
         int    mtu;
 
         if (skb->protocol != htons(ETH_P_IP))
@@ -460,7 +456,7 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         goto tx_error_icmp;
         }
 
-        rt = ip_route_output_ports(dev_net(dev), NULL,
+        rt = ip_route_output_ports(dev_net(dev), &fl4, NULL,
                                    dst, tiph->saddr,
                                    0, 0,
                                    IPPROTO_IPIP, RT_TOS(tos),
@@ -549,8 +545,8 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         iph->frag_off           =       df;
         iph->protocol           =       IPPROTO_IPIP;
         iph->tos                =       INET_ECN_encapsulate(tos, old_iph->tos);
-        iph->daddr              =       rt->rt_dst;
-        iph->saddr              =       rt->rt_src;
+        iph->daddr              =       fl4.daddr;
+        iph->saddr              =       fl4.saddr;
 
         if ((iph->ttl = tiph->ttl) == 0)
                 iph->ttl        =       old_iph->ttl;
@@ -572,19 +568,21 @@ static void ipip_tunnel_bind_dev(struct net_device *dev)
 {
         struct net_device *tdev = NULL;
         struct ip_tunnel *tunnel;
-        struct iphdr *iph;
+        const struct iphdr *iph;
 
         tunnel = netdev_priv(dev);
         iph = &tunnel->parms.iph;
 
         if (iph->daddr) {
-                struct rtable *rt = ip_route_output_ports(dev_net(dev), NULL,
-                                                          iph->daddr, iph->saddr,
-                                                          0, 0,
-                                                          IPPROTO_IPIP,
-                                                          RT_TOS(iph->tos),
-                                                          tunnel->parms.link);
-
+                struct rtable *rt;
+                struct flowi4 fl4;
+
+                rt = ip_route_output_ports(dev_net(dev), &fl4, NULL,
+                                           iph->daddr, iph->saddr,
+                                           0, 0,
+                                           IPPROTO_IPIP,
+                                           RT_TOS(iph->tos),
+                                           tunnel->parms.link);
                 if (!IS_ERR(rt)) {
                         tdev = rt->dst.dev;
                         ip_rt_put(rt);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 1f62eaeb6de4..30a7763c400e 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1549,7 +1549,7 @@ static struct notifier_block ip_mr_notifier = {
 static void ip_encap(struct sk_buff *skb, __be32 saddr, __be32 daddr)
 {
         struct iphdr *iph;
-        struct iphdr *old_iph = ip_hdr(skb);
+        const struct iphdr *old_iph = ip_hdr(skb);
 
         skb_push(skb, sizeof(struct iphdr));
         skb->transport_header = skb->network_header;
@@ -1595,6 +1595,7 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,
         struct vif_device *vif = &mrt->vif_table[vifi];
         struct net_device *dev;
         struct rtable *rt;
+        struct flowi4 fl4;
         int    encap = 0;
 
         if (vif->dev == NULL)
@@ -1612,7 +1613,7 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,
 #endif
 
         if (vif->flags & VIFF_TUNNEL) {
-                rt = ip_route_output_ports(net, NULL,
+                rt = ip_route_output_ports(net, &fl4, NULL,
                                            vif->remote, vif->local,
                                            0, 0,
                                            IPPROTO_IPIP,
@@ -1621,7 +1622,7 @@ static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,
                         goto out_free;
                 encap = sizeof(struct iphdr);
         } else {
-                rt = ip_route_output_ports(net, NULL, iph->daddr, 0,
+                rt = ip_route_output_ports(net, &fl4, NULL, iph->daddr, 0,
                                            0, 0,
                                            IPPROTO_IPIP,
                                            RT_TOS(iph->tos), vif->link);
@@ -1788,12 +1789,14 @@ dont_forward:
         return 0;
 }
 
-static struct mr_table *ipmr_rt_fib_lookup(struct net *net, struct rtable *rt)
+static struct mr_table *ipmr_rt_fib_lookup(struct net *net, struct sk_buff *skb)
 {
+        struct rtable *rt = skb_rtable(skb);
+        struct iphdr *iph = ip_hdr(skb);
         struct flowi4 fl4 = {
-                .daddr = rt->rt_key_dst,
-                .saddr = rt->rt_key_src,
-                .flowi4_tos = rt->rt_tos,
+                .daddr = iph->daddr,
+                .saddr = iph->saddr,
+                .flowi4_tos = iph->tos,
                 .flowi4_oif = rt->rt_oif,
                 .flowi4_iif = rt->rt_iif,
                 .flowi4_mark = rt->rt_mark,
@@ -1825,7 +1828,7 @@ int ip_mr_input(struct sk_buff *skb)
         if (IPCB(skb)->flags & IPSKB_FORWARDED)
                 goto dont_forward;
 
-        mrt = ipmr_rt_fib_lookup(net, skb_rtable(skb));
+        mrt = ipmr_rt_fib_lookup(net, skb);
         if (IS_ERR(mrt)) {
                 kfree_skb(skb);
                 return PTR_ERR(mrt);
@@ -1957,7 +1960,7 @@ int pim_rcv_v1(struct sk_buff *skb)
 
         pim = igmp_hdr(skb);
 
-        mrt = ipmr_rt_fib_lookup(net, skb_rtable(skb));
+        mrt = ipmr_rt_fib_lookup(net, skb);
         if (IS_ERR(mrt))
                 goto drop;
         if (!mrt->mroute_do_pim ||
@@ -1989,7 +1992,7 @@ static int pim_rcv(struct sk_buff *skb)
              csum_fold(skb_checksum(skb, 0, skb->len, 0))))
                 goto drop;
 
-        mrt = ipmr_rt_fib_lookup(net, skb_rtable(skb));
+        mrt = ipmr_rt_fib_lookup(net, skb);
         if (IS_ERR(mrt))
                 goto drop;
         if (__pim_rcv(mrt, skb, sizeof(*pim))) {
@@ -2038,20 +2041,20 @@ rtattr_failure:
         return -EMSGSIZE;
 }
 
-int ipmr_get_route(struct net *net,
-                   struct sk_buff *skb, struct rtmsg *rtm, int nowait)
+int ipmr_get_route(struct net *net, struct sk_buff *skb,
+                   __be32 saddr, __be32 daddr,
+                   struct rtmsg *rtm, int nowait)
 {
-        int err;
-        struct mr_table *mrt;
         struct mfc_cache *cache;
-        struct rtable *rt = skb_rtable(skb);
+        struct mr_table *mrt;
+        int err;
 
         mrt = ipmr_get_table(net, RT_TABLE_DEFAULT);
         if (mrt == NULL)
                 return -ENOENT;
 
         rcu_read_lock();
-        cache = ipmr_cache_find(mrt, rt->rt_src, rt->rt_dst);
+        cache = ipmr_cache_find(mrt, saddr, daddr);
 
         if (cache == NULL) {
                 struct sk_buff *skb2;
@@ -2084,8 +2087,8 @@ int ipmr_get_route(struct net *net,
                 skb_reset_network_header(skb2);
                 iph = ip_hdr(skb2);
                 iph->ihl = sizeof(struct iphdr) >> 2;
-                iph->saddr = rt->rt_src;
-                iph->daddr = rt->rt_dst;
+                iph->saddr = saddr;
+                iph->daddr = daddr;
                 iph->version = 0;
                 err = ipmr_cache_unresolved(mrt, vif, skb2);
                 read_unlock(&mrt_lock);
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 89bc7e66d598..fd7a3f68917f 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -260,6 +260,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
         void *table_base;
         const struct xt_table_info *private;
         struct xt_action_param acpar;
+        unsigned int addend;
 
         if (!pskb_may_pull(skb, arp_hdr_len(skb->dev)))
                 return NF_DROP;
@@ -267,7 +268,8 @@ unsigned int arpt_do_table(struct sk_buff *skb,
         indev = in ? in->name : nulldevname;
         outdev = out ? out->name : nulldevname;
 
-        xt_info_rdlock_bh();
+        local_bh_disable();
+        addend = xt_write_recseq_begin();
         private = table->private;
         table_base = private->entries[smp_processor_id()];
 
@@ -338,7 +340,8 @@ unsigned int arpt_do_table(struct sk_buff *skb,
                         /* Verdict */
                         break;
         } while (!acpar.hotdrop);
-        xt_info_rdunlock_bh();
+        xt_write_recseq_end(addend);
+        local_bh_enable();
 
         if (acpar.hotdrop)
                 return NF_DROP;
@@ -712,7 +715,7 @@ static void get_counters(const struct xt_table_info *t,
         unsigned int i;
 
         for_each_possible_cpu(cpu) {
-                seqlock_t *lock = &per_cpu(xt_info_locks, cpu).lock;
+                seqcount_t *s = &per_cpu(xt_recseq, cpu);
 
                 i = 0;
                 xt_entry_foreach(iter, t->entries[cpu], t->size) {
@@ -720,10 +723,10 @@ static void get_counters(const struct xt_table_info *t,
                         unsigned int start;
 
                         do {
-                                start = read_seqbegin(lock);
+                                start = read_seqcount_begin(s);
                                 bcnt = iter->counters.bcnt;
                                 pcnt = iter->counters.pcnt;
-                        } while (read_seqretry(lock, start));
+                        } while (read_seqcount_retry(s, start));
 
                         ADD_COUNTER(counters[i], bcnt, pcnt);
                         ++i;
@@ -1115,6 +1118,7 @@ static int do_add_counters(struct net *net, const void __user *user,
         int ret = 0;
         void *loc_cpu_entry;
         struct arpt_entry *iter;
+        unsigned int addend;
 #ifdef CONFIG_COMPAT
         struct compat_xt_counters_info compat_tmp;
 
@@ -1171,12 +1175,12 @@ static int do_add_counters(struct net *net, const void __user *user,
         /* Choose the copy that is on our node */
         curcpu = smp_processor_id();
         loc_cpu_entry = private->entries[curcpu];
-        xt_info_wrlock(curcpu);
+        addend = xt_write_recseq_begin();
         xt_entry_foreach(iter, loc_cpu_entry, private->size) {
                 ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
                 ++i;
         }
-        xt_info_wrunlock(curcpu);
+        xt_write_recseq_end(addend);
  unlock_up_free:
         local_bh_enable();
         xt_table_unlock(t);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 704915028009..764743843503 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -68,15 +68,6 @@ void *ipt_alloc_initial_table(const struct xt_table *info)
 }
 EXPORT_SYMBOL_GPL(ipt_alloc_initial_table);
 
-/*
-   We keep a set of rules for each CPU, so we can avoid write-locking
-   them in the softirq when updating the counters and therefore
-   only need to read-lock in the softirq; doing a write_lock_bh() in user
-   context stops packets coming through and allows user context to read
-   the counters or update the rules.
-
-   Hence the start of any table is given by get_table() below.  */
-
 /* Returns whether matches rule or not. */
 /* Performance critical - called for every packet */
 static inline bool
@@ -311,6 +302,7 @@ ipt_do_table(struct sk_buff *skb,
         unsigned int *stackptr, origptr, cpu;
         const struct xt_table_info *private;
         struct xt_action_param acpar;
+        unsigned int addend;
 
         /* Initialization */
         ip = ip_hdr(skb);
@@ -331,7 +323,8 @@ ipt_do_table(struct sk_buff *skb,
         acpar.hooknum = hook;
 
         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
-        xt_info_rdlock_bh();
+        local_bh_disable();
+        addend = xt_write_recseq_begin();
         private = table->private;
         cpu        = smp_processor_id();
         table_base = private->entries[cpu];
@@ -430,7 +423,9 @@ ipt_do_table(struct sk_buff *skb,
         pr_debug("Exiting %s; resetting sp from %u to %u\n",
                  __func__, *stackptr, origptr);
         *stackptr = origptr;
-        xt_info_rdunlock_bh();
+        xt_write_recseq_end(addend);
+        local_bh_enable();
+
 #ifdef DEBUG_ALLOW_ALL
         return NF_ACCEPT;
 #else
@@ -886,7 +881,7 @@ get_counters(const struct xt_table_info *t,
         unsigned int i;
 
         for_each_possible_cpu(cpu) {
-                seqlock_t *lock = &per_cpu(xt_info_locks, cpu).lock;
+                seqcount_t *s = &per_cpu(xt_recseq, cpu);
 
                 i = 0;
                 xt_entry_foreach(iter, t->entries[cpu], t->size) {
@@ -894,10 +889,10 @@ get_counters(const struct xt_table_info *t,
                         unsigned int start;
 
                         do {
-                                start = read_seqbegin(lock);
+                                start = read_seqcount_begin(s);
                                 bcnt = iter->counters.bcnt;
                                 pcnt = iter->counters.pcnt;
-                        } while (read_seqretry(lock, start));
+                        } while (read_seqcount_retry(s, start));
 
                         ADD_COUNTER(counters[i], bcnt, pcnt);
                         ++i; /* macro does multi eval of i */
@@ -1312,6 +1307,7 @@ do_add_counters(struct net *net, const void __user *user,
         int ret = 0;
         void *loc_cpu_entry;
         struct ipt_entry *iter;
+        unsigned int addend;
 #ifdef CONFIG_COMPAT
         struct compat_xt_counters_info compat_tmp;
 
@@ -1368,12 +1364,12 @@ do_add_counters(struct net *net, const void __user *user,
         /* Choose the copy that is on our node */
         curcpu = smp_processor_id();
         loc_cpu_entry = private->entries[curcpu];
-        xt_info_wrlock(curcpu);
+        addend = xt_write_recseq_begin();
         xt_entry_foreach(iter, loc_cpu_entry, private->size) {
                 ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
                 ++i;
         }
-        xt_info_wrunlock(curcpu);
+        xt_write_recseq_end(addend);
  unlock_up_free:
         local_bh_enable();
         xt_table_unlock(t);
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index 31427fb57aa8..99cfa28b6d38 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -153,7 +153,7 @@ void nf_nat_set_seq_adjust(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
 }
 EXPORT_SYMBOL_GPL(nf_nat_set_seq_adjust);
 
-static void nf_nat_csum(struct sk_buff *skb, struct iphdr *iph, void *data,
+static void nf_nat_csum(struct sk_buff *skb, const struct iphdr *iph, void *data,
                         int datalen, __sum16 *check, int oldlen)
 {
         struct rtable *rt = skb_rtable(skb);
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index bceaec42c37d..a8659e0c4a6e 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -154,7 +154,7 @@ static __inline__ int icmp_filter(struct sock *sk, struct sk_buff *skb)
  * RFC 1122: SHOULD pass TOS value up to the transport layer.
  * -> It does. And not only TOS, but all IP header.
  */
-static int raw_v4_input(struct sk_buff *skb, struct iphdr *iph, int hash)
+static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash)
 {
         struct sock *sk;
         struct hlist_head *head;
@@ -247,7 +247,7 @@ static void raw_err(struct sock *sk, struct sk_buff *skb, u32 info)
         }
 
         if (inet->recverr) {
-                struct iphdr *iph = (struct iphdr *)skb->data;
+                const struct iphdr *iph = (const struct iphdr *)skb->data;
                 u8 *payload = skb->data + (iph->ihl << 2);
 
                 if (inet->hdrincl)
@@ -265,7 +265,7 @@ void raw_icmp_error(struct sk_buff *skb, int protocol, u32 info)
 {
         int hash;
         struct sock *raw_sk;
-        struct iphdr *iph;
+        const struct iphdr *iph;
         struct net *net;
 
         hash = protocol & (RAW_HTABLE_SIZE - 1);
@@ -273,7 +273,7 @@ void raw_icmp_error(struct sk_buff *skb, int protocol, u32 info)
         read_lock(&raw_v4_hashinfo.lock);
         raw_sk = sk_head(&raw_v4_hashinfo.ht[hash]);
         if (raw_sk != NULL) {
-                iph = (struct iphdr *)skb->data;
+                iph = (const struct iphdr *)skb->data;
                 net = dev_net(skb->dev);
 
                 while ((raw_sk = __raw_v4_lookup(net, raw_sk, protocol,
@@ -281,7 +281,7 @@ void raw_icmp_error(struct sk_buff *skb, int protocol, u32 info)
                                                 skb->dev->ifindex)) != NULL) {
                         raw_err(raw_sk, skb, info);
                         raw_sk = sk_next(raw_sk);
-                        iph = (struct iphdr *)skb->data;
+                        iph = (const struct iphdr *)skb->data;
                 }
         }
         read_unlock(&raw_v4_hashinfo.lock);
@@ -460,6 +460,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         __be32 saddr;
         u8  tos;
         int err;
+        struct ip_options_data opt_copy;
 
         err = -EMSGSIZE;
         if (len > 0xFFFF)
@@ -520,8 +521,18 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         saddr = ipc.addr;
         ipc.addr = daddr;
 
-        if (!ipc.opt)
-                ipc.opt = inet->opt;
+        if (!ipc.opt) {
+                struct ip_options_rcu *inet_opt;
+
+                rcu_read_lock();
+                inet_opt = rcu_dereference(inet->inet_opt);
+                if (inet_opt) {
+                        memcpy(&opt_copy, inet_opt,
+                               sizeof(*inet_opt) + inet_opt->opt.optlen);
+                        ipc.opt = &opt_copy.opt;
+                }
+                rcu_read_unlock();
+        }
 
         if (ipc.opt) {
                 err = -EINVAL;
@@ -530,10 +541,10 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                  */
                 if (inet->hdrincl)
                         goto done;
-                if (ipc.opt->srr) {
+                if (ipc.opt->opt.srr) {
                         if (!daddr)
                                 goto done;
-                        daddr = ipc.opt->faddr;
+                        daddr = ipc.opt->opt.faddr;
                 }
         }
         tos = RT_CONN_FLAGS(sk);
@@ -548,17 +559,13 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         }
 
         {
-                struct flowi4 fl4 = {
-                        .flowi4_oif = ipc.oif,
-                        .flowi4_mark = sk->sk_mark,
-                        .daddr = daddr,
-                        .saddr = saddr,
-                        .flowi4_tos = tos,
-                        .flowi4_proto = (inet->hdrincl ?
-                                         IPPROTO_RAW :
-                                         sk->sk_protocol),
-                        .flowi4_flags = FLOWI_FLAG_CAN_SLEEP,
-                };
+                struct flowi4 fl4;
+
+                flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
+                                   RT_SCOPE_UNIVERSE,
+                                   inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
+                                   FLOWI_FLAG_CAN_SLEEP, daddr, saddr, 0, 0);
+
                 if (!inet->hdrincl) {
                         err = raw_probe_proto_opt(&fl4, msg);
                         if (err)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 99e6e4bb1c72..6a83840b16af 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -424,7 +424,7 @@ static int rt_cache_seq_show(struct seq_file *seq, void *v)
                         dst_metric(&r->dst, RTAX_WINDOW),
                         (int)((dst_metric(&r->dst, RTAX_RTT) >> 3) +
                               dst_metric(&r->dst, RTAX_RTTVAR)),
-                        r->rt_tos,
+                        r->rt_key_tos,
                         r->dst.hh ? atomic_read(&r->dst.hh->hh_refcnt) : -1,
                         r->dst.hh ? (r->dst.hh->hh_output ==
                                        dev_queue_xmit) : 0,
@@ -724,7 +724,7 @@ static inline int compare_keys(struct rtable *rt1, struct rtable *rt2)
         return (((__force u32)rt1->rt_key_dst ^ (__force u32)rt2->rt_key_dst) |
                 ((__force u32)rt1->rt_key_src ^ (__force u32)rt2->rt_key_src) |
                 (rt1->rt_mark ^ rt2->rt_mark) |
-                (rt1->rt_tos ^ rt2->rt_tos) |
+                (rt1->rt_key_tos ^ rt2->rt_key_tos) |
                 (rt1->rt_oif ^ rt2->rt_oif) |
                 (rt1->rt_iif ^ rt2->rt_iif)) == 0;
 }
@@ -1349,7 +1349,7 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
                                                 rt_genid(dev_net(dst->dev)));
 #if RT_CACHE_DEBUG >= 1
                         printk(KERN_DEBUG "ipv4_negative_advice: redirect to %pI4/%02x dropped\n",
-                                &rt->rt_dst, rt->rt_tos);
+                                &rt->rt_dst, rt->rt_key_tos);
 #endif
                         rt_del(hash, rt);
                         ret = NULL;
@@ -1507,7 +1507,7 @@ static inline unsigned short guess_mtu(unsigned short old_mtu)
         return 68;
 }
 
-unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
+unsigned short ip_rt_frag_needed(struct net *net, const struct iphdr *iph,
                                  unsigned short new_mtu,
                                  struct net_device *dev)
 {
@@ -1710,7 +1710,7 @@ void ip_rt_get_source(u8 *addr, struct rtable *rt)
                 struct flowi4 fl4 = {
                         .daddr = rt->rt_key_dst,
                         .saddr = rt->rt_key_src,
-                        .flowi4_tos = rt->rt_tos,
+                        .flowi4_tos = rt->rt_key_tos,
                         .flowi4_oif = rt->rt_oif,
                         .flowi4_iif = rt->rt_iif,
                         .flowi4_mark = rt->rt_mark,
@@ -1767,7 +1767,7 @@ static unsigned int ipv4_default_mtu(const struct dst_entry *dst)
         return mtu;
 }
 
-static void rt_init_metrics(struct rtable *rt, const struct flowi4 *oldflp4,
+static void rt_init_metrics(struct rtable *rt, const struct flowi4 *fl4,
                             struct fib_info *fi)
 {
         struct inet_peer *peer;
@@ -1776,7 +1776,7 @@ static void rt_init_metrics(struct rtable *rt, const struct flowi4 *oldflp4,
         /* If a peer entry exists for this destination, we must hook
          * it up in order to get at cached metrics.
          */
-        if (oldflp4 && (oldflp4->flowi4_flags & FLOWI_FLAG_PRECOW_METRICS))
+        if (fl4 && (fl4->flowi4_flags & FLOWI_FLAG_PRECOW_METRICS))
                 create = 1;
 
         rt->peer = peer = inet_getpeer_v4(rt->rt_dst, create);
@@ -1803,7 +1803,7 @@ static void rt_init_metrics(struct rtable *rt, const struct flowi4 *oldflp4,
         }
 }
 
-static void rt_set_nexthop(struct rtable *rt, const struct flowi4 *oldflp4,
+static void rt_set_nexthop(struct rtable *rt, const struct flowi4 *fl4,
                            const struct fib_result *res,
                            struct fib_info *fi, u16 type, u32 itag)
 {
@@ -1813,7 +1813,7 @@ static void rt_set_nexthop(struct rtable *rt, const struct flowi4 *oldflp4,
                 if (FIB_RES_GW(*res) &&
                     FIB_RES_NH(*res).nh_scope == RT_SCOPE_LINK)
                         rt->rt_gateway = FIB_RES_GW(*res);
-                rt_init_metrics(rt, oldflp4, fi);
+                rt_init_metrics(rt, fl4, fi);
 #ifdef CONFIG_IP_ROUTE_CLASSID
                 dst->tclassid = FIB_RES_NH(*res).nh_tclassid;
 #endif
@@ -1830,20 +1830,15 @@ static void rt_set_nexthop(struct rtable *rt, const struct flowi4 *oldflp4,
 #endif
         set_class_tag(rt, itag);
 #endif
-        rt->rt_type = type;
 }
 
-static struct rtable *rt_dst_alloc(bool nopolicy, bool noxfrm)
+static struct rtable *rt_dst_alloc(struct net_device *dev,
+                                   bool nopolicy, bool noxfrm)
 {
-        struct rtable *rt = dst_alloc(&ipv4_dst_ops, 1);
-        if (rt) {
-                rt->dst.obsolete = -1;
-
-                rt->dst.flags = DST_HOST |
-                        (nopolicy ? DST_NOPOLICY : 0) |
-                        (noxfrm ? DST_NOXFRM : 0);
-        }
-        return rt;
+        return dst_alloc(&ipv4_dst_ops, dev, 1, -1,
+                         DST_HOST |
+                         (nopolicy ? DST_NOPOLICY : 0) |
+                         (noxfrm ? DST_NOXFRM : 0));
 }
 
 /* called in rcu_read_lock() section */
@@ -1871,36 +1866,38 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                         goto e_inval;
                 spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);
         } else {
-                err = fib_validate_source(saddr, 0, tos, 0, dev, &spec_dst,
-                                          &itag, 0);
+                err = fib_validate_source(skb, saddr, 0, tos, 0, dev, &spec_dst,
+                                          &itag);
                 if (err < 0)
                         goto e_err;
         }
-        rth = rt_dst_alloc(IN_DEV_CONF_GET(in_dev, NOPOLICY), false);
+        rth = rt_dst_alloc(init_net.loopback_dev,
+                           IN_DEV_CONF_GET(in_dev, NOPOLICY), false);
         if (!rth)
                 goto e_nobufs;
 
+#ifdef CONFIG_IP_ROUTE_CLASSID
+        rth->dst.tclassid = itag;
+#endif
         rth->dst.output = ip_rt_bug;
 
         rth->rt_key_dst = daddr;
-        rth->rt_dst     = daddr;
-        rth->rt_tos     = tos;
-        rth->rt_mark    = skb->mark;
         rth->rt_key_src = saddr;
+        rth->rt_genid   = rt_genid(dev_net(dev));
+        rth->rt_flags   = RTCF_MULTICAST;
+        rth->rt_type    = RTN_MULTICAST;
+        rth->rt_key_tos = tos;
+        rth->rt_dst     = daddr;
         rth->rt_src     = saddr;
-#ifdef CONFIG_IP_ROUTE_CLASSID
-        rth->dst.tclassid = itag;
-#endif
         rth->rt_route_iif = dev->ifindex;
         rth->rt_iif     = dev->ifindex;
-        rth->dst.dev    = init_net.loopback_dev;
-        dev_hold(rth->dst.dev);
         rth->rt_oif     = 0;
+        rth->rt_mark    = skb->mark;
         rth->rt_gateway = daddr;
         rth->rt_spec_dst= spec_dst;
-        rth->rt_genid   = rt_genid(dev_net(dev));
-        rth->rt_flags   = RTCF_MULTICAST;
-        rth->rt_type    = RTN_MULTICAST;
+        rth->rt_peer_genid = 0;
+        rth->peer = NULL;
+        rth->fi = NULL;
         if (our) {
                 rth->dst.input= ip_local_deliver;
                 rth->rt_flags |= RTCF_LOCAL;
@@ -1981,8 +1978,8 @@ static int __mkroute_input(struct sk_buff *skb,
         }
 
 
-        err = fib_validate_source(saddr, daddr, tos, FIB_RES_OIF(*res),
-                                  in_dev->dev, &spec_dst, &itag, skb->mark);
+        err = fib_validate_source(skb, saddr, daddr, tos, FIB_RES_OIF(*res),
+                                  in_dev->dev, &spec_dst, &itag);
         if (err < 0) {
                 ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,
                                          saddr);
@@ -2013,7 +2010,8 @@ static int __mkroute_input(struct sk_buff *skb,
                 }
         }
 
-        rth = rt_dst_alloc(IN_DEV_CONF_GET(in_dev, NOPOLICY),
+        rth = rt_dst_alloc(out_dev->dev,
+                           IN_DEV_CONF_GET(in_dev, NOPOLICY),
                            IN_DEV_CONF_GET(out_dev, NOXFRM));
         if (!rth) {
                 err = -ENOBUFS;
@@ -2021,27 +2019,28 @@ static int __mkroute_input(struct sk_buff *skb,
         }
 
         rth->rt_key_dst = daddr;
-        rth->rt_dst     = daddr;
-        rth->rt_tos     = tos;
-        rth->rt_mark    = skb->mark;
         rth->rt_key_src = saddr;
+        rth->rt_genid = rt_genid(dev_net(rth->dst.dev));
+        rth->rt_flags = flags;
+        rth->rt_type = res->type;
+        rth->rt_key_tos = tos;
+        rth->rt_dst     = daddr;
         rth->rt_src     = saddr;
-        rth->rt_gateway = daddr;
         rth->rt_route_iif = in_dev->dev->ifindex;
         rth->rt_iif     = in_dev->dev->ifindex;
-        rth->dst.dev    = (out_dev)->dev;
-        dev_hold(rth->dst.dev);
         rth->rt_oif     = 0;
+        rth->rt_mark    = skb->mark;
+        rth->rt_gateway = daddr;
         rth->rt_spec_dst= spec_dst;
+        rth->rt_peer_genid = 0;
+        rth->peer = NULL;
+        rth->fi = NULL;
 
         rth->dst.input = ip_forward;
         rth->dst.output = ip_output;
-        rth->rt_genid = rt_genid(dev_net(rth->dst.dev));
 
         rt_set_nexthop(rth, NULL, res, res->fi, res->type, itag);
 
-        rth->rt_flags = flags;
-
         *result = rth;
         err = 0;
  cleanup:
@@ -2150,9 +2149,9 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                 goto brd_input;
 
         if (res.type == RTN_LOCAL) {
-                err = fib_validate_source(saddr, daddr, tos,
+                err = fib_validate_source(skb, saddr, daddr, tos,
                                           net->loopback_dev->ifindex,
-                                          dev, &spec_dst, &itag, skb->mark);
+                                          dev, &spec_dst, &itag);
                 if (err < 0)
                         goto martian_source_keep_err;
                 if (err)
@@ -2176,8 +2175,8 @@ brd_input:
         if (ipv4_is_zeronet(saddr))
                 spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);
         else {
-                err = fib_validate_source(saddr, 0, tos, 0, dev, &spec_dst,
-                                          &itag, skb->mark);
+                err = fib_validate_source(skb, saddr, 0, tos, 0, dev, &spec_dst,
+                                          &itag);
                 if (err < 0)
                         goto martian_source_keep_err;
                 if (err)
@@ -2188,36 +2187,42 @@ brd_input:
         RT_CACHE_STAT_INC(in_brd);
 
 local_input:
-        rth = rt_dst_alloc(IN_DEV_CONF_GET(in_dev, NOPOLICY), false);
+        rth = rt_dst_alloc(net->loopback_dev,
+                           IN_DEV_CONF_GET(in_dev, NOPOLICY), false);
         if (!rth)
                 goto e_nobufs;
 
+        rth->dst.input= ip_local_deliver;
         rth->dst.output= ip_rt_bug;
-        rth->rt_genid = rt_genid(net);
+#ifdef CONFIG_IP_ROUTE_CLASSID
+        rth->dst.tclassid = itag;
+#endif
 
         rth->rt_key_dst = daddr;
-        rth->rt_dst     = daddr;
-        rth->rt_tos     = tos;
-        rth->rt_mark    = skb->mark;
         rth->rt_key_src = saddr;
+        rth->rt_genid = rt_genid(net);
+        rth->rt_flags   = flags|RTCF_LOCAL;
+        rth->rt_type    = res.type;
+        rth->rt_key_tos = tos;
+        rth->rt_dst     = daddr;
         rth->rt_src     = saddr;
 #ifdef CONFIG_IP_ROUTE_CLASSID
         rth->dst.tclassid = itag;
 #endif
         rth->rt_route_iif = dev->ifindex;
         rth->rt_iif     = dev->ifindex;
-        rth->dst.dev    = net->loopback_dev;
-        dev_hold(rth->dst.dev);
+        rth->rt_oif     = 0;
+        rth->rt_mark    = skb->mark;
         rth->rt_gateway = daddr;
         rth->rt_spec_dst= spec_dst;
-        rth->dst.input= ip_local_deliver;
-        rth->rt_flags   = flags|RTCF_LOCAL;
+        rth->rt_peer_genid = 0;
+        rth->peer = NULL;
+        rth->fi = NULL;
         if (res.type == RTN_UNREACHABLE) {
                 rth->dst.input= ip_error;
                 rth->dst.error= -err;
                 rth->rt_flags   &= ~RTCF_LOCAL;
         }
-        rth->rt_type    = res.type;
         hash = rt_hash(daddr, saddr, fl4.flowi4_iif, rt_genid(net));
         rth = rt_intern_hash(hash, rth, skb, fl4.flowi4_iif);
         err = 0;
@@ -2288,7 +2293,7 @@ int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                      ((__force u32)rth->rt_key_src ^ (__force u32)saddr) |
                      (rth->rt_iif ^ iif) |
                      rth->rt_oif |
-                     (rth->rt_tos ^ tos)) == 0 &&
+                     (rth->rt_key_tos ^ tos)) == 0 &&
                     rth->rt_mark == skb->mark &&
                     net_eq(dev_net(rth->dst.dev), net) &&
                     !rt_is_expired(rth)) {
@@ -2349,12 +2354,12 @@ EXPORT_SYMBOL(ip_route_input_common);
 /* called with rcu_read_lock() */
 static struct rtable *__mkroute_output(const struct fib_result *res,
                                        const struct flowi4 *fl4,
-                                       const struct flowi4 *oldflp4,
-                                       struct net_device *dev_out,
+                                       __be32 orig_daddr, __be32 orig_saddr,
+                                       int orig_oif, struct net_device *dev_out,
                                        unsigned int flags)
 {
         struct fib_info *fi = res->fi;
-        u32 tos = RT_FL_TOS(oldflp4);
+        u32 tos = RT_FL_TOS(fl4);
         struct in_device *in_dev;
         u16 type = res->type;
         struct rtable *rth;
@@ -2381,8 +2386,8 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
                 fi = NULL;
         } else if (type == RTN_MULTICAST) {
                 flags |= RTCF_MULTICAST | RTCF_LOCAL;
-                if (!ip_check_mc_rcu(in_dev, oldflp4->daddr, oldflp4->saddr,
-                                     oldflp4->flowi4_proto))
+                if (!ip_check_mc_rcu(in_dev, fl4->daddr, fl4->saddr,
+                                     fl4->flowi4_proto))
                         flags &= ~RTCF_LOCAL;
                 /* If multicast route do not exist use
                  * default one, but do not gateway in this case.
@@ -2392,29 +2397,31 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
                         fi = NULL;
         }
 
-        rth = rt_dst_alloc(IN_DEV_CONF_GET(in_dev, NOPOLICY),
+        rth = rt_dst_alloc(dev_out,
+                           IN_DEV_CONF_GET(in_dev, NOPOLICY),
                            IN_DEV_CONF_GET(in_dev, NOXFRM));
         if (!rth)
                 return ERR_PTR(-ENOBUFS);
 
-        rth->rt_key_dst = oldflp4->daddr;
-        rth->rt_tos     = tos;
-        rth->rt_key_src = oldflp4->saddr;
-        rth->rt_oif     = oldflp4->flowi4_oif;
-        rth->rt_mark    = oldflp4->flowi4_mark;
+        rth->dst.output = ip_output;
+
+        rth->rt_key_dst = orig_daddr;
+        rth->rt_key_src = orig_saddr;
+        rth->rt_genid = rt_genid(dev_net(dev_out));
+        rth->rt_flags   = flags;
+        rth->rt_type    = type;
+        rth->rt_key_tos = tos;
         rth->rt_dst     = fl4->daddr;
         rth->rt_src     = fl4->saddr;
         rth->rt_route_iif = 0;
-        rth->rt_iif     = oldflp4->flowi4_oif ? : dev_out->ifindex;
-        /* get references to the devices that are to be hold by the routing
-           cache entry */
-        rth->dst.dev    = dev_out;
-        dev_hold(dev_out);
+        rth->rt_iif     = orig_oif ? : dev_out->ifindex;
+        rth->rt_oif     = orig_oif;
+        rth->rt_mark    = fl4->flowi4_mark;
         rth->rt_gateway = fl4->daddr;
         rth->rt_spec_dst= fl4->saddr;
-
-        rth->dst.output=ip_output;
-        rth->rt_genid = rt_genid(dev_net(dev_out));
+        rth->rt_peer_genid = 0;
+        rth->peer = NULL;
+        rth->fi = NULL;
 
         RT_CACHE_STAT_INC(out_slow_tot);
 
@@ -2432,7 +2439,7 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
 #ifdef CONFIG_IP_MROUTE
                 if (type == RTN_MULTICAST) {
                         if (IN_DEV_MFORWARD(in_dev) &&
-                            !ipv4_is_local_multicast(oldflp4->daddr)) {
+                            !ipv4_is_local_multicast(fl4->daddr)) {
                                 rth->dst.input = ip_mr_input;
                                 rth->dst.output = ip_mc_output;
                         }
@@ -2440,9 +2447,8 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
 #endif
         }
 
-        rt_set_nexthop(rth, oldflp4, res, fi, type, 0);
+        rt_set_nexthop(rth, fl4, res, fi, type, 0);
 
-        rth->rt_flags = flags;
         return rth;
 }
 
@@ -2451,36 +2457,37 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
  * called with rcu_read_lock();
  */
 
-static struct rtable *ip_route_output_slow(struct net *net,
-                                           const struct flowi4 *oldflp4)
+static struct rtable *ip_route_output_slow(struct net *net, struct flowi4 *fl4)
 {
-        u32 tos = RT_FL_TOS(oldflp4);
-        struct flowi4 fl4;
-        struct fib_result res;
-        unsigned int flags = 0;
         struct net_device *dev_out = NULL;
+        u32 tos = RT_FL_TOS(fl4);
+        unsigned int flags = 0;
+        struct fib_result res;
         struct rtable *rth;
+        __be32 orig_daddr;
+        __be32 orig_saddr;
+        int orig_oif;
 
         res.fi          = NULL;
 #ifdef CONFIG_IP_MULTIPLE_TABLES
         res.r           = NULL;
 #endif
 
-        fl4.flowi4_oif = oldflp4->flowi4_oif;
-        fl4.flowi4_iif = net->loopback_dev->ifindex;
-        fl4.flowi4_mark = oldflp4->flowi4_mark;
-        fl4.daddr = oldflp4->daddr;
-        fl4.saddr = oldflp4->saddr;
-        fl4.flowi4_tos = tos & IPTOS_RT_MASK;
-        fl4.flowi4_scope = ((tos & RTO_ONLINK) ?
-                        RT_SCOPE_LINK : RT_SCOPE_UNIVERSE);
+        orig_daddr = fl4->daddr;
+        orig_saddr = fl4->saddr;
+        orig_oif = fl4->flowi4_oif;
+
+        fl4->flowi4_iif = net->loopback_dev->ifindex;
+        fl4->flowi4_tos = tos & IPTOS_RT_MASK;
+        fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
+                         RT_SCOPE_LINK : RT_SCOPE_UNIVERSE);
 
         rcu_read_lock();
-        if (oldflp4->saddr) {
+        if (fl4->saddr) {
                 rth = ERR_PTR(-EINVAL);
-                if (ipv4_is_multicast(oldflp4->saddr) ||
-                    ipv4_is_lbcast(oldflp4->saddr) ||
-                    ipv4_is_zeronet(oldflp4->saddr))
+                if (ipv4_is_multicast(fl4->saddr) ||
+                    ipv4_is_lbcast(fl4->saddr) ||
+                    ipv4_is_zeronet(fl4->saddr))
                         goto out;
 
                 /* I removed check for oif == dev_out->oif here.
@@ -2491,11 +2498,11 @@ static struct rtable *ip_route_output_slow(struct net *net,
                       of another iface. --ANK
                  */
 
-                if (oldflp4->flowi4_oif == 0 &&
-                    (ipv4_is_multicast(oldflp4->daddr) ||
-                     ipv4_is_lbcast(oldflp4->daddr))) {
+                if (fl4->flowi4_oif == 0 &&
+                    (ipv4_is_multicast(fl4->daddr) ||
+                     ipv4_is_lbcast(fl4->daddr))) {
                         /* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
-                        dev_out = __ip_dev_find(net, oldflp4->saddr, false);
+                        dev_out = __ip_dev_find(net, fl4->saddr, false);
                         if (dev_out == NULL)
                                 goto out;
 
@@ -2514,20 +2521,20 @@ static struct rtable *ip_route_output_slow(struct net *net,
                            Luckily, this hack is good workaround.
                          */
 
-                        fl4.flowi4_oif = dev_out->ifindex;
+                        fl4->flowi4_oif = dev_out->ifindex;
                         goto make_route;
                 }
 
-                if (!(oldflp4->flowi4_flags & FLOWI_FLAG_ANYSRC)) {
+                if (!(fl4->flowi4_flags & FLOWI_FLAG_ANYSRC)) {
                         /* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
-                        if (!__ip_dev_find(net, oldflp4->saddr, false))
+                        if (!__ip_dev_find(net, fl4->saddr, false))
                                 goto out;
                 }
         }
 
 
-        if (oldflp4->flowi4_oif) {
-                dev_out = dev_get_by_index_rcu(net, oldflp4->flowi4_oif);
+        if (fl4->flowi4_oif) {
+                dev_out = dev_get_by_index_rcu(net, fl4->flowi4_oif);
                 rth = ERR_PTR(-ENODEV);
                 if (dev_out == NULL)
                         goto out;
@@ -2537,37 +2544,37 @@ static struct rtable *ip_route_output_slow(struct net *net,
                         rth = ERR_PTR(-ENETUNREACH);
                         goto out;
                 }
-                if (ipv4_is_local_multicast(oldflp4->daddr) ||
-                    ipv4_is_lbcast(oldflp4->daddr)) {
-                        if (!fl4.saddr)
-                                fl4.saddr = inet_select_addr(dev_out, 0,
-                                                             RT_SCOPE_LINK);
+                if (ipv4_is_local_multicast(fl4->daddr) ||
+                    ipv4_is_lbcast(fl4->daddr)) {
+                        if (!fl4->saddr)
+                                fl4->saddr = inet_select_addr(dev_out, 0,
+                                                              RT_SCOPE_LINK);
                         goto make_route;
                 }
-                if (!fl4.saddr) {
-                        if (ipv4_is_multicast(oldflp4->daddr))
-                                fl4.saddr = inet_select_addr(dev_out, 0,
-                                                             fl4.flowi4_scope);
-                        else if (!oldflp4->daddr)
-                                fl4.saddr = inet_select_addr(dev_out, 0,
-                                                             RT_SCOPE_HOST);
+                if (fl4->saddr) {
+                        if (ipv4_is_multicast(fl4->daddr))
+                                fl4->saddr = inet_select_addr(dev_out, 0,
+                                                              fl4->flowi4_scope);
+                        else if (!fl4->daddr)
+                                fl4->saddr = inet_select_addr(dev_out, 0,
+                                                              RT_SCOPE_HOST);
                 }
         }
 
-        if (!fl4.daddr) {
-                fl4.daddr = fl4.saddr;
-                if (!fl4.daddr)
-                        fl4.daddr = fl4.saddr = htonl(INADDR_LOOPBACK);
+        if (!fl4->daddr) {
+                fl4->daddr = fl4->saddr;
+                if (!fl4->daddr)
+                        fl4->daddr = fl4->saddr = htonl(INADDR_LOOPBACK);
                 dev_out = net->loopback_dev;
-                fl4.flowi4_oif = net->loopback_dev->ifindex;
+                fl4->flowi4_oif = net->loopback_dev->ifindex;
                 res.type = RTN_LOCAL;
                 flags |= RTCF_LOCAL;
                 goto make_route;
         }
 
-        if (fib_lookup(net, &fl4, &res)) {
+        if (fib_lookup(net, fl4, &res)) {
                 res.fi = NULL;
-                if (oldflp4->flowi4_oif) {
+                if (fl4->flowi4_oif) {
                         /* Apparently, routing tables are wrong. Assume,
                            that the destination is on link.
 
@@ -2586,9 +2593,9 @@ static struct rtable *ip_route_output_slow(struct net *net,
                            likely IPv6, but we do not.
                          */
 
-                        if (fl4.saddr == 0)
-                                fl4.saddr = inet_select_addr(dev_out, 0,
-                                                             RT_SCOPE_LINK);
+                        if (fl4->saddr == 0)
+                                fl4->saddr = inet_select_addr(dev_out, 0,
+                                                              RT_SCOPE_LINK);
                         res.type = RTN_UNICAST;
                         goto make_route;
                 }
@@ -2597,42 +2604,45 @@ static struct rtable *ip_route_output_slow(struct net *net,
         }
 
         if (res.type == RTN_LOCAL) {
-                if (!fl4.saddr) {
+                if (!fl4->saddr) {
                         if (res.fi->fib_prefsrc)
-                                fl4.saddr = res.fi->fib_prefsrc;
+                                fl4->saddr = res.fi->fib_prefsrc;
                         else
-                                fl4.saddr = fl4.daddr;
+                                fl4->saddr = fl4->daddr;
                 }
                 dev_out = net->loopback_dev;
-                fl4.flowi4_oif = dev_out->ifindex;
+                fl4->flowi4_oif = dev_out->ifindex;
                 res.fi = NULL;
                 flags |= RTCF_LOCAL;
                 goto make_route;
         }
 
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
-        if (res.fi->fib_nhs > 1 && fl4.flowi4_oif == 0)
+        if (res.fi->fib_nhs > 1 && fl4->flowi4_oif == 0)
                 fib_select_multipath(&res);
         else
 #endif
-        if (!res.prefixlen && res.type == RTN_UNICAST && !fl4.flowi4_oif)
+        if (!res.prefixlen &&
+            res.table->tb_num_default > 1 &&
+            res.type == RTN_UNICAST && !fl4->flowi4_oif)
                 fib_select_default(&res);
 
-        if (!fl4.saddr)
-                fl4.saddr = FIB_RES_PREFSRC(net, res);
+        if (!fl4->saddr)
+                fl4->saddr = FIB_RES_PREFSRC(net, res);
 
         dev_out = FIB_RES_DEV(res);
-        fl4.flowi4_oif = dev_out->ifindex;
+        fl4->flowi4_oif = dev_out->ifindex;
 
 
 make_route:
-        rth = __mkroute_output(&res, &fl4, oldflp4, dev_out, flags);
+        rth = __mkroute_output(&res, fl4, orig_daddr, orig_saddr, orig_oif,
+                               dev_out, flags);
         if (!IS_ERR(rth)) {
                 unsigned int hash;
 
-                hash = rt_hash(oldflp4->daddr, oldflp4->saddr, oldflp4->flowi4_oif,
+                hash = rt_hash(orig_daddr, orig_saddr, orig_oif,
                                rt_genid(dev_net(dev_out)));
-                rth = rt_intern_hash(hash, rth, NULL, oldflp4->flowi4_oif);
+                rth = rt_intern_hash(hash, rth, NULL, orig_oif);
         }
 
 out:
@@ -2640,7 +2650,7 @@ out:
         return rth;
 }
 
-struct rtable *__ip_route_output_key(struct net *net, const struct flowi4 *flp4)
+struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *flp4)
 {
         struct rtable *rth;
         unsigned int hash;
@@ -2658,13 +2668,17 @@ struct rtable *__ip_route_output_key(struct net *net, const struct flowi4 *flp4)
                     rt_is_output_route(rth) &&
                     rth->rt_oif == flp4->flowi4_oif &&
                     rth->rt_mark == flp4->flowi4_mark &&
-                    !((rth->rt_tos ^ flp4->flowi4_tos) &
+                    !((rth->rt_key_tos ^ flp4->flowi4_tos) &
                             (IPTOS_RT_MASK | RTO_ONLINK)) &&
                     net_eq(dev_net(rth->dst.dev), net) &&
                     !rt_is_expired(rth)) {
                         dst_use(&rth->dst, jiffies);
                         RT_CACHE_STAT_INC(out_hit);
                         rcu_read_unlock_bh();
+                        if (!flp4->saddr)
+                                flp4->saddr = rth->rt_src;
+                        if (!flp4->daddr)
+                                flp4->daddr = rth->rt_dst;
                         return rth;
                 }
                 RT_CACHE_STAT_INC(out_hlist_search);
@@ -2709,7 +2723,7 @@ static struct dst_ops ipv4_dst_blackhole_ops = {
 
 struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig)
 {
-        struct rtable *rt = dst_alloc(&ipv4_dst_blackhole_ops, 1);
+        struct rtable *rt = dst_alloc(&ipv4_dst_blackhole_ops, NULL, 1, 0, 0);
         struct rtable *ort = (struct rtable *) dst_orig;
 
         if (rt) {
@@ -2726,7 +2740,7 @@ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_or
 
                 rt->rt_key_dst = ort->rt_key_dst;
                 rt->rt_key_src = ort->rt_key_src;
-                rt->rt_tos = ort->rt_tos;
+                rt->rt_key_tos = ort->rt_key_tos;
                 rt->rt_route_iif = ort->rt_route_iif;
                 rt->rt_iif = ort->rt_iif;
                 rt->rt_oif = ort->rt_oif;
@@ -2762,15 +2776,10 @@ struct rtable *ip_route_output_flow(struct net *net, struct flowi4 *flp4,
         if (IS_ERR(rt))
                 return rt;
 
-        if (flp4->flowi4_proto) {
-                if (!flp4->saddr)
-                        flp4->saddr = rt->rt_src;
-                if (!flp4->daddr)
-                        flp4->daddr = rt->rt_dst;
+        if (flp4->flowi4_proto)
                 rt = (struct rtable *) xfrm_lookup(net, &rt->dst,
                                                    flowi4_to_flowi(flp4),
                                                    sk, 0);
-        }
 
         return rt;
 }
@@ -2794,7 +2803,7 @@ static int rt_fill_info(struct net *net,
         r->rtm_family    = AF_INET;
         r->rtm_dst_len  = 32;
         r->rtm_src_len  = 0;
-        r->rtm_tos      = rt->rt_tos;
+        r->rtm_tos      = rt->rt_key_tos;
         r->rtm_table    = RT_TABLE_MAIN;
         NLA_PUT_U32(skb, RTA_TABLE, RT_TABLE_MAIN);
         r->rtm_type     = rt->rt_type;
@@ -2848,7 +2857,9 @@ static int rt_fill_info(struct net *net,
 
                 if (ipv4_is_multicast(dst) && !ipv4_is_local_multicast(dst) &&
                     IPV4_DEVCONF_ALL(net, MC_FORWARDING)) {
-                        int err = ipmr_get_route(net, skb, r, nowait);
+                        int err = ipmr_get_route(net, skb,
+                                                 rt->rt_src, rt->rt_dst,
+                                                 r, nowait);
                         if (err <= 0) {
                                 if (!nowait) {
                                         if (err == 0)
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 8b44c6d2a79b..26461492a847 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -321,10 +321,10 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
          * the ACK carries the same options again (see RFC1122 4.2.3.8)
          */
         if (opt && opt->optlen) {
-                int opt_size = sizeof(struct ip_options) + opt->optlen;
+                int opt_size = sizeof(struct ip_options_rcu) + opt->optlen;
 
                 ireq->opt = kmalloc(opt_size, GFP_ATOMIC);
-                if (ireq->opt != NULL && ip_options_echo(ireq->opt, skb)) {
+                if (ireq->opt != NULL && ip_options_echo(&ireq->opt->opt, skb)) {
                         kfree(ireq->opt);
                         ireq->opt = NULL;
                 }
@@ -345,17 +345,13 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
          * no easy way to do this.
          */
         {
-                struct flowi4 fl4 = {
-                        .flowi4_mark = sk->sk_mark,
-                        .daddr = ((opt && opt->srr) ?
-                                  opt->faddr : ireq->rmt_addr),
-                        .saddr = ireq->loc_addr,
-                        .flowi4_tos = RT_CONN_FLAGS(sk),
-                        .flowi4_proto = IPPROTO_TCP,
-                        .flowi4_flags = inet_sk_flowi_flags(sk),
-                        .fl4_sport = th->dest,
-                        .fl4_dport = th->source,
-                };
+                struct flowi4 fl4;
+
+                flowi4_init_output(&fl4, 0, sk->sk_mark, RT_CONN_FLAGS(sk),
+                                   RT_SCOPE_UNIVERSE, IPPROTO_TCP,
+                                   inet_sk_flowi_flags(sk),
+                                   (opt && opt->srr) ? opt->faddr : ireq->rmt_addr,
+                                   ireq->loc_addr, th->source, th->dest);
                 security_req_classify_flow(req, flowi4_to_flowi(&fl4));
                 rt = ip_route_output_key(sock_net(sk), &fl4);
                 if (IS_ERR(rt)) {
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index b22d45010545..054a59d21eb0 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -999,7 +999,8 @@ new_segment:
                                 /* We have some space in skb head. Superb! */
                                 if (copy > skb_tailroom(skb))
                                         copy = skb_tailroom(skb);
-                                if ((err = skb_add_data(skb, from, copy)) != 0)
+                                err = skb_add_data_nocache(sk, skb, from, copy);
+                                if (err)
                                         goto do_fault;
                         } else {
                                 int merge = 0;
@@ -1042,8 +1043,8 @@ new_segment:
 
                                 /* Time to copy data. We are close to
                                  * the end! */
-                                err = skb_copy_to_page(sk, from, skb, page,
-                                                       off, copy);
+                                err = skb_copy_to_page_nocache(sk, from, skb,
+                                                               page, off, copy);
                                 if (err) {
                                         /* If this page was new, give it to the
                                          * socket so it does not get leaked.
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index f7e6c2c2d2bb..f3d16d8918c7 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -146,13 +146,15 @@ EXPORT_SYMBOL_GPL(tcp_twsk_unique);
 /* This will initiate an outgoing connection. */
 int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
+        struct sockaddr_in *usin = (struct sockaddr_in *)uaddr;
         struct inet_sock *inet = inet_sk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
-        struct sockaddr_in *usin = (struct sockaddr_in *)uaddr;
         __be16 orig_sport, orig_dport;
-        struct rtable *rt;
         __be32 daddr, nexthop;
+        struct flowi4 fl4;
+        struct rtable *rt;
         int err;
+        struct ip_options_rcu *inet_opt;
 
         if (addr_len < sizeof(struct sockaddr_in))
                 return -EINVAL;
@@ -161,15 +163,17 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 return -EAFNOSUPPORT;
 
         nexthop = daddr = usin->sin_addr.s_addr;
-        if (inet->opt && inet->opt->srr) {
+        inet_opt = rcu_dereference_protected(inet->inet_opt,
+                                             sock_owned_by_user(sk));
+        if (inet_opt && inet_opt->opt.srr) {
                 if (!daddr)
                         return -EINVAL;
-                nexthop = inet->opt->faddr;
+                nexthop = inet_opt->opt.faddr;
         }
 
         orig_sport = inet->inet_sport;
         orig_dport = usin->sin_port;
-        rt = ip_route_connect(nexthop, inet->inet_saddr,
+        rt = ip_route_connect(&fl4, nexthop, inet->inet_saddr,
                               RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
                               IPPROTO_TCP,
                               orig_sport, orig_dport, sk, true);
@@ -185,11 +189,11 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 return -ENETUNREACH;
         }
 
-        if (!inet->opt || !inet->opt->srr)
-                daddr = rt->rt_dst;
+        if (!inet_opt || !inet_opt->opt.srr)
+                daddr = fl4.daddr;
 
         if (!inet->inet_saddr)
-                inet->inet_saddr = rt->rt_src;
+                inet->inet_saddr = fl4.saddr;
         inet->inet_rcv_saddr = inet->inet_saddr;
 
         if (tp->rx_opt.ts_recent_stamp && inet->inet_daddr != daddr) {
@@ -200,7 +204,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         }
 
         if (tcp_death_row.sysctl_tw_recycle &&
-            !tp->rx_opt.ts_recent_stamp && rt->rt_dst == daddr) {
+            !tp->rx_opt.ts_recent_stamp && fl4.daddr == daddr) {
                 struct inet_peer *peer = rt_get_peer(rt);
                 /*
                  * VJ's idea. We save last timestamp seen from
@@ -221,8 +225,8 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         inet->inet_daddr = daddr;
 
         inet_csk(sk)->icsk_ext_hdr_len = 0;
-        if (inet->opt)
-                inet_csk(sk)->icsk_ext_hdr_len = inet->opt->optlen;
+        if (inet_opt)
+                inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
 
         tp->rx_opt.mss_clamp = TCP_MSS_DEFAULT;
 
@@ -236,8 +240,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (err)
                 goto failure;
 
-        rt = ip_route_newports(rt, IPPROTO_TCP,
-                               orig_sport, orig_dport,
+        rt = ip_route_newports(&fl4, rt, orig_sport, orig_dport,
                                inet->inet_sport, inet->inet_dport, sk);
         if (IS_ERR(rt)) {
                 err = PTR_ERR(rt);
@@ -279,7 +282,7 @@ EXPORT_SYMBOL(tcp_v4_connect);
 /*
  * This routine does path mtu discovery as defined in RFC1191.
  */
-static void do_pmtu_discovery(struct sock *sk, struct iphdr *iph, u32 mtu)
+static void do_pmtu_discovery(struct sock *sk, const struct iphdr *iph, u32 mtu)
 {
         struct dst_entry *dst;
         struct inet_sock *inet = inet_sk(sk);
@@ -341,7 +344,7 @@ static void do_pmtu_discovery(struct sock *sk, struct iphdr *iph, u32 mtu)
 
 void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
 {
-        struct iphdr *iph = (struct iphdr *)icmp_skb->data;
+        const struct iphdr *iph = (const struct iphdr *)icmp_skb->data;
         struct tcphdr *th = (struct tcphdr *)(icmp_skb->data + (iph->ihl << 2));
         struct inet_connection_sock *icsk;
         struct tcp_sock *tp;
@@ -820,17 +823,18 @@ static void syn_flood_warning(const struct sk_buff *skb)
 /*
  * Save and compile IPv4 options into the request_sock if needed.
  */
-static struct ip_options *tcp_v4_save_options(struct sock *sk,
-                                              struct sk_buff *skb)
+static struct ip_options_rcu *tcp_v4_save_options(struct sock *sk,
+                                                  struct sk_buff *skb)
 {
-        struct ip_options *opt = &(IPCB(skb)->opt);
-        struct ip_options *dopt = NULL;
+        const struct ip_options *opt = &(IPCB(skb)->opt);
+        struct ip_options_rcu *dopt = NULL;
 
         if (opt && opt->optlen) {
-                int opt_size = optlength(opt);
+                int opt_size = sizeof(*dopt) + opt->optlen;
+
                 dopt = kmalloc(opt_size, GFP_ATOMIC);
                 if (dopt) {
-                        if (ip_options_echo(dopt, skb)) {
+                        if (ip_options_echo(&dopt->opt, skb)) {
                                 kfree(dopt);
                                 dopt = NULL;
                         }
@@ -1411,6 +1415,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 #ifdef CONFIG_TCP_MD5SIG
         struct tcp_md5sig_key *key;
 #endif
+        struct ip_options_rcu *inet_opt;
 
         if (sk_acceptq_is_full(sk))
                 goto exit_overflow;
@@ -1431,13 +1436,14 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         newinet->inet_daddr   = ireq->rmt_addr;
         newinet->inet_rcv_saddr = ireq->loc_addr;
         newinet->inet_saddr           = ireq->loc_addr;
-        newinet->opt          = ireq->opt;
+        inet_opt              = ireq->opt;
+        rcu_assign_pointer(newinet->inet_opt, inet_opt);
         ireq->opt             = NULL;
         newinet->mc_index     = inet_iif(skb);
         newinet->mc_ttl       = ip_hdr(skb)->ttl;
         inet_csk(newsk)->icsk_ext_hdr_len = 0;
-        if (newinet->opt)
-                inet_csk(newsk)->icsk_ext_hdr_len = newinet->opt->optlen;
+        if (inet_opt)
+                inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
         newinet->inet_id = newtp->write_seq ^ jiffies;
 
         tcp_mtup_init(newsk);
@@ -2527,7 +2533,7 @@ void tcp4_proc_exit(void)
 
 struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 {
-        struct iphdr *iph = skb_gro_network_header(skb);
+        const struct iphdr *iph = skb_gro_network_header(skb);
 
         switch (skb->ip_summed) {
         case CHECKSUM_COMPLETE:
@@ -2548,7 +2554,7 @@ struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
 int tcp4_gro_complete(struct sk_buff *skb)
 {
-        struct iphdr *iph = ip_hdr(skb);
+        const struct iphdr *iph = ip_hdr(skb);
         struct tcphdr *th = tcp_hdr(skb);
 
         th->check = ~tcp_v4_check(skb->len - skb_transport_offset(skb),
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index f87a8eb76f3b..544f435d1aff 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -578,7 +578,7 @@ found:
 void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
 {
         struct inet_sock *inet;
-        struct iphdr *iph = (struct iphdr *)skb->data;
+        const struct iphdr *iph = (const struct iphdr *)skb->data;
         struct udphdr *uh = (struct udphdr *)(skb->data+(iph->ihl<<2));
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
@@ -804,6 +804,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
         int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
         struct sk_buff *skb;
+        struct ip_options_data opt_copy;
 
         if (len > 0xFFFF)
                 return -EMSGSIZE;
@@ -877,22 +878,32 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         free = 1;
                 connected = 0;
         }
-        if (!ipc.opt)
-                ipc.opt = inet->opt;
+        if (!ipc.opt) {
+                struct ip_options_rcu *inet_opt;
+
+                rcu_read_lock();
+                inet_opt = rcu_dereference(inet->inet_opt);
+                if (inet_opt) {
+                        memcpy(&opt_copy, inet_opt,
+                               sizeof(*inet_opt) + inet_opt->opt.optlen);
+                        ipc.opt = &opt_copy.opt;
+                }
+                rcu_read_unlock();
+        }
 
         saddr = ipc.addr;
         ipc.addr = faddr = daddr;
 
-        if (ipc.opt && ipc.opt->srr) {
+        if (ipc.opt && ipc.opt->opt.srr) {
                 if (!daddr)
                         return -EINVAL;
-                faddr = ipc.opt->faddr;
+                faddr = ipc.opt->opt.faddr;
                 connected = 0;
         }
         tos = RT_TOS(inet->tos);
         if (sock_flag(sk, SOCK_LOCALROUTE) ||
             (msg->msg_flags & MSG_DONTROUTE) ||
-            (ipc.opt && ipc.opt->is_strictroute)) {
+            (ipc.opt && ipc.opt->opt.is_strictroute)) {
                 tos |= RTO_ONLINK;
                 connected = 0;
         }
@@ -909,20 +920,14 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 rt = (struct rtable *)sk_dst_check(sk, 0);
 
         if (rt == NULL) {
-                struct flowi4 fl4 = {
-                        .flowi4_oif = ipc.oif,
-                        .flowi4_mark = sk->sk_mark,
-                        .daddr = faddr,
-                        .saddr = saddr,
-                        .flowi4_tos = tos,
-                        .flowi4_proto = sk->sk_protocol,
-                        .flowi4_flags = (inet_sk_flowi_flags(sk) |
-                                         FLOWI_FLAG_CAN_SLEEP),
-                        .fl4_sport = inet->inet_sport,
-                        .fl4_dport = dport,
-                };
+                struct flowi4 fl4;
                 struct net *net = sock_net(sk);
 
+                flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
+                                   RT_SCOPE_UNIVERSE, sk->sk_protocol,
+                                   inet_sk_flowi_flags(sk)|FLOWI_FLAG_CAN_SLEEP,
+                                   faddr, saddr, dport, inet->inet_sport);
+
                 security_sk_classify_flow(sk, flowi4_to_flowi(&fl4));
                 rt = ip_route_output_flow(net, &fl4, sk);
                 if (IS_ERR(rt)) {
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index d20a05e970d8..7ff973bd02dd 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -73,7 +73,7 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
 
         rt->rt_key_dst = fl4->daddr;
         rt->rt_key_src = fl4->saddr;
-        rt->rt_tos = fl4->flowi4_tos;
+        rt->rt_key_tos = fl4->flowi4_tos;
         rt->rt_route_iif = fl4->flowi4_iif;
         rt->rt_iif = fl4->flowi4_iif;
         rt->rt_oif = fl4->flowi4_oif;
@@ -102,7 +102,7 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
 static void
 _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
 {
-        struct iphdr *iph = ip_hdr(skb);
+        const struct iphdr *iph = ip_hdr(skb);
         u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
         struct flowi4 *fl4 = &fl->u.ip4;
 
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 1717c64628d1..ea983ae96ae6 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -55,7 +55,7 @@ xfrm4_init_temprop(struct xfrm_state *x, const struct xfrm_tmpl *tmpl,
 
 int xfrm4_extract_header(struct sk_buff *skb)
 {
-        struct iphdr *iph = ip_hdr(skb);
+        const struct iphdr *iph = ip_hdr(skb);
 
         XFRM_MODE_SKB_CB(skb)->ihl = sizeof(*iph);
         XFRM_MODE_SKB_CB(skb)->id = iph->id;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a7bda0757053..f2f9b2e3cfe9 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -825,6 +825,8 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
                 dst_release(&rt->dst);
         }
 
+        /* clean up prefsrc entries */
+        rt6_remove_prefsrc(ifp);
 out:
         in6_ifa_put(ifp);
 }
@@ -1281,7 +1283,7 @@ static int ipv6_count_addresses(struct inet6_dev *idev)
         return cnt;
 }
 
-int ipv6_chk_addr(struct net *net, struct in6_addr *addr,
+int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
                   struct net_device *dev, int strict)
 {
         struct inet6_ifaddr *ifp;
@@ -1324,7 +1326,7 @@ static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
         return false;
 }
 
-int ipv6_chk_prefix(struct in6_addr *addr, struct net_device *dev)
+int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)
 {
         struct inet6_dev *idev;
         struct inet6_ifaddr *ifa;
@@ -1455,7 +1457,7 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
 
 /* Join to solicited addr multicast group. */
 
-void addrconf_join_solict(struct net_device *dev, struct in6_addr *addr)
+void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)
 {
         struct in6_addr maddr;
 
@@ -1466,7 +1468,7 @@ void addrconf_join_solict(struct net_device *dev, struct in6_addr *addr)
         ipv6_dev_mc_inc(dev, &maddr);
 }
 
-void addrconf_leave_solict(struct inet6_dev *idev, struct in6_addr *addr)
+void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
 {
         struct in6_addr maddr;
 
@@ -2111,7 +2113,7 @@ err_exit:
 /*
  *      Manual configuration of address on an interface
  */
-static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
+static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *pfx,
                           unsigned int plen, __u8 ifa_flags, __u32 prefered_lft,
                           __u32 valid_lft)
 {
@@ -2185,7 +2187,7 @@ static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
         return PTR_ERR(ifp);
 }
 
-static int inet6_addr_del(struct net *net, int ifindex, struct in6_addr *pfx,
+static int inet6_addr_del(struct net *net, int ifindex, const struct in6_addr *pfx,
                           unsigned int plen)
 {
         struct inet6_ifaddr *ifp;
@@ -2348,7 +2350,7 @@ static void init_loopback(struct net_device *dev)
         add_addr(idev, &in6addr_loopback, 128, IFA_HOST);
 }
 
-static void addrconf_add_linklocal(struct inet6_dev *idev, struct in6_addr *addr)
+static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr *addr)
 {
         struct inet6_ifaddr * ifp;
         u32 addr_flags = IFA_F_PERMANENT;
@@ -3119,7 +3121,7 @@ void if6_proc_exit(void)
 
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 /* Check if address is a home address configured on any interface. */
-int ipv6_chk_home_addr(struct net *net, struct in6_addr *addr)
+int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr)
 {
         int ret = 0;
         struct inet6_ifaddr *ifp = NULL;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index afcc7099f96d..b7919f901fbf 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -740,7 +740,7 @@ static int ipv6_gso_pull_exthdrs(struct sk_buff *skb, int proto)
 
 static int ipv6_gso_send_check(struct sk_buff *skb)
 {
-        struct ipv6hdr *ipv6h;
+        const struct ipv6hdr *ipv6h;
         const struct inet6_protocol *ops;
         int err = -EINVAL;
 
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 0e5e943446f0..674255f5e6b7 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -44,7 +44,7 @@
 
 #include <net/checksum.h>
 
-static int ipv6_dev_ac_dec(struct net_device *dev, struct in6_addr *addr);
+static int ipv6_dev_ac_dec(struct net_device *dev, const struct in6_addr *addr);
 
 /* Big ac list lock for all the sockets */
 static DEFINE_RWLOCK(ipv6_sk_ac_lock);
@@ -54,7 +54,7 @@ static DEFINE_RWLOCK(ipv6_sk_ac_lock);
  *      socket join an anycast group
  */
 
-int ipv6_sock_ac_join(struct sock *sk, int ifindex, struct in6_addr *addr)
+int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct net_device *dev = NULL;
@@ -145,7 +145,7 @@ error:
 /*
  *      socket leave an anycast group
  */
-int ipv6_sock_ac_drop(struct sock *sk, int ifindex, struct in6_addr *addr)
+int ipv6_sock_ac_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct net_device *dev;
@@ -252,7 +252,7 @@ static void aca_put(struct ifacaddr6 *ac)
 /*
  *      device anycast group inc (add if not found)
  */
-int ipv6_dev_ac_inc(struct net_device *dev, struct in6_addr *addr)
+int ipv6_dev_ac_inc(struct net_device *dev, const struct in6_addr *addr)
 {
         struct ifacaddr6 *aca;
         struct inet6_dev *idev;
@@ -324,7 +324,7 @@ out:
 /*
  *      device anycast group decrement
  */
-int __ipv6_dev_ac_dec(struct inet6_dev *idev, struct in6_addr *addr)
+int __ipv6_dev_ac_dec(struct inet6_dev *idev, const struct in6_addr *addr)
 {
         struct ifacaddr6 *aca, *prev_aca;
 
@@ -358,7 +358,7 @@ int __ipv6_dev_ac_dec(struct inet6_dev *idev, struct in6_addr *addr)
 }
 
 /* called with rcu_read_lock() */
-static int ipv6_dev_ac_dec(struct net_device *dev, struct in6_addr *addr)
+static int ipv6_dev_ac_dec(struct net_device *dev, const struct in6_addr *addr)
 {
         struct inet6_dev *idev = __in6_dev_get(dev);
 
@@ -371,7 +371,7 @@ static int ipv6_dev_ac_dec(struct net_device *dev, struct in6_addr *addr)
  *      check if the interface has this anycast address
  *      called with rcu_read_lock()
  */
-static int ipv6_chk_acast_dev(struct net_device *dev, struct in6_addr *addr)
+static int ipv6_chk_acast_dev(struct net_device *dev, const struct in6_addr *addr)
 {
         struct inet6_dev *idev;
         struct ifacaddr6 *aca;
@@ -392,7 +392,7 @@ static int ipv6_chk_acast_dev(struct net_device *dev, struct in6_addr *addr)
  *      check if given interface (or any, if dev==0) has this anycast address
  */
 int ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
-                        struct in6_addr *addr)
+                        const struct in6_addr *addr)
 {
         int found = 0;
 
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 59dccfbb5b11..1ac7938dd9ec 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -430,7 +430,7 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                      u8 type, u8 code, int offset, __be32 info)
 {
         struct net *net = dev_net(skb->dev);
-        struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
+        const struct ipv6hdr *iph = (const struct ipv6hdr *)skb->data;
         struct ip_esp_hdr *esph = (struct ip_esp_hdr *)(skb->data + offset);
         struct xfrm_state *x;
 
@@ -438,7 +438,8 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
             type != ICMPV6_PKT_TOOBIG)
                 return;
 
-        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET6);
+        x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
+                              esph->spi, IPPROTO_ESP, AF_INET6);
         if (!x)
                 return;
         printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%pI6\n",
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 83cb4f9add81..11900417b1cc 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -372,7 +372,7 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
         struct ipv6hdr *hdr = ipv6_hdr(skb);
         struct sock *sk;
         struct ipv6_pinfo *np;
-        struct in6_addr *saddr = NULL;
+        const struct in6_addr *saddr = NULL;
         struct dst_entry *dst;
         struct icmp6hdr tmp_hdr;
         struct flowi6 fl6;
@@ -521,7 +521,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         struct sock *sk;
         struct inet6_dev *idev;
         struct ipv6_pinfo *np;
-        struct in6_addr *saddr = NULL;
+        const struct in6_addr *saddr = NULL;
         struct icmp6hdr *icmph = icmp6_hdr(skb);
         struct icmp6hdr tmp_hdr;
         struct flowi6 fl6;
@@ -645,8 +645,8 @@ static int icmpv6_rcv(struct sk_buff *skb)
 {
         struct net_device *dev = skb->dev;
         struct inet6_dev *idev = __in6_dev_get(dev);
-        struct in6_addr *saddr, *daddr;
-        struct ipv6hdr *orig_hdr;
+        const struct in6_addr *saddr, *daddr;
+        const struct ipv6hdr *orig_hdr;
         struct icmp6hdr *hdr;
         u8 type;
 
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 7548905e79e1..4076a0b14b20 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -134,9 +134,9 @@ static __inline__ u32 fib6_new_sernum(void)
 # define BITOP_BE32_SWIZZLE     0
 #endif
 
-static __inline__ __be32 addr_bit_set(void *token, int fn_bit)
+static __inline__ __be32 addr_bit_set(const void *token, int fn_bit)
 {
-        __be32 *addr = token;
+        const __be32 *addr = token;
         /*
          * Here,
          *      1 << ((~fn_bit ^ BITOP_BE32_SWIZZLE) & 0x1f)
@@ -394,10 +394,11 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
         arg.net = net;
         w->args = &arg;
 
+        rcu_read_lock();
         for (h = s_h; h < FIB6_TABLE_HASHSZ; h++, s_e = 0) {
                 e = 0;
                 head = &net->ipv6.fib_table_hash[h];
-                hlist_for_each_entry(tb, node, head, tb6_hlist) {
+                hlist_for_each_entry_rcu(tb, node, head, tb6_hlist) {
                         if (e < s_e)
                                 goto next;
                         res = fib6_dump_table(tb, skb, cb);
@@ -408,6 +409,7 @@ next:
                 }
         }
 out:
+        rcu_read_unlock();
         cb->args[1] = e;
         cb->args[0] = h;
 
@@ -822,7 +824,7 @@ st_failure:
 
 struct lookup_args {
         int             offset;         /* key offset on rt6_info       */
-        struct in6_addr *addr;          /* search key                   */
+        const struct in6_addr   *addr;          /* search key                   */
 };
 
 static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
@@ -881,8 +883,8 @@ static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
         return NULL;
 }
 
-struct fib6_node * fib6_lookup(struct fib6_node *root, struct in6_addr *daddr,
-                               struct in6_addr *saddr)
+struct fib6_node * fib6_lookup(struct fib6_node *root, const struct in6_addr *daddr,
+                               const struct in6_addr *saddr)
 {
         struct fib6_node *fn;
         struct lookup_args args[] = {
@@ -916,7 +918,7 @@ struct fib6_node * fib6_lookup(struct fib6_node *root, struct in6_addr *daddr,
 
 
 static struct fib6_node * fib6_locate_1(struct fib6_node *root,
-                                        struct in6_addr *addr,
+                                        const struct in6_addr *addr,
                                         int plen, int offset)
 {
         struct fib6_node *fn;
@@ -946,8 +948,8 @@ static struct fib6_node * fib6_locate_1(struct fib6_node *root,
 }
 
 struct fib6_node * fib6_locate(struct fib6_node *root,
-                               struct in6_addr *daddr, int dst_len,
-                               struct in6_addr *saddr, int src_len)
+                               const struct in6_addr *daddr, int dst_len,
+                               const struct in6_addr *saddr, int src_len)
 {
         struct fib6_node *fn;
 
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index a83e9209cecc..027c7ff6f1e5 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -57,7 +57,7 @@ inline int ip6_rcv_finish( struct sk_buff *skb)
 
 int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 {
-        struct ipv6hdr *hdr;
+        const struct ipv6hdr *hdr;
         u32             pkt_len;
         struct inet6_dev *idev;
         struct net *net = dev_net(skb->dev);
@@ -186,7 +186,7 @@ resubmit:
                 int ret;
 
                 if (ipprot->flags & INET6_PROTO_FINAL) {
-                        struct ipv6hdr *hdr;
+                        const struct ipv6hdr *hdr;
 
                         /* Free reference early: we don't need it any more,
                            and it may hold ip_conntrack module loaded
@@ -242,7 +242,7 @@ int ip6_input(struct sk_buff *skb)
 
 int ip6_mc_input(struct sk_buff *skb)
 {
-        struct ipv6hdr *hdr;
+        const struct ipv6hdr *hdr;
         int deliver;
 
         IP6_UPD_PO_STATS_BH(dev_net(skb_dst(skb)->dev),
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 46cf7bea6769..4cfbb24b9e04 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -869,9 +869,9 @@ fail:
         return err;
 }
 
-static inline int ip6_rt_check(struct rt6key *rt_key,
-                               struct in6_addr *fl_addr,
-                               struct in6_addr *addr_cache)
+static inline int ip6_rt_check(const struct rt6key *rt_key,
+                               const struct in6_addr *fl_addr,
+                               const struct in6_addr *addr_cache)
 {
         return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
                 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
@@ -879,7 +879,7 @@ static inline int ip6_rt_check(struct rt6key *rt_key,
 
 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
                                           struct dst_entry *dst,
-                                          struct flowi6 *fl6)
+                                          const struct flowi6 *fl6)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct rt6_info *rt = (struct rt6_info *)dst;
@@ -930,10 +930,10 @@ static int ip6_dst_lookup_tail(struct sock *sk,
                 goto out_err_release;
 
         if (ipv6_addr_any(&fl6->saddr)) {
-                err = ipv6_dev_get_saddr(net, ip6_dst_idev(*dst)->dev,
-                                         &fl6->daddr,
-                                         sk ? inet6_sk(sk)->srcprefs : 0,
-                                         &fl6->saddr);
+                struct rt6_info *rt = (struct rt6_info *) *dst;
+                err = ip6_route_get_saddr(net, rt, &fl6->daddr,
+                                          sk ? inet6_sk(sk)->srcprefs : 0,
+                                          &fl6->saddr);
                 if (err)
                         goto out_err_release;
         }
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index c1b1bd312df2..36c2842a86b2 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -162,7 +162,7 @@ static inline void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
         for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 
 static struct ip6_tnl *
-ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
+ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_addr *local)
 {
         unsigned int h0 = HASH(remote);
         unsigned int h1 = HASH(local);
@@ -194,10 +194,10 @@ ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
  **/
 
 static struct ip6_tnl __rcu **
-ip6_tnl_bucket(struct ip6_tnl_net *ip6n, struct ip6_tnl_parm *p)
+ip6_tnl_bucket(struct ip6_tnl_net *ip6n, const struct ip6_tnl_parm *p)
 {
-        struct in6_addr *remote = &p->raddr;
-        struct in6_addr *local = &p->laddr;
+        const struct in6_addr *remote = &p->raddr;
+        const struct in6_addr *local = &p->laddr;
         unsigned h = 0;
         int prio = 0;
 
@@ -280,11 +280,6 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
 
         dev_net_set(dev, net);
 
-        if (strchr(name, '%')) {
-                if (dev_alloc_name(dev, name) < 0)
-                        goto failed_free;
-        }
-
         t = netdev_priv(dev);
         t->parms = *p;
         err = ip6_tnl_dev_init(dev);
@@ -321,8 +316,8 @@ failed:
 static struct ip6_tnl *ip6_tnl_locate(struct net *net,
                 struct ip6_tnl_parm *p, int create)
 {
-        struct in6_addr *remote = &p->raddr;
-        struct in6_addr *local = &p->laddr;
+        const struct in6_addr *remote = &p->raddr;
+        const struct in6_addr *local = &p->laddr;
         struct ip6_tnl __rcu **tp;
         struct ip6_tnl *t;
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
@@ -374,7 +369,7 @@ ip6_tnl_dev_uninit(struct net_device *dev)
 static __u16
 parse_tlv_tnl_enc_lim(struct sk_buff *skb, __u8 * raw)
 {
-        struct ipv6hdr *ipv6h = (struct ipv6hdr *) raw;
+        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) raw;
         __u8 nexthdr = ipv6h->nexthdr;
         __u16 off = sizeof (*ipv6h);
 
@@ -435,7 +430,7 @@ static int
 ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
             u8 *type, u8 *code, int *msg, __u32 *info, int offset)
 {
-        struct ipv6hdr *ipv6h = (struct ipv6hdr *) skb->data;
+        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) skb->data;
         struct ip6_tnl *t;
         int rel_msg = 0;
         u8 rel_type = ICMPV6_DEST_UNREACH;
@@ -535,8 +530,9 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         __u32 rel_info = ntohl(info);
         int err;
         struct sk_buff *skb2;
-        struct iphdr *eiph;
+        const struct iphdr *eiph;
         struct rtable *rt;
+        struct flowi4 fl4;
 
         err = ip6_tnl_err(skb, IPPROTO_IPIP, opt, &rel_type, &rel_code,
                           &rel_msg, &rel_info, offset);
@@ -577,7 +573,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         eiph = ip_hdr(skb2);
 
         /* Try to guess incoming interface */
-        rt = ip_route_output_ports(dev_net(skb->dev), NULL,
+        rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
                                    eiph->saddr, 0,
                                    0, 0,
                                    IPPROTO_IPIP, RT_TOS(eiph->tos), 0);
@@ -590,7 +586,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (rt->rt_flags & RTCF_LOCAL) {
                 ip_rt_put(rt);
                 rt = NULL;
-                rt = ip_route_output_ports(dev_net(skb->dev), NULL,
+                rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
                                            eiph->daddr, eiph->saddr,
                                            0, 0,
                                            IPPROTO_IPIP,
@@ -669,8 +665,8 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         return 0;
 }
 
-static void ip4ip6_dscp_ecn_decapsulate(struct ip6_tnl *t,
-                                        struct ipv6hdr *ipv6h,
+static void ip4ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
+                                        const struct ipv6hdr *ipv6h,
                                         struct sk_buff *skb)
 {
         __u8 dsfield = ipv6_get_dsfield(ipv6h) & ~INET_ECN_MASK;
@@ -682,8 +678,8 @@ static void ip4ip6_dscp_ecn_decapsulate(struct ip6_tnl *t,
                 IP_ECN_set_ce(ip_hdr(skb));
 }
 
-static void ip6ip6_dscp_ecn_decapsulate(struct ip6_tnl *t,
-                                        struct ipv6hdr *ipv6h,
+static void ip6ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
+                                        const struct ipv6hdr *ipv6h,
                                         struct sk_buff *skb)
 {
         if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
@@ -726,12 +722,12 @@ static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t)
 
 static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                        __u8 ipproto,
-                       void (*dscp_ecn_decapsulate)(struct ip6_tnl *t,
-                                                    struct ipv6hdr *ipv6h,
+                       void (*dscp_ecn_decapsulate)(const struct ip6_tnl *t,
+                                                    const struct ipv6hdr *ipv6h,
                                                     struct sk_buff *skb))
 {
         struct ip6_tnl *t;
-        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+        const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 
         rcu_read_lock();
 
@@ -828,7 +824,7 @@ static void init_tel_txopt(struct ipv6_tel_txoption *opt, __u8 encap_limit)
  **/
 
 static inline int
-ip6_tnl_addr_conflict(struct ip6_tnl *t, struct ipv6hdr *hdr)
+ip6_tnl_addr_conflict(const struct ip6_tnl *t, const struct ipv6hdr *hdr)
 {
         return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
 }
@@ -1005,7 +1001,7 @@ static inline int
 ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
-        struct iphdr  *iph = ip_hdr(skb);
+        const struct iphdr  *iph = ip_hdr(skb);
         int encap_limit = -1;
         struct flowi6 fl6;
         __u8 dsfield;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 29e48593bf22..82a809901f8e 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -989,8 +989,8 @@ static int mif6_add(struct net *net, struct mr6_table *mrt,
 }
 
 static struct mfc6_cache *ip6mr_cache_find(struct mr6_table *mrt,
-                                           struct in6_addr *origin,
-                                           struct in6_addr *mcastgrp)
+                                           const struct in6_addr *origin,
+                                           const struct in6_addr *mcastgrp)
 {
         int line = MFC6_HASH(mcastgrp, origin);
         struct mfc6_cache *c;
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 85cccd6ed0b7..bba658d9a03c 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -55,7 +55,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 {
         struct net *net = dev_net(skb->dev);
         __be32 spi;
-        struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
+        const struct ipv6hdr *iph = (const struct ipv6hdr *)skb->data;
         struct ip_comp_hdr *ipcomph =
                 (struct ip_comp_hdr *)(skb->data + offset);
         struct xfrm_state *x;
@@ -64,7 +64,8 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 return;
 
         spi = htonl(ntohs(ipcomph->cpi));
-        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6);
+        x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
+                              spi, IPPROTO_COMP, AF_INET6);
         if (!x)
                 return;
 
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 76b893771e6e..ff62e33ead07 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -92,16 +92,16 @@ static void mld_gq_timer_expire(unsigned long data);
 static void mld_ifc_timer_expire(unsigned long data);
 static void mld_ifc_event(struct inet6_dev *idev);
 static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *pmc);
-static void mld_del_delrec(struct inet6_dev *idev, struct in6_addr *addr);
+static void mld_del_delrec(struct inet6_dev *idev, const struct in6_addr *addr);
 static void mld_clear_delrec(struct inet6_dev *idev);
 static int sf_setstate(struct ifmcaddr6 *pmc);
 static void sf_markstate(struct ifmcaddr6 *pmc);
 static void ip6_mc_clear_src(struct ifmcaddr6 *pmc);
-static int ip6_mc_del_src(struct inet6_dev *idev, struct in6_addr *pmca,
-                          int sfmode, int sfcount, struct in6_addr *psfsrc,
+static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
+                          int sfmode, int sfcount, const struct in6_addr *psfsrc,
                           int delta);
-static int ip6_mc_add_src(struct inet6_dev *idev, struct in6_addr *pmca,
-                          int sfmode, int sfcount, struct in6_addr *psfsrc,
+static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
+                          int sfmode, int sfcount, const struct in6_addr *psfsrc,
                           int delta);
 static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
                             struct inet6_dev *idev);
@@ -250,7 +250,7 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
 
 /* called with rcu_read_lock() */
 static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net,
-                                             struct in6_addr *group,
+                                             const struct in6_addr *group,
                                              int ifindex)
 {
         struct net_device *dev = NULL;
@@ -451,7 +451,7 @@ done:
 
 int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
 {
-        struct in6_addr *group;
+        const struct in6_addr *group;
         struct ipv6_mc_socklist *pmc;
         struct inet6_dev *idev;
         struct ipv6_pinfo *inet6 = inet6_sk(sk);
@@ -542,7 +542,7 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
         struct group_filter __user *optval, int __user *optlen)
 {
         int err, i, count, copycount;
-        struct in6_addr *group;
+        const struct in6_addr *group;
         struct ipv6_mc_socklist *pmc;
         struct inet6_dev *idev;
         struct ipv6_pinfo *inet6 = inet6_sk(sk);
@@ -752,7 +752,7 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
         spin_unlock_bh(&idev->mc_lock);
 }
 
-static void mld_del_delrec(struct inet6_dev *idev, struct in6_addr *pmca)
+static void mld_del_delrec(struct inet6_dev *idev, const struct in6_addr *pmca)
 {
         struct ifmcaddr6 *pmc, *pmc_prev;
         struct ip6_sf_list *psf, *psf_next;
@@ -1052,7 +1052,7 @@ static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
 
 /* mark EXCLUDE-mode sources */
 static int mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
-        struct in6_addr *srcs)
+        const struct in6_addr *srcs)
 {
         struct ip6_sf_list *psf;
         int i, scount;
@@ -1080,7 +1080,7 @@ static int mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
 }
 
 static int mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
-        struct in6_addr *srcs)
+        const struct in6_addr *srcs)
 {
         struct ip6_sf_list *psf;
         int i, scount;
@@ -1115,7 +1115,7 @@ int igmp6_event_query(struct sk_buff *skb)
 {
         struct mld2_query *mlh2 = NULL;
         struct ifmcaddr6 *ma;
-        struct in6_addr *group;
+        const struct in6_addr *group;
         unsigned long max_delay;
         struct inet6_dev *idev;
         struct mld_msg *mld;
@@ -1821,7 +1821,7 @@ err_out:
 }
 
 static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
-        struct in6_addr *psfsrc)
+        const struct in6_addr *psfsrc)
 {
         struct ip6_sf_list *psf, *psf_prev;
         int rv = 0;
@@ -1857,8 +1857,8 @@ static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
         return rv;
 }
 
-static int ip6_mc_del_src(struct inet6_dev *idev, struct in6_addr *pmca,
-                          int sfmode, int sfcount, struct in6_addr *psfsrc,
+static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
+                          int sfmode, int sfcount, const struct in6_addr *psfsrc,
                           int delta)
 {
         struct ifmcaddr6 *pmc;
@@ -1918,7 +1918,7 @@ static int ip6_mc_del_src(struct inet6_dev *idev, struct in6_addr *pmca,
  * Add multicast single-source filter to the interface list
  */
 static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
-        struct in6_addr *psfsrc, int delta)
+        const struct in6_addr *psfsrc, int delta)
 {
         struct ip6_sf_list *psf, *psf_prev;
 
@@ -2021,8 +2021,8 @@ static int sf_setstate(struct ifmcaddr6 *pmc)
 /*
  * Add multicast source filter list to the interface list
  */
-static int ip6_mc_add_src(struct inet6_dev *idev, struct in6_addr *pmca,
-                          int sfmode, int sfcount, struct in6_addr *psfsrc,
+static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
+                          int sfmode, int sfcount, const struct in6_addr *psfsrc,
                           int delta)
 {
         struct ifmcaddr6 *pmc;
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 9b210482fb05..43242e6e6103 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -126,7 +126,7 @@ static struct mip6_report_rate_limiter mip6_report_rl = {
 
 static int mip6_destopt_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
         struct ipv6_destopt_hdr *destopt = (struct ipv6_destopt_hdr *)skb->data;
         int err = destopt->nexthdr;
 
@@ -181,8 +181,8 @@ static int mip6_destopt_output(struct xfrm_state *x, struct sk_buff *skb)
 }
 
 static inline int mip6_report_rl_allow(struct timeval *stamp,
-                                       struct in6_addr *dst,
-                                       struct in6_addr *src, int iif)
+                                       const struct in6_addr *dst,
+                                       const struct in6_addr *src, int iif)
 {
         int allow = 0;
 
@@ -349,7 +349,7 @@ static const struct xfrm_type mip6_destopt_type =
 
 static int mip6_rthdr_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
         struct rt2_hdr *rt2 = (struct rt2_hdr *)skb->data;
         int err = rt2->rt_hdr.nexthdr;
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 92f952d093db..7596f071d308 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -324,7 +324,7 @@ static inline u8 *ndisc_opt_addr_data(struct nd_opt_hdr *p,
         return lladdr + prepad;
 }
 
-int ndisc_mc_map(struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
+int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 {
         switch (dev->type) {
         case ARPHRD_ETHER:
@@ -611,6 +611,29 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
                      inc_opt ? ND_OPT_TARGET_LL_ADDR : 0);
 }
 
+static void ndisc_send_unsol_na(struct net_device *dev)
+{
+        struct inet6_dev *idev;
+        struct inet6_ifaddr *ifa;
+        struct in6_addr mcaddr;
+
+        idev = in6_dev_get(dev);
+        if (!idev)
+                return;
+
+        read_lock_bh(&idev->lock);
+        list_for_each_entry(ifa, &idev->addr_list, if_list) {
+                addrconf_addr_solict_mult(&ifa->addr, &mcaddr);
+                ndisc_send_na(dev, NULL, &mcaddr, &ifa->addr,
+                              /*router=*/ !!idev->cnf.forwarding,
+                              /*solicited=*/ false, /*override=*/ true,
+                              /*inc_opt=*/ true);
+        }
+        read_unlock_bh(&idev->lock);
+
+        in6_dev_put(idev);
+}
+
 void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
                    const struct in6_addr *solicit,
                    const struct in6_addr *daddr, const struct in6_addr *saddr)
@@ -725,8 +748,8 @@ static int pndisc_is_router(const void *pkey,
 static void ndisc_recv_ns(struct sk_buff *skb)
 {
         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
-        struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
-        struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
+        const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
+        const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
         u8 *lladdr = NULL;
         u32 ndoptlen = skb->tail - (skb->transport_header +
                                     offsetof(struct nd_msg, opt));
@@ -901,8 +924,8 @@ out:
 static void ndisc_recv_na(struct sk_buff *skb)
 {
         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
-        struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
-        struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
+        const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
+        const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
         u8 *lladdr = NULL;
         u32 ndoptlen = skb->tail - (skb->transport_header +
                                     offsetof(struct nd_msg, opt));
@@ -945,9 +968,10 @@ static void ndisc_recv_na(struct sk_buff *skb)
         }
         ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
         if (ifp) {
-                if (ifp->flags & IFA_F_TENTATIVE) {
-                        addrconf_dad_failure(ifp);
-                        return;
+                if (skb->pkt_type != PACKET_LOOPBACK
+                    && (ifp->flags & IFA_F_TENTATIVE)) {
+                                addrconf_dad_failure(ifp);
+                                return;
                 }
                 /* What should we make now? The advertisement
                    is invalid, but ndisc specs say nothing
@@ -1014,7 +1038,7 @@ static void ndisc_recv_rs(struct sk_buff *skb)
         unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
         struct neighbour *neigh;
         struct inet6_dev *idev;
-        struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
+        const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
         struct ndisc_options ndopts;
         u8 *lladdr = NULL;
 
@@ -1411,8 +1435,8 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
 {
         struct inet6_dev *in6_dev;
         struct icmp6hdr *icmph;
-        struct in6_addr *dest;
-        struct in6_addr *target;        /* new first hop to destination */
+        const struct in6_addr *dest;
+        const struct in6_addr *target;  /* new first hop to destination */
         struct neighbour *neigh;
         int on_link = 0;
         struct ndisc_options ndopts;
@@ -1445,7 +1469,7 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
         }
 
         icmph = icmp6_hdr(skb);
-        target = (struct in6_addr *) (icmph + 1);
+        target = (const struct in6_addr *) (icmph + 1);
         dest = target + 1;
 
         if (ipv6_addr_is_multicast(dest)) {
@@ -1722,6 +1746,9 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event,
                 neigh_ifdown(&nd_tbl, dev);
                 fib6_run_gc(~0UL, net);
                 break;
+        case NETDEV_NOTIFY_PEERS:
+                ndisc_send_unsol_na(dev);
+                break;
         default:
                 break;
         }
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 28bc1f644b7b..30fcee465448 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -13,7 +13,7 @@
 int ip6_route_me_harder(struct sk_buff *skb)
 {
         struct net *net = dev_net(skb_dst(skb)->dev);
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
         struct dst_entry *dst;
         struct flowi6 fl6 = {
                 .flowi6_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
@@ -67,7 +67,7 @@ static void nf_ip6_saveroute(const struct sk_buff *skb,
         struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
 
         if (entry->hook == NF_INET_LOCAL_OUT) {
-                struct ipv6hdr *iph = ipv6_hdr(skb);
+                const struct ipv6hdr *iph = ipv6_hdr(skb);
 
                 rt_info->daddr = iph->daddr;
                 rt_info->saddr = iph->saddr;
@@ -81,7 +81,7 @@ static int nf_ip6_reroute(struct sk_buff *skb,
         struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
 
         if (entry->hook == NF_INET_LOCAL_OUT) {
-                struct ipv6hdr *iph = ipv6_hdr(skb);
+                const struct ipv6hdr *iph = ipv6_hdr(skb);
                 if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
                     !ipv6_addr_equal(&iph->saddr, &rt_info->saddr) ||
                     skb->mark != rt_info->mark)
@@ -108,7 +108,7 @@ static int nf_ip6_route(struct net *net, struct dst_entry **dst,
 __sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
                              unsigned int dataoff, u_int8_t protocol)
 {
-        struct ipv6hdr *ip6h = ipv6_hdr(skb);
+        const struct ipv6hdr *ip6h = ipv6_hdr(skb);
         __sum16 csum = 0;
 
         switch (skb->ip_summed) {
@@ -142,7 +142,7 @@ static __sum16 nf_ip6_checksum_partial(struct sk_buff *skb, unsigned int hook,
                                        unsigned int dataoff, unsigned int len,
                                        u_int8_t protocol)
 {
-        struct ipv6hdr *ip6h = ipv6_hdr(skb);
+        const struct ipv6hdr *ip6h = ipv6_hdr(skb);
         __wsum hsum;
         __sum16 csum = 0;
 
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 5a1c6f27ffaf..94874b0bdcdc 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -340,6 +340,7 @@ ip6t_do_table(struct sk_buff *skb,
         unsigned int *stackptr, origptr, cpu;
         const struct xt_table_info *private;
         struct xt_action_param acpar;
+        unsigned int addend;
 
         /* Initialization */
         indev = in ? in->name : nulldevname;
@@ -358,7 +359,8 @@ ip6t_do_table(struct sk_buff *skb,
 
         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
 
-        xt_info_rdlock_bh();
+        local_bh_disable();
+        addend = xt_write_recseq_begin();
         private = table->private;
         cpu        = smp_processor_id();
         table_base = private->entries[cpu];
@@ -442,7 +444,9 @@ ip6t_do_table(struct sk_buff *skb,
         } while (!acpar.hotdrop);
 
         *stackptr = origptr;
-        xt_info_rdunlock_bh();
+
+        xt_write_recseq_end(addend);
+        local_bh_enable();
 
 #ifdef DEBUG_ALLOW_ALL
         return NF_ACCEPT;
@@ -899,7 +903,7 @@ get_counters(const struct xt_table_info *t,
         unsigned int i;
 
         for_each_possible_cpu(cpu) {
-                seqlock_t *lock = &per_cpu(xt_info_locks, cpu).lock;
+                seqcount_t *s = &per_cpu(xt_recseq, cpu);
 
                 i = 0;
                 xt_entry_foreach(iter, t->entries[cpu], t->size) {
@@ -907,10 +911,10 @@ get_counters(const struct xt_table_info *t,
                         unsigned int start;
 
                         do {
-                                start = read_seqbegin(lock);
+                                start = read_seqcount_begin(s);
                                 bcnt = iter->counters.bcnt;
                                 pcnt = iter->counters.pcnt;
-                        } while (read_seqretry(lock, start));
+                        } while (read_seqcount_retry(s, start));
 
                         ADD_COUNTER(counters[i], bcnt, pcnt);
                         ++i;
@@ -1325,6 +1329,7 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len,
         int ret = 0;
         const void *loc_cpu_entry;
         struct ip6t_entry *iter;
+        unsigned int addend;
 #ifdef CONFIG_COMPAT
         struct compat_xt_counters_info compat_tmp;
 
@@ -1381,13 +1386,13 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len,
         i = 0;
         /* Choose the copy that is on our node */
         curcpu = smp_processor_id();
-        xt_info_wrlock(curcpu);
+        addend = xt_write_recseq_begin();
         loc_cpu_entry = private->entries[curcpu];
         xt_entry_foreach(iter, loc_cpu_entry, private->size) {
                 ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
                 ++i;
         }
-        xt_info_wrunlock(curcpu);
+        xt_write_recseq_end(addend);
 
  unlock_up_free:
         local_bh_enable();
@@ -1578,7 +1583,6 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
                             struct xt_table_info *newinfo, unsigned char *base)
 {
         struct xt_entry_target *t;
-        struct xt_target *target;
         struct ip6t_entry *de;
         unsigned int origsize;
         int ret, h;
@@ -1600,7 +1604,6 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
         }
         de->target_offset = e->target_offset - (origsize - *size);
         t = compat_ip6t_get_target(e);
-        target = t->u.kernel.target;
         xt_compat_target_from_user(t, dstptr, size);
 
         de->next_offset = e->next_offset - (origsize - *size);
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 679a0a3b7b3c..00d19173db7e 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -64,7 +64,8 @@ ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out)
             (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr)) ||
              memcmp(&ipv6_hdr(skb)->daddr, &daddr, sizeof(daddr)) ||
              skb->mark != mark ||
-             ipv6_hdr(skb)->hop_limit != hop_limit))
+             ipv6_hdr(skb)->hop_limit != hop_limit ||
+             flowlabel != *((u_int32_t *)ipv6_hdr(skb))))
                 return ip6_route_me_harder(skb) == 0 ? ret : NF_DROP;
 
         return ret;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 4a1c3b46c56b..e5e5425fe7d0 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -67,8 +67,8 @@ static struct raw_hashinfo raw_v6_hashinfo = {
 };
 
 static struct sock *__raw_v6_lookup(struct net *net, struct sock *sk,
-                unsigned short num, struct in6_addr *loc_addr,
-                struct in6_addr *rmt_addr, int dif)
+                unsigned short num, const struct in6_addr *loc_addr,
+                const struct in6_addr *rmt_addr, int dif)
 {
         struct hlist_node *node;
         int is_multicast = ipv6_addr_is_multicast(loc_addr);
@@ -154,8 +154,8 @@ EXPORT_SYMBOL(rawv6_mh_filter_unregister);
  */
 static int ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
 {
-        struct in6_addr *saddr;
-        struct in6_addr *daddr;
+        const struct in6_addr *saddr;
+        const struct in6_addr *daddr;
         struct sock *sk;
         int delivered = 0;
         __u8 hash;
@@ -348,7 +348,7 @@ void raw6_icmp_error(struct sk_buff *skb, int nexthdr,
 {
         struct sock *sk;
         int hash;
-        struct in6_addr *saddr, *daddr;
+        const struct in6_addr *saddr, *daddr;
         struct net *net;
 
         hash = nexthdr & (RAW_HTABLE_SIZE - 1);
@@ -357,7 +357,7 @@ void raw6_icmp_error(struct sk_buff *skb, int nexthdr,
         sk = sk_head(&raw_v6_hashinfo.ht[hash]);
         if (sk != NULL) {
                 /* Note: ipv6_hdr(skb) != skb->data */
-                struct ipv6hdr *ip6h = (struct ipv6hdr *)skb->data;
+                const struct ipv6hdr *ip6h = (const struct ipv6hdr *)skb->data;
                 saddr = &ip6h->saddr;
                 daddr = &ip6h->daddr;
                 net = dev_net(skb->dev);
@@ -1231,7 +1231,7 @@ struct proto rawv6_prot = {
 static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
 {
         struct ipv6_pinfo *np = inet6_sk(sp);
-        struct in6_addr *dest, *src;
+        const struct in6_addr *dest, *src;
         __u16 destp, srcp;
 
         dest  = &np->daddr;
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 07beeb06f752..7b954e2539d0 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -224,7 +224,7 @@ out:
 }
 
 static __inline__ struct frag_queue *
-fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst)
+fq_find(struct net *net, __be32 id, const struct in6_addr *src, const struct in6_addr *dst)
 {
         struct inet_frag_queue *q;
         struct ip6_create_arg arg;
@@ -535,7 +535,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
 {
         struct frag_hdr *fhdr;
         struct frag_queue *fq;
-        struct ipv6hdr *hdr = ipv6_hdr(skb);
+        const struct ipv6hdr *hdr = ipv6_hdr(skb);
         struct net *net = dev_net(skb_dst(skb)->dev);
 
         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMREQDS);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index fd0eec6f88c6..f1be5c5c85ef 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -89,12 +89,12 @@ static void		ip6_rt_update_pmtu(struct dst_entry *dst, u32 mtu);
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
 static struct rt6_info *rt6_add_route_info(struct net *net,
-                                           struct in6_addr *prefix, int prefixlen,
-                                           struct in6_addr *gwaddr, int ifindex,
+                                           const struct in6_addr *prefix, int prefixlen,
+                                           const struct in6_addr *gwaddr, int ifindex,
                                            unsigned pref);
 static struct rt6_info *rt6_get_route_info(struct net *net,
-                                           struct in6_addr *prefix, int prefixlen,
-                                           struct in6_addr *gwaddr, int ifindex);
+                                           const struct in6_addr *prefix, int prefixlen,
+                                           const struct in6_addr *gwaddr, int ifindex);
 #endif
 
 static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old)
@@ -227,9 +227,14 @@ static struct rt6_info ip6_blk_hole_entry_template = {
 #endif
 
 /* allocate dst with ip6_dst_ops */
-static inline struct rt6_info *ip6_dst_alloc(struct dst_ops *ops)
+static inline struct rt6_info *ip6_dst_alloc(struct dst_ops *ops,
+                                             struct net_device *dev)
 {
-        return (struct rt6_info *)dst_alloc(ops, 0);
+        struct rt6_info *rt = dst_alloc(ops, dev, 0, 0, 0);
+
+        memset(&rt->rt6i_table, 0, sizeof(*rt) - sizeof(struct dst_entry));
+
+        return rt;
 }
 
 static void ip6_dst_destroy(struct dst_entry *dst)
@@ -290,7 +295,7 @@ static __inline__ int rt6_check_expired(const struct rt6_info *rt)
                 time_after(jiffies, rt->rt6i_expires);
 }
 
-static inline int rt6_need_strict(struct in6_addr *daddr)
+static inline int rt6_need_strict(const struct in6_addr *daddr)
 {
         return ipv6_addr_type(daddr) &
                 (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
@@ -302,7 +307,7 @@ static inline int rt6_need_strict(struct in6_addr *daddr)
 
 static inline struct rt6_info *rt6_device_match(struct net *net,
                                                     struct rt6_info *rt,
-                                                    struct in6_addr *saddr,
+                                                    const struct in6_addr *saddr,
                                                     int oif,
                                                     int flags)
 {
@@ -514,7 +519,7 @@ static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
 int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
-                  struct in6_addr *gwaddr)
+                  const struct in6_addr *gwaddr)
 {
         struct net *net = dev_net(dev);
         struct route_info *rinfo = (struct route_info *) opt;
@@ -677,8 +682,8 @@ int ip6_ins_rt(struct rt6_info *rt)
         return __ip6_ins_rt(rt, &info);
 }
 
-static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort, struct in6_addr *daddr,
-                                      struct in6_addr *saddr)
+static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort, const struct in6_addr *daddr,
+                                      const struct in6_addr *saddr)
 {
         struct rt6_info *rt;
 
@@ -746,7 +751,7 @@ static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort, struct in6_addr *dad
         return rt;
 }
 
-static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort, struct in6_addr *daddr)
+static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort, const struct in6_addr *daddr)
 {
         struct rt6_info *rt = ip6_rt_copy(ort);
         if (rt) {
@@ -837,7 +842,7 @@ static struct rt6_info *ip6_pol_route_input(struct net *net, struct fib6_table *
 
 void ip6_route_input(struct sk_buff *skb)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
         struct net *net = dev_net(skb->dev);
         int flags = RT6_LOOKUP_F_HAS_SADDR;
         struct flowi6 fl6 = {
@@ -881,11 +886,13 @@ EXPORT_SYMBOL(ip6_route_output);
 
 struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_orig)
 {
-        struct rt6_info *rt = dst_alloc(&ip6_dst_blackhole_ops, 1);
-        struct rt6_info *ort = (struct rt6_info *) dst_orig;
+        struct rt6_info *rt, *ort = (struct rt6_info *) dst_orig;
         struct dst_entry *new = NULL;
 
+        rt = dst_alloc(&ip6_dst_blackhole_ops, ort->dst.dev, 1, 0, 0);
         if (rt) {
+                memset(&rt->rt6i_table, 0, sizeof(*rt) - sizeof(struct dst_entry));
+
                 new = &rt->dst;
 
                 new->__use = 1;
@@ -893,9 +900,6 @@ struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_ori
                 new->output = dst_discard;
 
                 dst_copy_metrics(new, &ort->dst);
-                new->dev = ort->dst.dev;
-                if (new->dev)
-                        dev_hold(new->dev);
                 rt->rt6i_idev = ort->rt6i_idev;
                 if (rt->rt6i_idev)
                         in6_dev_hold(rt->rt6i_idev);
@@ -1038,13 +1042,12 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
         if (unlikely(idev == NULL))
                 return NULL;
 
-        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops);
+        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops, dev);
         if (unlikely(rt == NULL)) {
                 in6_dev_put(idev);
                 goto out;
         }
 
-        dev_hold(dev);
         if (neigh)
                 neigh_hold(neigh);
         else {
@@ -1053,7 +1056,6 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
                         neigh = NULL;
         }
 
-        rt->rt6i_dev      = dev;
         rt->rt6i_idev     = idev;
         rt->rt6i_nexthop  = neigh;
         atomic_set(&rt->dst.__refcnt, 1);
@@ -1212,7 +1214,7 @@ int ip6_route_add(struct fib6_config *cfg)
                 goto out;
         }
 
-        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops);
+        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops, NULL);
 
         if (rt == NULL) {
                 err = -ENOMEM;
@@ -1279,7 +1281,7 @@ int ip6_route_add(struct fib6_config *cfg)
         }
 
         if (cfg->fc_flags & RTF_GATEWAY) {
-                struct in6_addr *gw_addr;
+                const struct in6_addr *gw_addr;
                 int gwa_type;
 
                 gw_addr = &cfg->fc_gateway;
@@ -1332,6 +1334,16 @@ int ip6_route_add(struct fib6_config *cfg)
         if (dev == NULL)
                 goto out;
 
+        if (!ipv6_addr_any(&cfg->fc_prefsrc)) {
+                if (!ipv6_chk_addr(net, &cfg->fc_prefsrc, dev, 0)) {
+                        err = -EINVAL;
+                        goto out;
+                }
+                ipv6_addr_copy(&rt->rt6i_prefsrc.addr, &cfg->fc_prefsrc);
+                rt->rt6i_prefsrc.plen = 128;
+        } else
+                rt->rt6i_prefsrc.plen = 0;
+
         if (cfg->fc_flags & (RTF_GATEWAY | RTF_NONEXTHOP)) {
                 rt->rt6i_nexthop = __neigh_lookup_errno(&nd_tbl, &rt->rt6i_gateway, dev);
                 if (IS_ERR(rt->rt6i_nexthop)) {
@@ -1509,9 +1521,9 @@ out:
         return rt;
 };
 
-static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
-                                           struct in6_addr *src,
-                                           struct in6_addr *gateway,
+static struct rt6_info *ip6_route_redirect(const struct in6_addr *dest,
+                                           const struct in6_addr *src,
+                                           const struct in6_addr *gateway,
                                            struct net_device *dev)
 {
         int flags = RT6_LOOKUP_F_HAS_SADDR;
@@ -1533,8 +1545,8 @@ static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
                                                    flags, __ip6_route_redirect);
 }
 
-void rt6_redirect(struct in6_addr *dest, struct in6_addr *src,
-                  struct in6_addr *saddr,
+void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src,
+                  const struct in6_addr *saddr,
                   struct neighbour *neigh, u8 *lladdr, int on_link)
 {
         struct rt6_info *rt, *nrt = NULL;
@@ -1608,7 +1620,7 @@ out:
  *      i.e. Path MTU discovery
  */
 
-static void rt6_do_pmtu_disc(struct in6_addr *daddr, struct in6_addr *saddr,
+static void rt6_do_pmtu_disc(const struct in6_addr *daddr, const struct in6_addr *saddr,
                              struct net *net, u32 pmtu, int ifindex)
 {
         struct rt6_info *rt, *nrt;
@@ -1693,7 +1705,7 @@ out:
         dst_release(&rt->dst);
 }
 
-void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
+void rt6_pmtu_discovery(const struct in6_addr *daddr, const struct in6_addr *saddr,
                         struct net_device *dev, u32 pmtu)
 {
         struct net *net = dev_net(dev);
@@ -1721,7 +1733,8 @@ void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
 static struct rt6_info * ip6_rt_copy(struct rt6_info *ort)
 {
         struct net *net = dev_net(ort->rt6i_dev);
-        struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops);
+        struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops,
+                                            ort->dst.dev);
 
         if (rt) {
                 rt->dst.input = ort->dst.input;
@@ -1729,9 +1742,6 @@ static struct rt6_info * ip6_rt_copy(struct rt6_info *ort)
 
                 dst_copy_metrics(&rt->dst, &ort->dst);
                 rt->dst.error = ort->dst.error;
-                rt->dst.dev = ort->dst.dev;
-                if (rt->dst.dev)
-                        dev_hold(rt->dst.dev);
                 rt->rt6i_idev = ort->rt6i_idev;
                 if (rt->rt6i_idev)
                         in6_dev_hold(rt->rt6i_idev);
@@ -1753,8 +1763,8 @@ static struct rt6_info * ip6_rt_copy(struct rt6_info *ort)
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
 static struct rt6_info *rt6_get_route_info(struct net *net,
-                                           struct in6_addr *prefix, int prefixlen,
-                                           struct in6_addr *gwaddr, int ifindex)
+                                           const struct in6_addr *prefix, int prefixlen,
+                                           const struct in6_addr *gwaddr, int ifindex)
 {
         struct fib6_node *fn;
         struct rt6_info *rt = NULL;
@@ -1785,8 +1795,8 @@ out:
 }
 
 static struct rt6_info *rt6_add_route_info(struct net *net,
-                                           struct in6_addr *prefix, int prefixlen,
-                                           struct in6_addr *gwaddr, int ifindex,
+                                           const struct in6_addr *prefix, int prefixlen,
+                                           const struct in6_addr *gwaddr, int ifindex,
                                            unsigned pref)
 {
         struct fib6_config cfg = {
@@ -1814,7 +1824,7 @@ static struct rt6_info *rt6_add_route_info(struct net *net,
 }
 #endif
 
-struct rt6_info *rt6_get_dflt_router(struct in6_addr *addr, struct net_device *dev)
+struct rt6_info *rt6_get_dflt_router(const struct in6_addr *addr, struct net_device *dev)
 {
         struct rt6_info *rt;
         struct fib6_table *table;
@@ -1836,7 +1846,7 @@ struct rt6_info *rt6_get_dflt_router(struct in6_addr *addr, struct net_device *d
         return rt;
 }
 
-struct rt6_info *rt6_add_dflt_router(struct in6_addr *gwaddr,
+struct rt6_info *rt6_add_dflt_router(const struct in6_addr *gwaddr,
                                      struct net_device *dev,
                                      unsigned int pref)
 {
@@ -2001,7 +2011,8 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
                                     int anycast)
 {
         struct net *net = dev_net(idev->dev);
-        struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops);
+        struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops,
+                                            net->loopback_dev);
         struct neighbour *neigh;
 
         if (rt == NULL) {
@@ -2011,13 +2022,11 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
                 return ERR_PTR(-ENOMEM);
         }
 
-        dev_hold(net->loopback_dev);
         in6_dev_hold(idev);
 
         rt->dst.flags = DST_HOST;
         rt->dst.input = ip6_input;
         rt->dst.output = ip6_output;
-        rt->rt6i_dev = net->loopback_dev;
         rt->rt6i_idev = idev;
         rt->dst.obsolete = -1;
 
@@ -2043,6 +2052,55 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
         return rt;
 }
 
+int ip6_route_get_saddr(struct net *net,
+                        struct rt6_info *rt,
+                        const struct in6_addr *daddr,
+                        unsigned int prefs,
+                        struct in6_addr *saddr)
+{
+        struct inet6_dev *idev = ip6_dst_idev((struct dst_entry*)rt);
+        int err = 0;
+        if (rt->rt6i_prefsrc.plen)
+                ipv6_addr_copy(saddr, &rt->rt6i_prefsrc.addr);
+        else
+                err = ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
+                                         daddr, prefs, saddr);
+        return err;
+}
+
+/* remove deleted ip from prefsrc entries */
+struct arg_dev_net_ip {
+        struct net_device *dev;
+        struct net *net;
+        struct in6_addr *addr;
+};
+
+static int fib6_remove_prefsrc(struct rt6_info *rt, void *arg)
+{
+        struct net_device *dev = ((struct arg_dev_net_ip *)arg)->dev;
+        struct net *net = ((struct arg_dev_net_ip *)arg)->net;
+        struct in6_addr *addr = ((struct arg_dev_net_ip *)arg)->addr;
+
+        if (((void *)rt->rt6i_dev == dev || dev == NULL) &&
+            rt != net->ipv6.ip6_null_entry &&
+            ipv6_addr_equal(addr, &rt->rt6i_prefsrc.addr)) {
+                /* remove prefsrc entry */
+                rt->rt6i_prefsrc.plen = 0;
+        }
+        return 0;
+}
+
+void rt6_remove_prefsrc(struct inet6_ifaddr *ifp)
+{
+        struct net *net = dev_net(ifp->idev->dev);
+        struct arg_dev_net_ip adni = {
+                .dev = ifp->idev->dev,
+                .net = net,
+                .addr = &ifp->addr,
+        };
+        fib6_clean_all(net, fib6_remove_prefsrc, 0, &adni);
+}
+
 struct arg_dev_net {
         struct net_device *dev;
         struct net *net;
@@ -2189,6 +2247,9 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
                 nla_memcpy(&cfg->fc_src, tb[RTA_SRC], plen);
         }
 
+        if (tb[RTA_PREFSRC])
+                nla_memcpy(&cfg->fc_prefsrc, tb[RTA_PREFSRC], 16);
+
         if (tb[RTA_OIF])
                 cfg->fc_ifindex = nla_get_u32(tb[RTA_OIF]);
 
@@ -2331,13 +2392,17 @@ static int rt6_fill_node(struct net *net,
 #endif
                         NLA_PUT_U32(skb, RTA_IIF, iif);
         } else if (dst) {
-                struct inet6_dev *idev = ip6_dst_idev(&rt->dst);
                 struct in6_addr saddr_buf;
-                if (ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
-                                       dst, 0, &saddr_buf) == 0)
+                if (ip6_route_get_saddr(net, rt, dst, 0, &saddr_buf) == 0)
                         NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
         }
 
+        if (rt->rt6i_prefsrc.plen) {
+                struct in6_addr saddr_buf;
+                ipv6_addr_copy(&saddr_buf, &rt->rt6i_prefsrc.addr);
+                NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
+        }
+
         if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
                 goto nla_put_failure;
 
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 43b33373adb2..a6a32b39b607 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -250,11 +250,6 @@ static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
 
         dev_net_set(dev, net);
 
-        if (strchr(name, '%')) {
-                if (dev_alloc_name(dev, name) < 0)
-                        goto failed_free;
-        }
-
         nt = netdev_priv(dev);
 
         nt->parms = *parms;
@@ -452,7 +447,7 @@ out:
 }
 
 static int
-isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
+isatap_chksrc(struct sk_buff *skb, const struct iphdr *iph, struct ip_tunnel *t)
 {
         struct ip_tunnel_prl_entry *p;
         int ok = 1;
@@ -465,7 +460,8 @@ isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
                 else
                         skb->ndisc_nodetype = NDISC_NODETYPE_NODEFAULT;
         } else {
-                struct in6_addr *addr6 = &ipv6_hdr(skb)->saddr;
+                const struct in6_addr *addr6 = &ipv6_hdr(skb)->saddr;
+
                 if (ipv6_addr_is_isatap(addr6) &&
                     (addr6->s6_addr32[3] == iph->saddr) &&
                     ipv6_chk_prefix(addr6, t->dev))
@@ -499,7 +495,7 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
    8 bytes of packet payload. It means, that precise relaying of
    ICMP in the real Internet is absolutely infeasible.
  */
-        struct iphdr *iph = (struct iphdr*)skb->data;
+        const struct iphdr *iph = (const struct iphdr *)skb->data;
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
         struct ip_tunnel *t;
@@ -557,7 +553,7 @@ out:
         return err;
 }
 
-static inline void ipip6_ecn_decapsulate(struct iphdr *iph, struct sk_buff *skb)
+static inline void ipip6_ecn_decapsulate(const struct iphdr *iph, struct sk_buff *skb)
 {
         if (INET_ECN_is_ce(iph->tos))
                 IP6_ECN_set_ce(ipv6_hdr(skb));
@@ -565,7 +561,7 @@ static inline void ipip6_ecn_decapsulate(struct iphdr *iph, struct sk_buff *skb)
 
 static int ipip6_rcv(struct sk_buff *skb)
 {
-        struct iphdr *iph;
+        const struct iphdr *iph;
         struct ip_tunnel *tunnel;
 
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
@@ -621,7 +617,7 @@ out:
  * comes from 6rd / 6to4 (RFC 3056) addr space.
  */
 static inline
-__be32 try_6rd(struct in6_addr *v6dst, struct ip_tunnel *tunnel)
+__be32 try_6rd(const struct in6_addr *v6dst, struct ip_tunnel *tunnel)
 {
         __be32 dst = 0;
 
@@ -664,8 +660,8 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct pcpu_tstats *tstats;
-        struct iphdr  *tiph = &tunnel->parms.iph;
-        struct ipv6hdr *iph6 = ipv6_hdr(skb);
+        const struct iphdr  *tiph = &tunnel->parms.iph;
+        const struct ipv6hdr *iph6 = ipv6_hdr(skb);
         u8     tos = tunnel->parms.iph.tos;
         __be16 df = tiph->frag_off;
         struct rtable *rt;                      /* Route to the other host */
@@ -673,8 +669,9 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         struct iphdr  *iph;                     /* Our new IP header */
         unsigned int max_headroom;              /* The extra header space needed */
         __be32 dst = tiph->daddr;
+        struct flowi4 fl4;
         int    mtu;
-        struct in6_addr *addr6;
+        const struct in6_addr *addr6;
         int addr_type;
 
         if (skb->protocol != htons(ETH_P_IPV6))
@@ -693,7 +690,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                         goto tx_error;
                 }
 
-                addr6 = (struct in6_addr*)&neigh->primary_key;
+                addr6 = (const struct in6_addr*)&neigh->primary_key;
                 addr_type = ipv6_addr_type(addr6);
 
                 if ((addr_type & IPV6_ADDR_UNICAST) &&
@@ -718,7 +715,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                         goto tx_error;
                 }
 
-                addr6 = (struct in6_addr*)&neigh->primary_key;
+                addr6 = (const struct in6_addr*)&neigh->primary_key;
                 addr_type = ipv6_addr_type(addr6);
 
                 if (addr_type == IPV6_ADDR_ANY) {
@@ -732,7 +729,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 dst = addr6->s6_addr32[3];
         }
 
-        rt = ip_route_output_ports(dev_net(dev), NULL,
+        rt = ip_route_output_ports(dev_net(dev), &fl4, NULL,
                                    dst, tiph->saddr,
                                    0, 0,
                                    IPPROTO_IPV6, RT_TOS(tos),
@@ -826,8 +823,8 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         iph->frag_off           =       df;
         iph->protocol           =       IPPROTO_IPV6;
         iph->tos                =       INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
-        iph->daddr              =       rt->rt_dst;
-        iph->saddr              =       rt->rt_src;
+        iph->daddr              =       fl4.daddr;
+        iph->saddr              =       fl4.saddr;
 
         if ((iph->ttl = tiph->ttl) == 0)
                 iph->ttl        =       iph6->hop_limit;
@@ -849,13 +846,14 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
 {
         struct net_device *tdev = NULL;
         struct ip_tunnel *tunnel;
-        struct iphdr *iph;
+        const struct iphdr *iph;
+        struct flowi4 fl4;
 
         tunnel = netdev_priv(dev);
         iph = &tunnel->parms.iph;
 
         if (iph->daddr) {
-                struct rtable *rt = ip_route_output_ports(dev_net(dev), NULL,
+                struct rtable *rt = ip_route_output_ports(dev_net(dev), &fl4, NULL,
                                                           iph->daddr, iph->saddr,
                                                           0, 0,
                                                           IPPROTO_IPV6,
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 352c26081f5d..8b9644a8b697 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -66,7 +66,7 @@ static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
 static DEFINE_PER_CPU(__u32 [16 + 5 + SHA_WORKSPACE_WORDS],
                       ipv6_cookie_scratch);
 
-static u32 cookie_hash(struct in6_addr *saddr, struct in6_addr *daddr,
+static u32 cookie_hash(const struct in6_addr *saddr, const struct in6_addr *daddr,
                        __be16 sport, __be16 dport, u32 count, int c)
 {
         __u32 *tmp = __get_cpu_var(ipv6_cookie_scratch);
@@ -86,7 +86,8 @@ static u32 cookie_hash(struct in6_addr *saddr, struct in6_addr *daddr,
         return tmp[17];
 }
 
-static __u32 secure_tcp_syn_cookie(struct in6_addr *saddr, struct in6_addr *daddr,
+static __u32 secure_tcp_syn_cookie(const struct in6_addr *saddr,
+                                   const struct in6_addr *daddr,
                                    __be16 sport, __be16 dport, __u32 sseq,
                                    __u32 count, __u32 data)
 {
@@ -96,8 +97,8 @@ static __u32 secure_tcp_syn_cookie(struct in6_addr *saddr, struct in6_addr *dadd
                 & COOKIEMASK));
 }
 
-static __u32 check_tcp_syn_cookie(__u32 cookie, struct in6_addr *saddr,
-                                  struct in6_addr *daddr, __be16 sport,
+static __u32 check_tcp_syn_cookie(__u32 cookie, const struct in6_addr *saddr,
+                                  const struct in6_addr *daddr, __be16 sport,
                                   __be16 dport, __u32 sseq, __u32 count,
                                   __u32 maxdiff)
 {
@@ -116,7 +117,7 @@ static __u32 check_tcp_syn_cookie(__u32 cookie, struct in6_addr *saddr,
 
 __u32 cookie_v6_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
         const struct tcphdr *th = tcp_hdr(skb);
         int mssind;
         const __u16 mss = *mssp;
@@ -138,7 +139,7 @@ __u32 cookie_v6_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
 
 static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
         const struct tcphdr *th = tcp_hdr(skb);
         __u32 seq = ntohl(th->seq) - 1;
         __u32 mssind = check_tcp_syn_cookie(cookie, &iph->saddr, &iph->daddr,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 4f49e5dd41bb..868366470b4a 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -76,8 +76,8 @@ static void	tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 
 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
 static void     __tcp_v6_send_check(struct sk_buff *skb,
-                                    struct in6_addr *saddr,
-                                    struct in6_addr *daddr);
+                                    const struct in6_addr *saddr,
+                                    const struct in6_addr *daddr);
 
 static const struct inet_connection_sock_af_ops ipv6_mapped;
 static const struct inet_connection_sock_af_ops ipv6_specific;
@@ -86,7 +86,7 @@ static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
 #else
 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
-                                                   struct in6_addr *addr)
+                                                   const struct in6_addr *addr)
 {
         return NULL;
 }
@@ -106,8 +106,8 @@ static void tcp_v6_hash(struct sock *sk)
 }
 
 static __inline__ __sum16 tcp_v6_check(int len,
-                                   struct in6_addr *saddr,
-                                   struct in6_addr *daddr,
+                                   const struct in6_addr *saddr,
+                                   const struct in6_addr *daddr,
                                    __wsum base)
 {
         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
@@ -331,7 +331,7 @@ failure:
 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 u8 type, u8 code, int offset, __be32 info)
 {
-        struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
+        const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
         struct ipv6_pinfo *np;
         struct sock *sk;
@@ -551,7 +551,7 @@ static void tcp_v6_reqsk_destructor(struct request_sock *req)
 
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
-                                                   struct in6_addr *addr)
+                                                   const struct in6_addr *addr)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int i;
@@ -580,7 +580,7 @@ static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 }
 
-static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
+static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
                              char *newkey, u8 newkeylen)
 {
         /* Add key to the list */
@@ -645,7 +645,7 @@ static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
                                  newkey, newkeylen);
 }
 
-static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer)
+static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int i;
@@ -753,8 +753,8 @@ static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 }
 
 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
-                                        struct in6_addr *daddr,
-                                        struct in6_addr *saddr, int nbytes)
+                                        const struct in6_addr *daddr,
+                                        const struct in6_addr *saddr, int nbytes)
 {
         struct tcp6_pseudohdr *bp;
         struct scatterlist sg;
@@ -771,7 +771,7 @@ static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 }
 
 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
-                               struct in6_addr *daddr, struct in6_addr *saddr,
+                               const struct in6_addr *daddr, struct in6_addr *saddr,
                                struct tcphdr *th)
 {
         struct tcp_md5sig_pool *hp;
@@ -807,7 +807,7 @@ static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
                                struct sock *sk, struct request_sock *req,
                                struct sk_buff *skb)
 {
-        struct in6_addr *saddr, *daddr;
+        const struct in6_addr *saddr, *daddr;
         struct tcp_md5sig_pool *hp;
         struct hash_desc *desc;
         struct tcphdr *th = tcp_hdr(skb);
@@ -819,7 +819,7 @@ static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
                 saddr = &inet6_rsk(req)->loc_addr;
                 daddr = &inet6_rsk(req)->rmt_addr;
         } else {
-                struct ipv6hdr *ip6h = ipv6_hdr(skb);
+                const struct ipv6hdr *ip6h = ipv6_hdr(skb);
                 saddr = &ip6h->saddr;
                 daddr = &ip6h->daddr;
         }
@@ -857,7 +857,7 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 {
         __u8 *hash_location = NULL;
         struct tcp_md5sig_key *hash_expected;
-        struct ipv6hdr *ip6h = ipv6_hdr(skb);
+        const struct ipv6hdr *ip6h = ipv6_hdr(skb);
         struct tcphdr *th = tcp_hdr(skb);
         int genhash;
         u8 newhash[16];
@@ -915,7 +915,7 @@ static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 #endif
 
 static void __tcp_v6_send_check(struct sk_buff *skb,
-                                struct in6_addr *saddr, struct in6_addr *daddr)
+                                const struct in6_addr *saddr, const struct in6_addr *daddr)
 {
         struct tcphdr *th = tcp_hdr(skb);
 
@@ -939,7 +939,7 @@ static void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
 
 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 {
-        struct ipv6hdr *ipv6h;
+        const struct ipv6hdr *ipv6h;
         struct tcphdr *th;
 
         if (!pskb_may_pull(skb, sizeof(*th)))
@@ -957,7 +957,7 @@ static int tcp_v6_gso_send_check(struct sk_buff *skb)
 static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
                                          struct sk_buff *skb)
 {
-        struct ipv6hdr *iph = skb_gro_network_header(skb);
+        const struct ipv6hdr *iph = skb_gro_network_header(skb);
 
         switch (skb->ip_summed) {
         case CHECKSUM_COMPLETE:
@@ -978,7 +978,7 @@ static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
 
 static int tcp6_gro_complete(struct sk_buff *skb)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
         struct tcphdr *th = tcp_hdr(skb);
 
         th->check = ~tcp_v6_check(skb->len - skb_transport_offset(skb),
@@ -1469,7 +1469,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
            First: no IPv4 options.
          */
-        newinet->opt = NULL;
+        newinet->inet_opt = NULL;
         newnp->ipv6_fl_list = NULL;
 
         /* Clone RX bits */
@@ -1702,7 +1702,7 @@ ipv6_pktoptions:
 static int tcp_v6_rcv(struct sk_buff *skb)
 {
         struct tcphdr *th;
-        struct ipv6hdr *hdr;
+        const struct ipv6hdr *hdr;
         struct sock *sk;
         int ret;
         struct net *net = dev_net(skb->dev);
@@ -2028,8 +2028,8 @@ static void get_openreq6(struct seq_file *seq,
                          struct sock *sk, struct request_sock *req, int i, int uid)
 {
         int ttd = req->expires - jiffies;
-        struct in6_addr *src = &inet6_rsk(req)->loc_addr;
-        struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
+        const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
+        const struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
 
         if (ttd < 0)
                 ttd = 0;
@@ -2057,7 +2057,7 @@ static void get_openreq6(struct seq_file *seq,
 
 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
 {
-        struct in6_addr *dest, *src;
+        const struct in6_addr *dest, *src;
         __u16 destp, srcp;
         int timer_active;
         unsigned long timer_expires;
@@ -2114,7 +2114,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
 static void get_timewait6_sock(struct seq_file *seq,
                                struct inet_timewait_sock *tw, int i)
 {
-        struct in6_addr *dest, *src;
+        const struct in6_addr *dest, *src;
         __u16 destp, srcp;
         struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
         int ttd = tw->tw_ttd - jiffies;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 9e305d74b3d4..fc0c42a88e54 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -311,7 +311,7 @@ static struct sock *__udp6_lib_lookup_skb(struct sk_buff *skb,
                                           struct udp_table *udptable)
 {
         struct sock *sk;
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
 
         if (unlikely(sk = skb_steal_sock(skb)))
                 return sk;
@@ -463,9 +463,9 @@ void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                     struct udp_table *udptable)
 {
         struct ipv6_pinfo *np;
-        struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
-        struct in6_addr *saddr = &hdr->saddr;
-        struct in6_addr *daddr = &hdr->daddr;
+        const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
+        const struct in6_addr *saddr = &hdr->saddr;
+        const struct in6_addr *daddr = &hdr->daddr;
         struct udphdr *uh = (struct udphdr*)(skb->data+offset);
         struct sock *sk;
         int err;
@@ -553,8 +553,8 @@ drop_no_sk_drops_inc:
 }
 
 static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
-                                      __be16 loc_port, struct in6_addr *loc_addr,
-                                      __be16 rmt_port, struct in6_addr *rmt_addr,
+                                      __be16 loc_port, const struct in6_addr *loc_addr,
+                                      __be16 rmt_port, const struct in6_addr *rmt_addr,
                                       int dif)
 {
         struct hlist_nulls_node *node;
@@ -633,7 +633,7 @@ drop:
  * so we don't need to lock the hashes.
  */
 static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
-                struct in6_addr *saddr, struct in6_addr *daddr,
+                const struct in6_addr *saddr, const struct in6_addr *daddr,
                 struct udp_table *udptable)
 {
         struct sock *sk, *stack[256 / sizeof(struct sock *)];
@@ -716,7 +716,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         struct net *net = dev_net(skb->dev);
         struct sock *sk;
         struct udphdr *uh;
-        struct in6_addr *saddr, *daddr;
+        const struct in6_addr *saddr, *daddr;
         u32 ulen = 0;
 
         if (!pskb_may_pull(skb, sizeof(struct udphdr)))
@@ -1278,7 +1278,7 @@ int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
 
 static int udp6_ufo_send_check(struct sk_buff *skb)
 {
-        struct ipv6hdr *ipv6h;
+        const struct ipv6hdr *ipv6h;
         struct udphdr *uh;
 
         if (!pskb_may_pull(skb, sizeof(*uh)))
@@ -1328,7 +1328,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features)
         /* Do software UFO. Complete and fill in the UDP checksum as HW cannot
          * do checksum of UDP packets sent as multiple IP fragments.
          */
-        offset = skb->csum_start - skb_headroom(skb);
+        offset = skb_checksum_start_offset(skb);
         csum = skb_checksum(skb, offset, skb->len- offset, 0);
         offset += skb->csum_offset;
         *(__sum16 *)(skb->data + offset) = csum_fold(csum);
@@ -1382,7 +1382,7 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
 {
         struct inet_sock *inet = inet_sk(sp);
         struct ipv6_pinfo *np = inet6_sk(sp);
-        struct in6_addr *dest, *src;
+        const struct in6_addr *dest, *src;
         __u16 destp, srcp;
 
         dest  = &np->daddr;
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index bbd48b101bae..3437d7d4eed6 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -41,10 +41,8 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         struct ipv6hdr *top_iph;
         struct ip_beet_phdr *ph;
-        struct iphdr *iphv4;
         int optlen, hdr_len;
 
-        iphv4 = ip_hdr(skb);
         hdr_len = 0;
         optlen = XFRM_MODE_SKB_CB(skb)->optlen;
         if (unlikely(optlen))
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 645cb968d450..4d6edff0498f 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -20,7 +20,7 @@
 
 static inline void ipip6_ecn_decapsulate(struct sk_buff *skb)
 {
-        struct ipv6hdr *outer_iph = ipv6_hdr(skb);
+        const struct ipv6hdr *outer_iph = ipv6_hdr(skb);
         struct ipv6hdr *inner_iph = ipipv6_hdr(skb);
 
         if (INET_ECN_is_ce(ipv6_get_dsfield(outer_iph)))
@@ -55,8 +55,8 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
                 dsfield &= ~INET_ECN_MASK;
         ipv6_change_dsfield(top_iph, 0, dsfield);
         top_iph->hop_limit = ip6_dst_hoplimit(dst->child);
-        ipv6_addr_copy(&top_iph->saddr, (struct in6_addr *)&x->props.saddr);
-        ipv6_addr_copy(&top_iph->daddr, (struct in6_addr *)&x->id.daddr);
+        ipv6_addr_copy(&top_iph->saddr, (const struct in6_addr *)&x->props.saddr);
+        ipv6_addr_copy(&top_iph->daddr, (const struct in6_addr *)&x->id.daddr);
         return 0;
 }
 
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 05e34c8ec913..d879f7efbd10 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -124,7 +124,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
         struct flowi6 *fl6 = &fl->u.ip6;
         int onlyproto = 0;
         u16 offset = skb_network_header_len(skb);
-        struct ipv6hdr *hdr = ipv6_hdr(skb);
+        const struct ipv6hdr *hdr = ipv6_hdr(skb);
         struct ipv6_opt_hdr *exthdr;
         const unsigned char *nh = skb_network_header(skb);
         u8 nexthdr = nh[IP6CB(skb)->nhoff];
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 2969cad408de..a6770a04e3bd 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -68,7 +68,7 @@ static DEFINE_SPINLOCK(xfrm6_tunnel_spi_lock);
 
 static struct kmem_cache *xfrm6_tunnel_spi_kmem __read_mostly;
 
-static inline unsigned xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
+static inline unsigned xfrm6_tunnel_spi_hash_byaddr(const xfrm_address_t *addr)
 {
         unsigned h;
 
@@ -85,7 +85,7 @@ static inline unsigned xfrm6_tunnel_spi_hash_byspi(u32 spi)
         return spi % XFRM6_TUNNEL_SPI_BYSPI_HSIZE;
 }
 
-static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr)
+static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr)
 {
         struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
         struct xfrm6_tunnel_spi *x6spi;
@@ -101,7 +101,7 @@ static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(struct net *net, xfrm_
         return NULL;
 }
 
-__be32 xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr)
+__be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr)
 {
         struct xfrm6_tunnel_spi *x6spi;
         u32 spi;
@@ -237,10 +237,10 @@ static int xfrm6_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_tunnel_rcv(struct sk_buff *skb)
 {
         struct net *net = dev_net(skb->dev);
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
         __be32 spi;
 
-        spi = xfrm6_tunnel_spi_lookup(net, (xfrm_address_t *)&iph->saddr);
+        spi = xfrm6_tunnel_spi_lookup(net, (const xfrm_address_t *)&iph->saddr);
         return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi) > 0 ? : 0;
 }
 
diff --git a/net/irda/irlap_event.c b/net/irda/irlap_event.c
index bb47021c9a55..ccd214f9d196 100644
--- a/net/irda/irlap_event.c
+++ b/net/irda/irlap_event.c
@@ -2227,8 +2227,6 @@ static int irlap_state_nrm_s(struct irlap_cb *self, IRLAP_EVENT event,
 static int irlap_state_sclose(struct irlap_cb *self, IRLAP_EVENT event,
                               struct sk_buff *skb, struct irlap_info *info)
 {
-        int ret = 0;
-
         IRDA_DEBUG(1, "%s()\n", __func__);
 
         IRDA_ASSERT(self != NULL, return -ENODEV;);
@@ -2289,7 +2287,6 @@ static int irlap_state_sclose(struct irlap_cb *self, IRLAP_EVENT event,
                 IRDA_DEBUG(1, "%s(), Unknown event %d, (%s)\n", __func__,
                            event, irlap_event[event]);
 
-                ret = -EINVAL;
                 break;
         }
 
diff --git a/net/irda/irproc.c b/net/irda/irproc.c
index 318766e5dbdf..b9ac598e2116 100644
--- a/net/irda/irproc.c
+++ b/net/irda/irproc.c
@@ -65,15 +65,14 @@ static const struct irda_entry irda_dirs[] = {
 void __init irda_proc_register(void)
 {
         int i;
-        struct proc_dir_entry *d;
 
         proc_irda = proc_mkdir("irda", init_net.proc_net);
         if (proc_irda == NULL)
                 return;
 
         for (i = 0; i < ARRAY_SIZE(irda_dirs); i++)
-                d = proc_create(irda_dirs[i].name, 0, proc_irda,
-                                irda_dirs[i].fops);
+                (void) proc_create(irda_dirs[i].name, 0, proc_irda,
+                                   irda_dirs[i].fops);
 }
 
 /*
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 7db86ffcf070..d62401c25684 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -712,7 +712,7 @@ static unsigned int pfkey_sockaddr_fill(const xfrm_address_t *xaddr, __be16 port
                 sin6->sin6_family = AF_INET6;
                 sin6->sin6_port = port;
                 sin6->sin6_flowinfo = 0;
-                ipv6_addr_copy(&sin6->sin6_addr, (struct in6_addr *)xaddr->a6);
+                ipv6_addr_copy(&sin6->sin6_addr, (const struct in6_addr *)xaddr->a6);
                 sin6->sin6_scope_id = 0;
                 return 128;
             }
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index fce9bd3bd3fe..81899600abe2 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -296,12 +296,12 @@ out_in_use:
 
 static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
-        int rc;
-        struct inet_sock *inet = inet_sk(sk);
         struct sockaddr_l2tpip *lsa = (struct sockaddr_l2tpip *) uaddr;
+        struct inet_sock *inet = inet_sk(sk);
+        struct flowi4 fl4;
         struct rtable *rt;
         __be32 saddr;
-        int oif;
+        int oif, rc;
 
         rc = -EINVAL;
         if (addr_len < sizeof(*lsa))
@@ -320,7 +320,7 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
         if (ipv4_is_multicast(lsa->l2tp_addr.s_addr))
                 goto out;
 
-        rt = ip_route_connect(lsa->l2tp_addr.s_addr, saddr,
+        rt = ip_route_connect(&fl4, lsa->l2tp_addr.s_addr, saddr,
                               RT_CONN_FLAGS(sk), oif,
                               IPPROTO_L2TP,
                               0, 0, sk, true);
@@ -340,10 +340,10 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
         l2tp_ip_sk(sk)->peer_conn_id = lsa->l2tp_conn_id;
 
         if (!inet->inet_saddr)
-                inet->inet_saddr = rt->rt_src;
+                inet->inet_saddr = fl4.saddr;
         if (!inet->inet_rcv_saddr)
-                inet->inet_rcv_saddr = rt->rt_src;
-        inet->inet_daddr = rt->rt_dst;
+                inet->inet_rcv_saddr = fl4.saddr;
+        inet->inet_daddr = fl4.daddr;
         sk->sk_state = TCP_ESTABLISHED;
         inet->inet_id = jiffies;
 
@@ -416,7 +416,6 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
         int rc;
         struct l2tp_ip_sock *lsa = l2tp_ip_sk(sk);
         struct inet_sock *inet = inet_sk(sk);
-        struct ip_options *opt = inet->opt;
         struct rtable *rt = NULL;
         int connected = 0;
         __be32 daddr;
@@ -471,15 +470,23 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
                 rt = (struct rtable *) __sk_dst_check(sk, 0);
 
         if (rt == NULL) {
+                struct ip_options_rcu *inet_opt;
+                struct flowi4 fl4;
+
+                rcu_read_lock();
+                inet_opt = rcu_dereference(inet->inet_opt);
+
                 /* Use correct destination address if we have options. */
-                if (opt && opt->srr)
-                        daddr = opt->faddr;
+                if (inet_opt && inet_opt->opt.srr)
+                        daddr = inet_opt->opt.faddr;
+
+                rcu_read_unlock();
 
                 /* If this fails, retransmit mechanism of transport layer will
                  * keep trying until route appears or the connection times
                  * itself out.
                  */
-                rt = ip_route_output_ports(sock_net(sk), sk,
+                rt = ip_route_output_ports(sock_net(sk), &fl4, sk,
                                            daddr, inet->inet_saddr,
                                            inet->inet_dport, inet->inet_sport,
                                            sk->sk_protocol, RT_CONN_FLAGS(sk),
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index 4c1e540732d7..93a41a09458b 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -795,11 +795,12 @@ int l2tp_nl_register_ops(enum l2tp_pwtype pw_type, const struct l2tp_nl_cmd_ops
                 goto out;
 
         l2tp_nl_cmd_ops[pw_type] = ops;
+        ret = 0;
 
 out:
         genl_unlock();
 err:
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(l2tp_nl_register_ops);
 
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 513f85cc2ae1..f5fdfcbf552a 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -2,7 +2,6 @@ config MAC80211
         tristate "Generic IEEE 802.11 Networking Stack (mac80211)"
         depends on CFG80211
         select CRYPTO
-        select CRYPTO_ECB
         select CRYPTO_ARC4
         select CRYPTO_AES
         select CRC32
diff --git a/net/mac80211/aes_ccm.c b/net/mac80211/aes_ccm.c
index 4bd6ef0be380..b9b595c08112 100644
--- a/net/mac80211/aes_ccm.c
+++ b/net/mac80211/aes_ccm.c
@@ -54,13 +54,12 @@ void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *scratch,
                                u8 *cdata, u8 *mic)
 {
         int i, j, last_len, num_blocks;
-        u8 *pos, *cpos, *b, *s_0, *e, *b_0, *aad;
+        u8 *pos, *cpos, *b, *s_0, *e, *b_0;
 
         b = scratch;
         s_0 = scratch + AES_BLOCK_LEN;
         e = scratch + 2 * AES_BLOCK_LEN;
         b_0 = scratch + 3 * AES_BLOCK_LEN;
-        aad = scratch + 4 * AES_BLOCK_LEN;
 
         num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_LEN);
         last_len = data_len % AES_BLOCK_LEN;
@@ -94,13 +93,12 @@ int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *scratch,
                               u8 *cdata, size_t data_len, u8 *mic, u8 *data)
 {
         int i, j, last_len, num_blocks;
-        u8 *pos, *cpos, *b, *s_0, *a, *b_0, *aad;
+        u8 *pos, *cpos, *b, *s_0, *a, *b_0;
 
         b = scratch;
         s_0 = scratch + AES_BLOCK_LEN;
         a = scratch + 2 * AES_BLOCK_LEN;
         b_0 = scratch + 3 * AES_BLOCK_LEN;
-        aad = scratch + 4 * AES_BLOCK_LEN;
 
         num_blocks = DIV_ROUND_UP(data_len, AES_BLOCK_LEN);
         last_len = data_len % AES_BLOCK_LEN;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 44049733c4ea..12d52cec9515 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -330,6 +330,7 @@ static void rate_idx_to_bitrate(struct rate_info *rate, struct sta_info *sta, in
 static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct timespec uptime;
 
         sinfo->generation = sdata->local->sta_generation;
 
@@ -342,7 +343,12 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                         STATION_INFO_TX_FAILED |
                         STATION_INFO_TX_BITRATE |
                         STATION_INFO_RX_BITRATE |
-                        STATION_INFO_RX_DROP_MISC;
+                        STATION_INFO_RX_DROP_MISC |
+                        STATION_INFO_BSS_PARAM |
+                        STATION_INFO_CONNECTED_TIME;
+
+        do_posix_clock_monotonic_gettime(&uptime);
+        sinfo->connected_time = uptime.tv_sec - sta->last_connected;
 
         sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
         sinfo->rx_bytes = sta->rx_bytes;
@@ -389,6 +395,16 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                 sinfo->plink_state = sta->plink_state;
 #endif
         }
+
+        sinfo->bss_param.flags = 0;
+        if (sdata->vif.bss_conf.use_cts_prot)
+                sinfo->bss_param.flags |= BSS_PARAM_FLAGS_CTS_PROT;
+        if (sdata->vif.bss_conf.use_short_preamble)
+                sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
+        if (sdata->vif.bss_conf.use_short_slot)
+                sinfo->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
+        sinfo->bss_param.dtim_period = sdata->local->hw.conf.ps_dtim_period;
+        sinfo->bss_param.beacon_interval = sdata->vif.bss_conf.beacon_int;
 }
 
 
@@ -675,6 +691,12 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                 if (set & BIT(NL80211_STA_FLAG_MFP))
                         sta->flags |= WLAN_STA_MFP;
         }
+
+        if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED)) {
+                sta->flags &= ~WLAN_STA_AUTH;
+                if (set & BIT(NL80211_STA_FLAG_AUTHENTICATED))
+                        sta->flags |= WLAN_STA_AUTH;
+        }
         spin_unlock_irqrestore(&sta->flaglock, flags);
 
         /*
@@ -1023,26 +1045,26 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
         u8 *new_ie;
         const u8 *old_ie;
 
-        /* first allocate the new vendor information element */
+        /* allocate information elements */
         new_ie = NULL;
-        old_ie = ifmsh->vendor_ie;
+        old_ie = ifmsh->ie;
 
-        ifmsh->vendor_ie_len = setup->vendor_ie_len;
-        if (setup->vendor_ie_len) {
-                new_ie = kmemdup(setup->vendor_ie, setup->vendor_ie_len,
+        if (setup->ie_len) {
+                new_ie = kmemdup(setup->ie, setup->ie_len,
                                 GFP_KERNEL);
                 if (!new_ie)
                         return -ENOMEM;
         }
+        ifmsh->ie_len = setup->ie_len;
+        ifmsh->ie = new_ie;
+        kfree(old_ie);
 
         /* now copy the rest of the setup parameters */
         ifmsh->mesh_id_len = setup->mesh_id_len;
         memcpy(ifmsh->mesh_id, setup->mesh_id, ifmsh->mesh_id_len);
         ifmsh->mesh_pp_id = setup->path_sel_proto;
         ifmsh->mesh_pm_id = setup->path_metric;
-        ifmsh->vendor_ie = new_ie;
-
-        kfree(old_ie);
+        ifmsh->is_secure = setup->is_secure;
 
         return 0;
 }
@@ -1611,16 +1633,13 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        int i;
-
-        /*
-         * This _could_ be supported by providing a hook for
-         * drivers for this function, but at this point it
-         * doesn't seem worth bothering.
-         */
-        if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
-                return -EOPNOTSUPP;
+        int i, ret;
 
+        if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
+                ret = drv_set_bitrate_mask(local, sdata, mask);
+                if (ret)
+                        return ret;
+        }
 
         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
                 sdata->rc_rateidx_mask[i] = mask->control[i].legacy;
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 51f0d780dafa..0a602dbfdb2b 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -37,7 +37,7 @@ int mac80211_format_buffer(char __user *userbuf, size_t count,
         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
 }
 
-#define DEBUGFS_READONLY_FILE(name, fmt, value...)                      \
+#define DEBUGFS_READONLY_FILE_FN(name, fmt, value...)                   \
 static ssize_t name## _read(struct file *file, char __user *userbuf,    \
                             size_t count, loff_t *ppos)                 \
 {                                                                       \
@@ -45,14 +45,19 @@ static ssize_t name## _read(struct file *file, char __user *userbuf,	\
                                                                         \
         return mac80211_format_buffer(userbuf, count, ppos,             \
                                       fmt "\n", ##value);               \
-}                                                                       \
-                                                                        \
+}
+
+#define DEBUGFS_READONLY_FILE_OPS(name)                 \
 static const struct file_operations name## _ops = {                     \
         .read = name## _read,                                           \
         .open = mac80211_open_file_generic,                             \
         .llseek = generic_file_llseek,                                  \
 };
 
+#define DEBUGFS_READONLY_FILE(name, fmt, value...)              \
+        DEBUGFS_READONLY_FILE_FN(name, fmt, value)              \
+        DEBUGFS_READONLY_FILE_OPS(name)
+
 #define DEBUGFS_ADD(name)                                               \
         debugfs_create_file(#name, 0400, phyd, local, &name## _ops);
 
@@ -291,11 +296,70 @@ static ssize_t channel_type_read(struct file *file, char __user *user_buf,
         return simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf));
 }
 
-static const struct file_operations channel_type_ops = {
-        .read = channel_type_read,
-        .open = mac80211_open_file_generic,
-        .llseek = default_llseek,
-};
+static ssize_t hwflags_read(struct file *file, char __user *user_buf,
+                            size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        int mxln = 500;
+        ssize_t rv;
+        char *buf = kzalloc(mxln, GFP_KERNEL);
+        int sf = 0; /* how many written so far */
+
+        sf += snprintf(buf, mxln - sf, "0x%x\n", local->hw.flags);
+        if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
+                sf += snprintf(buf + sf, mxln - sf, "HAS_RATE_CONTROL\n");
+        if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
+                sf += snprintf(buf + sf, mxln - sf, "RX_INCLUDES_FCS\n");
+        if (local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING)
+                sf += snprintf(buf + sf, mxln - sf,
+                               "HOST_BCAST_PS_BUFFERING\n");
+        if (local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE)
+                sf += snprintf(buf + sf, mxln - sf,
+                               "2GHZ_SHORT_SLOT_INCAPABLE\n");
+        if (local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE)
+                sf += snprintf(buf + sf, mxln - sf,
+                               "2GHZ_SHORT_PREAMBLE_INCAPABLE\n");
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
+                sf += snprintf(buf + sf, mxln - sf, "SIGNAL_UNSPEC\n");
+        if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
+                sf += snprintf(buf + sf, mxln - sf, "SIGNAL_DBM\n");
+        if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD)
+                sf += snprintf(buf + sf, mxln - sf, "NEED_DTIM_PERIOD\n");
+        if (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT)
+                sf += snprintf(buf + sf, mxln - sf, "SPECTRUM_MGMT\n");
+        if (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)
+                sf += snprintf(buf + sf, mxln - sf, "AMPDU_AGGREGATION\n");
+        if (local->hw.flags & IEEE80211_HW_SUPPORTS_PS)
+                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_PS\n");
+        if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
+                sf += snprintf(buf + sf, mxln - sf, "PS_NULLFUNC_STACK\n");
+        if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
+                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_DYNAMIC_PS\n");
+        if (local->hw.flags & IEEE80211_HW_MFP_CAPABLE)
+                sf += snprintf(buf + sf, mxln - sf, "MFP_CAPABLE\n");
+        if (local->hw.flags & IEEE80211_HW_BEACON_FILTER)
+                sf += snprintf(buf + sf, mxln - sf, "BEACON_FILTER\n");
+        if (local->hw.flags & IEEE80211_HW_SUPPORTS_STATIC_SMPS)
+                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_STATIC_SMPS\n");
+        if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS)
+                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_DYNAMIC_SMPS\n");
+        if (local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)
+                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_UAPSD\n");
+        if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                sf += snprintf(buf + sf, mxln - sf, "REPORTS_TX_ACK_STATUS\n");
+        if (local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
+                sf += snprintf(buf + sf, mxln - sf, "CONNECTION_MONITOR\n");
+        if (local->hw.flags & IEEE80211_HW_SUPPORTS_CQM_RSSI)
+                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_CQM_RSSI\n");
+        if (local->hw.flags & IEEE80211_HW_SUPPORTS_PER_STA_GTK)
+                sf += snprintf(buf + sf, mxln - sf, "SUPPORTS_PER_STA_GTK\n");
+        if (local->hw.flags & IEEE80211_HW_AP_LINK_PS)
+                sf += snprintf(buf + sf, mxln - sf, "AP_LINK_PS\n");
+
+        rv = simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf));
+        kfree(buf);
+        return rv;
+}
 
 static ssize_t queues_read(struct file *file, char __user *user_buf,
                            size_t count, loff_t *ppos)
@@ -315,11 +379,9 @@ static ssize_t queues_read(struct file *file, char __user *user_buf,
         return simple_read_from_buffer(user_buf, count, ppos, buf, res);
 }
 
-static const struct file_operations queues_ops = {
-        .read = queues_read,
-        .open = mac80211_open_file_generic,
-        .llseek = default_llseek,
-};
+DEBUGFS_READONLY_FILE_OPS(hwflags);
+DEBUGFS_READONLY_FILE_OPS(channel_type);
+DEBUGFS_READONLY_FILE_OPS(queues);
 
 /* statistics stuff */
 
@@ -395,6 +457,7 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_ADD(uapsd_queues);
         DEBUGFS_ADD(uapsd_max_sp_len);
         DEBUGFS_ADD(channel_type);
+        DEBUGFS_ADD(hwflags);
         DEBUGFS_ADD(user_power);
         DEBUGFS_ADD(power);
 
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index c04a1396cf8d..a01d2137fddc 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -92,6 +92,31 @@ static ssize_t sta_inactive_ms_read(struct file *file, char __user *userbuf,
 }
 STA_OPS(inactive_ms);
 
+
+static ssize_t sta_connected_time_read(struct file *file, char __user *userbuf,
+                                        size_t count, loff_t *ppos)
+{
+        struct sta_info *sta = file->private_data;
+        struct timespec uptime;
+        struct tm result;
+        long connected_time_secs;
+        char buf[100];
+        int res;
+        do_posix_clock_monotonic_gettime(&uptime);
+        connected_time_secs = uptime.tv_sec - sta->last_connected;
+        time_to_tm(connected_time_secs, 0, &result);
+        result.tm_year -= 70;
+        result.tm_mday -= 1;
+        res = scnprintf(buf, sizeof(buf),
+                "years  - %ld\nmonths - %d\ndays   - %d\nclock  - %d:%d:%d\n\n",
+                        result.tm_year, result.tm_mon, result.tm_mday,
+                        result.tm_hour, result.tm_min, result.tm_sec);
+        return simple_read_from_buffer(userbuf, count, ppos, buf, res);
+}
+STA_OPS(connected_time);
+
+
+
 static ssize_t sta_last_seq_ctrl_read(struct file *file, char __user *userbuf,
                                       size_t count, loff_t *ppos)
 {
@@ -324,6 +349,7 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
         DEBUGFS_ADD(flags);
         DEBUGFS_ADD(num_ps_buf_frames);
         DEBUGFS_ADD(inactive_ms);
+        DEBUGFS_ADD(connected_time);
         DEBUGFS_ADD(last_seq_ctrl);
         DEBUGFS_ADD(agg_status);
         DEBUGFS_ADD(dev);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 9c0d62bb0ea3..2ddb56e5b51f 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -552,4 +552,35 @@ static inline void drv_get_ringparam(struct ieee80211_local *local,
         trace_drv_return_void(local);
 }
 
+static inline bool drv_tx_frames_pending(struct ieee80211_local *local)
+{
+        bool ret = false;
+
+        might_sleep();
+
+        trace_drv_tx_frames_pending(local);
+        if (local->ops->tx_frames_pending)
+                ret = local->ops->tx_frames_pending(&local->hw);
+        trace_drv_return_bool(local, ret);
+
+        return ret;
+}
+
+static inline int drv_set_bitrate_mask(struct ieee80211_local *local,
+                                       struct ieee80211_sub_if_data *sdata,
+                                       const struct cfg80211_bitrate_mask *mask)
+{
+        int ret = -EOPNOTSUPP;
+
+        might_sleep();
+
+        trace_drv_set_bitrate_mask(local, sdata, mask);
+        if (local->ops->set_bitrate_mask)
+                ret = local->ops->set_bitrate_mask(&local->hw,
+                                                   &sdata->vif, mask);
+        trace_drv_return_int(local, ret);
+
+        return ret;
+}
+
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 45aab80738e2..191e834ec46b 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -74,6 +74,21 @@ TRACE_EVENT(drv_return_int,
         TP_printk(LOCAL_PR_FMT " - %d", LOCAL_PR_ARG, __entry->ret)
 );
 
+TRACE_EVENT(drv_return_bool,
+        TP_PROTO(struct ieee80211_local *local, bool ret),
+        TP_ARGS(local, ret),
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(bool, ret)
+        ),
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+        TP_printk(LOCAL_PR_FMT " - %s", LOCAL_PR_ARG, (__entry->ret) ?
+                  "true" : "false")
+);
+
 TRACE_EVENT(drv_return_u64,
         TP_PROTO(struct ieee80211_local *local, u64 ret),
         TP_ARGS(local, ret),
@@ -964,11 +979,43 @@ TRACE_EVENT(drv_get_ringparam,
         )
 );
 
+DEFINE_EVENT(local_only_evt, drv_tx_frames_pending,
+        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
+);
+
 DEFINE_EVENT(local_only_evt, drv_offchannel_tx_cancel_wait,
         TP_PROTO(struct ieee80211_local *local),
         TP_ARGS(local)
 );
 
+TRACE_EVENT(drv_set_bitrate_mask,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 const struct cfg80211_bitrate_mask *mask),
+
+        TP_ARGS(local, sdata, mask),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __field(u32, legacy_2g)
+                __field(u32, legacy_5g)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                __entry->legacy_2g = mask->control[IEEE80211_BAND_2GHZ].legacy;
+                __entry->legacy_5g = mask->control[IEEE80211_BAND_5GHZ].legacy;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT " 2G Mask:0x%x 5G Mask:0x%x",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->legacy_2g, __entry->legacy_5g
+        )
+);
+
 /*
  * Tracing for API calls that drivers call.
  */
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 3e81af1fce58..b81860c94698 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -40,7 +40,7 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
                                         struct ieee80211_mgmt *mgmt,
                                         size_t len)
 {
-        u16 auth_alg, auth_transaction, status_code;
+        u16 auth_alg, auth_transaction;
 
         lockdep_assert_held(&sdata->u.ibss.mtx);
 
@@ -49,7 +49,6 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
 
         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
-        status_code = le16_to_cpu(mgmt->u.auth.status_code);
 
         /*
          * IEEE 802.11 standard does not require authentication in IBSS
@@ -527,8 +526,6 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
 static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_supported_band *sband;
         u8 bssid[ETH_ALEN];
         u16 capability;
         int i;
@@ -551,8 +548,6 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %pM\n",
                sdata->name, bssid);
 
-        sband = local->hw.wiphy->bands[ifibss->channel->band];
-
         capability = WLAN_CAPABILITY_IBSS;
 
         if (ifibss->privacy)
@@ -661,7 +656,6 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
 static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
                                         struct sk_buff *req)
 {
-        struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(req);
         struct ieee80211_mgmt *mgmt = (void *)req->data;
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
@@ -685,7 +679,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
                mgmt->bssid, tx_last_beacon);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
-        if (!tx_last_beacon && !(rx_status->rx_flags & IEEE80211_RX_RA_MATCH))
+        if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
                 return;
 
         if (memcmp(mgmt->bssid, ifibss->bssid, ETH_ALEN) != 0 &&
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c18396c248d7..027c0467d7a3 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -488,8 +488,9 @@ struct ieee80211_if_mesh {
         struct mesh_config mshcfg;
         u32 mesh_seqnum;
         bool accepting_plinks;
-        const u8 *vendor_ie;
-        u8 vendor_ie_len;
+        const u8 *ie;
+        u8 ie_len;
+        bool is_secure;
 };
 
 #ifdef CONFIG_MAC80211_MESH
@@ -765,6 +766,9 @@ struct ieee80211_local {
 
         int tx_headroom; /* required headroom for hardware/radiotap */
 
+        /* count for keys needing tailroom space allocation */
+        int crypto_tx_tailroom_needed_cnt;
+
         /* Tasklet and skb queue to process calls from IRQ mode. All frames
          * added to skb_queue will be processed, but frames in
          * skb_queue_unreliable may be dropped if the total length of these
@@ -809,8 +813,8 @@ struct ieee80211_local {
 
         struct rate_control_ref *rate_ctrl;
 
-        struct crypto_blkcipher *wep_tx_tfm;
-        struct crypto_blkcipher *wep_rx_tfm;
+        struct crypto_cipher *wep_tx_tfm;
+        struct crypto_cipher *wep_rx_tfm;
         u32 wep_iv;
 
         /* see iface.c */
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 4054399be907..80c29d626aa4 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1144,10 +1144,6 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                                 + IEEE80211_ENCRYPT_HEADROOM;
         ndev->needed_tailroom = IEEE80211_ENCRYPT_TAILROOM;
 
-        ret = dev_alloc_name(ndev, ndev->name);
-        if (ret < 0)
-                goto fail;
-
         ieee80211_assign_perm_addr(local, ndev, type);
         memcpy(ndev->dev_addr, ndev->perm_addr, ETH_ALEN);
         SET_NETDEV_DEV(ndev, wiphy_dev(local->hw.wiphy));
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index af3c56482c80..b510721e3b3d 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -101,6 +101,11 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
 
         if (!ret) {
                 key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
+
+                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)))
+                        key->local->crypto_tx_tailroom_needed_cnt--;
+
                 return 0;
         }
 
@@ -156,6 +161,10 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                           key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
 
         key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
+
+        if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+              (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV)))
+                key->local->crypto_tx_tailroom_needed_cnt++;
 }
 
 void ieee80211_key_removed(struct ieee80211_key_conf *key_conf)
@@ -388,8 +397,10 @@ static void __ieee80211_key_destroy(struct ieee80211_key *key)
                 ieee80211_aes_key_free(key->u.ccmp.tfm);
         if (key->conf.cipher == WLAN_CIPHER_SUITE_AES_CMAC)
                 ieee80211_aes_cmac_key_free(key->u.aes_cmac.tfm);
-        if (key->local)
+        if (key->local) {
                 ieee80211_debugfs_key_remove(key);
+                key->local->crypto_tx_tailroom_needed_cnt--;
+        }
 
         kfree(key);
 }
@@ -451,6 +462,8 @@ int ieee80211_key_link(struct ieee80211_key *key,
 
         ieee80211_debugfs_key_add(key);
 
+        key->local->crypto_tx_tailroom_needed_cnt++;
+
         ret = ieee80211_key_enable_hw_accel(key);
 
         mutex_unlock(&sdata->local->key_mtx);
@@ -492,8 +505,12 @@ void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
 
         mutex_lock(&sdata->local->key_mtx);
 
-        list_for_each_entry(key, &sdata->key_list, list)
+        sdata->local->crypto_tx_tailroom_needed_cnt = 0;
+
+        list_for_each_entry(key, &sdata->key_list, list) {
+                sdata->local->crypto_tx_tailroom_needed_cnt++;
                 ieee80211_key_enable_hw_accel(key);
+        }
 
         mutex_unlock(&sdata->local->key_mtx);
 }
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 562d2984c482..61877662e8f8 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -33,12 +33,6 @@
 #include "cfg.h"
 #include "debugfs.h"
 
-
-static bool ieee80211_disable_40mhz_24ghz;
-module_param(ieee80211_disable_40mhz_24ghz, bool, 0644);
-MODULE_PARM_DESC(ieee80211_disable_40mhz_24ghz,
-                 "Disable 40MHz support in the 2.4GHz band");
-
 static struct lock_class_key ieee80211_rx_skb_queue_class;
 
 void ieee80211_configure_filter(struct ieee80211_local *local)
@@ -545,7 +539,9 @@ ieee80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
         },
         [NL80211_IFTYPE_MESH_POINT] = {
                 .tx = 0xffff,
-                .rx = BIT(IEEE80211_STYPE_ACTION >> 4),
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                        BIT(IEEE80211_STYPE_AUTH >> 4) |
+                        BIT(IEEE80211_STYPE_DEAUTH >> 4),
         },
 };
 
@@ -726,18 +722,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 }
                 channels += sband->n_channels;
 
-                /*
-                 * Since ieee80211_disable_40mhz_24ghz is global, we can
-                 * modify the sband's ht data even if the driver uses a
-                 * global structure for that.
-                 */
-                if (ieee80211_disable_40mhz_24ghz &&
-                    band == IEEE80211_BAND_2GHZ &&
-                    sband->ht_cap.ht_supported) {
-                        sband->ht_cap.cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                        sband->ht_cap.cap &= ~IEEE80211_HT_CAP_SGI_40;
-                }
-
                 if (max_bitrates < sband->n_bitrates)
                         max_bitrates = sband->n_bitrates;
                 supp_ht = supp_ht || sband->ht_cap.ht_supported;
@@ -760,6 +744,11 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         local->hw.wiphy->interface_modes &= ~BIT(NL80211_IFTYPE_MESH_POINT);
 #endif
 
+        /* if the underlying driver supports mesh, mac80211 will (at least)
+         * provide routing of mesh authentication frames to userspace */
+        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_MESH_POINT))
+                local->hw.wiphy->flags |= WIPHY_FLAG_MESH_AUTH;
+
         /* mac80211 supports control port protocol changing */
         local->hw.wiphy->flags |= WIPHY_FLAG_CONTROL_PORT_PROTOCOL;
 
@@ -879,10 +868,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         local->dynamic_ps_forced_timeout = -1;
 
-        result = sta_info_start(local);
-        if (result < 0)
-                goto fail_sta_info;
-
         result = ieee80211_wep_init(local);
         if (result < 0)
                 wiphy_debug(local->hw.wiphy, "Failed to initialize wep: %d\n",
@@ -945,7 +930,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         rtnl_unlock();
         ieee80211_wep_free(local);
         sta_info_stop(local);
- fail_sta_info:
         destroy_workqueue(local->workqueue);
  fail_workqueue:
         wiphy_unregister(local->hw.wiphy);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 2a57cc02c618..c1299e249541 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -279,9 +279,9 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
             MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
         *pos++ = 0x00;
 
-        if (sdata->u.mesh.vendor_ie) {
-                int len = sdata->u.mesh.vendor_ie_len;
-                const u8 *data = sdata->u.mesh.vendor_ie;
+        if (sdata->u.mesh.ie) {
+                int len = sdata->u.mesh.ie_len;
+                const u8 *data = sdata->u.mesh.ie;
                 if (skb_tailroom(skb) > len)
                         memcpy(skb_put(skb, len), data, len);
         }
@@ -573,6 +573,10 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
         ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
                                &elems);
 
+        /* ignore beacons from secure mesh peers if our security is off */
+        if (elems.rsn_len && !sdata->u.mesh.is_secure)
+                return;
+
         if (elems.ds_params && elems.ds_params_len == 1)
                 freq = ieee80211_channel_to_frequency(elems.ds_params[0], band);
         else
@@ -586,9 +590,7 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
         if (elems.mesh_id && elems.mesh_config &&
             mesh_matches_local(&elems, sdata)) {
                 supp_rates = ieee80211_sta_get_rates(local, &elems, band);
-
-                mesh_neighbour_update(mgmt->sa, supp_rates, sdata,
-                                      mesh_peer_accepts_plinks(&elems));
+                mesh_neighbour_update(mgmt->sa, supp_rates, sdata, &elems);
         }
 }
 
@@ -611,12 +613,9 @@ void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                    struct sk_buff *skb)
 {
         struct ieee80211_rx_status *rx_status;
-        struct ieee80211_if_mesh *ifmsh;
         struct ieee80211_mgmt *mgmt;
         u16 stype;
 
-        ifmsh = &sdata->u.mesh;
-
         rx_status = IEEE80211_SKB_RXCB(skb);
         mgmt = (struct ieee80211_mgmt *) skb->data;
         stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index b99e230fe31c..10acf1cc8082 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -226,7 +226,8 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
 int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata);
 /* Mesh plinks */
 void mesh_neighbour_update(u8 *hw_addr, u32 rates,
-                struct ieee80211_sub_if_data *sdata, bool add);
+                struct ieee80211_sub_if_data *sdata,
+                struct ieee802_11_elems *ie);
 bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie);
 void mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata);
 void mesh_plink_broken(struct sta_info *sta);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 5bf64d7112b3..e57f2e728cfe 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -633,7 +633,6 @@ static void hwmp_perr_frame_process(struct ieee80211_sub_if_data *sdata,
         struct mesh_path *mpath;
         u8 ttl;
         u8 *ta, *target_addr;
-        u8 target_flags;
         u32 target_sn;
         u16 target_rcode;
 
@@ -644,7 +643,6 @@ static void hwmp_perr_frame_process(struct ieee80211_sub_if_data *sdata,
                 return;
         }
         ttl--;
-        target_flags = PERR_IE_TARGET_FLAGS(perr_elem);
         target_addr = PERR_IE_TARGET_ADDR(perr_elem);
         target_sn = PERR_IE_TARGET_SN(perr_elem);
         target_rcode = PERR_IE_TARGET_RCODE(perr_elem);
@@ -675,12 +673,10 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath;
-        u8 *ta;
         u8 ttl, flags, hopcount;
         u8 *orig_addr;
         u32 orig_sn, metric;
 
-        ta = mgmt->sa;
         ttl = rann->rann_ttl;
         if (ttl <= 1) {
                 ifmsh->mshstats.dropped_frames_ttl++;
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 336ca9d0c5c4..35c715adaae2 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -65,42 +65,37 @@ void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
         __mesh_table_free(tbl);
 }
 
-static struct mesh_table *mesh_table_grow(struct mesh_table *tbl)
+static int mesh_table_grow(struct mesh_table *oldtbl,
+                struct mesh_table *newtbl)
 {
-        struct mesh_table *newtbl;
         struct hlist_head *oldhash;
         struct hlist_node *p, *q;
         int i;
 
-        if (atomic_read(&tbl->entries)
-                        < tbl->mean_chain_len * (tbl->hash_mask + 1))
-                goto endgrow;
+        if (atomic_read(&oldtbl->entries)
+                        < oldtbl->mean_chain_len * (oldtbl->hash_mask + 1))
+                return -EAGAIN;
 
-        newtbl = mesh_table_alloc(tbl->size_order + 1);
-        if (!newtbl)
-                goto endgrow;
 
-        newtbl->free_node = tbl->free_node;
-        newtbl->mean_chain_len = tbl->mean_chain_len;
-        newtbl->copy_node = tbl->copy_node;
-        atomic_set(&newtbl->entries, atomic_read(&tbl->entries));
+        newtbl->free_node = oldtbl->free_node;
+        newtbl->mean_chain_len = oldtbl->mean_chain_len;
+        newtbl->copy_node = oldtbl->copy_node;
+        atomic_set(&newtbl->entries, atomic_read(&oldtbl->entries));
 
-        oldhash = tbl->hash_buckets;
-        for (i = 0; i <= tbl->hash_mask; i++)
+        oldhash = oldtbl->hash_buckets;
+        for (i = 0; i <= oldtbl->hash_mask; i++)
                 hlist_for_each(p, &oldhash[i])
-                        if (tbl->copy_node(p, newtbl) < 0)
+                        if (oldtbl->copy_node(p, newtbl) < 0)
                                 goto errcopy;
 
-        return newtbl;
+        return 0;
 
 errcopy:
         for (i = 0; i <= newtbl->hash_mask; i++) {
                 hlist_for_each_safe(p, q, &newtbl->hash_buckets[i])
-                        tbl->free_node(p, 0);
+                        oldtbl->free_node(p, 0);
         }
-        __mesh_table_free(newtbl);
-endgrow:
-        return NULL;
+        return -ENOMEM;
 }
 
 
@@ -334,10 +329,13 @@ void mesh_mpath_table_grow(void)
 {
         struct mesh_table *oldtbl, *newtbl;
 
+        newtbl = mesh_table_alloc(mesh_paths->size_order + 1);
+        if (!newtbl)
+                return;
         write_lock(&pathtbl_resize_lock);
         oldtbl = mesh_paths;
-        newtbl = mesh_table_grow(mesh_paths);
-        if (!newtbl) {
+        if (mesh_table_grow(mesh_paths, newtbl) < 0) {
+                __mesh_table_free(newtbl);
                 write_unlock(&pathtbl_resize_lock);
                 return;
         }
@@ -352,10 +350,13 @@ void mesh_mpp_table_grow(void)
 {
         struct mesh_table *oldtbl, *newtbl;
 
+        newtbl = mesh_table_alloc(mpp_paths->size_order + 1);
+        if (!newtbl)
+                return;
         write_lock(&pathtbl_resize_lock);
         oldtbl = mpp_paths;
-        newtbl = mesh_table_grow(mpp_paths);
-        if (!newtbl) {
+        if (mesh_table_grow(mpp_paths, newtbl) < 0) {
+                __mesh_table_free(newtbl);
                 write_unlock(&pathtbl_resize_lock);
                 return;
         }
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 44b53931ba5e..84e5b056af02 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -105,7 +105,7 @@ static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
         if (!sta)
                 return NULL;
 
-        sta->flags = WLAN_STA_AUTHORIZED;
+        sta->flags = WLAN_STA_AUTHORIZED | WLAN_STA_AUTH;
         sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
         rate_control_rate_init(sta);
 
@@ -161,7 +161,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 __le16 reason) {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400 +
-                        sdata->u.mesh.vendor_ie_len);
+                        sdata->u.mesh.ie_len);
         struct ieee80211_mgmt *mgmt;
         bool include_plid = false;
         static const u8 meshpeeringproto[] = { 0x00, 0x0F, 0xAC, 0x2A };
@@ -237,8 +237,9 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-void mesh_neighbour_update(u8 *hw_addr, u32 rates, struct ieee80211_sub_if_data *sdata,
-                           bool peer_accepting_plinks)
+void mesh_neighbour_update(u8 *hw_addr, u32 rates,
+                struct ieee80211_sub_if_data *sdata,
+                struct ieee802_11_elems *elems)
 {
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
@@ -248,8 +249,14 @@ void mesh_neighbour_update(u8 *hw_addr, u32 rates, struct ieee80211_sub_if_data
         sta = sta_info_get(sdata, hw_addr);
         if (!sta) {
                 rcu_read_unlock();
-
-                sta = mesh_plink_alloc(sdata, hw_addr, rates);
+                /* Userspace handles peer allocation when security is enabled
+                 * */
+                if (sdata->u.mesh.is_secure)
+                        cfg80211_notify_new_peer_candidate(sdata->dev, hw_addr,
+                                        elems->ie_start, elems->total_len,
+                                        GFP_KERNEL);
+                else
+                        sta = mesh_plink_alloc(sdata, hw_addr, rates);
                 if (!sta)
                         return;
                 if (sta_info_insert_rcu(sta)) {
@@ -260,7 +267,8 @@ void mesh_neighbour_update(u8 *hw_addr, u32 rates, struct ieee80211_sub_if_data
 
         sta->last_rx = jiffies;
         sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
-        if (peer_accepting_plinks && sta->plink_state == PLINK_LISTEN &&
+        if (mesh_peer_accepts_plinks(elems) &&
+                        sta->plink_state == PLINK_LISTEN &&
                         sdata->u.mesh.accepting_plinks &&
                         sdata->u.mesh.mshcfg.auto_open_plinks)
                 mesh_plink_open(sta);
@@ -372,6 +380,9 @@ int mesh_plink_open(struct sta_info *sta)
         __le16 llid;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
 
+        if (!test_sta_flags(sta, WLAN_STA_AUTH))
+                return -EPERM;
+
         spin_lock_bh(&sta->lock);
         get_random_bytes(&llid, 2);
         sta->llid = llid;
@@ -449,6 +460,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 mpl_dbg("Mesh plink: missing necessary peer link ie\n");
                 return;
         }
+        if (elems.rsn_len && !sdata->u.mesh.is_secure) {
+                mpl_dbg("Mesh plink: can't establish link with secure peer\n");
+                return;
+        }
 
         ftype = mgmt->u.action.u.plink_action.action_code;
         ie_len = elems.peer_link_len;
@@ -480,6 +495,12 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 return;
         }
 
+        if (sta && !test_sta_flags(sta, WLAN_STA_AUTH)) {
+                mpl_dbg("Mesh plink: Action frame from non-authed peer\n");
+                rcu_read_unlock();
+                return;
+        }
+
         if (sta && sta->plink_state == PLINK_BLOCKED) {
                 rcu_read_unlock();
                 return;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 64d92d5a7f40..a41f234bd486 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -90,20 +90,11 @@ enum rx_mgmt_action {
         /* no action required */
         RX_MGMT_NONE,
 
-        /* caller must call cfg80211_send_rx_auth() */
-        RX_MGMT_CFG80211_AUTH,
-
-        /* caller must call cfg80211_send_rx_assoc() */
-        RX_MGMT_CFG80211_ASSOC,
-
         /* caller must call cfg80211_send_deauth() */
         RX_MGMT_CFG80211_DEAUTH,
 
         /* caller must call cfg80211_send_disassoc() */
         RX_MGMT_CFG80211_DISASSOC,
-
-        /* caller must tell cfg80211 about internal error */
-        RX_MGMT_CFG80211_ASSOC_ERROR,
 };
 
 /* utils */
@@ -770,15 +761,16 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
         if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
             (!(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED))) {
                 netif_tx_stop_all_queues(sdata->dev);
-                /*
-                 * Flush all the frames queued in the driver before
-                 * going to power save
-                 */
-                drv_flush(local, false);
-                ieee80211_send_nullfunc(local, sdata, 1);
 
-                /* Flush once again to get the tx status of nullfunc frame */
-                drv_flush(local, false);
+                if (drv_tx_frames_pending(local))
+                        mod_timer(&local->dynamic_ps_timer, jiffies +
+                                  msecs_to_jiffies(
+                                  local->hw.conf.dynamic_ps_timeout));
+                else {
+                        ieee80211_send_nullfunc(local, sdata, 1);
+                        /* Flush to get the tx status of nullfunc frame */
+                        drv_flush(local, false);
+                }
         }
 
         if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index e37355193ed1..042461710880 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -14,12 +14,23 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
 
         ieee80211_scan_cancel(local);
 
+        if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
+                mutex_lock(&local->sta_mtx);
+                list_for_each_entry(sta, &local->sta_list, list) {
+                        set_sta_flags(sta, WLAN_STA_BLOCK_BA);
+                        ieee80211_sta_tear_down_BA_sessions(sta, true);
+                }
+                mutex_unlock(&local->sta_mtx);
+        }
+
         ieee80211_stop_queues_by_reason(hw,
                         IEEE80211_QUEUE_STOP_REASON_SUSPEND);
 
         /* flush out all packets */
         synchronize_net();
 
+        drv_flush(local, false);
+
         local->quiescing = true;
         /* make quiescing visible to timers everywhere */
         mb();
@@ -43,11 +54,6 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
         /* tear down aggregation sessions and remove STAs */
         mutex_lock(&local->sta_mtx);
         list_for_each_entry(sta, &local->sta_list, list) {
-                if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
-                        set_sta_flags(sta, WLAN_STA_BLOCK_BA);
-                        ieee80211_sta_tear_down_BA_sessions(sta, true);
-                }
-
                 if (sta->uploaded) {
                         sdata = sta->sdata;
                         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index c5d4530d8284..13a6697651ad 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -143,7 +143,8 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         if (status->flag & RX_FLAG_HT) {
                 /*
                  * MCS information is a separate field in radiotap,
-                 * added below.
+                 * added below. The byte here is needed as padding
+                 * for the channel though, so initialise it to 0.
                  */
                 *pos = 0;
         } else {
@@ -502,7 +503,8 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 
                 if (ieee80211_is_probe_req(hdr->frame_control) ||
                     ieee80211_is_probe_resp(hdr->frame_control) ||
-                    ieee80211_is_beacon(hdr->frame_control))
+                    ieee80211_is_beacon(hdr->frame_control) ||
+                    ieee80211_is_auth(hdr->frame_control))
                         return RX_CONTINUE;
 
                 return RX_DROP_MONITOR;
@@ -650,7 +652,7 @@ static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
  set_release_timer:
 
                 mod_timer(&tid_agg_rx->reorder_timer,
-                          tid_agg_rx->reorder_time[j] +
+                          tid_agg_rx->reorder_time[j] + 1 +
                           HT_RX_REORDER_BUF_TIMEOUT);
         } else {
                 del_timer(&tid_agg_rx->reorder_timer);
@@ -707,6 +709,8 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
         /*
          * If the current MPDU is in the right order and nothing else
          * is stored we can process it directly, no need to buffer it.
+         * If it is first but there's something stored, we may be able
+         * to release frames after this one.
          */
         if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
             tid_agg_rx->stored_mpdu_num == 0) {
@@ -1583,7 +1587,7 @@ ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
 }
 
 static int
-__ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
+__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
 {
         struct ieee80211_sub_if_data *sdata = rx->sdata;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
@@ -1591,6 +1595,7 @@ __ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
         struct ethhdr *ehdr;
         int ret;
 
+        *port_control = false;
         if (ieee80211_has_a4(hdr->frame_control) &&
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
                 return -1;
@@ -1609,11 +1614,13 @@ __ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
                 return -1;
 
         ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
-        if (ret < 0 || !check_port_control)
+        if (ret < 0)
                 return ret;
 
         ehdr = (struct ethhdr *) rx->skb->data;
-        if (ehdr->h_proto != rx->sdata->control_port_protocol)
+        if (ehdr->h_proto == rx->sdata->control_port_protocol)
+                *port_control = true;
+        else if (check_port_control)
                 return -1;
 
         return 0;
@@ -1914,6 +1921,7 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
         struct net_device *dev = sdata->dev;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         __le16 fc = hdr->frame_control;
+        bool port_control;
         int err;
 
         if (unlikely(!ieee80211_is_data(hdr->frame_control)))
@@ -1930,13 +1938,21 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
             sdata->vif.type == NL80211_IFTYPE_AP)
                 return RX_DROP_MONITOR;
 
-        err = __ieee80211_data_to_8023(rx);
+        err = __ieee80211_data_to_8023(rx, &port_control);
         if (unlikely(err))
                 return RX_DROP_UNUSABLE;
 
         if (!ieee80211_frame_allowed(rx, fc))
                 return RX_DROP_MONITOR;
 
+        if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+            unlikely(port_control) && sdata->bss) {
+                sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
+                                     u.ap);
+                dev = sdata->dev;
+                rx->sdata = sdata;
+        }
+
         rx->skb->dev = dev;
 
         dev->stats.rx_packets++;
@@ -2352,47 +2368,6 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
         return RX_QUEUED;
 }
 
-static void ieee80211_rx_michael_mic_report(struct ieee80211_hdr *hdr,
-                                            struct ieee80211_rx_data *rx)
-{
-        int keyidx;
-        unsigned int hdrlen;
-
-        hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        if (rx->skb->len >= hdrlen + 4)
-                keyidx = rx->skb->data[hdrlen + 3] >> 6;
-        else
-                keyidx = -1;
-
-        if (!rx->sta) {
-                /*
-                 * Some hardware seem to generate incorrect Michael MIC
-                 * reports; ignore them to avoid triggering countermeasures.
-                 */
-                return;
-        }
-
-        if (!ieee80211_has_protected(hdr->frame_control))
-                return;
-
-        if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
-                /*
-                 * APs with pairwise keys should never receive Michael MIC
-                 * errors for non-zero keyidx because these are reserved for
-                 * group keys and only the AP is sending real multicast
-                 * frames in the BSS.
-                 */
-                return;
-        }
-
-        if (!ieee80211_is_data(hdr->frame_control) &&
-            !ieee80211_is_auth(hdr->frame_control))
-                return;
-
-        mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL,
-                                        GFP_ATOMIC);
-}
-
 /* TODO: use IEEE80211_RX_FRAGMENTED */
 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
                                         struct ieee80211_rate *rate)
@@ -2736,12 +2711,6 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
         if (!prepares)
                 return false;
 
-        if (status->flag & RX_FLAG_MMIC_ERROR) {
-                if (status->rx_flags & IEEE80211_RX_RA_MATCH)
-                        ieee80211_rx_michael_mic_report(hdr, rx);
-                return false;
-        }
-
         if (!consume) {
                 skb = skb_copy(skb, GFP_ATOMIC);
                 if (!skb) {
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 13e8c30adf01..d9e6e81ff6b2 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -228,6 +228,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
+        struct timespec uptime;
         int i;
 
         sta = kzalloc(sizeof(*sta) + local->hw.sta_data_size, gfp);
@@ -245,6 +246,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         sta->sdata = sdata;
         sta->last_rx = jiffies;
 
+        do_posix_clock_monotonic_gettime(&uptime);
+        sta->last_connected = uptime.tv_sec;
         ewma_init(&sta->avg_signal, 1024, 8);
 
         if (sta_prepare_rate_control(local, sta, gfp)) {
@@ -584,7 +587,6 @@ static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
 {
         unsigned long flags;
         struct sk_buff *skb;
-        struct ieee80211_sub_if_data *sdata;
 
         if (skb_queue_empty(&sta->ps_tx_buf))
                 return false;
@@ -601,7 +603,6 @@ static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
                 if (!skb)
                         break;
 
-                sdata = sta->sdata;
                 local->total_ps_buffered--;
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "Buffered frame expired (STA %pM)\n",
@@ -609,7 +610,8 @@ static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
 #endif
                 dev_kfree_skb(skb);
 
-                if (skb_queue_empty(&sta->ps_tx_buf))
+                if (skb_queue_empty(&sta->ps_tx_buf) &&
+                    !test_sta_flags(sta, WLAN_STA_PS_DRIVER_BUF))
                         sta_info_clear_tim_bit(sta);
         }
 
@@ -698,6 +700,8 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
         cancel_work_sync(&sta->drv_unblock_wk);
 
+        cfg80211_del_sta(sdata->dev, sta->sta.addr, GFP_KERNEL);
+
         rate_control_remove_sta_debugfs(sta);
         ieee80211_sta_debugfs_remove(sta);
 
@@ -766,9 +770,8 @@ static void sta_info_cleanup(unsigned long data)
         if (!timer_needed)
                 return;
 
-        local->sta_cleanup.expires =
-                round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL);
-        add_timer(&local->sta_cleanup);
+        mod_timer(&local->sta_cleanup,
+                  round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL));
 }
 
 void sta_info_init(struct ieee80211_local *local)
@@ -781,14 +784,6 @@ void sta_info_init(struct ieee80211_local *local)
 
         setup_timer(&local->sta_cleanup, sta_info_cleanup,
                     (unsigned long)local);
-        local->sta_cleanup.expires =
-                round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL);
-}
-
-int sta_info_start(struct ieee80211_local *local)
-{
-        add_timer(&local->sta_cleanup);
-        return 0;
 }
 
 void sta_info_stop(struct ieee80211_local *local)
@@ -900,6 +895,7 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
         struct ieee80211_local *local = sdata->local;
         int sent, buffered;
 
+        clear_sta_flags(sta, WLAN_STA_PS_DRIVER_BUF);
         if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
                 drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
 
@@ -992,3 +988,12 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
                 ieee80211_queue_work(hw, &sta->drv_unblock_wk);
 }
 EXPORT_SYMBOL(ieee80211_sta_block_awake);
+
+void ieee80211_sta_set_tim(struct ieee80211_sta *pubsta)
+{
+        struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
+
+        set_sta_flags(sta, WLAN_STA_PS_DRIVER_BUF);
+        sta_info_set_tim_bit(sta);
+}
+EXPORT_SYMBOL(ieee80211_sta_set_tim);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index b2f95966c7f4..aa0adcbf3a93 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -43,6 +43,8 @@
  *      be in the queues
  * @WLAN_STA_PSPOLL: Station sent PS-poll while driver was keeping
  *      station in power-save mode, reply when the driver unblocks.
+ * @WLAN_STA_PS_DRIVER_BUF: Station has frames pending in driver internal
+ *      buffers. Automatically cleared on station wake-up.
  */
 enum ieee80211_sta_info_flags {
         WLAN_STA_AUTH           = 1<<0,
@@ -58,6 +60,7 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_BLOCK_BA       = 1<<11,
         WLAN_STA_PS_DRIVER      = 1<<12,
         WLAN_STA_PSPOLL         = 1<<13,
+        WLAN_STA_PS_DRIVER_BUF  = 1<<14,
 };
 
 #define STA_TID_NUM 16
@@ -226,6 +229,7 @@ enum plink_state {
  * @rx_bytes: Number of bytes received from this STA
  * @wep_weak_iv_count: number of weak WEP IVs received from this station
  * @last_rx: time (in jiffies) when last frame was received from this STA
+ * @last_connected: time (in seconds) when a station got connected
  * @num_duplicates: number of duplicate frames received from this STA
  * @rx_fragments: number of received MPDUs
  * @rx_dropped: number of dropped MPDUs from this STA
@@ -295,6 +299,7 @@ struct sta_info {
         unsigned long rx_packets, rx_bytes;
         unsigned long wep_weak_iv_count;
         unsigned long last_rx;
+        long last_connected;
         unsigned long num_duplicates;
         unsigned long rx_fragments;
         unsigned long rx_dropped;
@@ -497,7 +502,6 @@ void sta_info_set_tim_bit(struct sta_info *sta);
 void sta_info_clear_tim_bit(struct sta_info *sta);
 
 void sta_info_init(struct ieee80211_local *local);
-int sta_info_start(struct ieee80211_local *local);
 void sta_info_stop(struct ieee80211_local *local);
 int sta_info_flush(struct ieee80211_local *local,
                    struct ieee80211_sub_if_data *sdata);
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index b936dd29e92b..1658efaa2e8e 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -189,16 +189,19 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         bool acked;
 
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
-                /* the HW cannot have attempted that rate */
-                if (i >= hw->max_report_rates) {
+                if (info->status.rates[i].idx < 0) {
+                        break;
+                } else if (i >= hw->max_report_rates) {
+                        /* the HW cannot have attempted that rate */
                         info->status.rates[i].idx = -1;
                         info->status.rates[i].count = 0;
-                } else if (info->status.rates[i].idx >= 0) {
-                        rates_idx = i;
+                        break;
                 }
 
                 retry_count += info->status.rates[i].count;
         }
+        rates_idx = i - 1;
+
         if (retry_count < 0)
                 retry_count = 0;
 
@@ -443,3 +446,11 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         dev_kfree_skb(skb);
 }
 EXPORT_SYMBOL(ieee80211_tx_status);
+
+void ieee80211_report_low_ack(struct ieee80211_sta *pubsta, u32 num_packets)
+{
+        struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
+        cfg80211_cqm_pktloss_notify(sta->sdata->dev, sta->sta.addr,
+                                    num_packets, GFP_ATOMIC);
+}
+EXPORT_SYMBOL(ieee80211_report_low_ack);
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index e840c9cd46db..757e4eb2baf7 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -202,7 +202,7 @@ EXPORT_SYMBOL(ieee80211_get_tkip_key);
  * @payload_len is the length of payload (_not_ including IV/ICV length).
  * @ta is the transmitter addresses.
  */
-int ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
+int ieee80211_tkip_encrypt_data(struct crypto_cipher *tfm,
                                 struct ieee80211_key *key,
                                 u8 *pos, size_t payload_len, u8 *ta)
 {
@@ -223,7 +223,7 @@ int ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
  * beginning of the buffer containing IEEE 802.11 header payload, i.e.,
  * including IV, Ext. IV, real data, Michael MIC, ICV. @payload_len is the
  * length of payload, including IV, Ext. IV, MIC, ICV.  */
-int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
+int ieee80211_tkip_decrypt_data(struct crypto_cipher *tfm,
                                 struct ieee80211_key *key,
                                 u8 *payload, size_t payload_len, u8 *ta,
                                 u8 *ra, int only_iv, int queue,
diff --git a/net/mac80211/tkip.h b/net/mac80211/tkip.h
index 7e83dee976fa..1cab9c86978f 100644
--- a/net/mac80211/tkip.h
+++ b/net/mac80211/tkip.h
@@ -15,7 +15,7 @@
 
 u8 *ieee80211_tkip_add_iv(u8 *pos, struct ieee80211_key *key, u16 iv16);
 
-int ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
+int ieee80211_tkip_encrypt_data(struct crypto_cipher *tfm,
                                  struct ieee80211_key *key,
                                  u8 *pos, size_t payload_len, u8 *ta);
 enum {
@@ -24,7 +24,7 @@ enum {
         TKIP_DECRYPT_INVALID_KEYIDX = -2,
         TKIP_DECRYPT_REPLAY = -3,
 };
-int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
+int ieee80211_tkip_decrypt_data(struct crypto_cipher *tfm,
                                 struct ieee80211_key *key,
                                 u8 *payload, size_t payload_len, u8 *ta,
                                 u8 *ra, int only_iv, int queue,
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index ce4596ed1268..e3e3aa173af0 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1036,14 +1036,11 @@ static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
         struct ieee80211_radiotap_iterator iterator;
         struct ieee80211_radiotap_header *rthdr =
                 (struct ieee80211_radiotap_header *) skb->data;
-        struct ieee80211_supported_band *sband;
         bool hw_frag;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
                                                    NULL);
 
-        sband = tx->local->hw.wiphy->bands[tx->channel->band];
-
         info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
         tx->flags &= ~IEEE80211_TX_FRAGMENTED;
 
@@ -1442,11 +1439,8 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_tx_data tx;
         ieee80211_tx_result res_prepare;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        u16 queue;
         bool result = true;
 
-        queue = skb_get_queue_mapping(skb);
-
         if (unlikely(skb->len < 10)) {
                 dev_kfree_skb(skb);
                 return true;
@@ -1482,12 +1476,7 @@ static int ieee80211_skb_resize(struct ieee80211_local *local,
 {
         int tail_need = 0;
 
-        /*
-         * This could be optimised, devices that do full hardware
-         * crypto (including TKIP MMIC) need no tailroom... But we
-         * have no drivers for such devices currently.
-         */
-        if (may_encrypt) {
+        if (may_encrypt && local->crypto_tx_tailroom_needed_cnt) {
                 tail_need = IEEE80211_ENCRYPT_TAILROOM;
                 tail_need -= skb_tailroom(skb);
                 tail_need = max_t(int, tail_need, 0);
@@ -2262,7 +2251,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
 
                 /* headroom, head length, tail length and maximum TIM length */
                 skb = dev_alloc_skb(local->tx_headroom + 400 +
-                                sdata->u.mesh.vendor_ie_len);
+                                sdata->u.mesh.ie_len);
                 if (!skb)
                         goto out;
 
@@ -2485,7 +2474,6 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct sk_buff *skb = NULL;
-        struct sta_info *sta;
         struct ieee80211_tx_data tx;
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_if_ap *bss = NULL;
@@ -2527,7 +2515,6 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
 
         info = IEEE80211_SKB_CB(skb);
 
-        sta = tx.sta;
         tx.flags |= IEEE80211_TX_PS_BUFFERED;
         tx.channel = local->hw.conf.channel;
         info->band = tx.channel->band;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 556647a910ac..ef0560a2346a 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1290,7 +1290,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 }
         }
 
-        add_timer(&local->sta_cleanup);
+        mod_timer(&local->sta_cleanup, jiffies + 1);
 
         mutex_lock(&local->sta_mtx);
         list_for_each_entry(sta, &local->sta_list, list)
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index 2ff6d1e3ed21..a1c6bfd55f0f 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -30,17 +30,15 @@ int ieee80211_wep_init(struct ieee80211_local *local)
         /* start WEP IV from a random value */
         get_random_bytes(&local->wep_iv, WEP_IV_LEN);
 
-        local->wep_tx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0,
-                                                CRYPTO_ALG_ASYNC);
+        local->wep_tx_tfm = crypto_alloc_cipher("arc4", 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(local->wep_tx_tfm)) {
                 local->wep_rx_tfm = ERR_PTR(-EINVAL);
                 return PTR_ERR(local->wep_tx_tfm);
         }
 
-        local->wep_rx_tfm = crypto_alloc_blkcipher("ecb(arc4)", 0,
-                                                CRYPTO_ALG_ASYNC);
+        local->wep_rx_tfm = crypto_alloc_cipher("arc4", 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(local->wep_rx_tfm)) {
-                crypto_free_blkcipher(local->wep_tx_tfm);
+                crypto_free_cipher(local->wep_tx_tfm);
                 local->wep_tx_tfm = ERR_PTR(-EINVAL);
                 return PTR_ERR(local->wep_rx_tfm);
         }
@@ -51,9 +49,9 @@ int ieee80211_wep_init(struct ieee80211_local *local)
 void ieee80211_wep_free(struct ieee80211_local *local)
 {
         if (!IS_ERR(local->wep_tx_tfm))
-                crypto_free_blkcipher(local->wep_tx_tfm);
+                crypto_free_cipher(local->wep_tx_tfm);
         if (!IS_ERR(local->wep_rx_tfm))
-                crypto_free_blkcipher(local->wep_rx_tfm);
+                crypto_free_cipher(local->wep_rx_tfm);
 }
 
 static inline bool ieee80211_wep_weak_iv(u32 iv, int keylen)
@@ -127,12 +125,11 @@ static void ieee80211_wep_remove_iv(struct ieee80211_local *local,
 /* Perform WEP encryption using given key. data buffer must have tailroom
  * for 4-byte ICV. data_len must not include this ICV. Note: this function
  * does _not_ add IV. data = RC4(data | CRC32(data)) */
-int ieee80211_wep_encrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
+int ieee80211_wep_encrypt_data(struct crypto_cipher *tfm, u8 *rc4key,
                                size_t klen, u8 *data, size_t data_len)
 {
-        struct blkcipher_desc desc = { .tfm = tfm };
-        struct scatterlist sg;
         __le32 icv;
+        int i;
 
         if (IS_ERR(tfm))
                 return -1;
@@ -140,9 +137,9 @@ int ieee80211_wep_encrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
         icv = cpu_to_le32(~crc32_le(~0, data, data_len));
         put_unaligned(icv, (__le32 *)(data + data_len));
 
-        crypto_blkcipher_setkey(tfm, rc4key, klen);
-        sg_init_one(&sg, data, data_len + WEP_ICV_LEN);
-        crypto_blkcipher_encrypt(&desc, &sg, &sg, sg.length);
+        crypto_cipher_setkey(tfm, rc4key, klen);
+        for (i = 0; i < data_len + WEP_ICV_LEN; i++)
+                crypto_cipher_encrypt_one(tfm, data + i, data + i);
 
         return 0;
 }
@@ -186,19 +183,18 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local,
 /* Perform WEP decryption using given key. data buffer includes encrypted
  * payload, including 4-byte ICV, but _not_ IV. data_len must not include ICV.
  * Return 0 on success and -1 on ICV mismatch. */
-int ieee80211_wep_decrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
+int ieee80211_wep_decrypt_data(struct crypto_cipher *tfm, u8 *rc4key,
                                size_t klen, u8 *data, size_t data_len)
 {
-        struct blkcipher_desc desc = { .tfm = tfm };
-        struct scatterlist sg;
         __le32 crc;
+        int i;
 
         if (IS_ERR(tfm))
                 return -1;
 
-        crypto_blkcipher_setkey(tfm, rc4key, klen);
-        sg_init_one(&sg, data, data_len + WEP_ICV_LEN);
-        crypto_blkcipher_decrypt(&desc, &sg, &sg, sg.length);
+        crypto_cipher_setkey(tfm, rc4key, klen);
+        for (i = 0; i < data_len + WEP_ICV_LEN; i++)
+                crypto_cipher_decrypt_one(tfm, data + i, data + i);
 
         crc = cpu_to_le32(~crc32_le(~0, data, data_len));
         if (memcmp(&crc, data + data_len, WEP_ICV_LEN) != 0)
diff --git a/net/mac80211/wep.h b/net/mac80211/wep.h
index 58654ee33518..01e54840a628 100644
--- a/net/mac80211/wep.h
+++ b/net/mac80211/wep.h
@@ -18,12 +18,12 @@
 
 int ieee80211_wep_init(struct ieee80211_local *local);
 void ieee80211_wep_free(struct ieee80211_local *local);
-int ieee80211_wep_encrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
+int ieee80211_wep_encrypt_data(struct crypto_cipher *tfm, u8 *rc4key,
                                 size_t klen, u8 *data, size_t data_len);
 int ieee80211_wep_encrypt(struct ieee80211_local *local,
                           struct sk_buff *skb,
                           const u8 *key, int keylen, int keyidx);
-int ieee80211_wep_decrypt_data(struct crypto_blkcipher *tfm, u8 *rc4key,
+int ieee80211_wep_decrypt_data(struct crypto_cipher *tfm, u8 *rc4key,
                                size_t klen, u8 *data, size_t data_len);
 bool ieee80211_wep_is_weak_iv(struct sk_buff *skb, struct ieee80211_key *key);
 
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index e73c8cae036b..a94b312dbfac 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -198,9 +198,8 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
         u8 *pos, qos_info;
-        const u8 *ies;
         size_t offset = 0, noffset;
-        int i, len, count, rates_len, supp_rates_len;
+        int i, count, rates_len, supp_rates_len;
         u16 capab;
         struct ieee80211_supported_band *sband;
         u32 rates = 0;
@@ -285,7 +284,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
         }
 
         /* SSID */
-        ies = pos = skb_put(skb, 2 + wk->assoc.ssid_len);
+        pos = skb_put(skb, 2 + wk->assoc.ssid_len);
         *pos++ = WLAN_EID_SSID;
         *pos++ = wk->assoc.ssid_len;
         memcpy(pos, wk->assoc.ssid, wk->assoc.ssid_len);
@@ -295,7 +294,6 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
         if (supp_rates_len > 8)
                 supp_rates_len = 8;
 
-        len = sband->n_bitrates;
         pos = skb_put(skb, supp_rates_len + 2);
         *pos++ = WLAN_EID_SUPP_RATES;
         *pos++ = supp_rates_len;
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index f1765de2f4bf..9dc3b5f26e80 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -87,42 +87,76 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
-        /* No way to verify the MIC if the hardware stripped it */
-        if (status->flag & RX_FLAG_MMIC_STRIPPED)
+        /*
+         * it makes no sense to check for MIC errors on anything other
+         * than data frames.
+         */
+        if (!ieee80211_is_data_present(hdr->frame_control))
+                return RX_CONTINUE;
+
+        /*
+         * No way to verify the MIC if the hardware stripped it or
+         * the IV with the key index. In this case we have solely rely
+         * on the driver to set RX_FLAG_MMIC_ERROR in the event of a
+         * MIC failure report.
+         */
+        if (status->flag & (RX_FLAG_MMIC_STRIPPED | RX_FLAG_IV_STRIPPED)) {
+                if (status->flag & RX_FLAG_MMIC_ERROR)
+                        goto mic_fail;
+
+                if (!(status->flag & RX_FLAG_IV_STRIPPED))
+                        goto update_iv;
+
                 return RX_CONTINUE;
+        }
 
+        /*
+         * Some hardware seems to generate Michael MIC failure reports; even
+         * though, the frame was not encrypted with TKIP and therefore has no
+         * MIC. Ignore the flag them to avoid triggering countermeasures.
+         */
         if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_TKIP ||
-            !ieee80211_has_protected(hdr->frame_control) ||
-            !ieee80211_is_data_present(hdr->frame_control))
+            !(status->flag & RX_FLAG_DECRYPTED))
                 return RX_CONTINUE;
 
+        if (rx->sdata->vif.type == NL80211_IFTYPE_AP && rx->key->conf.keyidx) {
+                /*
+                 * APs with pairwise keys should never receive Michael MIC
+                 * errors for non-zero keyidx because these are reserved for
+                 * group keys and only the AP is sending real multicast
+                 * frames in the BSS. (
+                 */
+                return RX_DROP_UNUSABLE;
+        }
+
+        if (status->flag & RX_FLAG_MMIC_ERROR)
+                goto mic_fail;
+
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
         if (skb->len < hdrlen + MICHAEL_MIC_LEN)
                 return RX_DROP_UNUSABLE;
 
         data = skb->data + hdrlen;
         data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
-
         key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
         michael_mic(key, hdr, data, data_len, mic);
-        if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0) {
-                if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
-                        return RX_DROP_UNUSABLE;
-
-                mac80211_ev_michael_mic_failure(rx->sdata, rx->key->conf.keyidx,
-                                                (void *) skb->data, NULL,
-                                                GFP_ATOMIC);
-                return RX_DROP_UNUSABLE;
-        }
+        if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0)
+                goto mic_fail;
 
         /* remove Michael MIC from payload */
         skb_trim(skb, skb->len - MICHAEL_MIC_LEN);
 
+update_iv:
         /* update IV in key information to be able to detect replays */
         rx->key->u.tkip.rx[rx->queue].iv32 = rx->tkip_iv32;
         rx->key->u.tkip.rx[rx->queue].iv16 = rx->tkip_iv16;
 
         return RX_CONTINUE;
+
+mic_fail:
+        mac80211_ev_michael_mic_failure(rx->sdata, rx->key->conf.keyidx,
+                                        (void *) skb->data, NULL, GFP_ATOMIC);
+        return RX_DROP_UNUSABLE;
 }
 
 
diff --git a/net/netfilter/ipset/ip_set_getport.c b/net/netfilter/ipset/ip_set_getport.c
index 8d5227212686..757143b2240a 100644
--- a/net/netfilter/ipset/ip_set_getport.c
+++ b/net/netfilter/ipset/ip_set_getport.c
@@ -11,6 +11,7 @@
 #include <linux/skbuff.h>
 #include <linux/icmp.h>
 #include <linux/icmpv6.h>
+#include <linux/sctp.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -35,7 +36,20 @@ get_port(const struct sk_buff *skb, int protocol, unsigned int protooff,
                 *port = src ? th->source : th->dest;
                 break;
         }
-        case IPPROTO_UDP: {
+        case IPPROTO_SCTP: {
+                sctp_sctphdr_t _sh;
+                const sctp_sctphdr_t *sh;
+
+                sh = skb_header_pointer(skb, protooff, sizeof(_sh), &_sh);
+                if (sh == NULL)
+                        /* No choice either */
+                        return false;
+
+                *port = src ? sh->source : sh->dest;
+                break;
+        }
+        case IPPROTO_UDP:
+        case IPPROTO_UDPLITE: {
                 struct udphdr _udph;
                 const struct udphdr *uh;
 
diff --git a/net/netfilter/ipset/ip_set_hash_ipport.c b/net/netfilter/ipset/ip_set_hash_ipport.c
index b9214145d357..14281b6b8074 100644
--- a/net/netfilter/ipset/ip_set_hash_ipport.c
+++ b/net/netfilter/ipset/ip_set_hash_ipport.c
@@ -491,7 +491,7 @@ static struct ip_set_type hash_ipport_type __read_mostly = {
         .features       = IPSET_TYPE_IP | IPSET_TYPE_PORT,
         .dimension      = IPSET_DIM_TWO,
         .family         = AF_UNSPEC,
-        .revision       = 0,
+        .revision       = 1,
         .create         = hash_ipport_create,
         .create_policy  = {
                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
diff --git a/net/netfilter/ipset/ip_set_hash_ipportip.c b/net/netfilter/ipset/ip_set_hash_ipportip.c
index 4642872df6e1..401c8a2531db 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportip.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportip.c
@@ -509,7 +509,7 @@ static struct ip_set_type hash_ipportip_type __read_mostly = {
         .features       = IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_TYPE_IP2,
         .dimension      = IPSET_DIM_THREE,
         .family         = AF_UNSPEC,
-        .revision       = 0,
+        .revision       = 1,
         .create         = hash_ipportip_create,
         .create_policy  = {
                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index 2cb84a54b7ad..4743e5402522 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -574,7 +574,7 @@ static struct ip_set_type hash_ipportnet_type __read_mostly = {
         .features       = IPSET_TYPE_IP | IPSET_TYPE_PORT | IPSET_TYPE_IP2,
         .dimension      = IPSET_DIM_THREE,
         .family         = AF_UNSPEC,
-        .revision       = 0,
+        .revision       = 1,
         .create         = hash_ipportnet_create,
         .create_policy  = {
                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c
index 8598676f2a05..d2a40362dd3a 100644
--- a/net/netfilter/ipset/ip_set_hash_netport.c
+++ b/net/netfilter/ipset/ip_set_hash_netport.c
@@ -526,7 +526,7 @@ static struct ip_set_type hash_netport_type __read_mostly = {
         .features       = IPSET_TYPE_IP | IPSET_TYPE_PORT,
         .dimension      = IPSET_DIM_TWO,
         .family         = AF_UNSPEC,
-        .revision       = 0,
+        .revision       = 1,
         .create         = hash_netport_create,
         .create_policy  = {
                 [IPSET_ATTR_HASHSIZE]   = { .type = NLA_U32 },
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index ae47090bf45f..9930f340908a 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1984,9 +1984,6 @@ static const struct file_operations ip_vs_info_fops = {
         .release = seq_release_private,
 };
 
-#endif
-
-#ifdef CONFIG_PROC_FS
 static int ip_vs_stats_show(struct seq_file *seq, void *v)
 {
         struct net *net = seq_file_single_net(seq);
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 0ae142825881..05e9feb101c3 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -245,7 +245,7 @@ static int ct_seq_show(struct seq_file *s, void *v)
         ret = 0;
 release:
         nf_ct_put(ct);
-        return 0;
+        return ret;
 }
 
 static const struct seq_operations ct_seq_ops = {
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 985e9b76c916..e0ee010935e7 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -381,7 +381,6 @@ __build_packet_message(struct nfulnl_instance *inst,
         struct nfulnl_msg_packet_hdr pmsg;
         struct nlmsghdr *nlh;
         struct nfgenmsg *nfmsg;
-        __be32 tmp_uint;
         sk_buff_data_t old_tail = inst->skb->tail;
 
         nlh = NLMSG_PUT(inst->skb, 0, 0,
@@ -428,7 +427,6 @@ __build_packet_message(struct nfulnl_instance *inst,
         }
 
         if (outdev) {
-                tmp_uint = htonl(outdev->ifindex);
 #ifndef CONFIG_BRIDGE_NETFILTER
                 NLA_PUT_BE32(inst->skb, NFULA_IFINDEX_OUTDEV,
                              htonl(outdev->ifindex));
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index a9adf4c6b299..52959efca858 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -762,8 +762,8 @@ void xt_compat_unlock(u_int8_t af)
 EXPORT_SYMBOL_GPL(xt_compat_unlock);
 #endif
 
-DEFINE_PER_CPU(struct xt_info_lock, xt_info_locks);
-EXPORT_PER_CPU_SYMBOL_GPL(xt_info_locks);
+DEFINE_PER_CPU(seqcount_t, xt_recseq);
+EXPORT_PER_CPU_SYMBOL_GPL(xt_recseq);
 
 static int xt_jumpstack_alloc(struct xt_table_info *i)
 {
@@ -1362,10 +1362,7 @@ static int __init xt_init(void)
         int rv;
 
         for_each_possible_cpu(i) {
-                struct xt_info_lock *lock = &per_cpu(xt_info_locks, i);
-
-                seqlock_init(&lock->lock);
-                lock->readers = 0;
+                seqcount_init(&per_cpu(xt_recseq, i));
         }
 
         xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL);
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index 5f14c8462e30..bae5756b1626 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -422,7 +422,6 @@ static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
 
 {
         int ret_val = -EINVAL;
-        const char *type_str = "(unknown)";
         struct netlbl_audit audit_info;
 
         if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
@@ -432,15 +431,12 @@ static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
         netlbl_netlink_auditinfo(skb, &audit_info);
         switch (nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE])) {
         case CIPSO_V4_MAP_TRANS:
-                type_str = "trans";
                 ret_val = netlbl_cipsov4_add_std(info, &audit_info);
                 break;
         case CIPSO_V4_MAP_PASS:
-                type_str = "pass";
                 ret_val = netlbl_cipsov4_add_pass(info, &audit_info);
                 break;
         case CIPSO_V4_MAP_LOCAL:
-                type_str = "local";
                 ret_val = netlbl_cipsov4_add_local(info, &audit_info);
                 break;
         }
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 06cb02796a0e..732152f718e0 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -591,7 +591,6 @@ static int nr_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 return -EINVAL;
         }
         if ((dev = nr_dev_get(&addr->fsa_ax25.sax25_call)) == NULL) {
-                SOCK_DEBUG(sk, "NET/ROM: bind failed: invalid node callsign\n");
                 release_sock(sk);
                 return -EADDRNOTAVAIL;
         }
@@ -632,7 +631,7 @@ static int nr_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         sock_reset_flag(sk, SOCK_ZAPPED);
         dev_put(dev);
         release_sock(sk);
-        SOCK_DEBUG(sk, "NET/ROM: socket is bound\n");
+
         return 0;
 }
 
@@ -1082,8 +1081,6 @@ static int nr_sendmsg(struct kiocb *iocb, struct socket *sock,
                 sax.sax25_call   = nr->dest_addr;
         }
 
-        SOCK_DEBUG(sk, "NET/ROM: sendto: Addresses built.\n");
-
         /* Build a packet - the conventional user limit is 236 bytes. We can
            do ludicrously large NetROM frames but must not overflow */
         if (len > 65536) {
@@ -1091,7 +1088,6 @@ static int nr_sendmsg(struct kiocb *iocb, struct socket *sock,
                 goto out;
         }
 
-        SOCK_DEBUG(sk, "NET/ROM: sendto: building packet.\n");
         size = len + NR_NETWORK_LEN + NR_TRANSPORT_LEN;
 
         if ((skb = sock_alloc_send_skb(sk, size, msg->msg_flags & MSG_DONTWAIT, &err)) == NULL)
@@ -1105,7 +1101,6 @@ static int nr_sendmsg(struct kiocb *iocb, struct socket *sock,
          */
 
         asmptr = skb_push(skb, NR_TRANSPORT_LEN);
-        SOCK_DEBUG(sk, "Building NET/ROM Header.\n");
 
         /* Build a NET/ROM Transport header */
 
@@ -1114,15 +1109,12 @@ static int nr_sendmsg(struct kiocb *iocb, struct socket *sock,
         *asmptr++ = 0;          /* To be filled in later */
         *asmptr++ = 0;          /*      Ditto            */
         *asmptr++ = NR_INFO;
-        SOCK_DEBUG(sk, "Built header.\n");
 
         /*
          *      Put the data on the end
          */
         skb_put(skb, len);
 
-        SOCK_DEBUG(sk, "NET/ROM: Appending user data\n");
-
         /* User data follows immediately after the NET/ROM transport header */
         if (memcpy_fromiovec(skb_transport_header(skb), msg->msg_iov, len)) {
                 kfree_skb(skb);
@@ -1130,8 +1122,6 @@ static int nr_sendmsg(struct kiocb *iocb, struct socket *sock,
                 goto out;
         }
 
-        SOCK_DEBUG(sk, "NET/ROM: Transmitting buffer\n");
-
         if (sk->sk_state != TCP_ESTABLISHED) {
                 kfree_skb(skb);
                 err = -ENOTCONN;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index b5362e96022b..549527bca87a 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -538,7 +538,7 @@ static inline unsigned int run_filter(const struct sk_buff *skb,
         rcu_read_lock();
         filter = rcu_dereference(sk->sk_filter);
         if (filter != NULL)
-                res = sk_run_filter(skb, filter->insns);
+                res = SK_RUN_FILTER(filter, skb);
         rcu_read_unlock();
 
         return res;
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 947038ddd04c..47b3452675b6 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -426,18 +426,14 @@ int phonet_route_del(struct net_device *dev, u8 daddr)
         return 0;
 }
 
-struct net_device *phonet_route_get(struct net *net, u8 daddr)
+struct net_device *phonet_route_get_rcu(struct net *net, u8 daddr)
 {
         struct phonet_net *pnn = phonet_pernet(net);
         struct phonet_routes *routes = &pnn->routes;
         struct net_device *dev;
 
-        ASSERT_RTNL(); /* no need to hold the device */
-
         daddr >>= 2;
-        rcu_read_lock();
         dev = rcu_dereference(routes->table[daddr]);
-        rcu_read_unlock();
         return dev;
 }
 
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index 58b3b1f991ed..438accb7a5a8 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c
@@ -264,10 +264,11 @@ static int route_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
         struct net *net = sock_net(skb->sk);
         u8 addr, addr_idx = 0, addr_start_idx = cb->args[0];
 
+        rcu_read_lock();
         for (addr = 0; addr < 64; addr++) {
                 struct net_device *dev;
 
-                dev = phonet_route_get(net, addr << 2);
+                dev = phonet_route_get_rcu(net, addr << 2);
                 if (!dev)
                         continue;
 
@@ -279,6 +280,7 @@ static int route_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
         }
 
 out:
+        rcu_read_unlock();
         cb->args[0] = addr_idx;
         cb->args[1] = 0;
 
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index b1adafab377c..8c5bfcef92cb 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -52,7 +52,7 @@ static int pn_socket_release(struct socket *sock)
 
 static struct  {
         struct hlist_head hlist[PN_HASHSIZE];
-        spinlock_t lock;
+        struct mutex lock;
 } pnsocks;
 
 void __init pn_sock_init(void)
@@ -61,7 +61,7 @@ void __init pn_sock_init(void)
 
         for (i = 0; i < PN_HASHSIZE; i++)
                 INIT_HLIST_HEAD(pnsocks.hlist + i);
-        spin_lock_init(&pnsocks.lock);
+        mutex_init(&pnsocks.lock);
 }
 
 static struct hlist_head *pn_hash_list(u16 obj)
@@ -82,9 +82,8 @@ struct sock *pn_find_sock_by_sa(struct net *net, const struct sockaddr_pn *spn)
         u8 res = spn->spn_resource;
         struct hlist_head *hlist = pn_hash_list(obj);
 
-        spin_lock_bh(&pnsocks.lock);
-
-        sk_for_each(sknode, node, hlist) {
+        rcu_read_lock();
+        sk_for_each_rcu(sknode, node, hlist) {
                 struct pn_sock *pn = pn_sk(sknode);
                 BUG_ON(!pn->sobject); /* unbound socket */
 
@@ -107,8 +106,7 @@ struct sock *pn_find_sock_by_sa(struct net *net, const struct sockaddr_pn *spn)
                 sock_hold(sknode);
                 break;
         }
-
-        spin_unlock_bh(&pnsocks.lock);
+        rcu_read_unlock();
 
         return rval;
 }
@@ -119,7 +117,7 @@ void pn_deliver_sock_broadcast(struct net *net, struct sk_buff *skb)
         struct hlist_head *hlist = pnsocks.hlist;
         unsigned h;
 
-        spin_lock(&pnsocks.lock);
+        rcu_read_lock();
         for (h = 0; h < PN_HASHSIZE; h++) {
                 struct hlist_node *node;
                 struct sock *sknode;
@@ -140,25 +138,26 @@ void pn_deliver_sock_broadcast(struct net *net, struct sk_buff *skb)
                 }
                 hlist++;
         }
-        spin_unlock(&pnsocks.lock);
+        rcu_read_unlock();
 }
 
 void pn_sock_hash(struct sock *sk)
 {
         struct hlist_head *hlist = pn_hash_list(pn_sk(sk)->sobject);
 
-        spin_lock_bh(&pnsocks.lock);
-        sk_add_node(sk, hlist);
-        spin_unlock_bh(&pnsocks.lock);
+        mutex_lock(&pnsocks.lock);
+        sk_add_node_rcu(sk, hlist);
+        mutex_unlock(&pnsocks.lock);
 }
 EXPORT_SYMBOL(pn_sock_hash);
 
 void pn_sock_unhash(struct sock *sk)
 {
-        spin_lock_bh(&pnsocks.lock);
-        sk_del_node_init(sk);
-        spin_unlock_bh(&pnsocks.lock);
+        mutex_lock(&pnsocks.lock);
+        sk_del_node_init_rcu(sk);
+        mutex_unlock(&pnsocks.lock);
         pn_sock_unbind_all_res(sk);
+        synchronize_rcu();
 }
 EXPORT_SYMBOL(pn_sock_unhash);
 
@@ -548,7 +547,7 @@ static struct sock *pn_sock_get_idx(struct seq_file *seq, loff_t pos)
         unsigned h;
 
         for (h = 0; h < PN_HASHSIZE; h++) {
-                sk_for_each(sknode, node, hlist) {
+                sk_for_each_rcu(sknode, node, hlist) {
                         if (!net_eq(net, sock_net(sknode)))
                                 continue;
                         if (!pos)
@@ -572,9 +571,9 @@ static struct sock *pn_sock_get_next(struct seq_file *seq, struct sock *sk)
 }
 
 static void *pn_sock_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(pnsocks.lock)
+        __acquires(rcu)
 {
-        spin_lock_bh(&pnsocks.lock);
+        rcu_read_lock();
         return *pos ? pn_sock_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
 }
 
@@ -591,9 +590,9 @@ static void *pn_sock_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void pn_sock_seq_stop(struct seq_file *seq, void *v)
-        __releases(pnsocks.lock)
+        __releases(rcu)
 {
-        spin_unlock_bh(&pnsocks.lock);
+        rcu_read_unlock();
 }
 
 static int pn_sock_seq_show(struct seq_file *seq, void *v)
@@ -721,13 +720,11 @@ void pn_sock_unbind_all_res(struct sock *sk)
         }
         mutex_unlock(&resource_mutex);
 
-        if (match == 0)
-                return;
-        synchronize_rcu();
         while (match > 0) {
-                sock_put(sk);
+                __sock_put(sk);
                 match--;
         }
+        /* Caller is responsible for RCU sync before final sock_put() */
 }
 
 #ifdef CONFIG_PROC_FS
diff --git a/net/rfkill/Kconfig b/net/rfkill/Kconfig
index 7fce6dfd2180..48464ca13b24 100644
--- a/net/rfkill/Kconfig
+++ b/net/rfkill/Kconfig
@@ -22,3 +22,14 @@ config RFKILL_INPUT
         depends on RFKILL
         depends on INPUT = y || RFKILL = INPUT
         default y if !EXPERT
+
+config RFKILL_REGULATOR
+        tristate "Generic rfkill regulator driver"
+        depends on RFKILL || !RFKILL
+        depends on REGULATOR
+        help
+          This options enable controlling radio transmitters connected to
+          voltage regulator using the regulator framework.
+
+          To compile this driver as a module, choose M here: the module will
+          be called rfkill-regulator.
diff --git a/net/rfkill/Makefile b/net/rfkill/Makefile
index 662105352691..d9a5a58ffd8c 100644
--- a/net/rfkill/Makefile
+++ b/net/rfkill/Makefile
@@ -5,3 +5,4 @@
 rfkill-y                        += core.o
 rfkill-$(CONFIG_RFKILL_INPUT)   += input.o
 obj-$(CONFIG_RFKILL)            += rfkill.o
+obj-$(CONFIG_RFKILL_REGULATOR)  += rfkill-regulator.o
diff --git a/net/rfkill/rfkill-regulator.c b/net/rfkill/rfkill-regulator.c
new file mode 100644
index 000000000000..18dc512a10f3
--- /dev/null
+++ b/net/rfkill/rfkill-regulator.c
@@ -0,0 +1,164 @@
+/*
+ * rfkill-regulator.c - Regulator consumer driver for rfkill
+ *
+ * Copyright (C) 2009  Guiming Zhuo <gmzhuo@gmail.com>
+ * Copyright (C) 2011  Antonio Ospite <ospite@studenti.unina.it>
+ *
+ * Implementation inspired by leds-regulator driver.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/err.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+#include <linux/regulator/consumer.h>
+#include <linux/rfkill.h>
+#include <linux/rfkill-regulator.h>
+
+struct rfkill_regulator_data {
+        struct rfkill *rf_kill;
+        bool reg_enabled;
+
+        struct regulator *vcc;
+};
+
+static int rfkill_regulator_set_block(void *data, bool blocked)
+{
+        struct rfkill_regulator_data *rfkill_data = data;
+
+        pr_debug("%s: blocked: %d\n", __func__, blocked);
+
+        if (blocked) {
+                if (rfkill_data->reg_enabled) {
+                        regulator_disable(rfkill_data->vcc);
+                        rfkill_data->reg_enabled = 0;
+                }
+        } else {
+                if (!rfkill_data->reg_enabled) {
+                        regulator_enable(rfkill_data->vcc);
+                        rfkill_data->reg_enabled = 1;
+                }
+        }
+
+        pr_debug("%s: regulator_is_enabled after set_block: %d\n", __func__,
+                regulator_is_enabled(rfkill_data->vcc));
+
+        return 0;
+}
+
+struct rfkill_ops rfkill_regulator_ops = {
+        .set_block = rfkill_regulator_set_block,
+};
+
+static int __devinit rfkill_regulator_probe(struct platform_device *pdev)
+{
+        struct rfkill_regulator_platform_data *pdata = pdev->dev.platform_data;
+        struct rfkill_regulator_data *rfkill_data;
+        struct regulator *vcc;
+        struct rfkill *rf_kill;
+        int ret = 0;
+
+        if (pdata == NULL) {
+                dev_err(&pdev->dev, "no platform data\n");
+                return -ENODEV;
+        }
+
+        if (pdata->name == NULL || pdata->type == 0) {
+                dev_err(&pdev->dev, "invalid name or type in platform data\n");
+                return -EINVAL;
+        }
+
+        vcc = regulator_get_exclusive(&pdev->dev, "vrfkill");
+        if (IS_ERR(vcc)) {
+                dev_err(&pdev->dev, "Cannot get vcc for %s\n", pdata->name);
+                ret = PTR_ERR(vcc);
+                goto out;
+        }
+
+        rfkill_data = kzalloc(sizeof(*rfkill_data), GFP_KERNEL);
+        if (rfkill_data == NULL) {
+                ret = -ENOMEM;
+                goto err_data_alloc;
+        }
+
+        rf_kill = rfkill_alloc(pdata->name, &pdev->dev,
+                                pdata->type,
+                                &rfkill_regulator_ops, rfkill_data);
+        if (rf_kill == NULL) {
+                dev_err(&pdev->dev, "Cannot alloc rfkill device\n");
+                ret = -ENOMEM;
+                goto err_rfkill_alloc;
+        }
+
+        if (regulator_is_enabled(vcc)) {
+                dev_dbg(&pdev->dev, "Regulator already enabled\n");
+                rfkill_data->reg_enabled = 1;
+        }
+        rfkill_data->vcc = vcc;
+        rfkill_data->rf_kill = rf_kill;
+
+        ret = rfkill_register(rf_kill);
+        if (ret) {
+                dev_err(&pdev->dev, "Cannot register rfkill device\n");
+                goto err_rfkill_register;
+        }
+
+        platform_set_drvdata(pdev, rfkill_data);
+        dev_info(&pdev->dev, "%s initialized\n", pdata->name);
+
+        return 0;
+
+err_rfkill_register:
+        rfkill_destroy(rf_kill);
+err_rfkill_alloc:
+        kfree(rfkill_data);
+err_data_alloc:
+        regulator_put(vcc);
+out:
+        return ret;
+}
+
+static int __devexit rfkill_regulator_remove(struct platform_device *pdev)
+{
+        struct rfkill_regulator_data *rfkill_data = platform_get_drvdata(pdev);
+        struct rfkill *rf_kill = rfkill_data->rf_kill;
+
+        rfkill_unregister(rf_kill);
+        rfkill_destroy(rf_kill);
+        regulator_put(rfkill_data->vcc);
+        kfree(rfkill_data);
+
+        return 0;
+}
+
+static struct platform_driver rfkill_regulator_driver = {
+        .probe = rfkill_regulator_probe,
+        .remove = __devexit_p(rfkill_regulator_remove),
+        .driver = {
+                .name = "rfkill-regulator",
+                .owner = THIS_MODULE,
+        },
+};
+
+static int __init rfkill_regulator_init(void)
+{
+        return platform_driver_register(&rfkill_regulator_driver);
+}
+module_init(rfkill_regulator_init);
+
+static void __exit rfkill_regulator_exit(void)
+{
+        platform_driver_unregister(&rfkill_regulator_driver);
+}
+module_exit(rfkill_regulator_exit);
+
+MODULE_AUTHOR("Guiming Zhuo <gmzhuo@gmail.com>");
+MODULE_AUTHOR("Antonio Ospite <ospite@studenti.unina.it>");
+MODULE_DESCRIPTION("Regulator consumer driver for rfkill");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:rfkill-regulator");
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index a80aef6e3d1f..f9ea925ad9cb 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -682,10 +682,8 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
                 return -EINVAL;
 
-        if ((dev = rose_dev_get(&addr->srose_addr)) == NULL) {
-                SOCK_DEBUG(sk, "ROSE: bind failed: invalid address\n");
+        if ((dev = rose_dev_get(&addr->srose_addr)) == NULL)
                 return -EADDRNOTAVAIL;
-        }
 
         source = &addr->srose_call;
 
@@ -716,7 +714,7 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         rose_insert_socket(sk);
 
         sock_reset_flag(sk, SOCK_ZAPPED);
-        SOCK_DEBUG(sk, "ROSE: socket is bound\n");
+
         return 0;
 }
 
@@ -1109,10 +1107,7 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
                         srose.srose_digis[n] = rose->dest_digis[n];
         }
 
-        SOCK_DEBUG(sk, "ROSE: sendto: Addresses built.\n");
-
         /* Build a packet */
-        SOCK_DEBUG(sk, "ROSE: sendto: building packet.\n");
         /* Sanity check the packet size */
         if (len > 65535)
                 return -EMSGSIZE;
@@ -1127,7 +1122,6 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
         /*
          *      Put the data on the end
          */
-        SOCK_DEBUG(sk, "ROSE: Appending user data\n");
 
         skb_reset_transport_header(skb);
         skb_put(skb, len);
@@ -1152,8 +1146,6 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
          */
         asmptr = skb_push(skb, ROSE_MIN_LEN);
 
-        SOCK_DEBUG(sk, "ROSE: Building Network Header.\n");
-
         /* Build a ROSE Network header */
         asmptr[0] = ((rose->lci >> 8) & 0x0F) | ROSE_GFI;
         asmptr[1] = (rose->lci >> 0) & 0xFF;
@@ -1162,10 +1154,6 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
         if (qbit)
                 asmptr[0] |= ROSE_Q_BIT;
 
-        SOCK_DEBUG(sk, "ROSE: Built header.\n");
-
-        SOCK_DEBUG(sk, "ROSE: Transmitting buffer\n");
-
         if (sk->sk_state != TCP_ESTABLISHED) {
                 kfree_skb(skb);
                 return -ENOTCONN;
diff --git a/net/rxrpc/ar-peer.c b/net/rxrpc/ar-peer.c
index 55b93dc60d0c..b6ff06351d67 100644
--- a/net/rxrpc/ar-peer.c
+++ b/net/rxrpc/ar-peer.c
@@ -36,10 +36,11 @@ static void rxrpc_destroy_peer(struct work_struct *work);
 static void rxrpc_assess_MTU_size(struct rxrpc_peer *peer)
 {
         struct rtable *rt;
+        struct flowi4 fl4;
 
         peer->if_mtu = 1500;
 
-        rt = ip_route_output_ports(&init_net, NULL,
+        rt = ip_route_output_ports(&init_net, &fl4, NULL,
                                    peer->srx.transport.sin.sin_addr.s_addr, 0,
                                    htons(7000), htons(7001),
                                    IPPROTO_UDP, 0, 0);
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index a7a5583d4f68..aeaa2110b699 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -239,6 +239,17 @@ config NET_SCH_CHOKE
           To compile this code as a module, choose M here: the
           module will be called sch_choke.
 
+config NET_SCH_QFQ
+        tristate "Quick Fair Queueing scheduler (QFQ)"
+        help
+          Say Y here if you want to use the Quick Fair Queueing Scheduler (QFQ)
+          packet scheduling algorithm.
+
+          To compile this driver as a module, choose M here: the module
+          will be called sch_qfq.
+
+          If unsure, say N.
+
 config NET_SCH_INGRESS
         tristate "Ingress Qdisc"
         depends on NET_CLS_ACT
diff --git a/net/sched/Makefile b/net/sched/Makefile
index 2e77b8dba22e..dc5889c0a15a 100644
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -35,6 +35,7 @@ obj-$(CONFIG_NET_SCH_NETEM)	+= sch_netem.o
 obj-$(CONFIG_NET_SCH_DRR)       += sch_drr.o
 obj-$(CONFIG_NET_SCH_MQPRIO)    += sch_mqprio.o
 obj-$(CONFIG_NET_SCH_CHOKE)     += sch_choke.o
+obj-$(CONFIG_NET_SCH_QFQ)       += sch_qfq.o
 
 obj-$(CONFIG_NET_CLS_U32)       += cls_u32.o
 obj-$(CONFIG_NET_CLS_ROUTE4)    += cls_route.o
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
new file mode 100644
index 000000000000..103343408593
--- /dev/null
+++ b/net/sched/sch_qfq.c
@@ -0,0 +1,1137 @@
+/*
+ * net/sched/sch_qfq.c         Quick Fair Queueing Scheduler.
+ *
+ * Copyright (c) 2009 Fabio Checconi, Luigi Rizzo, and Paolo Valente.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/bitops.h>
+#include <linux/errno.h>
+#include <linux/netdevice.h>
+#include <linux/pkt_sched.h>
+#include <net/sch_generic.h>
+#include <net/pkt_sched.h>
+#include <net/pkt_cls.h>
+
+
+/*  Quick Fair Queueing
+    ===================
+
+    Sources:
+
+    Fabio Checconi, Luigi Rizzo, and Paolo Valente: "QFQ: Efficient
+    Packet Scheduling with Tight Bandwidth Distribution Guarantees."
+
+    See also:
+    http://retis.sssup.it/~fabio/linux/qfq/
+ */
+
+/*
+
+  Virtual time computations.
+
+  S, F and V are all computed in fixed point arithmetic with
+  FRAC_BITS decimal bits.
+
+  QFQ_MAX_INDEX is the maximum index allowed for a group. We need
+        one bit per index.
+  QFQ_MAX_WSHIFT is the maximum power of two supported as a weight.
+
+  The layout of the bits is as below:
+
+                   [ MTU_SHIFT ][      FRAC_BITS    ]
+                   [ MAX_INDEX    ][ MIN_SLOT_SHIFT ]
+                                 ^.__grp->index = 0
+                                 *.__grp->slot_shift
+
+  where MIN_SLOT_SHIFT is derived by difference from the others.
+
+  The max group index corresponds to Lmax/w_min, where
+  Lmax=1<<MTU_SHIFT, w_min = 1 .
+  From this, and knowing how many groups (MAX_INDEX) we want,
+  we can derive the shift corresponding to each group.
+
+  Because we often need to compute
+        F = S + len/w_i  and V = V + len/wsum
+  instead of storing w_i store the value
+        inv_w = (1<<FRAC_BITS)/w_i
+  so we can do F = S + len * inv_w * wsum.
+  We use W_TOT in the formulas so we can easily move between
+  static and adaptive weight sum.
+
+  The per-scheduler-instance data contain all the data structures
+  for the scheduler: bitmaps and bucket lists.
+
+ */
+
+/*
+ * Maximum number of consecutive slots occupied by backlogged classes
+ * inside a group.
+ */
+#define QFQ_MAX_SLOTS   32
+
+/*
+ * Shifts used for class<->group mapping.  We allow class weights that are
+ * in the range [1, 2^MAX_WSHIFT], and we try to map each class i to the
+ * group with the smallest index that can support the L_i / r_i configured
+ * for the class.
+ *
+ * grp->index is the index of the group; and grp->slot_shift
+ * is the shift for the corresponding (scaled) sigma_i.
+ */
+#define QFQ_MAX_INDEX           19
+#define QFQ_MAX_WSHIFT          16
+
+#define QFQ_MAX_WEIGHT          (1<<QFQ_MAX_WSHIFT)
+#define QFQ_MAX_WSUM            (2*QFQ_MAX_WEIGHT)
+
+#define FRAC_BITS               30      /* fixed point arithmetic */
+#define ONE_FP                  (1UL << FRAC_BITS)
+#define IWSUM                   (ONE_FP/QFQ_MAX_WSUM)
+
+#define QFQ_MTU_SHIFT           11
+#define QFQ_MIN_SLOT_SHIFT      (FRAC_BITS + QFQ_MTU_SHIFT - QFQ_MAX_INDEX)
+
+/*
+ * Possible group states.  These values are used as indexes for the bitmaps
+ * array of struct qfq_queue.
+ */
+enum qfq_state { ER, IR, EB, IB, QFQ_MAX_STATE };
+
+struct qfq_group;
+
+struct qfq_class {
+        struct Qdisc_class_common common;
+
+        unsigned int refcnt;
+        unsigned int filter_cnt;
+
+        struct gnet_stats_basic_packed bstats;
+        struct gnet_stats_queue qstats;
+        struct gnet_stats_rate_est rate_est;
+        struct Qdisc *qdisc;
+
+        struct hlist_node next; /* Link for the slot list. */
+        u64 S, F;               /* flow timestamps (exact) */
+
+        /* group we belong to. In principle we would need the index,
+         * which is log_2(lmax/weight), but we never reference it
+         * directly, only the group.
+         */
+        struct qfq_group *grp;
+
+        /* these are copied from the flowset. */
+        u32     inv_w;          /* ONE_FP/weight */
+        u32     lmax;           /* Max packet size for this flow. */
+};
+
+struct qfq_group {
+        u64 S, F;                       /* group timestamps (approx). */
+        unsigned int slot_shift;        /* Slot shift. */
+        unsigned int index;             /* Group index. */
+        unsigned int front;             /* Index of the front slot. */
+        unsigned long full_slots;       /* non-empty slots */
+
+        /* Array of RR lists of active classes. */
+        struct hlist_head slots[QFQ_MAX_SLOTS];
+};
+
+struct qfq_sched {
+        struct tcf_proto *filter_list;
+        struct Qdisc_class_hash clhash;
+
+        u64             V;              /* Precise virtual time. */
+        u32             wsum;           /* weight sum */
+
+        unsigned long bitmaps[QFQ_MAX_STATE];       /* Group bitmaps. */
+        struct qfq_group groups[QFQ_MAX_INDEX + 1]; /* The groups. */
+};
+
+static struct qfq_class *qfq_find_class(struct Qdisc *sch, u32 classid)
+{
+        struct qfq_sched *q = qdisc_priv(sch);
+        struct Qdisc_class_common *clc;
+
+        clc = qdisc_class_find(&q->clhash, classid);
+        if (clc == NULL)
+                return NULL;
+        return container_of(clc, struct qfq_class, common);
+}
+
+static void qfq_purge_queue(struct qfq_class *cl)
+{
+        unsigned int len = cl->qdisc->q.qlen;
+
+        qdisc_reset(cl->qdisc);
+        qdisc_tree_decrease_qlen(cl->qdisc, len);
+}
+
+static const struct nla_policy qfq_policy[TCA_QFQ_MAX + 1] = {
+        [TCA_QFQ_WEIGHT] = { .type = NLA_U32 },
+        [TCA_QFQ_LMAX] = { .type = NLA_U32 },
+};
+
+/*
+ * Calculate a flow index, given its weight and maximum packet length.
+ * index = log_2(maxlen/weight) but we need to apply the scaling.
+ * This is used only once at flow creation.
+ */
+static int qfq_calc_index(u32 inv_w, unsigned int maxlen)
+{
+        u64 slot_size = (u64)maxlen * inv_w;
+        unsigned long size_map;
+        int index = 0;
+
+        size_map = slot_size >> QFQ_MIN_SLOT_SHIFT;
+        if (!size_map)
+                goto out;
+
+        index = __fls(size_map) + 1;    /* basically a log_2 */
+        index -= !(slot_size - (1ULL << (index + QFQ_MIN_SLOT_SHIFT - 1)));
+
+        if (index < 0)
+                index = 0;
+out:
+        pr_debug("qfq calc_index: W = %lu, L = %u, I = %d\n",
+                 (unsigned long) ONE_FP/inv_w, maxlen, index);
+
+        return index;
+}
+
+static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
+                            struct nlattr **tca, unsigned long *arg)
+{
+        struct qfq_sched *q = qdisc_priv(sch);
+        struct qfq_class *cl = (struct qfq_class *)*arg;
+        struct nlattr *tb[TCA_QFQ_MAX + 1];
+        u32 weight, lmax, inv_w;
+        int i, err;
+
+        if (tca[TCA_OPTIONS] == NULL) {
+                pr_notice("qfq: no options\n");
+                return -EINVAL;
+        }
+
+        err = nla_parse_nested(tb, TCA_QFQ_MAX, tca[TCA_OPTIONS], qfq_policy);
+        if (err < 0)
+                return err;
+
+        if (tb[TCA_QFQ_WEIGHT]) {
+                weight = nla_get_u32(tb[TCA_QFQ_WEIGHT]);
+                if (!weight || weight > (1UL << QFQ_MAX_WSHIFT)) {
+                        pr_notice("qfq: invalid weight %u\n", weight);
+                        return -EINVAL;
+                }
+        } else
+                weight = 1;
+
+        inv_w = ONE_FP / weight;
+        weight = ONE_FP / inv_w;
+        if (q->wsum + weight > QFQ_MAX_WSUM) {
+                pr_notice("qfq: total weight out of range (%u + %u)\n",
+                          weight, q->wsum);
+                return -EINVAL;
+        }
+
+        if (tb[TCA_QFQ_LMAX]) {
+                lmax = nla_get_u32(tb[TCA_QFQ_LMAX]);
+                if (!lmax || lmax > (1UL << QFQ_MTU_SHIFT)) {
+                        pr_notice("qfq: invalid max length %u\n", lmax);
+                        return -EINVAL;
+                }
+        } else
+                lmax = 1UL << QFQ_MTU_SHIFT;
+
+        if (cl != NULL) {
+                if (tca[TCA_RATE]) {
+                        err = gen_replace_estimator(&cl->bstats, &cl->rate_est,
+                                                    qdisc_root_sleeping_lock(sch),
+                                                    tca[TCA_RATE]);
+                        if (err)
+                                return err;
+                }
+
+                sch_tree_lock(sch);
+                if (tb[TCA_QFQ_WEIGHT]) {
+                        q->wsum = weight - ONE_FP / cl->inv_w;
+                        cl->inv_w = inv_w;
+                }
+                sch_tree_unlock(sch);
+
+                return 0;
+        }
+
+        cl = kzalloc(sizeof(struct qfq_class), GFP_KERNEL);
+        if (cl == NULL)
+                return -ENOBUFS;
+
+        cl->refcnt = 1;
+        cl->common.classid = classid;
+        cl->lmax = lmax;
+        cl->inv_w = inv_w;
+        i = qfq_calc_index(cl->inv_w, cl->lmax);
+
+        cl->grp = &q->groups[i];
+        q->wsum += weight;
+
+        cl->qdisc = qdisc_create_dflt(sch->dev_queue,
+                                      &pfifo_qdisc_ops, classid);
+        if (cl->qdisc == NULL)
+                cl->qdisc = &noop_qdisc;
+
+        if (tca[TCA_RATE]) {
+                err = gen_new_estimator(&cl->bstats, &cl->rate_est,
+                                        qdisc_root_sleeping_lock(sch),
+                                        tca[TCA_RATE]);
+                if (err) {
+                        qdisc_destroy(cl->qdisc);
+                        kfree(cl);
+                        return err;
+                }
+        }
+
+        sch_tree_lock(sch);
+        qdisc_class_hash_insert(&q->clhash, &cl->common);
+        sch_tree_unlock(sch);
+
+        qdisc_class_hash_grow(sch, &q->clhash);
+
+        *arg = (unsigned long)cl;
+        return 0;
+}
+
+static void qfq_destroy_class(struct Qdisc *sch, struct qfq_class *cl)
+{
+        struct qfq_sched *q = qdisc_priv(sch);
+
+        if (cl->inv_w) {
+                q->wsum -= ONE_FP / cl->inv_w;
+                cl->inv_w = 0;
+        }
+
+        gen_kill_estimator(&cl->bstats, &cl->rate_est);
+        qdisc_destroy(cl->qdisc);
+        kfree(cl);
+}
+
+static int qfq_delete_class(struct Qdisc *sch, unsigned long arg)
+{
+        struct qfq_sched *q = qdisc_priv(sch);
+        struct qfq_class *cl = (struct qfq_class *)arg;
+
+        if (cl->filter_cnt > 0)
+                return -EBUSY;
+
+        sch_tree_lock(sch);
+
+        qfq_purge_queue(cl);
+        qdisc_class_hash_remove(&q->clhash, &cl->common);
+
+        BUG_ON(--cl->refcnt == 0);
+        /*
+         * This shouldn't happen: we "hold" one cops->get() when called
+         * from tc_ctl_tclass; the destroy method is done from cops->put().
+         */
+
+        sch_tree_unlock(sch);
+        return 0;
+}
+
+static unsigned long qfq_get_class(struct Qdisc *sch, u32 classid)
+{
+        struct qfq_class *cl = qfq_find_class(sch, classid);
+
+        if (cl != NULL)
+                cl->refcnt++;
+
+        return (unsigned long)cl;
+}
+
+static void qfq_put_class(struct Qdisc *sch, unsigned long arg)
+{
+        struct qfq_class *cl = (struct qfq_class *)arg;
+
+        if (--cl->refcnt == 0)
+                qfq_destroy_class(sch, cl);
+}
+
+static struct tcf_proto **qfq_tcf_chain(struct Qdisc *sch, unsigned long cl)
+{
+        struct qfq_sched *q = qdisc_priv(sch);
+
+        if (cl)
+                return NULL;
+
+        return &q->filter_list;
+}
+
+static unsigned long qfq_bind_tcf(struct Qdisc *sch, unsigned long parent,
+                                  u32 classid)
+{
+        struct qfq_class *cl = qfq_find_class(sch, classid);
+
+        if (cl != NULL)
+                cl->filter_cnt++;
+
+        return (unsigned long)cl;
+}
+
+static void qfq_unbind_tcf(struct Qdisc *sch, unsigned long arg)
+{
+        struct qfq_class *cl = (struct qfq_class *)arg;
+
+        cl->filter_cnt--;
+}
+
+static int qfq_graft_class(struct Qdisc *sch, unsigned long arg,
+                           struct Qdisc *new, struct Qdisc **old)
+{
+        struct qfq_class *cl = (struct qfq_class *)arg;
+
+        if (new == NULL) {
+                new = qdisc_create_dflt(sch->dev_queue,
+                                        &pfifo_qdisc_ops, cl->common.classid);
+                if (new == NULL)
+                        new = &noop_qdisc;
+        }
+
+        sch_tree_lock(sch);
+        qfq_purge_queue(cl);
+        *old = cl->qdisc;
+        cl->qdisc = new;
+        sch_tree_unlock(sch);
+        return 0;
+}
+
+static struct Qdisc *qfq_class_leaf(struct Qdisc *sch, unsigned long arg)
+{
+        struct qfq_class *cl = (struct qfq_class *)arg;
+
+        return cl->qdisc;
+}
+
+static int qfq_dump_class(struct Qdisc *sch, unsigned long arg,
+                          struct sk_buff *skb, struct tcmsg *tcm)
+{
+        struct qfq_class *cl = (struct qfq_class *)arg;
+        struct nlattr *nest;
+
+        tcm->tcm_parent = TC_H_ROOT;
+        tcm->tcm_handle = cl->common.classid;
+        tcm->tcm_info   = cl->qdisc->handle;
+
+        nest = nla_nest_start(skb, TCA_OPTIONS);
+        if (nest == NULL)
+                goto nla_put_failure;
+        NLA_PUT_U32(skb, TCA_QFQ_WEIGHT, ONE_FP/cl->inv_w);
+        NLA_PUT_U32(skb, TCA_QFQ_LMAX, cl->lmax);
+        return nla_nest_end(skb, nest);
+
+nla_put_failure:
+        nla_nest_cancel(skb, nest);
+        return -EMSGSIZE;
+}
+
+static int qfq_dump_class_stats(struct Qdisc *sch, unsigned long arg,
+                                struct gnet_dump *d)
+{
+        struct qfq_class *cl = (struct qfq_class *)arg;
+        struct tc_qfq_stats xstats;
+
+        memset(&xstats, 0, sizeof(xstats));
+        cl->qdisc->qstats.qlen = cl->qdisc->q.qlen;
+
+        xstats.weight = ONE_FP/cl->inv_w;
+        xstats.lmax = cl->lmax;
+
+        if (gnet_stats_copy_basic(d, &cl->bstats) < 0 ||
+            gnet_stats_copy_rate_est(d, &cl->bstats, &cl->rate_est) < 0 ||
+            gnet_stats_copy_queue(d, &cl->qdisc->qstats) < 0)
+                return -1;
+
+        return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
+}
+
+static void qfq_walk(struct Qdisc *sch, struct qdisc_walker *arg)
+{
+        struct qfq_sched *q = qdisc_priv(sch);
+        struct qfq_class *cl;
+        struct hlist_node *n;
+        unsigned int i;
+
+        if (arg->stop)
+                return;
+
+        for (i = 0; i < q->clhash.hashsize; i++) {
+                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode) {
+                        if (arg->count < arg->skip) {
+                                arg->count++;
+                                continue;
+                        }
+                        if (arg->fn(sch, (unsigned long)cl, arg) < 0) {
+                                arg->stop = 1;
+                                return;
+                        }
+                        arg->count++;
+                }
+        }
+}
+
+static struct qfq_class *qfq_classify(struct sk_buff *skb, struct Qdisc *sch,
+                                      int *qerr)
+{
+        struct qfq_sched *q = qdisc_priv(sch);
+        struct qfq_class *cl;
+        struct tcf_result res;
+        int result;
+
+        if (TC_H_MAJ(skb->priority ^ sch->handle) == 0) {
+                pr_debug("qfq_classify: found %d\n", skb->priority);
+                cl = qfq_find_class(sch, skb->priority);
+                if (cl != NULL)
+                        return cl;
+        }
+
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
+        result = tc_classify(skb, q->filter_list, &res);
+        if (result >= 0) {
+#ifdef CONFIG_NET_CLS_ACT
+                switch (result) {
+                case TC_ACT_QUEUED:
+                case TC_ACT_STOLEN:
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
+                case TC_ACT_SHOT:
+                        return NULL;
+                }
+#endif
+                cl = (struct qfq_class *)res.class;
+                if (cl == NULL)
+                        cl = qfq_find_class(sch, res.classid);
+                return cl;
+        }
+
+        return NULL;
+}
+
+/* Generic comparison function, handling wraparound. */
+static inline int qfq_gt(u64 a, u64 b)
+{
+        return (s64)(a - b) > 0;
+}
+
+/* Round a precise timestamp to its slotted value. */
+static inline u64 qfq_round_down(u64 ts, unsigned int shift)
+{
+        return ts & ~((1ULL << shift) - 1);
+}
+
+/* return the pointer to the group with lowest index in the bitmap */
+static inline struct qfq_group *qfq_ffs(struct qfq_sched *q,
+                                        unsigned long bitmap)
+{
+        int index = __ffs(bitmap);
+        return &q->groups[index];
+}
+/* Calculate a mask to mimic what would be ffs_from(). */
+static inline unsigned long mask_from(unsigned long bitmap, int from)
+{
+        return bitmap & ~((1UL << from) - 1);
+}
+
+/*
+ * The state computation relies on ER=0, IR=1, EB=2, IB=3
+ * First compute eligibility comparing grp->S, q->V,
+ * then check if someone is blocking us and possibly add EB
+ */
+static int qfq_calc_state(struct qfq_sched *q, const struct qfq_group *grp)
+{
+        /* if S > V we are not eligible */
+        unsigned int state = qfq_gt(grp->S, q->V);
+        unsigned long mask = mask_from(q->bitmaps[ER], grp->index);
+        struct qfq_group *next;
+
+        if (mask) {
+                next = qfq_ffs(q, mask);
+                if (qfq_gt(grp->F, next->F))
+                        state |= EB;
+        }
+
+        return state;
+}
+
+
+/*
+ * In principle
+ *      q->bitmaps[dst] |= q->bitmaps[src] & mask;
+ *      q->bitmaps[src] &= ~mask;
+ * but we should make sure that src != dst
+ */
+static inline void qfq_move_groups(struct qfq_sched *q, unsigned long mask,
+                                   int src, int dst)
+{
+        q->bitmaps[dst] |= q->bitmaps[src] & mask;
+        q->bitmaps[src] &= ~mask;
+}
+
+static void qfq_unblock_groups(struct qfq_sched *q, int index, u64 old_F)
+{
+        unsigned long mask = mask_from(q->bitmaps[ER], index + 1);
+        struct qfq_group *next;
+
+        if (mask) {
+                next = qfq_ffs(q, mask);
+                if (!qfq_gt(next->F, old_F))
+                        return;
+        }
+
+        mask = (1UL << index) - 1;
+        qfq_move_groups(q, mask, EB, ER);
+        qfq_move_groups(q, mask, IB, IR);
+}
+
+/*
+ * perhaps
+ *
+        old_V ^= q->V;
+        old_V >>= QFQ_MIN_SLOT_SHIFT;
+        if (old_V) {
+                ...
+        }
+ *
+ */
+static void qfq_make_eligible(struct qfq_sched *q, u64 old_V)
+{
+        unsigned long vslot = q->V >> QFQ_MIN_SLOT_SHIFT;
+        unsigned long old_vslot = old_V >> QFQ_MIN_SLOT_SHIFT;
+
+        if (vslot != old_vslot) {
+                unsigned long mask = (1UL << fls(vslot ^ old_vslot)) - 1;
+                qfq_move_groups(q, mask, IR, ER);
+                qfq_move_groups(q, mask, IB, EB);
+        }
+}
+
+
+/*
+ * XXX we should make sure that slot becomes less than 32.
+ * This is guaranteed by the input values.
+ * roundedS is always cl->S rounded on grp->slot_shift bits.
+ */
+static void qfq_slot_insert(struct qfq_group *grp, struct qfq_class *cl,
+                            u64 roundedS)
+{
+        u64 slot = (roundedS - grp->S) >> grp->slot_shift;
+        unsigned int i = (grp->front + slot) % QFQ_MAX_SLOTS;
+
+        hlist_add_head(&cl->next, &grp->slots[i]);
+        __set_bit(slot, &grp->full_slots);
+}
+
+/* Maybe introduce hlist_first_entry?? */
+static struct qfq_class *qfq_slot_head(struct qfq_group *grp)
+{
+        return hlist_entry(grp->slots[grp->front].first,
+                           struct qfq_class, next);
+}
+
+/*
+ * remove the entry from the slot
+ */
+static void qfq_front_slot_remove(struct qfq_group *grp)
+{
+        struct qfq_class *cl = qfq_slot_head(grp);
+
+        BUG_ON(!cl);
+        hlist_del(&cl->next);
+        if (hlist_empty(&grp->slots[grp->front]))
+                __clear_bit(0, &grp->full_slots);
+}
+
+/*
+ * Returns the first full queue in a group. As a side effect,
+ * adjust the bucket list so the first non-empty bucket is at
+ * position 0 in full_slots.
+ */
+static struct qfq_class *qfq_slot_scan(struct qfq_group *grp)
+{
+        unsigned int i;
+
+        pr_debug("qfq slot_scan: grp %u full %#lx\n",
+                 grp->index, grp->full_slots);
+
+        if (grp->full_slots == 0)
+                return NULL;
+
+        i = __ffs(grp->full_slots);  /* zero based */
+        if (i > 0) {
+                grp->front = (grp->front + i) % QFQ_MAX_SLOTS;
+                grp->full_slots >>= i;
+        }
+
+        return qfq_slot_head(grp);
+}
+
+/*
+ * adjust the bucket list. When the start time of a group decreases,
+ * we move the index down (modulo QFQ_MAX_SLOTS) so we don't need to
+ * move the objects. The mask of occupied slots must be shifted
+ * because we use ffs() to find the first non-empty slot.
+ * This covers decreases in the group's start time, but what about
+ * increases of the start time ?
+ * Here too we should make sure that i is less than 32
+ */
+static void qfq_slot_rotate(struct qfq_group *grp, u64 roundedS)
+{
+        unsigned int i = (grp->S - roundedS) >> grp->slot_shift;
+
+        grp->full_slots <<= i;
+        grp->front = (grp->front - i) % QFQ_MAX_SLOTS;
+}
+
+static void qfq_update_eligible(struct qfq_sched *q, u64 old_V)
+{
+        struct qfq_group *grp;
+        unsigned long ineligible;
+
+        ineligible = q->bitmaps[IR] | q->bitmaps[IB];
+        if (ineligible) {
+                if (!q->bitmaps[ER]) {
+                        grp = qfq_ffs(q, ineligible);
+                        if (qfq_gt(grp->S, q->V))
+                                q->V = grp->S;
+                }
+                qfq_make_eligible(q, old_V);
+        }
+}
+
+/* What is length of next packet in queue (0 if queue is empty) */
+static unsigned int qdisc_peek_len(struct Qdisc *sch)
+{
+        struct sk_buff *skb;
+
+        skb = sch->ops->peek(sch);
+        return skb ? qdisc_pkt_len(skb) : 0;
+}
+
+/*
+ * Updates the class, returns true if also the group needs to be updated.
+ */
+static bool qfq_update_class(struct qfq_group *grp, struct qfq_class *cl)
+{
+        unsigned int len = qdisc_peek_len(cl->qdisc);
+
+        cl->S = cl->F;
+        if (!len)
+                qfq_front_slot_remove(grp);     /* queue is empty */
+        else {
+                u64 roundedS;
+
+                cl->F = cl->S + (u64)len * cl->inv_w;
+                roundedS = qfq_round_down(cl->S, grp->slot_shift);
+                if (roundedS == grp->S)
+                        return false;
+
+                qfq_front_slot_remove(grp);
+                qfq_slot_insert(grp, cl, roundedS);
+        }
+
+        return true;
+}
+
+static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
+{
+        struct qfq_sched *q = qdisc_priv(sch);
+        struct qfq_group *grp;
+        struct qfq_class *cl;
+        struct sk_buff *skb;
+        unsigned int len;
+        u64 old_V;
+
+        if (!q->bitmaps[ER])
+                return NULL;
+
+        grp = qfq_ffs(q, q->bitmaps[ER]);
+
+        cl = qfq_slot_head(grp);
+        skb = qdisc_dequeue_peeked(cl->qdisc);
+        if (!skb) {
+                WARN_ONCE(1, "qfq_dequeue: non-workconserving leaf\n");
+                return NULL;
+        }
+
+        sch->q.qlen--;
+        qdisc_bstats_update(sch, skb);
+
+        old_V = q->V;
+        len = qdisc_pkt_len(skb);
+        q->V += (u64)len * IWSUM;
+        pr_debug("qfq dequeue: len %u F %lld now %lld\n",
+                 len, (unsigned long long) cl->F, (unsigned long long) q->V);
+
+        if (qfq_update_class(grp, cl)) {
+                u64 old_F = grp->F;
+
+                cl = qfq_slot_scan(grp);
+                if (!cl)
+                        __clear_bit(grp->index, &q->bitmaps[ER]);
+                else {
+                        u64 roundedS = qfq_round_down(cl->S, grp->slot_shift);
+                        unsigned int s;
+
+                        if (grp->S == roundedS)
+                                goto skip_unblock;
+                        grp->S = roundedS;
+                        grp->F = roundedS + (2ULL << grp->slot_shift);
+                        __clear_bit(grp->index, &q->bitmaps[ER]);
+                        s = qfq_calc_state(q, grp);
+                        __set_bit(grp->index, &q->bitmaps[s]);
+                }
+
+                qfq_unblock_groups(q, grp->index, old_F);
+        }
+
+skip_unblock:
+        qfq_update_eligible(q, old_V);
+
+        return skb;
+}
+
+/*
+ * Assign a reasonable start time for a new flow k in group i.
+ * Admissible values for \hat(F) are multiples of \sigma_i
+ * no greater than V+\sigma_i . Larger values mean that
+ * we had a wraparound so we consider the timestamp to be stale.
+ *
+ * If F is not stale and F >= V then we set S = F.
+ * Otherwise we should assign S = V, but this may violate
+ * the ordering in ER. So, if we have groups in ER, set S to
+ * the F_j of the first group j which would be blocking us.
+ * We are guaranteed not to move S backward because
+ * otherwise our group i would still be blocked.
+ */
+static void qfq_update_start(struct qfq_sched *q, struct qfq_class *cl)
+{
+        unsigned long mask;
+        uint32_t limit, roundedF;
+        int slot_shift = cl->grp->slot_shift;
+
+        roundedF = qfq_round_down(cl->F, slot_shift);
+        limit = qfq_round_down(q->V, slot_shift) + (1UL << slot_shift);
+
+        if (!qfq_gt(cl->F, q->V) || qfq_gt(roundedF, limit)) {
+                /* timestamp was stale */
+                mask = mask_from(q->bitmaps[ER], cl->grp->index);
+                if (mask) {
+                        struct qfq_group *next = qfq_ffs(q, mask);
+                        if (qfq_gt(roundedF, next->F)) {
+                                cl->S = next->F;
+                                return;
+                        }
+                }
+                cl->S = q->V;
+        } else  /* timestamp is not stale */
+                cl->S = cl->F;
+}
+
+static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+{
+        struct qfq_sched *q = qdisc_priv(sch);
+        struct qfq_group *grp;
+        struct qfq_class *cl;
+        int err;
+        u64 roundedS;
+        int s;
+
+        cl = qfq_classify(skb, sch, &err);
+        if (cl == NULL) {
+                if (err & __NET_XMIT_BYPASS)
+                        sch->qstats.drops++;
+                kfree_skb(skb);
+                return err;
+        }
+        pr_debug("qfq_enqueue: cl = %x\n", cl->common.classid);
+
+        err = qdisc_enqueue(skb, cl->qdisc);
+        if (unlikely(err != NET_XMIT_SUCCESS)) {
+                pr_debug("qfq_enqueue: enqueue failed %d\n", err);
+                if (net_xmit_drop_count(err)) {
+                        cl->qstats.drops++;
+                        sch->qstats.drops++;
+                }
+                return err;
+        }
+
+        bstats_update(&cl->bstats, skb);
+        ++sch->q.qlen;
+
+        /* If the new skb is not the head of queue, then done here. */
+        if (cl->qdisc->q.qlen != 1)
+                return err;
+
+        /* If reach this point, queue q was idle */
+        grp = cl->grp;
+        qfq_update_start(q, cl);
+
+        /* compute new finish time and rounded start. */
+        cl->F = cl->S + (u64)qdisc_pkt_len(skb) * cl->inv_w;
+        roundedS = qfq_round_down(cl->S, grp->slot_shift);
+
+        /*
+         * insert cl in the correct bucket.
+         * If cl->S >= grp->S we don't need to adjust the
+         * bucket list and simply go to the insertion phase.
+         * Otherwise grp->S is decreasing, we must make room
+         * in the bucket list, and also recompute the group state.
+         * Finally, if there were no flows in this group and nobody
+         * was in ER make sure to adjust V.
+         */
+        if (grp->full_slots) {
+                if (!qfq_gt(grp->S, cl->S))
+                        goto skip_update;
+
+                /* create a slot for this cl->S */
+                qfq_slot_rotate(grp, roundedS);
+                /* group was surely ineligible, remove */
+                __clear_bit(grp->index, &q->bitmaps[IR]);
+                __clear_bit(grp->index, &q->bitmaps[IB]);
+        } else if (!q->bitmaps[ER] && qfq_gt(roundedS, q->V))
+                q->V = roundedS;
+
+        grp->S = roundedS;
+        grp->F = roundedS + (2ULL << grp->slot_shift);
+        s = qfq_calc_state(q, grp);
+        __set_bit(grp->index, &q->bitmaps[s]);
+
+        pr_debug("qfq enqueue: new state %d %#lx S %lld F %lld V %lld\n",
+                 s, q->bitmaps[s],
+                 (unsigned long long) cl->S,
+                 (unsigned long long) cl->F,
+                 (unsigned long long) q->V);
+
+skip_update:
+        qfq_slot_insert(grp, cl, roundedS);
+
+        return err;
+}
+
+
+static void qfq_slot_remove(struct qfq_sched *q, struct qfq_group *grp,
+                            struct qfq_class *cl)
+{
+        unsigned int i, offset;
+        u64 roundedS;
+
+        roundedS = qfq_round_down(cl->S, grp->slot_shift);
+        offset = (roundedS - grp->S) >> grp->slot_shift;
+        i = (grp->front + offset) % QFQ_MAX_SLOTS;
+
+        hlist_del(&cl->next);
+        if (hlist_empty(&grp->slots[i]))
+                __clear_bit(offset, &grp->full_slots);
+}
+
+/*
+ * called to forcibly destroy a queue.
+ * If the queue is not in the front bucket, or if it has
+ * other queues in the front bucket, we can simply remove
+ * the queue with no other side effects.
+ * Otherwise we must propagate the event up.
+ */
+static void qfq_deactivate_class(struct qfq_sched *q, struct qfq_class *cl)
+{
+        struct qfq_group *grp = cl->grp;
+        unsigned long mask;
+        u64 roundedS;
+        int s;
+
+        cl->F = cl->S;
+        qfq_slot_remove(q, grp, cl);
+
+        if (!grp->full_slots) {
+                __clear_bit(grp->index, &q->bitmaps[IR]);
+                __clear_bit(grp->index, &q->bitmaps[EB]);
+                __clear_bit(grp->index, &q->bitmaps[IB]);
+
+                if (test_bit(grp->index, &q->bitmaps[ER]) &&
+                    !(q->bitmaps[ER] & ~((1UL << grp->index) - 1))) {
+                        mask = q->bitmaps[ER] & ((1UL << grp->index) - 1);
+                        if (mask)
+                                mask = ~((1UL << __fls(mask)) - 1);
+                        else
+                                mask = ~0UL;
+                        qfq_move_groups(q, mask, EB, ER);
+                        qfq_move_groups(q, mask, IB, IR);
+                }
+                __clear_bit(grp->index, &q->bitmaps[ER]);
+        } else if (hlist_empty(&grp->slots[grp->front])) {
+                cl = qfq_slot_scan(grp);
+                roundedS = qfq_round_down(cl->S, grp->slot_shift);
+                if (grp->S != roundedS) {
+                        __clear_bit(grp->index, &q->bitmaps[ER]);
+                        __clear_bit(grp->index, &q->bitmaps[IR]);
+                        __clear_bit(grp->index, &q->bitmaps[EB]);
+                        __clear_bit(grp->index, &q->bitmaps[IB]);
+                        grp->S = roundedS;
+                        grp->F = roundedS + (2ULL << grp->slot_shift);
+                        s = qfq_calc_state(q, grp);
+                        __set_bit(grp->index, &q->bitmaps[s]);
+                }
+        }
+
+        qfq_update_eligible(q, q->V);
+}
+
+static void qfq_qlen_notify(struct Qdisc *sch, unsigned long arg)
+{
+        struct qfq_sched *q = qdisc_priv(sch);
+        struct qfq_class *cl = (struct qfq_class *)arg;
+
+        if (cl->qdisc->q.qlen == 0)
+                qfq_deactivate_class(q, cl);
+}
+
+static unsigned int qfq_drop(struct Qdisc *sch)
+{
+        struct qfq_sched *q = qdisc_priv(sch);
+        struct qfq_group *grp;
+        unsigned int i, j, len;
+
+        for (i = 0; i <= QFQ_MAX_INDEX; i++) {
+                grp = &q->groups[i];
+                for (j = 0; j < QFQ_MAX_SLOTS; j++) {
+                        struct qfq_class *cl;
+                        struct hlist_node *n;
+
+                        hlist_for_each_entry(cl, n, &grp->slots[j], next) {
+
+                                if (!cl->qdisc->ops->drop)
+                                        continue;
+
+                                len = cl->qdisc->ops->drop(cl->qdisc);
+                                if (len > 0) {
+                                        sch->q.qlen--;
+                                        if (!cl->qdisc->q.qlen)
+                                                qfq_deactivate_class(q, cl);
+
+                                        return len;
+                                }
+                        }
+                }
+        }
+
+        return 0;
+}
+
+static int qfq_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct qfq_sched *q = qdisc_priv(sch);
+        struct qfq_group *grp;
+        int i, j, err;
+
+        err = qdisc_class_hash_init(&q->clhash);
+        if (err < 0)
+                return err;
+
+        for (i = 0; i <= QFQ_MAX_INDEX; i++) {
+                grp = &q->groups[i];
+                grp->index = i;
+                grp->slot_shift = QFQ_MTU_SHIFT + FRAC_BITS
+                                   - (QFQ_MAX_INDEX - i);
+                for (j = 0; j < QFQ_MAX_SLOTS; j++)
+                        INIT_HLIST_HEAD(&grp->slots[j]);
+        }
+
+        return 0;
+}
+
+static void qfq_reset_qdisc(struct Qdisc *sch)
+{
+        struct qfq_sched *q = qdisc_priv(sch);
+        struct qfq_group *grp;
+        struct qfq_class *cl;
+        struct hlist_node *n, *tmp;
+        unsigned int i, j;
+
+        for (i = 0; i <= QFQ_MAX_INDEX; i++) {
+                grp = &q->groups[i];
+                for (j = 0; j < QFQ_MAX_SLOTS; j++) {
+                        hlist_for_each_entry_safe(cl, n, tmp,
+                                                  &grp->slots[j], next) {
+                                qfq_deactivate_class(q, cl);
+                        }
+                }
+        }
+
+        for (i = 0; i < q->clhash.hashsize; i++) {
+                hlist_for_each_entry(cl, n, &q->clhash.hash[i], common.hnode)
+                        qdisc_reset(cl->qdisc);
+        }
+        sch->q.qlen = 0;
+}
+
+static void qfq_destroy_qdisc(struct Qdisc *sch)
+{
+        struct qfq_sched *q = qdisc_priv(sch);
+        struct qfq_class *cl;
+        struct hlist_node *n, *next;
+        unsigned int i;
+
+        tcf_destroy_chain(&q->filter_list);
+
+        for (i = 0; i < q->clhash.hashsize; i++) {
+                hlist_for_each_entry_safe(cl, n, next, &q->clhash.hash[i],
+                                          common.hnode) {
+                        qfq_destroy_class(sch, cl);
+                }
+        }
+        qdisc_class_hash_destroy(&q->clhash);
+}
+
+static const struct Qdisc_class_ops qfq_class_ops = {
+        .change         = qfq_change_class,
+        .delete         = qfq_delete_class,
+        .get            = qfq_get_class,
+        .put            = qfq_put_class,
+        .tcf_chain      = qfq_tcf_chain,
+        .bind_tcf       = qfq_bind_tcf,
+        .unbind_tcf     = qfq_unbind_tcf,
+        .graft          = qfq_graft_class,
+        .leaf           = qfq_class_leaf,
+        .qlen_notify    = qfq_qlen_notify,
+        .dump           = qfq_dump_class,
+        .dump_stats     = qfq_dump_class_stats,
+        .walk           = qfq_walk,
+};
+
+static struct Qdisc_ops qfq_qdisc_ops __read_mostly = {
+        .cl_ops         = &qfq_class_ops,
+        .id             = "qfq",
+        .priv_size      = sizeof(struct qfq_sched),
+        .enqueue        = qfq_enqueue,
+        .dequeue        = qfq_dequeue,
+        .peek           = qdisc_peek_dequeued,
+        .drop           = qfq_drop,
+        .init           = qfq_init_qdisc,
+        .reset          = qfq_reset_qdisc,
+        .destroy        = qfq_destroy_qdisc,
+        .owner          = THIS_MODULE,
+};
+
+static int __init qfq_init(void)
+{
+        return register_qdisc(&qfq_qdisc_ops);
+}
+
+static void __exit qfq_exit(void)
+{
+        unregister_qdisc(&qfq_qdisc_ops);
+}
+
+module_init(qfq_init);
+module_exit(qfq_exit);
+MODULE_LICENSE("GPL");
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index c2e628dfaacc..7ef87f9eb675 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -169,7 +169,7 @@ static unsigned int sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
         }
         case htons(ETH_P_IPV6):
         {
-                struct ipv6hdr *iph;
+                const struct ipv6hdr *iph;
                 int poff;
 
                 if (!pskb_network_may_pull(skb, sizeof(*iph)))
diff --git a/net/sctp/debug.c b/net/sctp/debug.c
index bf24fa697de2..ec997cfe0a7e 100644
--- a/net/sctp/debug.c
+++ b/net/sctp/debug.c
@@ -98,7 +98,6 @@ const char *sctp_cname(const sctp_subtype_t cid)
 
 /* These are printable forms of the states.  */
 const char *const sctp_state_tbl[SCTP_STATE_NUM_STATES] = {
-        "STATE_EMPTY",
         "STATE_CLOSED",
         "STATE_COOKIE_WAIT",
         "STATE_COOKIE_ECHOED",
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index e10acc01c75f..c8cc24e282c3 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -325,6 +325,7 @@ static struct sctp_association *__sctp_endpoint_lookup_assoc(
         struct sctp_transport **transport)
 {
         struct sctp_association *asoc = NULL;
+        struct sctp_association *tmp;
         struct sctp_transport *t = NULL;
         struct sctp_hashbucket *head;
         struct sctp_ep_common *epb;
@@ -333,25 +334,32 @@ static struct sctp_association *__sctp_endpoint_lookup_assoc(
         int rport;
 
         *transport = NULL;
+
+        /* If the local port is not set, there can't be any associations
+         * on this endpoint.
+         */
+        if (!ep->base.bind_addr.port)
+                goto out;
+
         rport = ntohs(paddr->v4.sin_port);
 
         hash = sctp_assoc_hashfn(ep->base.bind_addr.port, rport);
         head = &sctp_assoc_hashtable[hash];
         read_lock(&head->lock);
         sctp_for_each_hentry(epb, node, &head->chain) {
-                asoc = sctp_assoc(epb);
-                if (asoc->ep != ep || rport != asoc->peer.port)
-                        goto next;
+                tmp = sctp_assoc(epb);
+                if (tmp->ep != ep || rport != tmp->peer.port)
+                        continue;
 
-                t = sctp_assoc_lookup_paddr(asoc, paddr);
+                t = sctp_assoc_lookup_paddr(tmp, paddr);
                 if (t) {
+                        asoc = tmp;
                         *transport = t;
                         break;
                 }
-next:
-                asoc = NULL;
         }
         read_unlock(&head->lock);
+out:
         return asoc;
 }
 
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 5436c6921167..741ed1648838 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -565,7 +565,7 @@ void sctp_err_finish(struct sock *sk, struct sctp_association *asoc)
  */
 void sctp_v4_err(struct sk_buff *skb, __u32 info)
 {
-        struct iphdr *iph = (struct iphdr *)skb->data;
+        const struct iphdr *iph = (const struct iphdr *)skb->data;
         const int ihlen = iph->ihl * 4;
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
@@ -661,7 +661,6 @@ static int sctp_rcv_ootb(struct sk_buff *skb)
 {
         sctp_chunkhdr_t *ch;
         __u8 *ch_end;
-        sctp_errhdr_t *err;
 
         ch = (sctp_chunkhdr_t *) skb->data;
 
@@ -697,20 +696,6 @@ static int sctp_rcv_ootb(struct sk_buff *skb)
                 if (SCTP_CID_INIT == ch->type && (void *)ch != skb->data)
                         goto discard;
 
-                /* RFC 8.4, 7) If the packet contains a "Stale cookie" ERROR
-                 * or a COOKIE ACK the SCTP Packet should be silently
-                 * discarded.
-                 */
-                if (SCTP_CID_COOKIE_ACK == ch->type)
-                        goto discard;
-
-                if (SCTP_CID_ERROR == ch->type) {
-                        sctp_walk_errors(err, ch) {
-                                if (SCTP_ERROR_STALE_COOKIE == err->cause)
-                                        goto discard;
-                        }
-                }
-
                 ch = (sctp_chunkhdr_t *) ch_end;
         } while (ch_end < skb_tail_pointer(skb));
 
@@ -1017,7 +1002,7 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
         /* Skip over the ADDIP header and find the Address parameter */
         param = (union sctp_addr_param *)(asconf + 1);
 
-        af = sctp_get_af_specific(param_type2af(param->v4.param_hdr.type));
+        af = sctp_get_af_specific(param_type2af(param->p.type));
         if (unlikely(!af))
                 return NULL;
 
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 865ce7ba4e14..500875f4dc41 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -80,6 +80,13 @@
 
 #include <asm/uaccess.h>
 
+static inline int sctp_v6_addr_match_len(union sctp_addr *s1,
+                                         union sctp_addr *s2);
+static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr,
+                              __be16 port);
+static int sctp_v6_cmp_addr(const union sctp_addr *addr1,
+                            const union sctp_addr *addr2);
+
 /* Event handler for inet6 address addition/deletion events.
  * The sctp_local_addr_list needs to be protocted by a spin lock since
  * multiple notifiers (say IPv4 and IPv6) may be running at the same
@@ -240,37 +247,107 @@ static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
 /* Returns the dst cache entry for the given source and destination ip
  * addresses.
  */
-static struct dst_entry *sctp_v6_get_dst(struct sctp_association *asoc,
-                                         union sctp_addr *daddr,
-                                         union sctp_addr *saddr)
+static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+                            struct flowi *fl, struct sock *sk)
 {
-        struct dst_entry *dst;
-        struct flowi6 fl6;
+        struct sctp_association *asoc = t->asoc;
+        struct dst_entry *dst = NULL;
+        struct flowi6 *fl6 = &fl->u.ip6;
+        struct sctp_bind_addr *bp;
+        struct sctp_sockaddr_entry *laddr;
+        union sctp_addr *baddr = NULL;
+        union sctp_addr *daddr = &t->ipaddr;
+        union sctp_addr dst_saddr;
+        __u8 matchlen = 0;
+        __u8 bmatchlen;
+        sctp_scope_t scope;
 
-        memset(&fl6, 0, sizeof(fl6));
-        ipv6_addr_copy(&fl6.daddr, &daddr->v6.sin6_addr);
+        memset(fl6, 0, sizeof(struct flowi6));
+        ipv6_addr_copy(&fl6->daddr, &daddr->v6.sin6_addr);
+        fl6->fl6_dport = daddr->v6.sin6_port;
+        fl6->flowi6_proto = IPPROTO_SCTP;
         if (ipv6_addr_type(&daddr->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL)
-                fl6.flowi6_oif = daddr->v6.sin6_scope_id;
+                fl6->flowi6_oif = daddr->v6.sin6_scope_id;
 
+        SCTP_DEBUG_PRINTK("%s: DST=%pI6 ", __func__, &fl6->daddr);
 
-        SCTP_DEBUG_PRINTK("%s: DST=%pI6 ", __func__, &fl6.daddr);
+        if (asoc)
+                fl6->fl6_sport = htons(asoc->base.bind_addr.port);
 
         if (saddr) {
-                ipv6_addr_copy(&fl6.saddr, &saddr->v6.sin6_addr);
-                SCTP_DEBUG_PRINTK("SRC=%pI6 - ", &fl6.saddr);
+                ipv6_addr_copy(&fl6->saddr, &saddr->v6.sin6_addr);
+                fl6->fl6_sport = saddr->v6.sin6_port;
+                SCTP_DEBUG_PRINTK("SRC=%pI6 - ", &fl6->saddr);
+        }
+
+        dst = ip6_dst_lookup_flow(sk, fl6, NULL, false);
+        if (!asoc || saddr)
+                goto out;
+
+        bp = &asoc->base.bind_addr;
+        scope = sctp_scope(daddr);
+        /* ip6_dst_lookup has filled in the fl6->saddr for us.  Check
+         * to see if we can use it.
+         */
+        if (!IS_ERR(dst)) {
+                /* Walk through the bind address list and look for a bind
+                 * address that matches the source address of the returned dst.
+                 */
+                sctp_v6_to_addr(&dst_saddr, &fl6->saddr, htons(bp->port));
+                rcu_read_lock();
+                list_for_each_entry_rcu(laddr, &bp->address_list, list) {
+                        if (!laddr->valid || (laddr->state != SCTP_ADDR_SRC))
+                                continue;
+
+                        /* Do not compare against v4 addrs */
+                        if ((laddr->a.sa.sa_family == AF_INET6) &&
+                            (sctp_v6_cmp_addr(&dst_saddr, &laddr->a))) {
+                                rcu_read_unlock();
+                                goto out;
+                        }
+                }
+                rcu_read_unlock();
+                /* None of the bound addresses match the source address of the
+                 * dst. So release it.
+                 */
+                dst_release(dst);
+                dst = NULL;
         }
 
-        dst = ip6_route_output(&init_net, NULL, &fl6);
-        if (!dst->error) {
+        /* Walk through the bind address list and try to get the
+         * best source address for a given destination.
+         */
+        rcu_read_lock();
+        list_for_each_entry_rcu(laddr, &bp->address_list, list) {
+                if (!laddr->valid && laddr->state != SCTP_ADDR_SRC)
+                        continue;
+                if ((laddr->a.sa.sa_family == AF_INET6) &&
+                    (scope <= sctp_scope(&laddr->a))) {
+                        bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
+                        if (!baddr || (matchlen < bmatchlen)) {
+                                baddr = &laddr->a;
+                                matchlen = bmatchlen;
+                        }
+                }
+        }
+        rcu_read_unlock();
+        if (baddr) {
+                ipv6_addr_copy(&fl6->saddr, &baddr->v6.sin6_addr);
+                fl6->fl6_sport = baddr->v6.sin6_port;
+                dst = ip6_dst_lookup_flow(sk, fl6, NULL, false);
+        }
+
+out:
+        if (!IS_ERR(dst)) {
                 struct rt6_info *rt;
                 rt = (struct rt6_info *)dst;
+                t->dst = dst;
                 SCTP_DEBUG_PRINTK("rt6_dst:%pI6 rt6_src:%pI6\n",
-                        &rt->rt6i_dst.addr, &rt->rt6i_src.addr);
-                return dst;
+                        &rt->rt6i_dst.addr, &fl6->saddr);
+        } else {
+                t->dst = NULL;
+                SCTP_DEBUG_PRINTK("NO ROUTE\n");
         }
-        SCTP_DEBUG_PRINTK("NO ROUTE\n");
-        dst_release(dst);
-        return NULL;
 }
 
 /* Returns the number of consecutive initial bits that match in the 2 ipv6
@@ -286,64 +363,18 @@ static inline int sctp_v6_addr_match_len(union sctp_addr *s1,
  * and asoc's bind address list.
  */
 static void sctp_v6_get_saddr(struct sctp_sock *sk,
-                              struct sctp_association *asoc,
-                              struct dst_entry *dst,
-                              union sctp_addr *daddr,
-                              union sctp_addr *saddr)
+                              struct sctp_transport *t,
+                              struct flowi *fl)
 {
-        struct sctp_bind_addr *bp;
-        struct sctp_sockaddr_entry *laddr;
-        sctp_scope_t scope;
-        union sctp_addr *baddr = NULL;
-        __u8 matchlen = 0;
-        __u8 bmatchlen;
+        struct flowi6 *fl6 = &fl->u.ip6;
+        union sctp_addr *saddr = &t->saddr;
 
-        SCTP_DEBUG_PRINTK("%s: asoc:%p dst:%p daddr:%pI6 ",
-                          __func__, asoc, dst, &daddr->v6.sin6_addr);
-
-        if (!asoc) {
-                ipv6_dev_get_saddr(sock_net(sctp_opt2sk(sk)),
-                                   dst ? ip6_dst_idev(dst)->dev : NULL,
-                                   &daddr->v6.sin6_addr,
-                                   inet6_sk(&sk->inet.sk)->srcprefs,
-                                   &saddr->v6.sin6_addr);
-                SCTP_DEBUG_PRINTK("saddr from ipv6_get_saddr: %pI6\n",
-                                  &saddr->v6.sin6_addr);
-                return;
-        }
-
-        scope = sctp_scope(daddr);
-
-        bp = &asoc->base.bind_addr;
+        SCTP_DEBUG_PRINTK("%s: asoc:%p dst:%p\n", __func__, t->asoc, t->dst);
 
-        /* Go through the bind address list and find the best source address
-         * that matches the scope of the destination address.
-         */
-        rcu_read_lock();
-        list_for_each_entry_rcu(laddr, &bp->address_list, list) {
-                if (!laddr->valid)
-                        continue;
-                if ((laddr->state == SCTP_ADDR_SRC) &&
-                    (laddr->a.sa.sa_family == AF_INET6) &&
-                    (scope <= sctp_scope(&laddr->a))) {
-                        bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
-                        if (!baddr || (matchlen < bmatchlen)) {
-                                baddr = &laddr->a;
-                                matchlen = bmatchlen;
-                        }
-                }
-        }
-
-        if (baddr) {
-                memcpy(saddr, baddr, sizeof(union sctp_addr));
-                SCTP_DEBUG_PRINTK("saddr: %pI6\n", &saddr->v6.sin6_addr);
-        } else {
-                pr_err("%s: asoc:%p Could not find a valid source "
-                       "address for the dest:%pI6\n",
-                       __func__, asoc, &daddr->v6.sin6_addr);
+        if (t->dst) {
+                saddr->v6.sin6_family = AF_INET6;
+                ipv6_addr_copy(&saddr->v6.sin6_addr, &fl6->saddr);
         }
-
-        rcu_read_unlock();
 }
 
 /* Make a copy of all potential local addresses. */
@@ -465,14 +496,13 @@ static int sctp_v6_to_addr_param(const union sctp_addr *addr,
         return length;
 }
 
-/* Initialize a sctp_addr from a dst_entry. */
-static void sctp_v6_dst_saddr(union sctp_addr *addr, struct dst_entry *dst,
+/* Initialize a sctp_addr from struct in6_addr. */
+static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr,
                               __be16 port)
 {
-        struct rt6_info *rt = (struct rt6_info *)dst;
         addr->sa.sa_family = AF_INET6;
         addr->v6.sin6_port = port;
-        ipv6_addr_copy(&addr->v6.sin6_addr, &rt->rt6i_src.addr);
+        ipv6_addr_copy(&addr->v6.sin6_addr, saddr);
 }
 
 /* Compare addresses exactly.
@@ -531,7 +561,7 @@ static int sctp_v6_is_any(const union sctp_addr *addr)
 static int sctp_v6_available(union sctp_addr *addr, struct sctp_sock *sp)
 {
         int type;
-        struct in6_addr *in6 = (struct in6_addr *)&addr->v6.sin6_addr;
+        const struct in6_addr *in6 = (const struct in6_addr *)&addr->v6.sin6_addr;
 
         type = ipv6_addr_type(in6);
         if (IPV6_ADDR_ANY == type)
@@ -959,7 +989,6 @@ static struct sctp_af sctp_af_inet6 = {
         .to_sk_daddr       = sctp_v6_to_sk_daddr,
         .from_addr_param   = sctp_v6_from_addr_param,
         .to_addr_param     = sctp_v6_to_addr_param,
-        .dst_saddr         = sctp_v6_dst_saddr,
         .cmp_addr          = sctp_v6_cmp_addr,
         .scope             = sctp_v6_scope,
         .addr_valid        = sctp_v6_addr_valid,
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index bf92a5b68f8b..1c88c8911dc5 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -131,7 +131,8 @@ static inline int sctp_cacc_skip_3_1_d(struct sctp_transport *primary,
 static inline int sctp_cacc_skip_3_1_f(struct sctp_transport *transport,
                                        int count_of_newacks)
 {
-        if (count_of_newacks < 2 && !transport->cacc.cacc_saw_newack)
+        if (count_of_newacks < 2 &&
+                        (transport && !transport->cacc.cacc_saw_newack))
                 return 1;
         return 0;
 }
@@ -319,7 +320,6 @@ int sctp_outq_tail(struct sctp_outq *q, struct sctp_chunk *chunk)
                  * chunk.
                  */
                 switch (q->asoc->state) {
-                case SCTP_STATE_EMPTY:
                 case SCTP_STATE_CLOSED:
                 case SCTP_STATE_SHUTDOWN_PENDING:
                 case SCTP_STATE_SHUTDOWN_SENT:
@@ -577,6 +577,13 @@ static int sctp_outq_flush_rtx(struct sctp_outq *q, struct sctp_packet *pkt,
          * try to send as much as possible.
          */
         list_for_each_entry_safe(chunk, chunk1, lqueue, transmitted_list) {
+                /* If the chunk is abandoned, move it to abandoned list. */
+                if (sctp_chunk_abandoned(chunk)) {
+                        list_del_init(&chunk->transmitted_list);
+                        sctp_insert_list(&q->abandoned,
+                                         &chunk->transmitted_list);
+                        continue;
+                }
 
                 /* Make sure that Gap Acked TSNs are not retransmitted.  A
                  * simple approach is just to move such TSNs out of the
@@ -618,9 +625,12 @@ redo:
 
                         /* If we are retransmitting, we should only
                          * send a single packet.
+                         * Otherwise, try appending this chunk again.
                          */
                         if (rtx_timeout || fast_rtx)
                                 done = 1;
+                        else
+                                goto redo;
 
                         /* Bundle next chunk in the next round.  */
                         break;
@@ -1683,8 +1693,9 @@ static void sctp_mark_missing(struct sctp_outq *q,
                         /* SFR-CACC may require us to skip marking
                          * this chunk as missing.
                          */
-                        if (!transport || !sctp_cacc_skip(primary, transport,
-                                            count_of_newacks, tsn)) {
+                        if (!transport || !sctp_cacc_skip(primary,
+                                                chunk->transport,
+                                                count_of_newacks, tsn)) {
                                 chunk->tsn_missing_report++;
 
                                 SCTP_DEBUG_PRINTK(
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index d5bf91d04f63..69fbc55cf18e 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -339,13 +339,12 @@ static int sctp_v4_to_addr_param(const union sctp_addr *addr,
 }
 
 /* Initialize a sctp_addr from a dst_entry. */
-static void sctp_v4_dst_saddr(union sctp_addr *saddr, struct dst_entry *dst,
+static void sctp_v4_dst_saddr(union sctp_addr *saddr, struct flowi4 *fl4,
                               __be16 port)
 {
-        struct rtable *rt = (struct rtable *)dst;
         saddr->v4.sin_family = AF_INET;
         saddr->v4.sin_port = port;
-        saddr->v4.sin_addr.s_addr = rt->rt_src;
+        saddr->v4.sin_addr.s_addr = fl4->saddr;
 }
 
 /* Compare two addresses exactly. */
@@ -463,35 +462,36 @@ static sctp_scope_t sctp_v4_scope(union sctp_addr *addr)
  * addresses. If an association is passed, trys to get a dst entry with a
  * source address that matches an address in the bind address list.
  */
-static struct dst_entry *sctp_v4_get_dst(struct sctp_association *asoc,
-                                         union sctp_addr *daddr,
-                                         union sctp_addr *saddr)
+static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+                                struct flowi *fl, struct sock *sk)
 {
+        struct sctp_association *asoc = t->asoc;
         struct rtable *rt;
-        struct flowi4 fl4;
+        struct flowi4 *fl4 = &fl->u.ip4;
         struct sctp_bind_addr *bp;
         struct sctp_sockaddr_entry *laddr;
         struct dst_entry *dst = NULL;
+        union sctp_addr *daddr = &t->ipaddr;
         union sctp_addr dst_saddr;
 
-        memset(&fl4, 0x0, sizeof(struct flowi4));
-        fl4.daddr  = daddr->v4.sin_addr.s_addr;
-        fl4.fl4_dport = daddr->v4.sin_port;
-        fl4.flowi4_proto = IPPROTO_SCTP;
+        memset(fl4, 0x0, sizeof(struct flowi4));
+        fl4->daddr  = daddr->v4.sin_addr.s_addr;
+        fl4->fl4_dport = daddr->v4.sin_port;
+        fl4->flowi4_proto = IPPROTO_SCTP;
         if (asoc) {
-                fl4.flowi4_tos = RT_CONN_FLAGS(asoc->base.sk);
-                fl4.flowi4_oif = asoc->base.sk->sk_bound_dev_if;
-                fl4.fl4_sport = htons(asoc->base.bind_addr.port);
+                fl4->flowi4_tos = RT_CONN_FLAGS(asoc->base.sk);
+                fl4->flowi4_oif = asoc->base.sk->sk_bound_dev_if;
+                fl4->fl4_sport = htons(asoc->base.bind_addr.port);
         }
         if (saddr) {
-                fl4.saddr = saddr->v4.sin_addr.s_addr;
-                fl4.fl4_sport = saddr->v4.sin_port;
+                fl4->saddr = saddr->v4.sin_addr.s_addr;
+                fl4->fl4_sport = saddr->v4.sin_port;
         }
 
         SCTP_DEBUG_PRINTK("%s: DST:%pI4, SRC:%pI4 - ",
-                          __func__, &fl4.daddr, &fl4.saddr);
+                          __func__, &fl4->daddr, &fl4->saddr);
 
-        rt = ip_route_output_key(&init_net, &fl4);
+        rt = ip_route_output_key(&init_net, fl4);
         if (!IS_ERR(rt))
                 dst = &rt->dst;
 
@@ -507,7 +507,7 @@ static struct dst_entry *sctp_v4_get_dst(struct sctp_association *asoc,
                 /* Walk through the bind address list and look for a bind
                  * address that matches the source address of the returned dst.
                  */
-                sctp_v4_dst_saddr(&dst_saddr, dst, htons(bp->port));
+                sctp_v4_dst_saddr(&dst_saddr, fl4, htons(bp->port));
                 rcu_read_lock();
                 list_for_each_entry_rcu(laddr, &bp->address_list, list) {
                         if (!laddr->valid || (laddr->state != SCTP_ADDR_SRC))
@@ -533,9 +533,9 @@ static struct dst_entry *sctp_v4_get_dst(struct sctp_association *asoc,
                         continue;
                 if ((laddr->state == SCTP_ADDR_SRC) &&
                     (AF_INET == laddr->a.sa.sa_family)) {
-                        fl4.saddr = laddr->a.v4.sin_addr.s_addr;
-                        fl4.fl4_sport = laddr->a.v4.sin_port;
-                        rt = ip_route_output_key(&init_net, &fl4);
+                        fl4->saddr = laddr->a.v4.sin_addr.s_addr;
+                        fl4->fl4_sport = laddr->a.v4.sin_port;
+                        rt = ip_route_output_key(&init_net, fl4);
                         if (!IS_ERR(rt)) {
                                 dst = &rt->dst;
                                 goto out_unlock;
@@ -546,32 +546,26 @@ static struct dst_entry *sctp_v4_get_dst(struct sctp_association *asoc,
 out_unlock:
         rcu_read_unlock();
 out:
+        t->dst = dst;
         if (dst)
                 SCTP_DEBUG_PRINTK("rt_dst:%pI4, rt_src:%pI4\n",
-                                  &rt->rt_dst, &rt->rt_src);
+                                  &fl4->daddr, &fl4->saddr);
         else
                 SCTP_DEBUG_PRINTK("NO ROUTE\n");
-
-        return dst;
 }
 
 /* For v4, the source address is cached in the route entry(dst). So no need
  * to cache it separately and hence this is an empty routine.
  */
 static void sctp_v4_get_saddr(struct sctp_sock *sk,
-                              struct sctp_association *asoc,
-                              struct dst_entry *dst,
-                              union sctp_addr *daddr,
-                              union sctp_addr *saddr)
+                              struct sctp_transport *t,
+                              struct flowi *fl)
 {
-        struct rtable *rt = (struct rtable *)dst;
-
-        if (!asoc)
-                return;
+        union sctp_addr *saddr = &t->saddr;
+        struct rtable *rt = (struct rtable *)t->dst;
 
         if (rt) {
                 saddr->v4.sin_family = AF_INET;
-                saddr->v4.sin_port = htons(asoc->base.bind_addr.port);
                 saddr->v4.sin_addr.s_addr = rt->rt_src;
         }
 }
@@ -950,7 +944,6 @@ static struct sctp_af sctp_af_inet = {
         .to_sk_daddr       = sctp_v4_to_sk_daddr,
         .from_addr_param   = sctp_v4_from_addr_param,
         .to_addr_param     = sctp_v4_to_addr_param,
-        .dst_saddr         = sctp_v4_dst_saddr,
         .cmp_addr          = sctp_v4_cmp_addr,
         .addr_valid        = sctp_v4_addr_valid,
         .inaddr_any        = sctp_v4_inaddr_any,
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index b3434cc7d0cf..58eb27fed4b4 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1075,20 +1075,28 @@ nodata:
 
 /* Make a HEARTBEAT chunk.  */
 struct sctp_chunk *sctp_make_heartbeat(const struct sctp_association *asoc,
-                                  const struct sctp_transport *transport,
-                                  const void *payload, const size_t paylen)
+                                  const struct sctp_transport *transport)
 {
-        struct sctp_chunk *retval = sctp_make_chunk(asoc, SCTP_CID_HEARTBEAT,
-                                                    0, paylen);
+        struct sctp_chunk *retval;
+        sctp_sender_hb_info_t hbinfo;
+
+        retval = sctp_make_chunk(asoc, SCTP_CID_HEARTBEAT, 0, sizeof(hbinfo));
 
         if (!retval)
                 goto nodata;
 
+        hbinfo.param_hdr.type = SCTP_PARAM_HEARTBEAT_INFO;
+        hbinfo.param_hdr.length = htons(sizeof(sctp_sender_hb_info_t));
+        hbinfo.daddr = transport->ipaddr;
+        hbinfo.sent_at = jiffies;
+        hbinfo.hb_nonce = transport->hb_nonce;
+
         /* Cast away the 'const', as this is just telling the chunk
          * what transport it belongs to.
          */
         retval->transport = (struct sctp_transport *) transport;
-        retval->subh.hbs_hdr = sctp_addto_chunk(retval, paylen, payload);
+        retval->subh.hbs_hdr = sctp_addto_chunk(retval, sizeof(hbinfo),
+                                                &hbinfo);
 
 nodata:
         return retval;
@@ -2242,14 +2250,17 @@ int sctp_verify_init(const struct sctp_association *asoc,
  * Returns 0 on failure, else success.
  * FIXME:  This is an association method.
  */
-int sctp_process_init(struct sctp_association *asoc, sctp_cid_t cid,
+int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
                       const union sctp_addr *peer_addr,
                       sctp_init_chunk_t *peer_init, gfp_t gfp)
 {
         union sctp_params param;
         struct sctp_transport *transport;
         struct list_head *pos, *temp;
+        struct sctp_af *af;
+        union sctp_addr addr;
         char *cookie;
+        int src_match = 0;
 
         /* We must include the address that the INIT packet came from.
          * This is the only address that matters for an INIT packet.
@@ -2261,18 +2272,31 @@ int sctp_process_init(struct sctp_association *asoc, sctp_cid_t cid,
          * added as the primary transport.  The source address seems to
          * be a a better choice than any of the embedded addresses.
          */
-        if (peer_addr) {
-                if(!sctp_assoc_add_peer(asoc, peer_addr, gfp, SCTP_ACTIVE))
-                        goto nomem;
-        }
+        if(!sctp_assoc_add_peer(asoc, peer_addr, gfp, SCTP_ACTIVE))
+                goto nomem;
+
+        if (sctp_cmp_addr_exact(sctp_source(chunk), peer_addr))
+                src_match = 1;
 
         /* Process the initialization parameters.  */
         sctp_walk_params(param, peer_init, init_hdr.params) {
+                if (!src_match && (param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
+                    param.p->type == SCTP_PARAM_IPV6_ADDRESS)) {
+                        af = sctp_get_af_specific(param_type2af(param.p->type));
+                        af->from_addr_param(&addr, param.addr,
+                                            chunk->sctp_hdr->source, 0);
+                        if (sctp_cmp_addr_exact(sctp_source(chunk), &addr))
+                                src_match = 1;
+                }
 
                 if (!sctp_process_param(asoc, param, peer_addr, gfp))
                         goto clean_up;
         }
 
+        /* source address of chunk may not match any valid address */
+        if (!src_match)
+                goto clean_up;
+
         /* AUTH: After processing the parameters, make sure that we
          * have all the required info to potentially do authentications.
          */
@@ -2923,7 +2947,7 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
             asconf_param->param_hdr.type != SCTP_PARAM_SET_PRIMARY)
                 return SCTP_ERROR_UNKNOWN_PARAM;
 
-        switch (addr_param->v4.param_hdr.type) {
+        switch (addr_param->p.type) {
         case SCTP_PARAM_IPV6_ADDRESS:
                 if (!asoc->peer.ipv6_address)
                         return SCTP_ERROR_DNS_FAILED;
@@ -2936,7 +2960,7 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
                 return SCTP_ERROR_DNS_FAILED;
         }
 
-        af = sctp_get_af_specific(param_type2af(addr_param->v4.param_hdr.type));
+        af = sctp_get_af_specific(param_type2af(addr_param->p.type));
         if (unlikely(!af))
                 return SCTP_ERROR_DNS_FAILED;
 
@@ -3100,7 +3124,7 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
         /* Skip the address parameter and store a pointer to the first
          * asconf parameter.
          */
-        length = ntohs(addr_param->v4.param_hdr.length);
+        length = ntohs(addr_param->p.length);
         asconf_param = (sctp_addip_param_t *)((void *)addr_param + length);
         chunk_len -= length;
 
@@ -3177,7 +3201,7 @@ static void sctp_asconf_param_success(struct sctp_association *asoc,
                         ((void *)asconf_param + sizeof(sctp_addip_param_t));
 
         /* We have checked the packet before, so we do not check again. */
-        af = sctp_get_af_specific(param_type2af(addr_param->v4.param_hdr.type));
+        af = sctp_get_af_specific(param_type2af(addr_param->p.type));
         af->from_addr_param(&addr, addr_param, htons(bp->port), 0);
 
         switch (asconf_param->param_hdr.type) {
@@ -3193,11 +3217,8 @@ static void sctp_asconf_param_success(struct sctp_association *asoc,
                 local_bh_enable();
                 list_for_each_entry(transport, &asoc->peer.transport_addr_list,
                                 transports) {
-                        if (transport->state == SCTP_ACTIVE)
-                                continue;
                         dst_release(transport->dst);
-                        sctp_transport_route(transport, NULL,
-                                             sctp_sk(asoc->base.sk));
+                        transport->dst = NULL;
                 }
                 break;
         case SCTP_PARAM_DEL_IP:
@@ -3207,8 +3228,7 @@ static void sctp_asconf_param_success(struct sctp_association *asoc,
                 list_for_each_entry(transport, &asoc->peer.transport_addr_list,
                                 transports) {
                         dst_release(transport->dst);
-                        sctp_transport_route(transport, NULL,
-                                             sctp_sk(asoc->base.sk));
+                        transport->dst = NULL;
                 }
                 break;
         default:
@@ -3304,7 +3324,7 @@ int sctp_process_asconf_ack(struct sctp_association *asoc,
         /* Skip the address parameter in the last asconf sent and store a
          * pointer to the first asconf parameter.
          */
-        length = ntohs(addr_param->v4.param_hdr.length);
+        length = ntohs(addr_param->p.length);
         asconf_param = (sctp_addip_param_t *)((void *)addr_param + length);
         asconf_len -= length;
 
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 5f86ee4b54c1..d612ca1ca6c0 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -595,8 +595,7 @@ static int sctp_cmd_process_init(sctp_cmd_seq_t *commands,
          * fail during INIT processing (due to malloc problems),
          * just return the error and stop processing the stack.
          */
-        if (!sctp_process_init(asoc, chunk->chunk_hdr->type,
-                               sctp_source(chunk), peer_init, gfp))
+        if (!sctp_process_init(asoc, chunk, sctp_source(chunk), peer_init, gfp))
                 error = -ENOMEM;
         else
                 error = 0;
@@ -1415,12 +1414,6 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                                         SCTP_RTXR_T3_RTX);
                         break;
 
-                case SCTP_CMD_TRANSMIT:
-                        /* Kick start transmission. */
-                        error = sctp_outq_uncork(&asoc->outqueue);
-                        local_cork = 0;
-                        break;
-
                 case SCTP_CMD_ECN_CE:
                         /* Do delayed CE processing.   */
                         sctp_do_ecn_ce_work(asoc, cmd->obj.u32);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 76792083c379..7f4a4f8368ee 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -393,8 +393,7 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
                 goto nomem_init;
 
         /* The call, sctp_process_init(), can fail on memory allocation.  */
-        if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
-                               sctp_source(chunk),
+        if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
                                (sctp_init_chunk_t *)chunk->chunk_hdr,
                                GFP_ATOMIC))
                 goto nomem_init;
@@ -725,7 +724,7 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
          */
         peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
 
-        if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
+        if (!sctp_process_init(new_asoc, chunk,
                                &chunk->subh.cookie_hdr->c.peer_addr,
                                peer_init, GFP_ATOMIC))
                 goto nomem_init;
@@ -942,18 +941,9 @@ static sctp_disposition_t sctp_sf_heartbeat(const struct sctp_endpoint *ep,
 {
         struct sctp_transport *transport = (struct sctp_transport *) arg;
         struct sctp_chunk *reply;
-        sctp_sender_hb_info_t hbinfo;
-        size_t paylen = 0;
-
-        hbinfo.param_hdr.type = SCTP_PARAM_HEARTBEAT_INFO;
-        hbinfo.param_hdr.length = htons(sizeof(sctp_sender_hb_info_t));
-        hbinfo.daddr = transport->ipaddr;
-        hbinfo.sent_at = jiffies;
-        hbinfo.hb_nonce = transport->hb_nonce;
 
         /* Send a heartbeat to our peer.  */
-        paylen = sizeof(sctp_sender_hb_info_t);
-        reply = sctp_make_heartbeat(asoc, transport, &hbinfo, paylen);
+        reply = sctp_make_heartbeat(asoc, transport);
         if (!reply)
                 return SCTP_DISPOSITION_NOMEM;
 
@@ -1464,8 +1454,7 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
          * Verification Tag and Peers Verification tag into a reserved
          * place (local tie-tag and per tie-tag) within the state cookie.
          */
-        if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
-                               sctp_source(chunk),
+        if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk),
                                (sctp_init_chunk_t *)chunk->chunk_hdr,
                                GFP_ATOMIC))
                 goto nomem;
@@ -1694,8 +1683,7 @@ static sctp_disposition_t sctp_sf_do_dupcook_a(const struct sctp_endpoint *ep,
          */
         peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
 
-        if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
-                               sctp_source(chunk), peer_init,
+        if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
                                GFP_ATOMIC))
                 goto nomem;
 
@@ -1780,8 +1768,7 @@ static sctp_disposition_t sctp_sf_do_dupcook_b(const struct sctp_endpoint *ep,
          * side effects--it is safe to run them here.
          */
         peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
-        if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
-                               sctp_source(chunk), peer_init,
+        if (!sctp_process_init(new_asoc, chunk, sctp_source(chunk), peer_init,
                                GFP_ATOMIC))
                 goto nomem;
 
@@ -2412,8 +2399,15 @@ static sctp_disposition_t __sctp_sf_do_9_1_abort(const struct sctp_endpoint *ep,
 
         /* See if we have an error cause code in the chunk.  */
         len = ntohs(chunk->chunk_hdr->length);
-        if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
+        if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr)) {
+
+                sctp_errhdr_t *err;
+                sctp_walk_errors(err, chunk->chunk_hdr);
+                if ((void *)err != (void *)chunk->chunk_end)
+                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+
                 error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
+        }
 
         sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR, SCTP_ERROR(ECONNRESET));
         /* ASSOC_FAILED will DELETE_TCB. */
@@ -3204,6 +3198,7 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
                                         sctp_cmd_seq_t *commands)
 {
         struct sctp_chunk *chunk = arg;
+        sctp_errhdr_t *err;
 
         if (!sctp_vtag_verify(chunk, asoc))
                 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
@@ -3212,6 +3207,10 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
         if (!sctp_chunk_length_valid(chunk, sizeof(sctp_operr_chunk_t)))
                 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
                                                   commands);
+        sctp_walk_errors(err, chunk->chunk_hdr);
+        if ((void *)err != (void *)chunk->chunk_end)
+                return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+                                                  (void *)err, commands);
 
         sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
                         SCTP_CHUNK(chunk));
@@ -3320,8 +3319,10 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
         struct sctp_chunk *chunk = arg;
         struct sk_buff *skb = chunk->skb;
         sctp_chunkhdr_t *ch;
+        sctp_errhdr_t *err;
         __u8 *ch_end;
         int ootb_shut_ack = 0;
+        int ootb_cookie_ack = 0;
 
         SCTP_INC_STATS(SCTP_MIB_OUTOFBLUES);
 
@@ -3346,6 +3347,23 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
                 if (SCTP_CID_ABORT == ch->type)
                         return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 
+                /* RFC 8.4, 7) If the packet contains a "Stale cookie" ERROR
+                 * or a COOKIE ACK the SCTP Packet should be silently
+                 * discarded.
+                 */
+
+                if (SCTP_CID_COOKIE_ACK == ch->type)
+                        ootb_cookie_ack = 1;
+
+                if (SCTP_CID_ERROR == ch->type) {
+                        sctp_walk_errors(err, ch) {
+                                if (SCTP_ERROR_STALE_COOKIE == err->cause) {
+                                        ootb_cookie_ack = 1;
+                                        break;
+                                }
+                        }
+                }
+
                 /* Report violation if chunk len overflows */
                 ch_end = ((__u8 *)ch) + WORD_ROUND(ntohs(ch->length));
                 if (ch_end > skb_tail_pointer(skb))
@@ -3357,6 +3375,8 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
 
         if (ootb_shut_ack)
                 return sctp_sf_shut_8_4_5(ep, asoc, type, arg, commands);
+        else if (ootb_cookie_ack)
+                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
         else
                 return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
 }
@@ -4343,8 +4363,9 @@ static sctp_disposition_t sctp_sf_violation_chunklen(
 
 /*
  * Handle a protocol violation when the parameter length is invalid.
- * "Invalid" length is identified as smaller than the minimal length a
- * given parameter can be.
+ * If the length is smaller than the minimum length of a given parameter,
+ * or accumulated length in multi parameters exceeds the end of the chunk,
+ * the length is considered as invalid.
  */
 static sctp_disposition_t sctp_sf_violation_paramlen(
                                      const struct sctp_endpoint *ep,
@@ -5056,6 +5077,30 @@ sctp_disposition_t sctp_sf_ignore_primitive(
  ***************************************************************************/
 
 /*
+ * When the SCTP stack has no more user data to send or retransmit, this
+ * notification is given to the user. Also, at the time when a user app
+ * subscribes to this event, if there is no data to be sent or
+ * retransmit, the stack will immediately send up this notification.
+ */
+sctp_disposition_t sctp_sf_do_no_pending_tsn(
+        const struct sctp_endpoint *ep,
+        const struct sctp_association *asoc,
+        const sctp_subtype_t type,
+        void *arg,
+        sctp_cmd_seq_t *commands)
+{
+        struct sctp_ulpevent *event;
+
+        event = sctp_ulpevent_make_sender_dry_event(asoc, GFP_ATOMIC);
+        if (!event)
+                return SCTP_DISPOSITION_NOMEM;
+
+        sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(event));
+
+        return SCTP_DISPOSITION_CONSUME;
+}
+
+/*
  * Start the shutdown negotiation.
  *
  * From Section 9.2:
diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c
index 546d4387fb3c..0338dc6fdc9d 100644
--- a/net/sctp/sm_statetable.c
+++ b/net/sctp/sm_statetable.c
@@ -107,8 +107,6 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 #define TYPE_SCTP_FUNC(func) {.fn = func, .name = #func}
 
 #define TYPE_SCTP_DATA { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -128,8 +126,6 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 } /* TYPE_SCTP_DATA */
 
 #define TYPE_SCTP_INIT { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_do_5_1B_init), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -149,8 +145,6 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 } /* TYPE_SCTP_INIT */
 
 #define TYPE_SCTP_INIT_ACK { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_do_5_2_3_initack), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -170,8 +164,6 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 } /* TYPE_SCTP_INIT_ACK */
 
 #define TYPE_SCTP_SACK { \
-        /*  SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -191,8 +183,6 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 } /* TYPE_SCTP_SACK */
 
 #define TYPE_SCTP_HEARTBEAT { \
-        /*  SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -213,8 +203,6 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 } /* TYPE_SCTP_HEARTBEAT */
 
 #define TYPE_SCTP_HEARTBEAT_ACK { \
-        /*  SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -234,8 +222,6 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 } /* TYPE_SCTP_HEARTBEAT_ACK */
 
 #define TYPE_SCTP_ABORT { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_pdiscard), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -255,8 +241,6 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 } /* TYPE_SCTP_ABORT */
 
 #define TYPE_SCTP_SHUTDOWN { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -276,8 +260,6 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 } /* TYPE_SCTP_SHUTDOWN */
 
 #define TYPE_SCTP_SHUTDOWN_ACK { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -297,8 +279,6 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 } /* TYPE_SCTP_SHUTDOWN_ACK */
 
 #define TYPE_SCTP_ERROR { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -318,8 +298,6 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 } /* TYPE_SCTP_ERROR */
 
 #define TYPE_SCTP_COOKIE_ECHO { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_do_5_1D_ce), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -339,8 +317,6 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 } /* TYPE_SCTP_COOKIE_ECHO */
 
 #define TYPE_SCTP_COOKIE_ACK { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_discard_chunk), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -360,8 +336,6 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 } /* TYPE_SCTP_COOKIE_ACK */
 
 #define TYPE_SCTP_ECN_ECNE { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_discard_chunk), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -381,8 +355,6 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 } /* TYPE_SCTP_ECN_ECNE */
 
 #define TYPE_SCTP_ECN_CWR { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_discard_chunk), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -402,8 +374,6 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 } /* TYPE_SCTP_ECN_CWR */
 
 #define TYPE_SCTP_SHUTDOWN_COMPLETE { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_discard_chunk), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -446,8 +416,6 @@ static const sctp_sm_table_entry_t chunk_event_table[SCTP_NUM_BASE_CHUNK_TYPES][
 }; /* state_fn_t chunk_event_table[][] */
 
 #define TYPE_SCTP_ASCONF { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_discard_chunk), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -467,8 +435,6 @@ static const sctp_sm_table_entry_t chunk_event_table[SCTP_NUM_BASE_CHUNK_TYPES][
 } /* TYPE_SCTP_ASCONF */
 
 #define TYPE_SCTP_ASCONF_ACK { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_discard_chunk), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -496,8 +462,6 @@ static const sctp_sm_table_entry_t addip_chunk_event_table[SCTP_NUM_ADDIP_CHUNK_
 }; /*state_fn_t addip_chunk_event_table[][] */
 
 #define TYPE_SCTP_FWD_TSN { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -524,8 +488,6 @@ static const sctp_sm_table_entry_t prsctp_chunk_event_table[SCTP_NUM_PRSCTP_CHUN
 }; /*state_fn_t prsctp_chunk_event_table[][] */
 
 #define TYPE_SCTP_AUTH { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_ootb), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -553,8 +515,6 @@ static const sctp_sm_table_entry_t auth_chunk_event_table[SCTP_NUM_AUTH_CHUNK_TY
 
 static const sctp_sm_table_entry_t
 chunk_event_table_unknown[SCTP_STATE_NUM_STATES] = {
-        /* SCTP_STATE_EMPTY */
-        TYPE_SCTP_FUNC(sctp_sf_ootb),
         /* SCTP_STATE_CLOSED */
         TYPE_SCTP_FUNC(sctp_sf_ootb),
         /* SCTP_STATE_COOKIE_WAIT */
@@ -575,8 +535,6 @@ chunk_event_table_unknown[SCTP_STATE_NUM_STATES] = {
 
 
 #define TYPE_SCTP_PRIMITIVE_ASSOCIATE  { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_do_prm_asoc), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -596,8 +554,6 @@ chunk_event_table_unknown[SCTP_STATE_NUM_STATES] = {
 } /* TYPE_SCTP_PRIMITIVE_ASSOCIATE */
 
 #define TYPE_SCTP_PRIMITIVE_SHUTDOWN  { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_error_closed), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -617,8 +573,6 @@ chunk_event_table_unknown[SCTP_STATE_NUM_STATES] = {
 } /* TYPE_SCTP_PRIMITIVE_SHUTDOWN */
 
 #define TYPE_SCTP_PRIMITIVE_ABORT  { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_error_closed), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -638,8 +592,6 @@ chunk_event_table_unknown[SCTP_STATE_NUM_STATES] = {
 } /* TYPE_SCTP_PRIMITIVE_ABORT */
 
 #define TYPE_SCTP_PRIMITIVE_SEND  { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_error_closed), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -659,8 +611,6 @@ chunk_event_table_unknown[SCTP_STATE_NUM_STATES] = {
 } /* TYPE_SCTP_PRIMITIVE_SEND */
 
 #define TYPE_SCTP_PRIMITIVE_REQUESTHEARTBEAT  { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_error_closed), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -680,8 +630,6 @@ chunk_event_table_unknown[SCTP_STATE_NUM_STATES] = {
 } /* TYPE_SCTP_PRIMITIVE_REQUESTHEARTBEAT */
 
 #define TYPE_SCTP_PRIMITIVE_ASCONF { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_error_closed), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -713,8 +661,6 @@ static const sctp_sm_table_entry_t primitive_event_table[SCTP_NUM_PRIMITIVE_TYPE
 };
 
 #define TYPE_SCTP_OTHER_NO_PENDING_TSN  { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_ignore_other), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -722,7 +668,7 @@ static const sctp_sm_table_entry_t primitive_event_table[SCTP_NUM_PRIMITIVE_TYPE
         /* SCTP_STATE_COOKIE_ECHOED */ \
         TYPE_SCTP_FUNC(sctp_sf_ignore_other), \
         /* SCTP_STATE_ESTABLISHED */ \
-        TYPE_SCTP_FUNC(sctp_sf_ignore_other), \
+        TYPE_SCTP_FUNC(sctp_sf_do_no_pending_tsn), \
         /* SCTP_STATE_SHUTDOWN_PENDING */ \
         TYPE_SCTP_FUNC(sctp_sf_do_9_2_start_shutdown), \
         /* SCTP_STATE_SHUTDOWN_SENT */ \
@@ -734,8 +680,6 @@ static const sctp_sm_table_entry_t primitive_event_table[SCTP_NUM_PRIMITIVE_TYPE
 }
 
 #define TYPE_SCTP_OTHER_ICMP_PROTO_UNREACH  { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_ignore_other), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -760,8 +704,6 @@ static const sctp_sm_table_entry_t other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_
 };
 
 #define TYPE_SCTP_EVENT_TIMEOUT_NONE { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -781,8 +723,6 @@ static const sctp_sm_table_entry_t other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_
 }
 
 #define TYPE_SCTP_EVENT_TIMEOUT_T1_COOKIE { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -802,8 +742,6 @@ static const sctp_sm_table_entry_t other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_
 }
 
 #define TYPE_SCTP_EVENT_TIMEOUT_T1_INIT { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -823,8 +761,6 @@ static const sctp_sm_table_entry_t other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_
 }
 
 #define TYPE_SCTP_EVENT_TIMEOUT_T2_SHUTDOWN { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -844,8 +780,6 @@ static const sctp_sm_table_entry_t other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_
 }
 
 #define TYPE_SCTP_EVENT_TIMEOUT_T3_RTX { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -865,8 +799,6 @@ static const sctp_sm_table_entry_t other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_
 }
 
 #define TYPE_SCTP_EVENT_TIMEOUT_T4_RTO { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -886,8 +818,6 @@ static const sctp_sm_table_entry_t other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_
 }
 
 #define TYPE_SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -907,8 +837,6 @@ static const sctp_sm_table_entry_t other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_
 }
 
 #define TYPE_SCTP_EVENT_TIMEOUT_HEARTBEAT { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -928,8 +856,6 @@ static const sctp_sm_table_entry_t other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_
 }
 
 #define TYPE_SCTP_EVENT_TIMEOUT_SACK { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_bug), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
         /* SCTP_STATE_COOKIE_WAIT */ \
@@ -949,8 +875,6 @@ static const sctp_sm_table_entry_t other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_
 }
 
 #define TYPE_SCTP_EVENT_TIMEOUT_AUTOCLOSE { \
-        /* SCTP_STATE_EMPTY */ \
-        TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
         /* SCTP_STATE_CLOSED */ \
         TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
         /* SCTP_STATE_COOKIE_WAIT */ \
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index deb82e35a107..33d9ee629b4e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -658,11 +658,15 @@ static int sctp_bindx_rem(struct sock *sk, struct sockaddr *addrs, int addrcnt)
                         goto err_bindx_rem;
                 }
 
-                if (sa_addr->v4.sin_port != htons(bp->port)) {
+                if (sa_addr->v4.sin_port &&
+                    sa_addr->v4.sin_port != htons(bp->port)) {
                         retval = -EINVAL;
                         goto err_bindx_rem;
                 }
 
+                if (!sa_addr->v4.sin_port)
+                        sa_addr->v4.sin_port = htons(bp->port);
+
                 /* FIXME - There is probably a need to check if sk->sk_saddr and
                  * sk->sk_rcv_addr are currently set to one of the addresses to
                  * be removed. This is something which needs to be looked into
@@ -2283,7 +2287,7 @@ static int sctp_apply_peer_addr_params(struct sctp_paddrparams *params,
                         trans->param_flags =
                                 (trans->param_flags & ~SPP_PMTUD) | pmtud_change;
                         if (update) {
-                                sctp_transport_pmtu(trans);
+                                sctp_transport_pmtu(trans, sctp_opt2sk(sp));
                                 sctp_assoc_sync_pmtu(asoc);
                         }
                 } else if (asoc) {
@@ -3215,14 +3219,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
         if (optlen < sizeof(struct sctp_hmacalgo))
                 return -EINVAL;
 
-        hmacs = kmalloc(optlen, GFP_KERNEL);
-        if (!hmacs)
-                return -ENOMEM;
-
-        if (copy_from_user(hmacs, optval, optlen)) {
-                err = -EFAULT;
-                goto out;
-        }
+        hmacs= memdup_user(optval, optlen);
+        if (IS_ERR(hmacs))
+                return PTR_ERR(hmacs);
 
         idents = hmacs->shmac_num_idents;
         if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||
@@ -3257,14 +3256,9 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
         if (optlen <= sizeof(struct sctp_authkey))
                 return -EINVAL;
 
-        authkey = kmalloc(optlen, GFP_KERNEL);
-        if (!authkey)
-                return -ENOMEM;
-
-        if (copy_from_user(authkey, optval, optlen)) {
-                ret = -EFAULT;
-                goto out;
-        }
+        authkey= memdup_user(optval, optlen);
+        if (IS_ERR(authkey))
+                return PTR_ERR(authkey);
 
         if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) {
                 ret = -EINVAL;
@@ -5283,6 +5277,55 @@ static int sctp_getsockopt_assoc_number(struct sock *sk, int len,
         return 0;
 }
 
+/*
+ * 8.2.6. Get the Current Identifiers of Associations
+ *        (SCTP_GET_ASSOC_ID_LIST)
+ *
+ * This option gets the current list of SCTP association identifiers of
+ * the SCTP associations handled by a one-to-many style socket.
+ */
+static int sctp_getsockopt_assoc_ids(struct sock *sk, int len,
+                                    char __user *optval, int __user *optlen)
+{
+        struct sctp_sock *sp = sctp_sk(sk);
+        struct sctp_association *asoc;
+        struct sctp_assoc_ids *ids;
+        u32 num = 0;
+
+        if (sctp_style(sk, TCP))
+                return -EOPNOTSUPP;
+
+        if (len < sizeof(struct sctp_assoc_ids))
+                return -EINVAL;
+
+        list_for_each_entry(asoc, &(sp->ep->asocs), asocs) {
+                num++;
+        }
+
+        if (len < sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num)
+                return -EINVAL;
+
+        len = sizeof(struct sctp_assoc_ids) + sizeof(sctp_assoc_t) * num;
+
+        ids = kmalloc(len, GFP_KERNEL);
+        if (unlikely(!ids))
+                return -ENOMEM;
+
+        ids->gaids_number_of_ids = num;
+        num = 0;
+        list_for_each_entry(asoc, &(sp->ep->asocs), asocs) {
+                ids->gaids_assoc_id[num++] = asoc->assoc_id;
+        }
+
+        if (put_user(len, optlen) || copy_to_user(optval, ids, len)) {
+                kfree(ids);
+                return -EFAULT;
+        }
+
+        kfree(ids);
+        return 0;
+}
+
 SCTP_STATIC int sctp_getsockopt(struct sock *sk, int level, int optname,
                                 char __user *optval, int __user *optlen)
 {
@@ -5415,6 +5458,9 @@ SCTP_STATIC int sctp_getsockopt(struct sock *sk, int level, int optname,
         case SCTP_GET_ASSOC_NUMBER:
                 retval = sctp_getsockopt_assoc_number(sk, len, optval, optlen);
                 break;
+        case SCTP_GET_ASSOC_ID_LIST:
+                retval = sctp_getsockopt_assoc_ids(sk, len, optval, optlen);
+                break;
         default:
                 retval = -ENOPROTOOPT;
                 break;
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index d3ae493d234a..d8595dd1a8a7 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -211,15 +211,19 @@ void sctp_transport_set_owner(struct sctp_transport *transport,
 }
 
 /* Initialize the pmtu of a transport. */
-void sctp_transport_pmtu(struct sctp_transport *transport)
+void sctp_transport_pmtu(struct sctp_transport *transport, struct sock *sk)
 {
-        struct dst_entry *dst;
+        struct flowi fl;
 
-        dst = transport->af_specific->get_dst(NULL, &transport->ipaddr, NULL);
+        /* If we don't have a fresh route, look one up */
+        if (!transport->dst || transport->dst->obsolete > 1) {
+                dst_release(transport->dst);
+                transport->af_specific->get_dst(transport, &transport->saddr,
+                                              &fl, sk);
+        }
 
-        if (dst) {
-                transport->pathmtu = dst_mtu(dst);
-                dst_release(dst);
+        if (transport->dst) {
+                transport->pathmtu = dst_mtu(transport->dst);
         } else
                 transport->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
 }
@@ -270,22 +274,20 @@ void sctp_transport_route(struct sctp_transport *transport,
 {
         struct sctp_association *asoc = transport->asoc;
         struct sctp_af *af = transport->af_specific;
-        union sctp_addr *daddr = &transport->ipaddr;
-        struct dst_entry *dst;
+        struct flowi fl;
 
-        dst = af->get_dst(asoc, daddr, saddr);
+        af->get_dst(transport, saddr, &fl, sctp_opt2sk(opt));
 
         if (saddr)
                 memcpy(&transport->saddr, saddr, sizeof(union sctp_addr));
         else
-                af->get_saddr(opt, asoc, dst, daddr, &transport->saddr);
+                af->get_saddr(opt, transport, &fl);
 
-        transport->dst = dst;
         if ((transport->param_flags & SPP_PMTUD_DISABLE) && transport->pathmtu) {
                 return;
         }
-        if (dst) {
-                transport->pathmtu = dst_mtu(dst);
+        if (transport->dst) {
+                transport->pathmtu = dst_mtu(transport->dst);
 
                 /* Initialize sk->sk_rcv_saddr, if the transport is the
                  * association's active path for getsockname().
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index dff27d5e22fd..c962c6062aab 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -843,7 +843,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_authkey(
         ak = (struct sctp_authkey_event *)
                 skb_put(skb, sizeof(struct sctp_authkey_event));
 
-        ak->auth_type = SCTP_AUTHENTICATION_INDICATION;
+        ak->auth_type = SCTP_AUTHENTICATION_EVENT;
         ak->auth_flags = 0;
         ak->auth_length = sizeof(struct sctp_authkey_event);
 
@@ -862,6 +862,34 @@ fail:
         return NULL;
 }
 
+/*
+ * Socket Extensions for SCTP
+ * 6.3.10. SCTP_SENDER_DRY_EVENT
+ */
+struct sctp_ulpevent *sctp_ulpevent_make_sender_dry_event(
+        const struct sctp_association *asoc, gfp_t gfp)
+{
+        struct sctp_ulpevent *event;
+        struct sctp_sender_dry_event *sdry;
+        struct sk_buff *skb;
+
+        event = sctp_ulpevent_new(sizeof(struct sctp_sender_dry_event),
+                                  MSG_NOTIFICATION, gfp);
+        if (!event)
+                return NULL;
+
+        skb = sctp_event2skb(event);
+        sdry = (struct sctp_sender_dry_event *)
+                skb_put(skb, sizeof(struct sctp_sender_dry_event));
+
+        sdry->sender_dry_type = SCTP_SENDER_DRY_EVENT;
+        sdry->sender_dry_flags = 0;
+        sdry->sender_dry_length = sizeof(struct sctp_sender_dry_event);
+        sctp_ulpevent_set_owner(event, asoc);
+        sdry->sender_dry_assoc_id = sctp_assoc2id(asoc);
+
+        return event;
+}
 
 /* Return the notification type, assuming this is a notification
  * event.
diff --git a/net/socket.c b/net/socket.c
index 310d16b1b3c9..ed50255143d5 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -551,11 +551,10 @@ int sock_tx_timestamp(struct sock *sk, __u8 *tx_flags)
 }
 EXPORT_SYMBOL(sock_tx_timestamp);
 
-static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
-                                 struct msghdr *msg, size_t size)
+static inline int __sock_sendmsg_nosec(struct kiocb *iocb, struct socket *sock,
+                                       struct msghdr *msg, size_t size)
 {
         struct sock_iocb *si = kiocb_to_siocb(iocb);
-        int err;
 
         sock_update_classid(sock->sk);
 
@@ -564,13 +563,17 @@ static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         si->msg = msg;
         si->size = size;
 
-        err = security_socket_sendmsg(sock, msg, size);
-        if (err)
-                return err;
-
         return sock->ops->sendmsg(iocb, sock, msg, size);
 }
 
+static inline int __sock_sendmsg(struct kiocb *iocb, struct socket *sock,
+                                 struct msghdr *msg, size_t size)
+{
+        int err = security_socket_sendmsg(sock, msg, size);
+
+        return err ?: __sock_sendmsg_nosec(iocb, sock, msg, size);
+}
+
 int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 {
         struct kiocb iocb;
@@ -586,6 +589,20 @@ int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 }
 EXPORT_SYMBOL(sock_sendmsg);
 
+int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg, size_t size)
+{
+        struct kiocb iocb;
+        struct sock_iocb siocb;
+        int ret;
+
+        init_sync_kiocb(&iocb, NULL);
+        iocb.private = &siocb;
+        ret = __sock_sendmsg_nosec(&iocb, sock, msg, size);
+        if (-EIOCBQUEUED == ret)
+                ret = wait_on_sync_kiocb(&iocb);
+        return ret;
+}
+
 int kernel_sendmsg(struct socket *sock, struct msghdr *msg,
                    struct kvec *vec, size_t num, size_t size)
 {
@@ -1863,57 +1880,47 @@ SYSCALL_DEFINE2(shutdown, int, fd, int, how)
 #define COMPAT_NAMELEN(msg)     COMPAT_MSG(msg, msg_namelen)
 #define COMPAT_FLAGS(msg)       COMPAT_MSG(msg, msg_flags)
 
-/*
- *      BSD sendmsg interface
- */
-
-SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
+static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+                         struct msghdr *msg_sys, unsigned flags, int nosec)
 {
         struct compat_msghdr __user *msg_compat =
             (struct compat_msghdr __user *)msg;
-        struct socket *sock;
         struct sockaddr_storage address;
         struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
         unsigned char ctl[sizeof(struct cmsghdr) + 20]
             __attribute__ ((aligned(sizeof(__kernel_size_t))));
         /* 20 is size of ipv6_pktinfo */
         unsigned char *ctl_buf = ctl;
-        struct msghdr msg_sys;
         int err, ctl_len, iov_size, total_len;
-        int fput_needed;
 
         err = -EFAULT;
         if (MSG_CMSG_COMPAT & flags) {
-                if (get_compat_msghdr(&msg_sys, msg_compat))
+                if (get_compat_msghdr(msg_sys, msg_compat))
                         return -EFAULT;
-        } else if (copy_from_user(&msg_sys, msg, sizeof(struct msghdr)))
+        } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
                 return -EFAULT;
 
-        sock = sockfd_lookup_light(fd, &err, &fput_needed);
-        if (!sock)
-                goto out;
-
         /* do not move before msg_sys is valid */
         err = -EMSGSIZE;
-        if (msg_sys.msg_iovlen > UIO_MAXIOV)
-                goto out_put;
+        if (msg_sys->msg_iovlen > UIO_MAXIOV)
+                goto out;
 
         /* Check whether to allocate the iovec area */
         err = -ENOMEM;
-        iov_size = msg_sys.msg_iovlen * sizeof(struct iovec);
-        if (msg_sys.msg_iovlen > UIO_FASTIOV) {
+        iov_size = msg_sys->msg_iovlen * sizeof(struct iovec);
+        if (msg_sys->msg_iovlen > UIO_FASTIOV) {
                 iov = sock_kmalloc(sock->sk, iov_size, GFP_KERNEL);
                 if (!iov)
-                        goto out_put;
+                        goto out;
         }
 
         /* This will also move the address data into kernel space */
         if (MSG_CMSG_COMPAT & flags) {
-                err = verify_compat_iovec(&msg_sys, iov,
+                err = verify_compat_iovec(msg_sys, iov,
                                           (struct sockaddr *)&address,
                                           VERIFY_READ);
         } else
-                err = verify_iovec(&msg_sys, iov,
+                err = verify_iovec(msg_sys, iov,
                                    (struct sockaddr *)&address,
                                    VERIFY_READ);
         if (err < 0)
@@ -1922,17 +1929,17 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
 
         err = -ENOBUFS;
 
-        if (msg_sys.msg_controllen > INT_MAX)
+        if (msg_sys->msg_controllen > INT_MAX)
                 goto out_freeiov;
-        ctl_len = msg_sys.msg_controllen;
+        ctl_len = msg_sys->msg_controllen;
         if ((MSG_CMSG_COMPAT & flags) && ctl_len) {
                 err =
-                    cmsghdr_from_user_compat_to_kern(&msg_sys, sock->sk, ctl,
+                    cmsghdr_from_user_compat_to_kern(msg_sys, sock->sk, ctl,
                                                      sizeof(ctl));
                 if (err)
                         goto out_freeiov;
-                ctl_buf = msg_sys.msg_control;
-                ctl_len = msg_sys.msg_controllen;
+                ctl_buf = msg_sys->msg_control;
+                ctl_len = msg_sys->msg_controllen;
         } else if (ctl_len) {
                 if (ctl_len > sizeof(ctl)) {
                         ctl_buf = sock_kmalloc(sock->sk, ctl_len, GFP_KERNEL);
@@ -1941,21 +1948,22 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
                 }
                 err = -EFAULT;
                 /*
-                 * Careful! Before this, msg_sys.msg_control contains a user pointer.
+                 * Careful! Before this, msg_sys->msg_control contains a user pointer.
                  * Afterwards, it will be a kernel pointer. Thus the compiler-assisted
                  * checking falls down on this.
                  */
                 if (copy_from_user(ctl_buf,
-                                   (void __user __force *)msg_sys.msg_control,
+                                   (void __user __force *)msg_sys->msg_control,
                                    ctl_len))
                         goto out_freectl;
-                msg_sys.msg_control = ctl_buf;
+                msg_sys->msg_control = ctl_buf;
         }
-        msg_sys.msg_flags = flags;
+        msg_sys->msg_flags = flags;
 
         if (sock->file->f_flags & O_NONBLOCK)
-                msg_sys.msg_flags |= MSG_DONTWAIT;
-        err = sock_sendmsg(sock, &msg_sys, total_len);
+                msg_sys->msg_flags |= MSG_DONTWAIT;
+        err = (nosec ? sock_sendmsg_nosec : sock_sendmsg)(sock, msg_sys,
+                                                          total_len);
 
 out_freectl:
         if (ctl_buf != ctl)
@@ -1963,12 +1971,114 @@ out_freectl:
 out_freeiov:
         if (iov != iovstack)
                 sock_kfree_s(sock->sk, iov, iov_size);
-out_put:
+out:
+        return err;
+}
+
+/*
+ *      BSD sendmsg interface
+ */
+
+SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
+{
+        int fput_needed, err;
+        struct msghdr msg_sys;
+        struct socket *sock = sockfd_lookup_light(fd, &err, &fput_needed);
+
+        if (!sock)
+                goto out;
+
+        err = __sys_sendmsg(sock, msg, &msg_sys, flags, 0);
+
         fput_light(sock->file, fput_needed);
 out:
         return err;
 }
 
+/*
+ *      Linux sendmmsg interface
+ */
+
+int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
+                   unsigned int flags)
+{
+        int fput_needed, err, datagrams;
+        struct socket *sock;
+        struct mmsghdr __user *entry;
+        struct compat_mmsghdr __user *compat_entry;
+        struct msghdr msg_sys;
+
+        datagrams = 0;
+
+        sock = sockfd_lookup_light(fd, &err, &fput_needed);
+        if (!sock)
+                return err;
+
+        err = sock_error(sock->sk);
+        if (err)
+                goto out_put;
+
+        entry = mmsg;
+        compat_entry = (struct compat_mmsghdr __user *)mmsg;
+
+        while (datagrams < vlen) {
+                /*
+                 * No need to ask LSM for more than the first datagram.
+                 */
+                if (MSG_CMSG_COMPAT & flags) {
+                        err = __sys_sendmsg(sock, (struct msghdr __user *)compat_entry,
+                                            &msg_sys, flags, datagrams);
+                        if (err < 0)
+                                break;
+                        err = __put_user(err, &compat_entry->msg_len);
+                        ++compat_entry;
+                } else {
+                        err = __sys_sendmsg(sock, (struct msghdr __user *)entry,
+                                            &msg_sys, flags, datagrams);
+                        if (err < 0)
+                                break;
+                        err = put_user(err, &entry->msg_len);
+                        ++entry;
+                }
+
+                if (err)
+                        break;
+                ++datagrams;
+        }
+
+out_put:
+        fput_light(sock->file, fput_needed);
+
+        if (err == 0)
+                return datagrams;
+
+        if (datagrams != 0) {
+                /*
+                 * We may send less entries than requested (vlen) if the
+                 * sock is non blocking...
+                 */
+                if (err != -EAGAIN) {
+                        /*
+                         * ... or if sendmsg returns an error after we
+                         * send some datagrams, where we record the
+                         * error to return on the next call or if the
+                         * app asks about it using getsockopt(SO_ERROR).
+                         */
+                        sock->sk->sk_err = -err;
+                }
+
+                return datagrams;
+        }
+
+        return err;
+}
+
+SYSCALL_DEFINE4(sendmmsg, int, fd, struct mmsghdr __user *, mmsg,
+                unsigned int, vlen, unsigned int, flags)
+{
+        return __sys_sendmmsg(fd, mmsg, vlen, flags);
+}
+
 static int __sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
                          struct msghdr *msg_sys, unsigned flags, int nosec)
 {
@@ -2214,11 +2324,11 @@ SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
 #ifdef __ARCH_WANT_SYS_SOCKETCALL
 /* Argument list sizes for sys_socketcall */
 #define AL(x) ((x) * sizeof(unsigned long))
-static const unsigned char nargs[20] = {
+static const unsigned char nargs[21] = {
         AL(0), AL(3), AL(3), AL(3), AL(2), AL(3),
         AL(3), AL(3), AL(4), AL(4), AL(4), AL(6),
         AL(6), AL(2), AL(5), AL(5), AL(3), AL(3),
-        AL(4), AL(5)
+        AL(4), AL(5), AL(4)
 };
 
 #undef AL
@@ -2238,7 +2348,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
         int err;
         unsigned int len;
 
-        if (call < 1 || call > SYS_RECVMMSG)
+        if (call < 1 || call > SYS_SENDMMSG)
                 return -EINVAL;
 
         len = nargs[call];
@@ -2313,6 +2423,9 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
         case SYS_SENDMSG:
                 err = sys_sendmsg(a0, (struct msghdr __user *)a1, a[2]);
                 break;
+        case SYS_SENDMMSG:
+                err = sys_sendmmsg(a0, (struct mmsghdr __user *)a1, a[2], a[3]);
+                break;
         case SYS_RECVMSG:
                 err = sys_recvmsg(a0, (struct msghdr __user *)a1, a[2]);
                 break;
@@ -2643,13 +2756,13 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
                 return -EFAULT;
 
         if (convert_in) {
-                /* We expect there to be holes between fs.m_u and
+                /* We expect there to be holes between fs.m_ext and
                  * fs.ring_cookie and at the end of fs, but nowhere else.
                  */
-                BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_u) +
-                             sizeof(compat_rxnfc->fs.m_u) !=
-                             offsetof(struct ethtool_rxnfc, fs.m_u) +
-                             sizeof(rxnfc->fs.m_u));
+                BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
+                             sizeof(compat_rxnfc->fs.m_ext) !=
+                             offsetof(struct ethtool_rxnfc, fs.m_ext) +
+                             sizeof(rxnfc->fs.m_ext));
                 BUILD_BUG_ON(
                         offsetof(struct compat_ethtool_rxnfc, fs.location) -
                         offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
@@ -2657,7 +2770,7 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
                         offsetof(struct ethtool_rxnfc, fs.ring_cookie));
 
                 if (copy_in_user(rxnfc, compat_rxnfc,
-                                 (void *)(&rxnfc->fs.m_u + 1) -
+                                 (void *)(&rxnfc->fs.m_ext + 1) -
                                  (void *)rxnfc) ||
                     copy_in_user(&rxnfc->fs.ring_cookie,
                                  &compat_rxnfc->fs.ring_cookie,
@@ -2674,7 +2787,7 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
 
         if (convert_out) {
                 if (copy_in_user(compat_rxnfc, rxnfc,
-                                 (const void *)(&rxnfc->fs.m_u + 1) -
+                                 (const void *)(&rxnfc->fs.m_ext + 1) -
                                  (const void *)rxnfc) ||
                     copy_in_user(&compat_rxnfc->fs.ring_cookie,
                                  &rxnfc->fs.ring_cookie,
diff --git a/net/wireless/core.c b/net/wireless/core.c
index fe01de29bfe8..bbf1fa11107a 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -46,6 +46,11 @@ static struct dentry *ieee80211_debugfs_dir;
 /* for the cleanup, scan and event works */
 struct workqueue_struct *cfg80211_wq;
 
+static bool cfg80211_disable_40mhz_24ghz;
+module_param(cfg80211_disable_40mhz_24ghz, bool, 0644);
+MODULE_PARM_DESC(cfg80211_disable_40mhz_24ghz,
+                 "Disable 40MHz support in the 2.4GHz band");
+
 /* requires cfg80211_mutex to be held! */
 struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx)
 {
@@ -451,6 +456,18 @@ int wiphy_register(struct wiphy *wiphy)
                         return -EINVAL;
 
                 /*
+                 * Since cfg80211_disable_40mhz_24ghz is global, we can
+                 * modify the sband's ht data even if the driver uses a
+                 * global structure for that.
+                 */
+                if (cfg80211_disable_40mhz_24ghz &&
+                    band == IEEE80211_BAND_2GHZ &&
+                    sband->ht_cap.ht_supported) {
+                        sband->ht_cap.cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        sband->ht_cap.cap &= ~IEEE80211_HT_CAP_SGI_40;
+                }
+
+                /*
                  * Since we use a u32 for rate bitmaps in
                  * ieee80211_get_response_rate, we cannot
                  * have more than 32 legacy rates.
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index 73e39c171ffb..5c116083eeca 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -1,5 +1,6 @@
 #include <linux/ieee80211.h>
 #include <net/cfg80211.h>
+#include "nl80211.h"
 #include "core.h"
 
 /* Default values, timeouts in ms */
@@ -53,8 +54,9 @@ const struct mesh_config default_mesh_config = {
 const struct mesh_setup default_mesh_setup = {
         .path_sel_proto = IEEE80211_PATH_PROTOCOL_HWMP,
         .path_metric = IEEE80211_PATH_METRIC_AIRTIME,
-        .vendor_ie = NULL,
-        .vendor_ie_len = 0,
+        .ie = NULL,
+        .ie_len = 0,
+        .is_secure = false,
 };
 
 int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
@@ -72,6 +74,10 @@ int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
                 return -EOPNOTSUPP;
 
+        if (!(rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
+              setup->is_secure)
+                return -EOPNOTSUPP;
+
         if (wdev->mesh_id_len)
                 return -EALREADY;
 
@@ -105,6 +111,19 @@ int cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
         return err;
 }
 
+void cfg80211_notify_new_peer_candidate(struct net_device *dev,
+                const u8 *macaddr, const u8* ie, u8 ie_len, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
+                return;
+
+        nl80211_send_new_peer_candidate(wiphy_to_dev(wdev->wiphy), dev,
+                        macaddr, ie, ie_len, gfp);
+}
+EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
+
 static int __cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
                                  struct net_device *dev)
 {
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index aa5df8865ff7..16881fea4ce6 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -770,6 +770,15 @@ void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
 }
 EXPORT_SYMBOL(cfg80211_new_sta);
 
+void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        nl80211_send_sta_del_event(rdev, dev, mac_addr, gfp);
+}
+EXPORT_SYMBOL(cfg80211_del_sta);
+
 struct cfg80211_mgmt_registration {
         struct list_head list;
 
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 4ebce4284e9d..0efa7fd01150 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -124,6 +124,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 
         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
+        [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 
         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
                                          .len = NL80211_HT_CAPABILITY_LEN },
@@ -594,6 +595,8 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 
         if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
                 NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
+        if (dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH)
+                NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_MESH_AUTH);
 
         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
                 sizeof(u32) * dev->wiphy.n_cipher_suites,
@@ -1922,6 +1925,7 @@ static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
+        [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
 };
 
 static int parse_station_flags(struct genl_info *info,
@@ -2002,7 +2006,7 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
                                 const u8 *mac_addr, struct station_info *sinfo)
 {
         void *hdr;
-        struct nlattr *sinfoattr;
+        struct nlattr *sinfoattr, *bss_param;
 
         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
         if (!hdr)
@@ -2016,6 +2020,9 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
         if (!sinfoattr)
                 goto nla_put_failure;
+        if (sinfo->filled & STATION_INFO_CONNECTED_TIME)
+                NLA_PUT_U32(msg, NL80211_STA_INFO_CONNECTED_TIME,
+                            sinfo->connected_time);
         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
                             sinfo->inactive_time);
@@ -2062,6 +2069,25 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
         if (sinfo->filled & STATION_INFO_TX_FAILED)
                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
                             sinfo->tx_failed);
+        if (sinfo->filled & STATION_INFO_BSS_PARAM) {
+                bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
+                if (!bss_param)
+                        goto nla_put_failure;
+
+                if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT)
+                        NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_CTS_PROT);
+                if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE)
+                        NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE);
+                if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME)
+                        NLA_PUT_FLAG(msg,
+                                     NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME);
+                NLA_PUT_U8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
+                           sinfo->bss_param.dtim_period);
+                NLA_PUT_U16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
+                            sinfo->bss_param.beacon_interval);
+
+                nla_nest_end(msg, bss_param);
+        }
         nla_nest_end(msg, sinfoattr);
 
         return genlmsg_end(msg, hdr);
@@ -2262,7 +2288,9 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                         err = -EINVAL;
                 if (params.supported_rates)
                         err = -EINVAL;
-                if (params.sta_flags_mask)
+                if (params.sta_flags_mask &
+                                ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                  BIT(NL80211_STA_FLAG_AUTHORIZED)))
                         err = -EINVAL;
                 break;
         default:
@@ -2324,11 +2352,16 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                 params.ht_capa =
                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
 
+        if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
+                params.plink_action =
+                    nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
+
         if (parse_station_flags(info, &params))
                 return -EINVAL;
 
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
                 return -EINVAL;
 
@@ -2804,7 +2837,8 @@ static const struct nla_policy
         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
-        [NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE] = { .type = NLA_BINARY,
+        [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
+        [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
                 .len = IEEE80211_MAX_DATA_LEN },
 };
 
@@ -2906,14 +2940,16 @@ static int nl80211_parse_mesh_setup(struct genl_info *info,
                  IEEE80211_PATH_METRIC_VENDOR :
                  IEEE80211_PATH_METRIC_AIRTIME;
 
-        if (tb[NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE]) {
+
+        if (tb[NL80211_MESH_SETUP_IE]) {
                 struct nlattr *ieattr =
-                        tb[NL80211_MESH_SETUP_VENDOR_PATH_SEL_IE];
+                        tb[NL80211_MESH_SETUP_IE];
                 if (!is_valid_ie_attr(ieattr))
                         return -EINVAL;
-                setup->vendor_ie = nla_data(ieattr);
-                setup->vendor_ie_len = nla_len(ieattr);
+                setup->ie = nla_data(ieattr);
+                setup->ie_len = nla_len(ieattr);
         }
+        setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
 
         return 0;
 }
@@ -5785,6 +5821,44 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
         nlmsg_free(msg);
 }
 
+void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
+                struct net_device *netdev,
+                const u8 *macaddr, const u8* ie, u8 ie_len,
+                gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr);
+        if (ie_len && ie)
+                NLA_PUT(msg, NL80211_ATTR_IE, ie_len , ie);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
                                  struct net_device *netdev, const u8 *addr,
                                  enum nl80211_key_type key_type, int key_id,
@@ -5966,6 +6040,40 @@ void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
                                 nl80211_mlme_mcgrp.id, gfp);
 }
 
+void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
+                                struct net_device *dev, const u8 *mac_addr,
+                                gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
+        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
                       struct net_device *netdev, u32 nlpid,
                       int freq, const u8 *buf, size_t len, gfp_t gfp)
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index e3f7fa886966..f2af6955a665 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -50,6 +50,10 @@ void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
                                struct net_device *netdev, u16 reason,
                                const u8 *ie, size_t ie_len, bool from_ap);
 
+void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
+                                     struct net_device *netdev,
+                                     const u8 *macaddr, const u8* ie, u8 ie_len,
+                                     gfp_t gfp);
 void
 nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
                             struct net_device *netdev, const u8 *addr,
@@ -79,6 +83,9 @@ void nl80211_send_remain_on_channel_cancel(
 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
                             struct net_device *dev, const u8 *mac_addr,
                             struct station_info *sinfo, gfp_t gfp);
+void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
+                                struct net_device *dev, const u8 *mac_addr,
+                                gfp_t gfp);
 
 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
                       struct net_device *netdev, u32 nlpid, int freq,
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index ab801a1097b2..1613080a96b9 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -106,6 +106,9 @@ struct reg_beacon {
 static void reg_todo(struct work_struct *work);
 static DECLARE_WORK(reg_work, reg_todo);
 
+static void reg_timeout_work(struct work_struct *work);
+static DECLARE_DELAYED_WORK(reg_timeout, reg_timeout_work);
+
 /* We keep a static world regulatory domain in case of the absence of CRDA */
 static const struct ieee80211_regdomain world_regdom = {
         .n_reg_rules = 5,
@@ -1330,6 +1333,9 @@ static void reg_set_request_processed(void)
                 need_more_processing = true;
         spin_unlock(&reg_requests_lock);
 
+        if (last_request->initiator == NL80211_REGDOM_SET_BY_USER)
+                cancel_delayed_work_sync(&reg_timeout);
+
         if (need_more_processing)
                 schedule_work(&reg_work);
 }
@@ -1440,8 +1446,18 @@ static void reg_process_hint(struct regulatory_request *reg_request)
         r = __regulatory_hint(wiphy, reg_request);
         /* This is required so that the orig_* parameters are saved */
         if (r == -EALREADY && wiphy &&
-            wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY)
+            wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY) {
                 wiphy_update_regulatory(wiphy, initiator);
+                return;
+        }
+
+        /*
+         * We only time out user hints, given that they should be the only
+         * source of bogus requests.
+         */
+        if (r != -EALREADY &&
+            reg_request->initiator == NL80211_REGDOM_SET_BY_USER)
+                schedule_delayed_work(&reg_timeout, msecs_to_jiffies(3142));
 }
 
 /*
@@ -1744,6 +1760,8 @@ static void restore_regulatory_settings(bool reset_user)
 {
         char alpha2[2];
         struct reg_beacon *reg_beacon, *btmp;
+        struct regulatory_request *reg_request, *tmp;
+        LIST_HEAD(tmp_reg_req_list);
 
         mutex_lock(&cfg80211_mutex);
         mutex_lock(&reg_mutex);
@@ -1751,6 +1769,25 @@ static void restore_regulatory_settings(bool reset_user)
         reset_regdomains();
         restore_alpha2(alpha2, reset_user);
 
+        /*
+         * If there's any pending requests we simply
+         * stash them to a temporary pending queue and
+         * add then after we've restored regulatory
+         * settings.
+         */
+        spin_lock(&reg_requests_lock);
+        if (!list_empty(&reg_requests_list)) {
+                list_for_each_entry_safe(reg_request, tmp,
+                                         &reg_requests_list, list) {
+                        if (reg_request->initiator !=
+                            NL80211_REGDOM_SET_BY_USER)
+                                continue;
+                        list_del(&reg_request->list);
+                        list_add_tail(&reg_request->list, &tmp_reg_req_list);
+                }
+        }
+        spin_unlock(&reg_requests_lock);
+
         /* Clear beacon hints */
         spin_lock_bh(&reg_pending_beacons_lock);
         if (!list_empty(&reg_pending_beacons)) {
@@ -1785,8 +1822,31 @@ static void restore_regulatory_settings(bool reset_user)
          */
         if (is_an_alpha2(alpha2))
                 regulatory_hint_user(user_alpha2);
-}
 
+        if (list_empty(&tmp_reg_req_list))
+                return;
+
+        mutex_lock(&cfg80211_mutex);
+        mutex_lock(&reg_mutex);
+
+        spin_lock(&reg_requests_lock);
+        list_for_each_entry_safe(reg_request, tmp, &tmp_reg_req_list, list) {
+                REG_DBG_PRINT("Adding request for country %c%c back "
+                              "into the queue\n",
+                              reg_request->alpha2[0],
+                              reg_request->alpha2[1]);
+                list_del(&reg_request->list);
+                list_add_tail(&reg_request->list, &reg_requests_list);
+        }
+        spin_unlock(&reg_requests_lock);
+
+        mutex_unlock(&reg_mutex);
+        mutex_unlock(&cfg80211_mutex);
+
+        REG_DBG_PRINT("Kicking the queue\n");
+
+        schedule_work(&reg_work);
+}
 
 void regulatory_hint_disconnect(void)
 {
@@ -2125,6 +2185,13 @@ out:
         mutex_unlock(&reg_mutex);
 }
 
+static void reg_timeout_work(struct work_struct *work)
+{
+        REG_DBG_PRINT("Timeout while waiting for CRDA to reply, "
+                      "restoring regulatory settings");
+        restore_regulatory_settings(true);
+}
+
 int __init regulatory_init(void)
 {
         int err = 0;
@@ -2178,6 +2245,7 @@ void /* __init_or_exit */ regulatory_exit(void)
         struct reg_beacon *reg_beacon, *btmp;
 
         cancel_work_sync(&reg_work);
+        cancel_delayed_work_sync(&reg_timeout);
 
         mutex_lock(&cfg80211_mutex);
         mutex_lock(&reg_mutex);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 15792d8b6272..00bcb88386c2 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1348,7 +1348,8 @@ static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family)
         default:
                 BUG();
         }
-        xdst = dst_alloc(dst_ops, 0);
+        xdst = dst_alloc(dst_ops, NULL, 0, 0, 0);
+        memset(&xdst->u.rt6.rt6i_table, 0, sizeof(*xdst) - sizeof(struct dst_entry));
         xfrm_policy_put_afinfo(afinfo);
 
         if (likely(xdst))
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index dd78536d40de..d70f85eb7864 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1036,15 +1036,15 @@ static struct xfrm_state *__find_acq_core(struct net *net, struct xfrm_mark *m,
 
                 case AF_INET6:
                         ipv6_addr_copy((struct in6_addr *)x->sel.daddr.a6,
-                                       (struct in6_addr *)daddr);
+                                       (const struct in6_addr *)daddr);
                         ipv6_addr_copy((struct in6_addr *)x->sel.saddr.a6,
-                                       (struct in6_addr *)saddr);
+                                       (const struct in6_addr *)saddr);
                         x->sel.prefixlen_d = 128;
                         x->sel.prefixlen_s = 128;
                         ipv6_addr_copy((struct in6_addr *)x->props.saddr.a6,
-                                       (struct in6_addr *)saddr);
+                                       (const struct in6_addr *)saddr);
                         ipv6_addr_copy((struct in6_addr *)x->id.daddr.a6,
-                                       (struct in6_addr *)daddr);
+                                       (const struct in6_addr *)daddr);
                         break;
                 }
 
@@ -2092,8 +2092,8 @@ static void xfrm_audit_helper_sainfo(struct xfrm_state *x,
 static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
                                       struct audit_buffer *audit_buf)
 {
-        struct iphdr *iph4;
-        struct ipv6hdr *iph6;
+        const struct iphdr *iph4;
+        const struct ipv6hdr *iph6;
 
         switch (family) {
         case AF_INET: