247 files changed, 5958 insertions, 4245 deletions

diff --git a/net/802/tr.c b/net/802/tr.c
index d7d8f40c4fed..829deb41ce81 100644
--- a/net/802/tr.c
+++ b/net/802/tr.c
@@ -164,7 +164,7 @@ static int tr_rebuild_header(struct sk_buff *skb)
          */
          
         if(trllc->ethertype != htons(ETH_P_IP)) {
-                printk("tr_rebuild_header: Don't know how to resolve type %04X addresses ?\n",(unsigned int)htons(trllc->ethertype));
+                printk("tr_rebuild_header: Don't know how to resolve type %04X addresses ?\n", ntohs(trllc->ethertype));
                 return 0;
         }
 
@@ -186,7 +186,7 @@ static int tr_rebuild_header(struct sk_buff *skb)
  *      it via SNAP.
  */
  
-unsigned short tr_type_trans(struct sk_buff *skb, struct net_device *dev) 
+__be16 tr_type_trans(struct sk_buff *skb, struct net_device *dev)
 {
 
         struct trh_hdr *trh=(struct trh_hdr *)skb->data;
@@ -229,15 +229,15 @@ unsigned short tr_type_trans(struct sk_buff *skb, struct net_device *dev)
          */
 
         if (trllc->dsap == EXTENDED_SAP &&
-            (trllc->ethertype == ntohs(ETH_P_IP) ||
-             trllc->ethertype == ntohs(ETH_P_IPV6) ||
-             trllc->ethertype == ntohs(ETH_P_ARP)))
+            (trllc->ethertype == htons(ETH_P_IP) ||
+             trllc->ethertype == htons(ETH_P_IPV6) ||
+             trllc->ethertype == htons(ETH_P_ARP)))
         {
                 skb_pull(skb, sizeof(struct trllc));
                 return trllc->ethertype;
         }
 
-        return ntohs(ETH_P_TR_802_2);
+        return htons(ETH_P_TR_802_2);
 }
 
 /*
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index da9cfe927158..60a508eb1945 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -62,7 +62,7 @@ int vlan_dev_rebuild_header(struct sk_buff *skb)
         default:
                 printk(VLAN_DBG
                        "%s: unable to resolve type %X addresses.\n", 
-                       dev->name, (int)veth->h_vlan_encapsulated_proto);
+                       dev->name, ntohs(veth->h_vlan_encapsulated_proto));
          
                 memcpy(veth->h_source, dev->dev_addr, ETH_ALEN);
                 break;
diff --git a/net/Kconfig b/net/Kconfig
index 6528a935622c..a81aca43932f 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -231,7 +231,7 @@ config NET_TCPPROBE
         TCP congestion avoidance modules. If you don't understand
         what was just said, you don't need it: say N.
 
-        Documentation on how to use the packet generator can be found
+        Documentation on how to use TCP connection probing can be found
         at http://linux-net.osdl.org/index.php/TcpProbe
 
         To compile this code as a module, choose M here: the
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 96dc6bb52d14..708e2e0371af 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1002,7 +1002,7 @@ static unsigned long atalk_sum_skb(const struct sk_buff *skb, int offset,
         return sum;
 }
 
-static unsigned short atalk_checksum(const struct sk_buff *skb, int len)
+static __be16 atalk_checksum(const struct sk_buff *skb, int len)
 {
         unsigned long sum;
 
@@ -1010,7 +1010,7 @@ static unsigned short atalk_checksum(const struct sk_buff *skb, int len)
         sum = atalk_sum_skb(skb, 4, len-4, 0);
 
         /* Use 0xFFFF for 0. 0 itself means none */
-        return sum ? htons((unsigned short)sum) : 0xFFFF;
+        return sum ? htons((unsigned short)sum) : htons(0xFFFF);
 }
 
 static struct proto ddp_proto = {
@@ -1289,7 +1289,7 @@ static int handle_ip_over_ddp(struct sk_buff *skb)
 #endif
 
 static void atalk_route_packet(struct sk_buff *skb, struct net_device *dev,
-                               struct ddpehdr *ddp, struct ddpebits *ddphv,
+                               struct ddpehdr *ddp, __u16 len_hops,
                                int origlen)
 {
         struct atalk_route *rt;
@@ -1317,10 +1317,12 @@ static void atalk_route_packet(struct sk_buff *skb, struct net_device *dev,
 
         /* Route the packet */
         rt = atrtr_find(&ta);
-        if (!rt || ddphv->deh_hops == DDP_MAXHOPS)
+        /* increment hops count */
+        len_hops += 1 << 10;
+        if (!rt || !(len_hops & (15 << 10)))
                 goto free_it;
+
         /* FIXME: use skb->cb to be able to use shared skbs */
-        ddphv->deh_hops++;
 
         /*
          * Route goes through another gateway, so set the target to the
@@ -1335,11 +1337,10 @@ static void atalk_route_packet(struct sk_buff *skb, struct net_device *dev,
         /* Fix up skb->len field */
         skb_trim(skb, min_t(unsigned int, origlen,
                             (rt->dev->hard_header_len +
-                             ddp_dl->header_length + ddphv->deh_len)));
+                             ddp_dl->header_length + (len_hops & 1023))));
 
-        /* Mend the byte order */
         /* FIXME: use skb->cb to be able to use shared skbs */
-        *((__u16 *)ddp) = ntohs(*((__u16 *)ddphv));
+        ddp->deh_len_hops = htons(len_hops);
 
         /*
          * Send the buffer onwards
@@ -1394,7 +1395,7 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
         struct atalk_iface *atif;
         struct sockaddr_at tosat;
         int origlen;
-        struct ddpebits ddphv;
+        __u16 len_hops;
 
         /* Don't mangle buffer if shared */
         if (!(skb = skb_share_check(skb, GFP_ATOMIC))) 
@@ -1406,16 +1407,11 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
 
         ddp = ddp_hdr(skb);
 
-        /*
-         *      Fix up the length field [Ok this is horrible but otherwise
-         *      I end up with unions of bit fields and messy bit field order
-         *      compiler/endian dependencies..]
-         */
-        *((__u16 *)&ddphv) = ntohs(*((__u16 *)ddp));
+        len_hops = ntohs(ddp->deh_len_hops);
 
         /* Trim buffer in case of stray trailing data */
         origlen = skb->len;
-        skb_trim(skb, min_t(unsigned int, skb->len, ddphv.deh_len));
+        skb_trim(skb, min_t(unsigned int, skb->len, len_hops & 1023));
 
         /*
          * Size check to see if ddp->deh_len was crap
@@ -1430,7 +1426,7 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
          * valid for net byte orders all over the networking code...
          */
         if (ddp->deh_sum &&
-            atalk_checksum(skb, ddphv.deh_len) != ddp->deh_sum)
+            atalk_checksum(skb, len_hops & 1023) != ddp->deh_sum)
                 /* Not a valid AppleTalk frame - dustbin time */
                 goto freeit;
 
@@ -1444,7 +1440,7 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
                 /* Not ours, so we route the packet via the correct
                  * AppleTalk iface
                  */
-                atalk_route_packet(skb, dev, ddp, &ddphv, origlen);
+                atalk_route_packet(skb, dev, ddp, len_hops, origlen);
                 goto out;
         }
 
@@ -1489,7 +1485,7 @@ static int ltalk_rcv(struct sk_buff *skb, struct net_device *dev,
                 /* Find our address */
                 struct atalk_addr *ap = atalk_find_dev_addr(dev);
 
-                if (!ap || skb->len < sizeof(struct ddpshdr))
+                if (!ap || skb->len < sizeof(__be16) || skb->len > 1023)
                         goto freeit;
 
                 /* Don't mangle buffer if shared */
@@ -1519,11 +1515,8 @@ static int ltalk_rcv(struct sk_buff *skb, struct net_device *dev,
                 /*
                  * Not sure about this bit...
                  */
-                ddp->deh_len   = skb->len;
-                ddp->deh_hops  = DDP_MAXHOPS;   /* Non routable, so force a drop
-                                                   if we slip up later */
-                /* Mend the byte order */
-                *((__u16 *)ddp) = htons(*((__u16 *)ddp));
+                /* Non routable, so force a drop if we slip up later */
+                ddp->deh_len_hops = htons(skb->len + (DDP_MAXHOPS << 10));
         }
         skb->h.raw = skb->data;
 
@@ -1622,16 +1615,7 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
         SOCK_DEBUG(sk, "SK %p: Begin build.\n", sk);
 
         ddp = (struct ddpehdr *)skb_put(skb, sizeof(struct ddpehdr));
-        ddp->deh_pad  = 0;
-        ddp->deh_hops = 0;
-        ddp->deh_len  = len + sizeof(*ddp);
-        /*
-         * Fix up the length field [Ok this is horrible but otherwise
-         * I end up with unions of bit fields and messy bit field order
-         * compiler/endian dependencies..
-         */
-        *((__u16 *)ddp) = ntohs(*((__u16 *)ddp));
-
+        ddp->deh_len_hops  = htons(len + sizeof(*ddp));
         ddp->deh_dnet  = usat->sat_addr.s_net;
         ddp->deh_snet  = at->src_net;
         ddp->deh_dnode = usat->sat_addr.s_node;
@@ -1712,8 +1696,8 @@ static int atalk_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
         struct sockaddr_at *sat = (struct sockaddr_at *)msg->msg_name;
         struct ddpehdr *ddp;
         int copied = 0;
+        int offset = 0;
         int err = 0;
-        struct ddpebits ddphv;
         struct sk_buff *skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                                 flags & MSG_DONTWAIT, &err);
         if (!skb)
@@ -1721,25 +1705,18 @@ static int atalk_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
 
         /* FIXME: use skb->cb to be able to use shared skbs */
         ddp = ddp_hdr(skb);
-        *((__u16 *)&ddphv) = ntohs(*((__u16 *)ddp));
+        copied = ntohs(ddp->deh_len_hops) & 1023;
 
-        if (sk->sk_type == SOCK_RAW) {
-                copied = ddphv.deh_len;
-                if (copied > size) {
-                        copied = size;
-                        msg->msg_flags |= MSG_TRUNC;
-                }
+        if (sk->sk_type != SOCK_RAW) {
+                offset = sizeof(*ddp);
+                copied -= offset;
+        }
 
-                err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
-        } else {
-                copied = ddphv.deh_len - sizeof(*ddp);
-                if (copied > size) {
-                        copied = size;
-                        msg->msg_flags |= MSG_TRUNC;
-                }
-                err = skb_copy_datagram_iovec(skb, sizeof(*ddp),
-                                              msg->msg_iov, copied);
+        if (copied > size) {
+                copied = size;
+                msg->msg_flags |= MSG_TRUNC;
         }
+        err = skb_copy_datagram_iovec(skb, offset, msg->msg_iov, copied);
 
         if (!err) {
                 if (sat) {
diff --git a/net/atm/lec.c b/net/atm/lec.c
index b4aa489849df..66c57c1091a8 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -1,7 +1,7 @@
 /*
  * lec.c: Lan Emulation driver 
- * Marko Kiiskila mkiiskila@yahoo.com
  *
+ * Marko Kiiskila <mkiiskila@yahoo.com>
  */
 
 #include <linux/kernel.h>
@@ -38,7 +38,7 @@
 #include <linux/if_bridge.h>
 #include "../bridge/br_private.h"
 
-static unsigned char bridge_ula_lec[] = {0x01, 0x80, 0xc2, 0x00, 0x00};
+static unsigned char bridge_ula_lec[] = { 0x01, 0x80, 0xc2, 0x00, 0x00 };
 #endif
 
 /* Modular too */
@@ -55,38 +55,41 @@ static unsigned char bridge_ula_lec[] = {0x01, 0x80, 0xc2, 0x00, 0x00};
 #define DPRINTK(format,args...)
 #endif
 
-#define DUMP_PACKETS 0 /* 0 = None,
-                        * 1 = 30 first bytes
-                        * 2 = Whole packet
-                        */
+#define DUMP_PACKETS 0          /*
+                                 * 0 = None,
+                                 * 1 = 30 first bytes
+                                 * 2 = Whole packet
+                                 */
 
-#define LEC_UNRES_QUE_LEN 8 /* number of tx packets to queue for a
-                               single destination while waiting for SVC */
+#define LEC_UNRES_QUE_LEN 8     /*
+                                 * number of tx packets to queue for a
+                                 * single destination while waiting for SVC
+                                 */
 
 static int lec_open(struct net_device *dev);
 static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev);
 static int lec_close(struct net_device *dev);
 static struct net_device_stats *lec_get_stats(struct net_device *dev);
 static void lec_init(struct net_device *dev);
-static struct lec_arp_table* lec_arp_find(struct lec_priv *priv,
-                                                     unsigned char *mac_addr);
+static struct lec_arp_table *lec_arp_find(struct lec_priv *priv,
+                                          unsigned char *mac_addr);
 static int lec_arp_remove(struct lec_priv *priv,
-                                     struct lec_arp_table *to_remove);
+                          struct lec_arp_table *to_remove);
 /* LANE2 functions */
-static void lane2_associate_ind (struct net_device *dev, u8 *mac_address,
-                          u8 *tlvs, u32 sizeoftlvs);
+static void lane2_associate_ind(struct net_device *dev, u8 *mac_address,
+                                u8 *tlvs, u32 sizeoftlvs);
 static int lane2_resolve(struct net_device *dev, u8 *dst_mac, int force,
-                  u8 **tlvs, u32 *sizeoftlvs);
-static int lane2_associate_req (struct net_device *dev, u8 *lan_dst,
-                         u8 *tlvs, u32 sizeoftlvs);
+                         u8 **tlvs, u32 *sizeoftlvs);
+static int lane2_associate_req(struct net_device *dev, u8 *lan_dst,
+                               u8 *tlvs, u32 sizeoftlvs);
 
-static int lec_addr_delete(struct lec_priv *priv, unsigned char *atm_addr, 
+static int lec_addr_delete(struct lec_priv *priv, unsigned char *atm_addr,
                            unsigned long permanent);
 static void lec_arp_check_empties(struct lec_priv *priv,
                                   struct atm_vcc *vcc, struct sk_buff *skb);
 static void lec_arp_destroy(struct lec_priv *priv);
 static void lec_arp_init(struct lec_priv *priv);
-static struct atm_vcc* lec_arp_resolve(struct lec_priv *priv,
+static struct atm_vcc *lec_arp_resolve(struct lec_priv *priv,
                                        unsigned char *mac_to_find,
                                        int is_rdesc,
                                        struct lec_arp_table **ret_entry);
@@ -100,16 +103,30 @@ static void lec_set_flush_tran_id(struct lec_priv *priv,
                                   unsigned long tran_id);
 static void lec_vcc_added(struct lec_priv *priv, struct atmlec_ioc *ioc_data,
                           struct atm_vcc *vcc,
-                          void (*old_push)(struct atm_vcc *vcc, struct sk_buff *skb));
+                          void (*old_push) (struct atm_vcc *vcc,
+                                            struct sk_buff *skb));
 static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc);
 
+/* must be done under lec_arp_lock */
+static inline void lec_arp_hold(struct lec_arp_table *entry)
+{
+        atomic_inc(&entry->usage);
+}
+
+static inline void lec_arp_put(struct lec_arp_table *entry)
+{
+        if (atomic_dec_and_test(&entry->usage))
+                kfree(entry);
+}
+
+
 static struct lane2_ops lane2_ops = {
-        lane2_resolve,         /* resolve,             spec 3.1.3 */
-        lane2_associate_req,   /* associate_req,       spec 3.1.4 */
-        NULL                  /* associate indicator, spec 3.1.5 */
+        lane2_resolve,          /* resolve,             spec 3.1.3 */
+        lane2_associate_req,    /* associate_req,       spec 3.1.4 */
+        NULL                    /* associate indicator, spec 3.1.5 */
 };
 
-static unsigned char bus_mac[ETH_ALEN] = {0xff,0xff,0xff,0xff,0xff,0xff};
+static unsigned char bus_mac[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
 /* Device structures */
 static struct net_device *dev_lec[MAX_LEC_ITF];
@@ -117,36 +134,39 @@ static struct net_device *dev_lec[MAX_LEC_ITF];
 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
 static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
 {
-        struct ethhdr *eth;
-        char *buff;
-        struct lec_priv *priv;
-
-        /* Check if this is a BPDU. If so, ask zeppelin to send
-         * LE_TOPOLOGY_REQUEST with the same value of Topology Change bit
-         * as the Config BPDU has */
-        eth = (struct ethhdr *)skb->data;
-        buff = skb->data + skb->dev->hard_header_len;
-        if (*buff++ == 0x42 && *buff++ == 0x42 && *buff++ == 0x03) {
+        struct ethhdr *eth;
+        char *buff;
+        struct lec_priv *priv;
+
+        /*
+         * Check if this is a BPDU. If so, ask zeppelin to send
+         * LE_TOPOLOGY_REQUEST with the same value of Topology Change bit
+         * as the Config BPDU has
+         */
+        eth = (struct ethhdr *)skb->data;
+        buff = skb->data + skb->dev->hard_header_len;
+        if (*buff++ == 0x42 && *buff++ == 0x42 && *buff++ == 0x03) {
                 struct sock *sk;
-                struct sk_buff *skb2;
-                struct atmlec_msg *mesg;
-
-                skb2 = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
-                if (skb2 == NULL) return;
-                skb2->len = sizeof(struct atmlec_msg);
-                mesg = (struct atmlec_msg *)skb2->data;
-                mesg->type = l_topology_change;
-                buff += 4;
-                mesg->content.normal.flag = *buff & 0x01; /* 0x01 is topology change */
-
-                priv = (struct lec_priv *)dev->priv;
-                atm_force_charge(priv->lecd, skb2->truesize);
+                struct sk_buff *skb2;
+                struct atmlec_msg *mesg;
+
+                skb2 = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
+                if (skb2 == NULL)
+                        return;
+                skb2->len = sizeof(struct atmlec_msg);
+                mesg = (struct atmlec_msg *)skb2->data;
+                mesg->type = l_topology_change;
+                buff += 4;
+                mesg->content.normal.flag = *buff & 0x01;       /* 0x01 is topology change */
+
+                priv = (struct lec_priv *)dev->priv;
+                atm_force_charge(priv->lecd, skb2->truesize);
                 sk = sk_atm(priv->lecd);
-                skb_queue_tail(&sk->sk_receive_queue, skb2);
-                sk->sk_data_ready(sk, skb2->len);
-        }
+                skb_queue_tail(&sk->sk_receive_queue, skb2);
+                sk->sk_data_ready(sk, skb2->len);
+        }
 
-        return;
+        return;
 }
 #endif /* defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE) */
 
@@ -162,36 +182,35 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
 #ifdef CONFIG_TR
 static unsigned char *get_tr_dst(unsigned char *packet, unsigned char *rdesc)
 {
-        struct trh_hdr *trh;
-        int riflen, num_rdsc;
-        
-        trh = (struct trh_hdr *)packet;
-        if (trh->daddr[0] & (uint8_t)0x80)
-                return bus_mac; /* multicast */
-
-        if (trh->saddr[0] & TR_RII) {
-                riflen = (ntohs(trh->rcf) & TR_RCF_LEN_MASK) >> 8;
-                if ((ntohs(trh->rcf) >> 13) != 0)
-                        return bus_mac; /* ARE or STE */
-        }
-        else
-                return trh->daddr; /* not source routed */
-
-        if (riflen < 6)
-                return trh->daddr; /* last hop, source routed */
-                
-        /* riflen is 6 or more, packet has more than one route descriptor */
-        num_rdsc = (riflen/2) - 1;
-        memset(rdesc, 0, ETH_ALEN);
-        /* offset 4 comes from LAN destination field in LE control frames */
-        if (trh->rcf & htons((uint16_t)TR_RCF_DIR_BIT))
-                memcpy(&rdesc[4], &trh->rseg[num_rdsc-2], sizeof(uint16_t));
-        else {
-                memcpy(&rdesc[4], &trh->rseg[1], sizeof(uint16_t));
-                rdesc[5] = ((ntohs(trh->rseg[0]) & 0x000f) | (rdesc[5] & 0xf0));
-        }
-
-        return NULL;
+        struct trh_hdr *trh;
+        int riflen, num_rdsc;
+
+        trh = (struct trh_hdr *)packet;
+        if (trh->daddr[0] & (uint8_t) 0x80)
+                return bus_mac; /* multicast */
+
+        if (trh->saddr[0] & TR_RII) {
+                riflen = (ntohs(trh->rcf) & TR_RCF_LEN_MASK) >> 8;
+                if ((ntohs(trh->rcf) >> 13) != 0)
+                        return bus_mac; /* ARE or STE */
+        } else
+                return trh->daddr;      /* not source routed */
+
+        if (riflen < 6)
+                return trh->daddr;      /* last hop, source routed */
+
+        /* riflen is 6 or more, packet has more than one route descriptor */
+        num_rdsc = (riflen / 2) - 1;
+        memset(rdesc, 0, ETH_ALEN);
+        /* offset 4 comes from LAN destination field in LE control frames */
+        if (trh->rcf & htons((uint16_t) TR_RCF_DIR_BIT))
+                memcpy(&rdesc[4], &trh->rseg[num_rdsc - 2], sizeof(uint16_t));
+        else {
+                memcpy(&rdesc[4], &trh->rseg[1], sizeof(uint16_t));
+                rdesc[5] = ((ntohs(trh->rseg[0]) & 0x000f) | (rdesc[5] & 0xf0));
+        }
+
+        return NULL;
 }
 #endif /* CONFIG_TR */
 
@@ -204,15 +223,14 @@ static unsigned char *get_tr_dst(unsigned char *packet, unsigned char *rdesc)
  * there is non-reboot way to recover if something goes wrong.
  */
 
-static int 
-lec_open(struct net_device *dev)
+static int lec_open(struct net_device *dev)
 {
-        struct lec_priv *priv = (struct lec_priv *)dev->priv;
-        
+        struct lec_priv *priv = (struct lec_priv *)dev->priv;
+
         netif_start_queue(dev);
-        memset(&priv->stats,0,sizeof(struct net_device_stats));
-        
-        return 0;
+        memset(&priv->stats, 0, sizeof(struct net_device_stats));
+
+        return 0;
 }
 
 static __inline__ void
@@ -231,160 +249,166 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb, struct lec_priv *priv)
         priv->stats.tx_bytes += skb->len;
 }
 
-static void
-lec_tx_timeout(struct net_device *dev)
+static void lec_tx_timeout(struct net_device *dev)
 {
         printk(KERN_INFO "%s: tx timeout\n", dev->name);
         dev->trans_start = jiffies;
         netif_wake_queue(dev);
 }
 
-static int 
-lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
+static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        struct sk_buff *skb2;
-        struct lec_priv *priv = (struct lec_priv *)dev->priv;
-        struct lecdatahdr_8023 *lec_h;
-        struct atm_vcc *vcc;
+        struct sk_buff *skb2;
+        struct lec_priv *priv = (struct lec_priv *)dev->priv;
+        struct lecdatahdr_8023 *lec_h;
+        struct atm_vcc *vcc;
         struct lec_arp_table *entry;
-        unsigned char *dst;
+        unsigned char *dst;
         int min_frame_size;
 #ifdef CONFIG_TR
-        unsigned char rdesc[ETH_ALEN]; /* Token Ring route descriptor */
+        unsigned char rdesc[ETH_ALEN];  /* Token Ring route descriptor */
 #endif
-        int is_rdesc;
+        int is_rdesc;
 #if DUMP_PACKETS > 0
-        char buf[300];
-        int i=0;
+        char buf[300];
+        int i = 0;
 #endif /* DUMP_PACKETS >0 */
-        
-        DPRINTK("lec_start_xmit called\n");  
-        if (!priv->lecd) {
-                printk("%s:No lecd attached\n",dev->name);
-                priv->stats.tx_errors++;
-                netif_stop_queue(dev);
-                return -EUNATCH;
-        } 
-
-        DPRINTK("skbuff head:%lx data:%lx tail:%lx end:%lx\n",
-                (long)skb->head, (long)skb->data, (long)skb->tail,
-                (long)skb->end);
+
+        DPRINTK("lec_start_xmit called\n");
+        if (!priv->lecd) {
+                printk("%s:No lecd attached\n", dev->name);
+                priv->stats.tx_errors++;
+                netif_stop_queue(dev);
+                return -EUNATCH;
+        }
+
+        DPRINTK("skbuff head:%lx data:%lx tail:%lx end:%lx\n",
+                (long)skb->head, (long)skb->data, (long)skb->tail,
+                (long)skb->end);
 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
-        if (memcmp(skb->data, bridge_ula_lec, sizeof(bridge_ula_lec)) == 0)
-                lec_handle_bridge(skb, dev);
+        if (memcmp(skb->data, bridge_ula_lec, sizeof(bridge_ula_lec)) == 0)
+                lec_handle_bridge(skb, dev);
 #endif
 
-        /* Make sure we have room for lec_id */
-        if (skb_headroom(skb) < 2) {
+        /* Make sure we have room for lec_id */
+        if (skb_headroom(skb) < 2) {
 
-                DPRINTK("lec_start_xmit: reallocating skb\n");
-                skb2 = skb_realloc_headroom(skb, LEC_HEADER_LEN);
-                kfree_skb(skb);
-                if (skb2 == NULL) return 0;
-                skb = skb2;
-        }
-        skb_push(skb, 2);
+                DPRINTK("lec_start_xmit: reallocating skb\n");
+                skb2 = skb_realloc_headroom(skb, LEC_HEADER_LEN);
+                kfree_skb(skb);
+                if (skb2 == NULL)
+                        return 0;
+                skb = skb2;
+        }
+        skb_push(skb, 2);
 
-        /* Put le header to place, works for TokenRing too */
-        lec_h = (struct lecdatahdr_8023*)skb->data;
-        lec_h->le_header = htons(priv->lecid); 
+        /* Put le header to place, works for TokenRing too */
+        lec_h = (struct lecdatahdr_8023 *)skb->data;
+        lec_h->le_header = htons(priv->lecid);
 
 #ifdef CONFIG_TR
-        /* Ugly. Use this to realign Token Ring packets for
-         * e.g. PCA-200E driver. */
-        if (priv->is_trdev) {
-                skb2 = skb_realloc_headroom(skb, LEC_HEADER_LEN);
-                kfree_skb(skb);
-                if (skb2 == NULL) return 0;
-                skb = skb2;
-        }
+        /*
+         * Ugly. Use this to realign Token Ring packets for
+         * e.g. PCA-200E driver.
+         */
+        if (priv->is_trdev) {
+                skb2 = skb_realloc_headroom(skb, LEC_HEADER_LEN);
+                kfree_skb(skb);
+                if (skb2 == NULL)
+                        return 0;
+                skb = skb2;
+        }
 #endif
 
 #if DUMP_PACKETS > 0
-        printk("%s: send datalen:%ld lecid:%4.4x\n", dev->name,
-               skb->len, priv->lecid);
+        printk("%s: send datalen:%ld lecid:%4.4x\n", dev->name,
+               skb->len, priv->lecid);
 #if DUMP_PACKETS >= 2
-        for(i=0;i<skb->len && i <99;i++) {
-                sprintf(buf+i*3,"%2.2x ",0xff&skb->data[i]);
-        }
+        for (i = 0; i < skb->len && i < 99; i++) {
+                sprintf(buf + i * 3, "%2.2x ", 0xff & skb->data[i]);
+        }
 #elif DUMP_PACKETS >= 1
-        for(i=0;i<skb->len && i < 30;i++) {
-                sprintf(buf+i*3,"%2.2x ", 0xff&skb->data[i]);
-        }
+        for (i = 0; i < skb->len && i < 30; i++) {
+                sprintf(buf + i * 3, "%2.2x ", 0xff & skb->data[i]);
+        }
 #endif /* DUMP_PACKETS >= 1 */
-        if (i==skb->len)
-                printk("%s\n",buf);
-        else
-                printk("%s...\n",buf);
+        if (i == skb->len)
+                printk("%s\n", buf);
+        else
+                printk("%s...\n", buf);
 #endif /* DUMP_PACKETS > 0 */
 
-        /* Minimum ethernet-frame size */
+        /* Minimum ethernet-frame size */
 #ifdef CONFIG_TR
-        if (priv->is_trdev)
-                min_frame_size = LEC_MINIMUM_8025_SIZE;
+        if (priv->is_trdev)
+                min_frame_size = LEC_MINIMUM_8025_SIZE;
         else
 #endif
-        min_frame_size = LEC_MINIMUM_8023_SIZE;
-        if (skb->len < min_frame_size) {
-                if ((skb->len + skb_tailroom(skb)) < min_frame_size) {
-                        skb2 = skb_copy_expand(skb, 0,
-                            min_frame_size - skb->truesize, GFP_ATOMIC);
-                                dev_kfree_skb(skb);
-                        if (skb2 == NULL) {
-                                priv->stats.tx_dropped++;
-                                return 0;
-                        }
-                        skb = skb2;
-                }
+                min_frame_size = LEC_MINIMUM_8023_SIZE;
+        if (skb->len < min_frame_size) {
+                if ((skb->len + skb_tailroom(skb)) < min_frame_size) {
+                        skb2 = skb_copy_expand(skb, 0,
+                                               min_frame_size - skb->truesize,
+                                               GFP_ATOMIC);
+                        dev_kfree_skb(skb);
+                        if (skb2 == NULL) {
+                                priv->stats.tx_dropped++;
+                                return 0;
+                        }
+                        skb = skb2;
+                }
                 skb_put(skb, min_frame_size - skb->len);
-        }
-        
-        /* Send to right vcc */
-        is_rdesc = 0;
-        dst = lec_h->h_dest;
+        }
+
+        /* Send to right vcc */
+        is_rdesc = 0;
+        dst = lec_h->h_dest;
 #ifdef CONFIG_TR
-        if (priv->is_trdev) {
-                dst = get_tr_dst(skb->data+2, rdesc);
-                if (dst == NULL) {
-                        dst = rdesc;
-                        is_rdesc = 1;
-                }
-        }
+        if (priv->is_trdev) {
+                dst = get_tr_dst(skb->data + 2, rdesc);
+                if (dst == NULL) {
+                        dst = rdesc;
+                        is_rdesc = 1;
+                }
+        }
 #endif
-        entry = NULL;
-        vcc = lec_arp_resolve(priv, dst, is_rdesc, &entry);
-        DPRINTK("%s:vcc:%p vcc_flags:%x, entry:%p\n", dev->name,
-                vcc, vcc?vcc->flags:0, entry);
-        if (!vcc || !test_bit(ATM_VF_READY,&vcc->flags)) {    
-                if (entry && (entry->tx_wait.qlen < LEC_UNRES_QUE_LEN)) {
-                        DPRINTK("%s:lec_start_xmit: queuing packet, ", dev->name);
-                        DPRINTK("MAC address 0x%02x:%02x:%02x:%02x:%02x:%02x\n",
-                                lec_h->h_dest[0], lec_h->h_dest[1], lec_h->h_dest[2],
-                                lec_h->h_dest[3], lec_h->h_dest[4], lec_h->h_dest[5]);
-                        skb_queue_tail(&entry->tx_wait, skb);
-                } else {
-                        DPRINTK("%s:lec_start_xmit: tx queue full or no arp entry, dropping, ", dev->name);
-                        DPRINTK("MAC address 0x%02x:%02x:%02x:%02x:%02x:%02x\n",
-                                lec_h->h_dest[0], lec_h->h_dest[1], lec_h->h_dest[2],
-                                lec_h->h_dest[3], lec_h->h_dest[4], lec_h->h_dest[5]);
-                        priv->stats.tx_dropped++;
-                        dev_kfree_skb(skb);
-                }
-                return 0;
-        }
-                
-#if DUMP_PACKETS > 0                    
-        printk("%s:sending to vpi:%d vci:%d\n", dev->name,
-               vcc->vpi, vcc->vci);       
+        entry = NULL;
+        vcc = lec_arp_resolve(priv, dst, is_rdesc, &entry);
+        DPRINTK("%s:vcc:%p vcc_flags:%x, entry:%p\n", dev->name,
+                vcc, vcc ? vcc->flags : 0, entry);
+        if (!vcc || !test_bit(ATM_VF_READY, &vcc->flags)) {
+                if (entry && (entry->tx_wait.qlen < LEC_UNRES_QUE_LEN)) {
+                        DPRINTK("%s:lec_start_xmit: queuing packet, ",
+                                dev->name);
+                        DPRINTK("MAC address 0x%02x:%02x:%02x:%02x:%02x:%02x\n",
+                                lec_h->h_dest[0], lec_h->h_dest[1],
+                                lec_h->h_dest[2], lec_h->h_dest[3],
+                                lec_h->h_dest[4], lec_h->h_dest[5]);
+                        skb_queue_tail(&entry->tx_wait, skb);
+                } else {
+                        DPRINTK
+                            ("%s:lec_start_xmit: tx queue full or no arp entry, dropping, ",
+                             dev->name);
+                        DPRINTK("MAC address 0x%02x:%02x:%02x:%02x:%02x:%02x\n",
+                                lec_h->h_dest[0], lec_h->h_dest[1],
+                                lec_h->h_dest[2], lec_h->h_dest[3],
+                                lec_h->h_dest[4], lec_h->h_dest[5]);
+                        priv->stats.tx_dropped++;
+                        dev_kfree_skb(skb);
+                }
+                goto out;
+        }
+#if DUMP_PACKETS > 0
+        printk("%s:sending to vpi:%d vci:%d\n", dev->name, vcc->vpi, vcc->vci);
 #endif /* DUMP_PACKETS > 0 */
-                
-        while (entry && (skb2 = skb_dequeue(&entry->tx_wait))) {
-                DPRINTK("lec.c: emptying tx queue, ");
-                DPRINTK("MAC address 0x%02x:%02x:%02x:%02x:%02x:%02x\n",
-                        lec_h->h_dest[0], lec_h->h_dest[1], lec_h->h_dest[2],
-                        lec_h->h_dest[3], lec_h->h_dest[4], lec_h->h_dest[5]);
+
+        while (entry && (skb2 = skb_dequeue(&entry->tx_wait))) {
+                DPRINTK("lec.c: emptying tx queue, ");
+                DPRINTK("MAC address 0x%02x:%02x:%02x:%02x:%02x:%02x\n",
+                        lec_h->h_dest[0], lec_h->h_dest[1], lec_h->h_dest[2],
+                        lec_h->h_dest[3], lec_h->h_dest[4], lec_h->h_dest[5]);
                 lec_send(vcc, skb2, priv);
-        }
+        }
 
         lec_send(vcc, skb, priv);
 
@@ -404,210 +428,219 @@ lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         netif_wake_queue(dev);
         }
 
+out:
+        if (entry)
+                lec_arp_put(entry);
         dev->trans_start = jiffies;
-        return 0;
+        return 0;
 }
 
 /* The inverse routine to net_open(). */
-static int 
-lec_close(struct net_device *dev) 
+static int lec_close(struct net_device *dev)
 {
-        netif_stop_queue(dev);
-        return 0;
+        netif_stop_queue(dev);
+        return 0;
 }
 
 /*
  * Get the current statistics.
  * This may be called with the card open or closed.
  */
-static struct net_device_stats *
-lec_get_stats(struct net_device *dev)
+static struct net_device_stats *lec_get_stats(struct net_device *dev)
 {
-        return &((struct lec_priv *)dev->priv)->stats;
+        return &((struct lec_priv *)dev->priv)->stats;
 }
 
-static int 
-lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
+static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         unsigned long flags;
-        struct net_device *dev = (struct net_device*)vcc->proto_data;
-        struct lec_priv *priv = (struct lec_priv*)dev->priv;
-        struct atmlec_msg *mesg;
-        struct lec_arp_table *entry;
-        int i;
-        char *tmp; /* FIXME */
+        struct net_device *dev = (struct net_device *)vcc->proto_data;
+        struct lec_priv *priv = (struct lec_priv *)dev->priv;
+        struct atmlec_msg *mesg;
+        struct lec_arp_table *entry;
+        int i;
+        char *tmp;              /* FIXME */
 
         atomic_sub(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
-        mesg = (struct atmlec_msg *)skb->data;
-        tmp = skb->data;
-        tmp += sizeof(struct atmlec_msg);
-        DPRINTK("%s: msg from zeppelin:%d\n", dev->name, mesg->type);
-        switch(mesg->type) {
-        case l_set_mac_addr:
-                for (i=0;i<6;i++) {
-                        dev->dev_addr[i] = mesg->content.normal.mac_addr[i];
-                }    
-                break;
-        case l_del_mac_addr:
-                for(i=0;i<6;i++) {
-                        dev->dev_addr[i] = 0;
-                }
-                break;
-        case l_addr_delete:
-                lec_addr_delete(priv, mesg->content.normal.atm_addr, 
-                                mesg->content.normal.flag);
-                break;
-        case l_topology_change:
-                priv->topology_change = mesg->content.normal.flag;  
-                break;
-        case l_flush_complete:
-                lec_flush_complete(priv, mesg->content.normal.flag);
-                break;
-        case l_narp_req: /* LANE2: see 7.1.35 in the lane2 spec */
+        mesg = (struct atmlec_msg *)skb->data;
+        tmp = skb->data;
+        tmp += sizeof(struct atmlec_msg);
+        DPRINTK("%s: msg from zeppelin:%d\n", dev->name, mesg->type);
+        switch (mesg->type) {
+        case l_set_mac_addr:
+                for (i = 0; i < 6; i++) {
+                        dev->dev_addr[i] = mesg->content.normal.mac_addr[i];
+                }
+                break;
+        case l_del_mac_addr:
+                for (i = 0; i < 6; i++) {
+                        dev->dev_addr[i] = 0;
+                }
+                break;
+        case l_addr_delete:
+                lec_addr_delete(priv, mesg->content.normal.atm_addr,
+                                mesg->content.normal.flag);
+                break;
+        case l_topology_change:
+                priv->topology_change = mesg->content.normal.flag;
+                break;
+        case l_flush_complete:
+                lec_flush_complete(priv, mesg->content.normal.flag);
+                break;
+        case l_narp_req:        /* LANE2: see 7.1.35 in the lane2 spec */
                 spin_lock_irqsave(&priv->lec_arp_lock, flags);
-                entry = lec_arp_find(priv, mesg->content.normal.mac_addr);
-                lec_arp_remove(priv, entry);
+                entry = lec_arp_find(priv, mesg->content.normal.mac_addr);
+                lec_arp_remove(priv, entry);
                 spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
 
-                if (mesg->content.normal.no_source_le_narp)
-                        break;
-                /* FALL THROUGH */
-        case l_arp_update:
-                lec_arp_update(priv, mesg->content.normal.mac_addr,
-                               mesg->content.normal.atm_addr,
-                               mesg->content.normal.flag,
-                               mesg->content.normal.targetless_le_arp);
-                DPRINTK("lec: in l_arp_update\n");
-                if (mesg->sizeoftlvs != 0) { /* LANE2 3.1.5 */
-                        DPRINTK("lec: LANE2 3.1.5, got tlvs, size %d\n", mesg->sizeoftlvs);
-                        lane2_associate_ind(dev,
-                                            mesg->content.normal.mac_addr,
-                                            tmp, mesg->sizeoftlvs);
-                }
-                break;
-        case l_config:
-                priv->maximum_unknown_frame_count = 
-                        mesg->content.config.maximum_unknown_frame_count;
-                priv->max_unknown_frame_time = 
-                        (mesg->content.config.max_unknown_frame_time*HZ);
-                priv->max_retry_count = 
-                        mesg->content.config.max_retry_count;
-                priv->aging_time = (mesg->content.config.aging_time*HZ);
-                priv->forward_delay_time = 
-                        (mesg->content.config.forward_delay_time*HZ);
-                priv->arp_response_time = 
-                        (mesg->content.config.arp_response_time*HZ);
-                priv->flush_timeout = (mesg->content.config.flush_timeout*HZ);
-                priv->path_switching_delay = 
-                        (mesg->content.config.path_switching_delay*HZ);
-                priv->lane_version = mesg->content.config.lane_version; /* LANE2 */
+                if (mesg->content.normal.no_source_le_narp)
+                        break;
+                /* FALL THROUGH */
+        case l_arp_update:
+                lec_arp_update(priv, mesg->content.normal.mac_addr,
+                               mesg->content.normal.atm_addr,
+                               mesg->content.normal.flag,
+                               mesg->content.normal.targetless_le_arp);
+                DPRINTK("lec: in l_arp_update\n");
+                if (mesg->sizeoftlvs != 0) {    /* LANE2 3.1.5 */
+                        DPRINTK("lec: LANE2 3.1.5, got tlvs, size %d\n",
+                                mesg->sizeoftlvs);
+                        lane2_associate_ind(dev, mesg->content.normal.mac_addr,
+                                            tmp, mesg->sizeoftlvs);
+                }
+                break;
+        case l_config:
+                priv->maximum_unknown_frame_count =
+                    mesg->content.config.maximum_unknown_frame_count;
+                priv->max_unknown_frame_time =
+                    (mesg->content.config.max_unknown_frame_time * HZ);
+                priv->max_retry_count = mesg->content.config.max_retry_count;
+                priv->aging_time = (mesg->content.config.aging_time * HZ);
+                priv->forward_delay_time =
+                    (mesg->content.config.forward_delay_time * HZ);
+                priv->arp_response_time =
+                    (mesg->content.config.arp_response_time * HZ);
+                priv->flush_timeout = (mesg->content.config.flush_timeout * HZ);
+                priv->path_switching_delay =
+                    (mesg->content.config.path_switching_delay * HZ);
+                priv->lane_version = mesg->content.config.lane_version; /* LANE2 */
                 priv->lane2_ops = NULL;
                 if (priv->lane_version > 1)
                         priv->lane2_ops = &lane2_ops;
                 if (dev->change_mtu(dev, mesg->content.config.mtu))
                         printk("%s: change_mtu to %d failed\n", dev->name,
-                            mesg->content.config.mtu);
+                               mesg->content.config.mtu);
                 priv->is_proxy = mesg->content.config.is_proxy;
-                break;
-        case l_flush_tran_id:
-                lec_set_flush_tran_id(priv, mesg->content.normal.atm_addr,
-                                      mesg->content.normal.flag);
-                break;
-        case l_set_lecid:
-                priv->lecid=(unsigned short)(0xffff&mesg->content.normal.flag);
-                break;
-        case l_should_bridge: {
+                break;
+        case l_flush_tran_id:
+                lec_set_flush_tran_id(priv, mesg->content.normal.atm_addr,
+                                      mesg->content.normal.flag);
+                break;
+        case l_set_lecid:
+                priv->lecid =
+                    (unsigned short)(0xffff & mesg->content.normal.flag);
+                break;
+        case l_should_bridge:
 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
-                struct net_bridge_fdb_entry *f;
-
-                DPRINTK("%s: bridge zeppelin asks about 0x%02x:%02x:%02x:%02x:%02x:%02x\n",
-                        dev->name,
-                        mesg->content.proxy.mac_addr[0], mesg->content.proxy.mac_addr[1],
-                        mesg->content.proxy.mac_addr[2], mesg->content.proxy.mac_addr[3],
-                        mesg->content.proxy.mac_addr[4], mesg->content.proxy.mac_addr[5]);
-
-                if (br_fdb_get_hook == NULL || dev->br_port == NULL)
-                        break;
-
-                f = br_fdb_get_hook(dev->br_port->br, mesg->content.proxy.mac_addr);
-                if (f != NULL &&
-                    f->dst->dev != dev &&
-                    f->dst->state == BR_STATE_FORWARDING) {
-                                /* hit from bridge table, send LE_ARP_RESPONSE */
-                        struct sk_buff *skb2;
-                        struct sock *sk;
-
-                        DPRINTK("%s: entry found, responding to zeppelin\n", dev->name);
-                        skb2 = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
-                        if (skb2 == NULL) {
-                                br_fdb_put_hook(f);
-                                break;
-                        }
-                        skb2->len = sizeof(struct atmlec_msg);
-                        memcpy(skb2->data, mesg, sizeof(struct atmlec_msg));
-                        atm_force_charge(priv->lecd, skb2->truesize);
-                        sk = sk_atm(priv->lecd);
-                        skb_queue_tail(&sk->sk_receive_queue, skb2);
-                        sk->sk_data_ready(sk, skb2->len);
-                }
-                if (f != NULL) br_fdb_put_hook(f);
+                {
+                        struct net_bridge_fdb_entry *f;
+
+                        DPRINTK
+                            ("%s: bridge zeppelin asks about 0x%02x:%02x:%02x:%02x:%02x:%02x\n",
+                             dev->name, mesg->content.proxy.mac_addr[0],
+                             mesg->content.proxy.mac_addr[1],
+                             mesg->content.proxy.mac_addr[2],
+                             mesg->content.proxy.mac_addr[3],
+                             mesg->content.proxy.mac_addr[4],
+                             mesg->content.proxy.mac_addr[5]);
+
+                        if (br_fdb_get_hook == NULL || dev->br_port == NULL)
+                                break;
+
+                        f = br_fdb_get_hook(dev->br_port->br,
+                                            mesg->content.proxy.mac_addr);
+                        if (f != NULL && f->dst->dev != dev
+                            && f->dst->state == BR_STATE_FORWARDING) {
+                                /* hit from bridge table, send LE_ARP_RESPONSE */
+                                struct sk_buff *skb2;
+                                struct sock *sk;
+
+                                DPRINTK
+                                    ("%s: entry found, responding to zeppelin\n",
+                                     dev->name);
+                                skb2 =
+                                    alloc_skb(sizeof(struct atmlec_msg),
+                                              GFP_ATOMIC);
+                                if (skb2 == NULL) {
+                                        br_fdb_put_hook(f);
+                                        break;
+                                }
+                                skb2->len = sizeof(struct atmlec_msg);
+                                memcpy(skb2->data, mesg,
+                                       sizeof(struct atmlec_msg));
+                                atm_force_charge(priv->lecd, skb2->truesize);
+                                sk = sk_atm(priv->lecd);
+                                skb_queue_tail(&sk->sk_receive_queue, skb2);
+                                sk->sk_data_ready(sk, skb2->len);
+                        }
+                        if (f != NULL)
+                                br_fdb_put_hook(f);
+                }
 #endif /* defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE) */
-                }
-                break;
-        default:
-                printk("%s: Unknown message type %d\n", dev->name, mesg->type);
-                dev_kfree_skb(skb);
-                return -EINVAL;
-        }
-        dev_kfree_skb(skb);
-        return 0;
+                break;
+        default:
+                printk("%s: Unknown message type %d\n", dev->name, mesg->type);
+                dev_kfree_skb(skb);
+                return -EINVAL;
+        }
+        dev_kfree_skb(skb);
+        return 0;
 }
 
-static void 
-lec_atm_close(struct atm_vcc *vcc)
+static void lec_atm_close(struct atm_vcc *vcc)
 {
-        struct sk_buff *skb;
-        struct net_device *dev = (struct net_device *)vcc->proto_data;
-        struct lec_priv *priv = (struct lec_priv *)dev->priv;
+        struct sk_buff *skb;
+        struct net_device *dev = (struct net_device *)vcc->proto_data;
+        struct lec_priv *priv = (struct lec_priv *)dev->priv;
 
-        priv->lecd = NULL;
-        /* Do something needful? */
+        priv->lecd = NULL;
+        /* Do something needful? */
 
-        netif_stop_queue(dev);
-        lec_arp_destroy(priv);
+        netif_stop_queue(dev);
+        lec_arp_destroy(priv);
 
-        if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
+        if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
                 printk("%s lec_atm_close: closing with messages pending\n",
-                       dev->name);
-        while ((skb = skb_dequeue(&sk_atm(vcc)->sk_receive_queue)) != NULL) {
-                atm_return(vcc, skb->truesize);
+                       dev->name);
+        while ((skb = skb_dequeue(&sk_atm(vcc)->sk_receive_queue)) != NULL) {
+                atm_return(vcc, skb->truesize);
                 dev_kfree_skb(skb);
-        }
-  
+        }
+
         printk("%s: Shut down!\n", dev->name);
-        module_put(THIS_MODULE);
+        module_put(THIS_MODULE);
 }
 
 static struct atmdev_ops lecdev_ops = {
-        .close  = lec_atm_close,
-        .send   = lec_atm_send
+        .close = lec_atm_close,
+        .send = lec_atm_send
 };
 
 static struct atm_dev lecatm_dev = {
-        .ops    = &lecdev_ops,
-        .type   = "lec",
-        .number = 999,  /* dummy device number */
-        .lock   = SPIN_LOCK_UNLOCKED
+        .ops = &lecdev_ops,
+        .type = "lec",
+        .number = 999,          /* dummy device number */
+        .lock = SPIN_LOCK_UNLOCKED
 };
 
 /*
  * LANE2: new argument struct sk_buff *data contains
  * the LE_ARP based TLVs introduced in the LANE2 spec
  */
-static int 
-send_to_lecd(struct lec_priv *priv, atmlec_msg_type type, 
-             unsigned char *mac_addr, unsigned char *atm_addr,
-             struct sk_buff *data)
+static int
+send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
+             unsigned char *mac_addr, unsigned char *atm_addr,
+             struct sk_buff *data)
 {
         struct sock *sk;
         struct sk_buff *skb;
@@ -621,187 +654,193 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
                 return -1;
         skb->len = sizeof(struct atmlec_msg);
         mesg = (struct atmlec_msg *)skb->data;
-        memset(mesg, 0, sizeof(struct atmlec_msg));
+        memset(mesg, 0, sizeof(struct atmlec_msg));
         mesg->type = type;
-        if (data != NULL)
-                mesg->sizeoftlvs = data->len;
+        if (data != NULL)
+                mesg->sizeoftlvs = data->len;
         if (mac_addr)
                 memcpy(&mesg->content.normal.mac_addr, mac_addr, ETH_ALEN);
-        else
-                mesg->content.normal.targetless_le_arp = 1;
+        else
+                mesg->content.normal.targetless_le_arp = 1;
         if (atm_addr)
                 memcpy(&mesg->content.normal.atm_addr, atm_addr, ATM_ESA_LEN);
 
-        atm_force_charge(priv->lecd, skb->truesize);
+        atm_force_charge(priv->lecd, skb->truesize);
         sk = sk_atm(priv->lecd);
         skb_queue_tail(&sk->sk_receive_queue, skb);
-        sk->sk_data_ready(sk, skb->len);
+        sk->sk_data_ready(sk, skb->len);
 
-        if (data != NULL) {
-                DPRINTK("lec: about to send %d bytes of data\n", data->len);
-                atm_force_charge(priv->lecd, data->truesize);
-                skb_queue_tail(&sk->sk_receive_queue, data);
-                sk->sk_data_ready(sk, skb->len);
-        }
+        if (data != NULL) {
+                DPRINTK("lec: about to send %d bytes of data\n", data->len);
+                atm_force_charge(priv->lecd, data->truesize);
+                skb_queue_tail(&sk->sk_receive_queue, data);
+                sk->sk_data_ready(sk, skb->len);
+        }
 
-        return 0;
+        return 0;
 }
 
 /* shamelessly stolen from drivers/net/net_init.c */
 static int lec_change_mtu(struct net_device *dev, int new_mtu)
 {
-        if ((new_mtu < 68) || (new_mtu > 18190))
-                return -EINVAL;
-        dev->mtu = new_mtu;
-        return 0;
+        if ((new_mtu < 68) || (new_mtu > 18190))
+                return -EINVAL;
+        dev->mtu = new_mtu;
+        return 0;
 }
 
 static void lec_set_multicast_list(struct net_device *dev)
 {
-        /* by default, all multicast frames arrive over the bus.
-         * eventually support selective multicast service
-         */
-        return;
+        /*
+         * by default, all multicast frames arrive over the bus.
+         * eventually support selective multicast service
+         */
+        return;
 }
 
-static void 
-lec_init(struct net_device *dev)
+static void lec_init(struct net_device *dev)
 {
-        dev->change_mtu = lec_change_mtu;
-        dev->open = lec_open;
-        dev->stop = lec_close;
-        dev->hard_start_xmit = lec_start_xmit;
+        dev->change_mtu = lec_change_mtu;
+        dev->open = lec_open;
+        dev->stop = lec_close;
+        dev->hard_start_xmit = lec_start_xmit;
         dev->tx_timeout = lec_tx_timeout;
 
-        dev->get_stats = lec_get_stats;
-        dev->set_multicast_list = lec_set_multicast_list;
-        dev->do_ioctl  = NULL;
-        printk("%s: Initialized!\n",dev->name);
-        return;
+        dev->get_stats = lec_get_stats;
+        dev->set_multicast_list = lec_set_multicast_list;
+        dev->do_ioctl = NULL;
+        printk("%s: Initialized!\n", dev->name);
+        return;
 }
 
 static unsigned char lec_ctrl_magic[] = {
-        0xff,
-        0x00,
-        0x01,
-        0x01 };
+        0xff,
+        0x00,
+        0x01,
+        0x01
+};
 
 #define LEC_DATA_DIRECT_8023  2
 #define LEC_DATA_DIRECT_8025  3
 
 static int lec_is_data_direct(struct atm_vcc *vcc)
-{ 
+{
         return ((vcc->sap.blli[0].l3.tr9577.snap[4] == LEC_DATA_DIRECT_8023) ||
                 (vcc->sap.blli[0].l3.tr9577.snap[4] == LEC_DATA_DIRECT_8025));
-} 
+}
 
-static void 
-lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
+static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         unsigned long flags;
-        struct net_device *dev = (struct net_device *)vcc->proto_data;
-        struct lec_priv *priv = (struct lec_priv *)dev->priv; 
+        struct net_device *dev = (struct net_device *)vcc->proto_data;
+        struct lec_priv *priv = (struct lec_priv *)dev->priv;
 
 #if DUMP_PACKETS >0
-        int i=0;
-        char buf[300];
+        int i = 0;
+        char buf[300];
 
-        printk("%s: lec_push vcc vpi:%d vci:%d\n", dev->name,
-               vcc->vpi, vcc->vci);
+        printk("%s: lec_push vcc vpi:%d vci:%d\n", dev->name,
+               vcc->vpi, vcc->vci);
 #endif
-        if (!skb) {
-                DPRINTK("%s: null skb\n",dev->name);
-                lec_vcc_close(priv, vcc);
-                return;
-        }
+        if (!skb) {
+                DPRINTK("%s: null skb\n", dev->name);
+                lec_vcc_close(priv, vcc);
+                return;
+        }
 #if DUMP_PACKETS > 0
-        printk("%s: rcv datalen:%ld lecid:%4.4x\n", dev->name,
-               skb->len, priv->lecid);
+        printk("%s: rcv datalen:%ld lecid:%4.4x\n", dev->name,
+               skb->len, priv->lecid);
 #if DUMP_PACKETS >= 2
-        for(i=0;i<skb->len && i <99;i++) {
-                sprintf(buf+i*3,"%2.2x ",0xff&skb->data[i]);
-        }
+        for (i = 0; i < skb->len && i < 99; i++) {
+                sprintf(buf + i * 3, "%2.2x ", 0xff & skb->data[i]);
+        }
 #elif DUMP_PACKETS >= 1
-        for(i=0;i<skb->len && i < 30;i++) {
-                sprintf(buf+i*3,"%2.2x ", 0xff&skb->data[i]);
-        }
+        for (i = 0; i < skb->len && i < 30; i++) {
+                sprintf(buf + i * 3, "%2.2x ", 0xff & skb->data[i]);
+        }
 #endif /* DUMP_PACKETS >= 1 */
-        if (i==skb->len)
-                printk("%s\n",buf);
-        else
-                printk("%s...\n",buf);
+        if (i == skb->len)
+                printk("%s\n", buf);
+        else
+                printk("%s...\n", buf);
 #endif /* DUMP_PACKETS > 0 */
-        if (memcmp(skb->data, lec_ctrl_magic, 4) ==0) { /* Control frame, to daemon*/
+        if (memcmp(skb->data, lec_ctrl_magic, 4) == 0) {        /* Control frame, to daemon */
                 struct sock *sk = sk_atm(vcc);
 
-                DPRINTK("%s: To daemon\n",dev->name);
-                skb_queue_tail(&sk->sk_receive_queue, skb);
-                sk->sk_data_ready(sk, skb->len);
-        } else { /* Data frame, queue to protocol handlers */
+                DPRINTK("%s: To daemon\n", dev->name);
+                skb_queue_tail(&sk->sk_receive_queue, skb);
+                sk->sk_data_ready(sk, skb->len);
+        } else {                /* Data frame, queue to protocol handlers */
                 struct lec_arp_table *entry;
-                unsigned char *src, *dst;
-
-                atm_return(vcc,skb->truesize);
-                if (*(uint16_t *)skb->data == htons(priv->lecid) ||
-                    !priv->lecd ||
-                    !(dev->flags & IFF_UP)) { 
-                        /* Probably looping back, or if lecd is missing,
-                           lecd has gone down */
-                        DPRINTK("Ignoring frame...\n");
-                        dev_kfree_skb(skb);
-                        return;
-                }
+                unsigned char *src, *dst;
+
+                atm_return(vcc, skb->truesize);
+                if (*(uint16_t *) skb->data == htons(priv->lecid) ||
+                    !priv->lecd || !(dev->flags & IFF_UP)) {
+                        /*
+                         * Probably looping back, or if lecd is missing,
+                         * lecd has gone down
+                         */
+                        DPRINTK("Ignoring frame...\n");
+                        dev_kfree_skb(skb);
+                        return;
+                }
 #ifdef CONFIG_TR
-                if (priv->is_trdev)
-                        dst = ((struct lecdatahdr_8025 *) skb->data)->h_dest;
-                else
+                if (priv->is_trdev)
+                        dst = ((struct lecdatahdr_8025 *)skb->data)->h_dest;
+                else
 #endif
-                dst = ((struct lecdatahdr_8023 *) skb->data)->h_dest;
+                        dst = ((struct lecdatahdr_8023 *)skb->data)->h_dest;
 
-                /* If this is a Data Direct VCC, and the VCC does not match
+                /*
+                 * If this is a Data Direct VCC, and the VCC does not match
                  * the LE_ARP cache entry, delete the LE_ARP cache entry.
                  */
                 spin_lock_irqsave(&priv->lec_arp_lock, flags);
                 if (lec_is_data_direct(vcc)) {
 #ifdef CONFIG_TR
                         if (priv->is_trdev)
-                                src = ((struct lecdatahdr_8025 *) skb->data)->h_source;
+                                src =
+                                    ((struct lecdatahdr_8025 *)skb->data)->
+                                    h_source;
                         else
 #endif
-                        src = ((struct lecdatahdr_8023 *) skb->data)->h_source;
+                                src =
+                                    ((struct lecdatahdr_8023 *)skb->data)->
+                                    h_source;
                         entry = lec_arp_find(priv, src);
                         if (entry && entry->vcc != vcc) {
                                 lec_arp_remove(priv, entry);
-                                kfree(entry);
+                                lec_arp_put(entry);
                         }
                 }
                 spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
 
-                if (!(dst[0]&0x01) &&   /* Never filter Multi/Broadcast */
-                    !priv->is_proxy &&  /* Proxy wants all the packets */
+                if (!(dst[0] & 0x01) && /* Never filter Multi/Broadcast */
+                    !priv->is_proxy &&  /* Proxy wants all the packets */
                     memcmp(dst, dev->dev_addr, dev->addr_len)) {
-                        dev_kfree_skb(skb);
-                        return;
-                }
-                if (priv->lec_arp_empty_ones) {
-                        lec_arp_check_empties(priv, vcc, skb);
-                }
-                skb->dev = dev;
-                skb_pull(skb, 2); /* skip lec_id */
+                        dev_kfree_skb(skb);
+                        return;
+                }
+                if (!hlist_empty(&priv->lec_arp_empty_ones)) {
+                        lec_arp_check_empties(priv, vcc, skb);
+                }
+                skb->dev = dev;
+                skb_pull(skb, 2);       /* skip lec_id */
 #ifdef CONFIG_TR
-                if (priv->is_trdev) skb->protocol = tr_type_trans(skb, dev);
-                else
+                if (priv->is_trdev)
+                        skb->protocol = tr_type_trans(skb, dev);
+                else
 #endif
-                skb->protocol = eth_type_trans(skb, dev);
-                priv->stats.rx_packets++;
-                priv->stats.rx_bytes += skb->len;
-                memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
-                netif_rx(skb);
-        }
+                        skb->protocol = eth_type_trans(skb, dev);
+                priv->stats.rx_packets++;
+                priv->stats.rx_bytes += skb->len;
+                memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
+                netif_rx(skb);
+        }
 }
 
-static void
-lec_pop(struct atm_vcc *vcc, struct sk_buff *skb)
+static void lec_pop(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         struct lec_vcc_priv *vpriv = LEC_VCC_PRIV(vcc);
         struct net_device *dev = skb->dev;
@@ -820,123 +859,121 @@ lec_pop(struct atm_vcc *vcc, struct sk_buff *skb)
         }
 }
 
-static int 
-lec_vcc_attach(struct atm_vcc *vcc, void __user *arg)
+static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg)
 {
         struct lec_vcc_priv *vpriv;
-        int bytes_left;
-        struct atmlec_ioc ioc_data;
-
-        /* Lecd must be up in this case */
-        bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmlec_ioc));
-        if (bytes_left != 0) {
-                printk("lec: lec_vcc_attach, copy from user failed for %d bytes\n",
-                       bytes_left);
-        }
-        if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF || 
-            !dev_lec[ioc_data.dev_num])
-                return -EINVAL;
+        int bytes_left;
+        struct atmlec_ioc ioc_data;
+
+        /* Lecd must be up in this case */
+        bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmlec_ioc));
+        if (bytes_left != 0) {
+                printk
+                    ("lec: lec_vcc_attach, copy from user failed for %d bytes\n",
+                     bytes_left);
+        }
+        if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF ||
+            !dev_lec[ioc_data.dev_num])
+                return -EINVAL;
         if (!(vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL)))
                 return -ENOMEM;
         vpriv->xoff = 0;
         vpriv->old_pop = vcc->pop;
         vcc->user_back = vpriv;
         vcc->pop = lec_pop;
-        lec_vcc_added(dev_lec[ioc_data.dev_num]->priv, 
-                      &ioc_data, vcc, vcc->push);
-        vcc->proto_data = dev_lec[ioc_data.dev_num];
-        vcc->push = lec_push;
-        return 0;
+        lec_vcc_added(dev_lec[ioc_data.dev_num]->priv,
+                      &ioc_data, vcc, vcc->push);
+        vcc->proto_data = dev_lec[ioc_data.dev_num];
+        vcc->push = lec_push;
+        return 0;
 }
 
-static int 
-lec_mcast_attach(struct atm_vcc *vcc, int arg)
+static int lec_mcast_attach(struct atm_vcc *vcc, int arg)
 {
-        if (arg <0 || arg >= MAX_LEC_ITF || !dev_lec[arg])
-                return -EINVAL;
-        vcc->proto_data = dev_lec[arg];
-        return (lec_mcast_make((struct lec_priv*)dev_lec[arg]->priv, vcc));
+        if (arg < 0 || arg >= MAX_LEC_ITF || !dev_lec[arg])
+                return -EINVAL;
+        vcc->proto_data = dev_lec[arg];
+        return (lec_mcast_make((struct lec_priv *)dev_lec[arg]->priv, vcc));
 }
 
 /* Initialize device. */
-static int 
-lecd_attach(struct atm_vcc *vcc, int arg)
-{  
-        int i;
-        struct lec_priv *priv;
-
-        if (arg<0)
-                i = 0;
-        else
-                i = arg;
+static int lecd_attach(struct atm_vcc *vcc, int arg)
+{
+        int i;
+        struct lec_priv *priv;
+
+        if (arg < 0)
+                i = 0;
+        else
+                i = arg;
 #ifdef CONFIG_TR
-        if (arg >= MAX_LEC_ITF)
-                return -EINVAL;
-#else /* Reserve the top NUM_TR_DEVS for TR */
-        if (arg >= (MAX_LEC_ITF-NUM_TR_DEVS))
-                return -EINVAL;
+        if (arg >= MAX_LEC_ITF)
+                return -EINVAL;
+#else                           /* Reserve the top NUM_TR_DEVS for TR */
+        if (arg >= (MAX_LEC_ITF - NUM_TR_DEVS))
+                return -EINVAL;
 #endif
-        if (!dev_lec[i]) {
-                int is_trdev, size;
+        if (!dev_lec[i]) {
+                int is_trdev, size;
 
-                is_trdev = 0;
-                if (i >= (MAX_LEC_ITF - NUM_TR_DEVS))
-                        is_trdev = 1;
+                is_trdev = 0;
+                if (i >= (MAX_LEC_ITF - NUM_TR_DEVS))
+                        is_trdev = 1;
 
-                size = sizeof(struct lec_priv);
+                size = sizeof(struct lec_priv);
 #ifdef CONFIG_TR
-                if (is_trdev)
-                        dev_lec[i] = alloc_trdev(size);
-                else
+                if (is_trdev)
+                        dev_lec[i] = alloc_trdev(size);
+                else
 #endif
-                dev_lec[i] = alloc_etherdev(size);
-                if (!dev_lec[i])
-                        return -ENOMEM;
-                snprintf(dev_lec[i]->name, IFNAMSIZ, "lec%d", i);
-                if (register_netdev(dev_lec[i])) {
-                        free_netdev(dev_lec[i]);
-                        return -EINVAL;
-                }
-
-                priv = dev_lec[i]->priv;
-                priv->is_trdev = is_trdev;
-                lec_init(dev_lec[i]);
-        } else {
-                priv = dev_lec[i]->priv;
-                if (priv->lecd)
-                        return -EADDRINUSE;
-        }
-        lec_arp_init(priv);
-        priv->itfnum = i;  /* LANE2 addition */
-        priv->lecd = vcc;
-        vcc->dev = &lecatm_dev;
-        vcc_insert_socket(sk_atm(vcc));
-        
-        vcc->proto_data = dev_lec[i];
-        set_bit(ATM_VF_META,&vcc->flags);
-        set_bit(ATM_VF_READY,&vcc->flags);
-
-        /* Set default values to these variables */
-        priv->maximum_unknown_frame_count = 1;
-        priv->max_unknown_frame_time = (1*HZ);
-        priv->vcc_timeout_period = (1200*HZ);
-        priv->max_retry_count = 1;
-        priv->aging_time = (300*HZ);
-        priv->forward_delay_time = (15*HZ);
-        priv->topology_change = 0;
-        priv->arp_response_time = (1*HZ);
-        priv->flush_timeout = (4*HZ);
-        priv->path_switching_delay = (6*HZ);
-
-        if (dev_lec[i]->flags & IFF_UP) {
-                netif_start_queue(dev_lec[i]);
-        }
-        __module_get(THIS_MODULE);
-        return i;
+                        dev_lec[i] = alloc_etherdev(size);
+                if (!dev_lec[i])
+                        return -ENOMEM;
+                snprintf(dev_lec[i]->name, IFNAMSIZ, "lec%d", i);
+                if (register_netdev(dev_lec[i])) {
+                        free_netdev(dev_lec[i]);
+                        return -EINVAL;
+                }
+
+                priv = dev_lec[i]->priv;
+                priv->is_trdev = is_trdev;
+                lec_init(dev_lec[i]);
+        } else {
+                priv = dev_lec[i]->priv;
+                if (priv->lecd)
+                        return -EADDRINUSE;
+        }
+        lec_arp_init(priv);
+        priv->itfnum = i;       /* LANE2 addition */
+        priv->lecd = vcc;
+        vcc->dev = &lecatm_dev;
+        vcc_insert_socket(sk_atm(vcc));
+
+        vcc->proto_data = dev_lec[i];
+        set_bit(ATM_VF_META, &vcc->flags);
+        set_bit(ATM_VF_READY, &vcc->flags);
+
+        /* Set default values to these variables */
+        priv->maximum_unknown_frame_count = 1;
+        priv->max_unknown_frame_time = (1 * HZ);
+        priv->vcc_timeout_period = (1200 * HZ);
+        priv->max_retry_count = 1;
+        priv->aging_time = (300 * HZ);
+        priv->forward_delay_time = (15 * HZ);
+        priv->topology_change = 0;
+        priv->arp_response_time = (1 * HZ);
+        priv->flush_timeout = (4 * HZ);
+        priv->path_switching_delay = (6 * HZ);
+
+        if (dev_lec[i]->flags & IFF_UP) {
+                netif_start_queue(dev_lec[i]);
+        }
+        __module_get(THIS_MODULE);
+        return i;
 }
 
 #ifdef CONFIG_PROC_FS
-static char* lec_arp_get_status_string(unsigned char status)
+static char *lec_arp_get_status_string(unsigned char status)
 {
         static char *lec_arp_status_string[] = {
                 "ESI_UNKNOWN       ",
@@ -966,52 +1003,54 @@ static void lec_info(struct seq_file *seq, struct lec_arp_table *entry)
         if (entry->vcc)
                 seq_printf(seq, "%3d %3d ", entry->vcc->vpi, entry->vcc->vci);
         else
-                seq_printf(seq, "        ");
+                seq_printf(seq, "        ");
         if (entry->recv_vcc) {
                 seq_printf(seq, "     %3d %3d", entry->recv_vcc->vpi,
                            entry->recv_vcc->vci);
-        }
-        seq_putc(seq, '\n');
+        }
+        seq_putc(seq, '\n');
 }
 
-
 struct lec_state {
         unsigned long flags;
         struct lec_priv *locked;
-        struct lec_arp_table *entry;
+        struct hlist_node *node;
         struct net_device *dev;
         int itf;
         int arp_table;
         int misc_table;
 };
 
-static void *lec_tbl_walk(struct lec_state *state, struct lec_arp_table *tbl,
+static void *lec_tbl_walk(struct lec_state *state, struct hlist_head *tbl,
                           loff_t *l)
 {
-        struct lec_arp_table *e = state->entry;
+        struct hlist_node *e = state->node;
+        struct lec_arp_table *tmp;
 
         if (!e)
-                e = tbl;
+                e = tbl->first;
         if (e == (void *)1) {
-                e = tbl;
+                e = tbl->first;
                 --*l;
         }
-        for (; e; e = e->next) {
+
+        hlist_for_each_entry_from(tmp, e, next) {
                 if (--*l < 0)
                         break;
         }
-        state->entry = e;
+        state->node = e;
+
         return (*l < 0) ? state : NULL;
 }
 
 static void *lec_arp_walk(struct lec_state *state, loff_t *l,
-                              struct lec_priv *priv)
+                          struct lec_priv *priv)
 {
         void *v = NULL;
         int p;
 
         for (p = state->arp_table; p < LEC_ARP_TABLE_SIZE; p++) {
-                v = lec_tbl_walk(state, priv->lec_arp_tables[p], l);
+                v = lec_tbl_walk(state, &priv->lec_arp_tables[p], l);
                 if (v)
                         break;
         }
@@ -1022,10 +1061,10 @@ static void *lec_arp_walk(struct lec_state *state, loff_t *l,
 static void *lec_misc_walk(struct lec_state *state, loff_t *l,
                            struct lec_priv *priv)
 {
-        struct lec_arp_table *lec_misc_tables[] = {
-                priv->lec_arp_empty_ones,
-                priv->lec_no_forward,
-                priv->mcast_fwds
+        struct hlist_head *lec_misc_tables[] = {
+                &priv->lec_arp_empty_ones,
+                &priv->lec_no_forward,
+                &priv->mcast_fwds
         };
         void *v = NULL;
         int q;
@@ -1046,8 +1085,7 @@ static void *lec_priv_walk(struct lec_state *state, loff_t *l,
                 state->locked = priv;
                 spin_lock_irqsave(&priv->lec_arp_lock, state->flags);
         }
-        if (!lec_arp_walk(state, l, priv) &&
-            !lec_misc_walk(state, l, priv)) {
+        if (!lec_arp_walk(state, l, priv) && !lec_misc_walk(state, l, priv)) {
                 spin_unlock_irqrestore(&priv->lec_arp_lock, state->flags);
                 state->locked = NULL;
                 /* Partial state reset for the next time we get called */
@@ -1081,7 +1119,7 @@ static void *lec_get_idx(struct lec_state *state, loff_t l)
                 if (v)
                         break;
         }
-        return v; 
+        return v;
 }
 
 static void *lec_seq_start(struct seq_file *seq, loff_t *pos)
@@ -1093,9 +1131,9 @@ static void *lec_seq_start(struct seq_file *seq, loff_t *pos)
         state->locked = NULL;
         state->arp_table = 0;
         state->misc_table = 0;
-        state->entry = (void *)1;
+        state->node = (void *)1;
 
-        return *pos ? lec_get_idx(state, *pos) : (void*)1;
+        return *pos ? lec_get_idx(state, *pos) : (void *)1;
 }
 
 static void lec_seq_stop(struct seq_file *seq, void *v)
@@ -1120,27 +1158,28 @@ static void *lec_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 
 static int lec_seq_show(struct seq_file *seq, void *v)
 {
-        static char lec_banner[] = "Itf  MAC          ATM destination" 
-                "                          Status            Flags "
-                "VPI/VCI Recv VPI/VCI\n";
+        static char lec_banner[] = "Itf  MAC          ATM destination"
+            "                          Status            Flags "
+            "VPI/VCI Recv VPI/VCI\n";
 
         if (v == (void *)1)
                 seq_puts(seq, lec_banner);
         else {
                 struct lec_state *state = seq->private;
-                struct net_device *dev = state->dev; 
+                struct net_device *dev = state->dev;
+                struct lec_arp_table *entry = hlist_entry(state->node, struct lec_arp_table, next);
 
                 seq_printf(seq, "%s ", dev->name);
-                lec_info(seq, state->entry);
+                lec_info(seq, entry);
         }
         return 0;
 }
 
 static struct seq_operations lec_seq_ops = {
-        .start  = lec_seq_start,
-        .next   = lec_seq_next,
-        .stop   = lec_seq_stop,
-        .show   = lec_seq_show,
+        .start = lec_seq_start,
+        .next = lec_seq_next,
+        .stop = lec_seq_stop,
+        .show = lec_seq_show,
 };
 
 static int lec_seq_open(struct inode *inode, struct file *file)
@@ -1174,11 +1213,11 @@ static int lec_seq_release(struct inode *inode, struct file *file)
 }
 
 static struct file_operations lec_seq_fops = {
-        .owner          = THIS_MODULE,
-        .open           = lec_seq_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = lec_seq_release,
+        .owner = THIS_MODULE,
+        .open = lec_seq_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = lec_seq_release,
 };
 #endif
 
@@ -1186,38 +1225,38 @@ static int lane_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         struct atm_vcc *vcc = ATM_SD(sock);
         int err = 0;
-        
+
         switch (cmd) {
-                case ATMLEC_CTRL: 
-                case ATMLEC_MCAST:
-                case ATMLEC_DATA:
-                        if (!capable(CAP_NET_ADMIN))
-                                return -EPERM;
-                        break;
-                default:
-                        return -ENOIOCTLCMD;
+        case ATMLEC_CTRL:
+        case ATMLEC_MCAST:
+        case ATMLEC_DATA:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
+                break;
+        default:
+                return -ENOIOCTLCMD;
         }
 
         switch (cmd) {
-                case ATMLEC_CTRL:
-                        err = lecd_attach(vcc, (int) arg);
-                        if (err >= 0)
-                                sock->state = SS_CONNECTED;
-                        break;
-                case ATMLEC_MCAST:
-                        err = lec_mcast_attach(vcc, (int) arg);
-                        break;
-                case ATMLEC_DATA:
-                        err = lec_vcc_attach(vcc, (void __user *) arg);
-                        break;
+        case ATMLEC_CTRL:
+                err = lecd_attach(vcc, (int)arg);
+                if (err >= 0)
+                        sock->state = SS_CONNECTED;
+                break;
+        case ATMLEC_MCAST:
+                err = lec_mcast_attach(vcc, (int)arg);
+                break;
+        case ATMLEC_DATA:
+                err = lec_vcc_attach(vcc, (void __user *)arg);
+                break;
         }
 
         return err;
 }
 
 static struct atm_ioctl lane_ioctl_ops = {
-        .owner  = THIS_MODULE,
-        .ioctl  = lane_ioctl,
+        .owner = THIS_MODULE,
+        .ioctl = lane_ioctl,
 };
 
 static int __init lane_module_init(void)
@@ -1231,29 +1270,29 @@ static int __init lane_module_init(void)
 #endif
 
         register_atm_ioctl(&lane_ioctl_ops);
-        printk("lec.c: " __DATE__ " " __TIME__ " initialized\n");
-        return 0;
+        printk("lec.c: " __DATE__ " " __TIME__ " initialized\n");
+        return 0;
 }
 
 static void __exit lane_module_cleanup(void)
 {
-        int i;
-        struct lec_priv *priv;
+        int i;
+        struct lec_priv *priv;
 
         remove_proc_entry("lec", atm_proc_root);
 
         deregister_atm_ioctl(&lane_ioctl_ops);
 
-        for (i = 0; i < MAX_LEC_ITF; i++) {
-                if (dev_lec[i] != NULL) {
-                        priv = (struct lec_priv *)dev_lec[i]->priv;
+        for (i = 0; i < MAX_LEC_ITF; i++) {
+                if (dev_lec[i] != NULL) {
+                        priv = (struct lec_priv *)dev_lec[i]->priv;
                         unregister_netdev(dev_lec[i]);
-                        free_netdev(dev_lec[i]);
-                        dev_lec[i] = NULL;
-                }
-        }
+                        free_netdev(dev_lec[i]);
+                        dev_lec[i] = NULL;
+                }
+        }
 
-        return;                                    
+        return;
 }
 
 module_init(lane_module_init);
@@ -1267,34 +1306,34 @@ module_exit(lane_module_cleanup);
  * If dst_mac == NULL, targetless LE_ARP will be sent
  */
 static int lane2_resolve(struct net_device *dev, u8 *dst_mac, int force,
-    u8 **tlvs, u32 *sizeoftlvs)
+                         u8 **tlvs, u32 *sizeoftlvs)
 {
         unsigned long flags;
-        struct lec_priv *priv = (struct lec_priv *)dev->priv;
-        struct lec_arp_table *table;
-        struct sk_buff *skb;
-        int retval;
+        struct lec_priv *priv = (struct lec_priv *)dev->priv;
+        struct lec_arp_table *table;
+        struct sk_buff *skb;
+        int retval;
 
-        if (force == 0) {
+        if (force == 0) {
                 spin_lock_irqsave(&priv->lec_arp_lock, flags);
-                table = lec_arp_find(priv, dst_mac);
+                table = lec_arp_find(priv, dst_mac);
                 spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
-                if(table == NULL)
-                        return -1;
-                
-                *tlvs = kmalloc(table->sizeoftlvs, GFP_ATOMIC);
-                if (*tlvs == NULL)
-                        return -1;
-                
-                memcpy(*tlvs, table->tlvs, table->sizeoftlvs);
-                *sizeoftlvs = table->sizeoftlvs;
-                
-                return 0;
-        }
+                if (table == NULL)
+                        return -1;
+
+                *tlvs = kmalloc(table->sizeoftlvs, GFP_ATOMIC);
+                if (*tlvs == NULL)
+                        return -1;
+
+                memcpy(*tlvs, table->tlvs, table->sizeoftlvs);
+                *sizeoftlvs = table->sizeoftlvs;
+
+                return 0;
+        }
 
         if (sizeoftlvs == NULL)
                 retval = send_to_lecd(priv, l_arp_xmt, dst_mac, NULL, NULL);
-                
+
         else {
                 skb = alloc_skb(*sizeoftlvs, GFP_ATOMIC);
                 if (skb == NULL)
@@ -1303,9 +1342,8 @@ static int lane2_resolve(struct net_device *dev, u8 *dst_mac, int force,
                 memcpy(skb->data, *tlvs, *sizeoftlvs);
                 retval = send_to_lecd(priv, l_arp_xmt, dst_mac, NULL, skb);
         }
-        return retval;
-}        
-
+        return retval;
+}
 
 /*
  * LANE2: 3.1.4, LE_ASSOCIATE.request
@@ -1314,80 +1352,85 @@ static int lane2_resolve(struct net_device *dev, u8 *dst_mac, int force,
  * Returns 1 for success, 0 for failure (out of memory)
  *
  */
-static int lane2_associate_req (struct net_device *dev, u8 *lan_dst,
-                         u8 *tlvs, u32 sizeoftlvs)
+static int lane2_associate_req(struct net_device *dev, u8 *lan_dst,
+                               u8 *tlvs, u32 sizeoftlvs)
 {
-        int retval;
-        struct sk_buff *skb;
-        struct lec_priv *priv = (struct lec_priv*)dev->priv;
-
-        if (compare_ether_addr(lan_dst, dev->dev_addr))
-                return (0);       /* not our mac address */
-
-        kfree(priv->tlvs); /* NULL if there was no previous association */
-
-        priv->tlvs = kmalloc(sizeoftlvs, GFP_KERNEL);
-        if (priv->tlvs == NULL)
-                return (0);
-        priv->sizeoftlvs = sizeoftlvs;
-        memcpy(priv->tlvs, tlvs, sizeoftlvs);
-
-        skb = alloc_skb(sizeoftlvs, GFP_ATOMIC);
-        if (skb == NULL)
-                return 0;
-        skb->len = sizeoftlvs;
-        memcpy(skb->data, tlvs, sizeoftlvs);
-        retval = send_to_lecd(priv, l_associate_req, NULL, NULL, skb);
-        if (retval != 0)
-                printk("lec.c: lane2_associate_req() failed\n");
-        /* If the previous association has changed we must
-         * somehow notify other LANE entities about the change
-         */
-        return (1);
+        int retval;
+        struct sk_buff *skb;
+        struct lec_priv *priv = (struct lec_priv *)dev->priv;
+
+        if (compare_ether_addr(lan_dst, dev->dev_addr))
+                return (0);     /* not our mac address */
+
+        kfree(priv->tlvs);      /* NULL if there was no previous association */
+
+        priv->tlvs = kmalloc(sizeoftlvs, GFP_KERNEL);
+        if (priv->tlvs == NULL)
+                return (0);
+        priv->sizeoftlvs = sizeoftlvs;
+        memcpy(priv->tlvs, tlvs, sizeoftlvs);
+
+        skb = alloc_skb(sizeoftlvs, GFP_ATOMIC);
+        if (skb == NULL)
+                return 0;
+        skb->len = sizeoftlvs;
+        memcpy(skb->data, tlvs, sizeoftlvs);
+        retval = send_to_lecd(priv, l_associate_req, NULL, NULL, skb);
+        if (retval != 0)
+                printk("lec.c: lane2_associate_req() failed\n");
+        /*
+         * If the previous association has changed we must
+         * somehow notify other LANE entities about the change
+         */
+        return (1);
 }
 
 /*
  * LANE2: 3.1.5, LE_ASSOCIATE.indication
  *
  */
-static void lane2_associate_ind (struct net_device *dev, u8 *mac_addr,
-    u8 *tlvs, u32 sizeoftlvs)
+static void lane2_associate_ind(struct net_device *dev, u8 *mac_addr,
+                                u8 *tlvs, u32 sizeoftlvs)
 {
 #if 0
-        int i = 0;
+        int i = 0;
 #endif
         struct lec_priv *priv = (struct lec_priv *)dev->priv;
-#if 0 /* Why have the TLVs in LE_ARP entries since we do not use them? When you
-         uncomment this code, make sure the TLVs get freed when entry is killed */
-        struct lec_arp_table *entry = lec_arp_find(priv, mac_addr);
+#if 0                           /*
+                                 * Why have the TLVs in LE_ARP entries
+                                 * since we do not use them? When you
+                                 * uncomment this code, make sure the
+                                 * TLVs get freed when entry is killed
+                                 */
+        struct lec_arp_table *entry = lec_arp_find(priv, mac_addr);
 
-        if (entry == NULL)
-                return;     /* should not happen */
+        if (entry == NULL)
+                return;         /* should not happen */
 
-        kfree(entry->tlvs);
+        kfree(entry->tlvs);
 
-        entry->tlvs = kmalloc(sizeoftlvs, GFP_KERNEL);
-        if (entry->tlvs == NULL)
-                return;
+        entry->tlvs = kmalloc(sizeoftlvs, GFP_KERNEL);
+        if (entry->tlvs == NULL)
+                return;
 
-        entry->sizeoftlvs = sizeoftlvs;
-        memcpy(entry->tlvs, tlvs, sizeoftlvs);
+        entry->sizeoftlvs = sizeoftlvs;
+        memcpy(entry->tlvs, tlvs, sizeoftlvs);
 #endif
 #if 0
-        printk("lec.c: lane2_associate_ind()\n");
-        printk("dump of tlvs, sizeoftlvs=%d\n", sizeoftlvs);
-        while (i < sizeoftlvs)
-                printk("%02x ", tlvs[i++]);
-        
-        printk("\n");
+        printk("lec.c: lane2_associate_ind()\n");
+        printk("dump of tlvs, sizeoftlvs=%d\n", sizeoftlvs);
+        while (i < sizeoftlvs)
+                printk("%02x ", tlvs[i++]);
+
+        printk("\n");
 #endif
 
-        /* tell MPOA about the TLVs we saw */
-        if (priv->lane2_ops && priv->lane2_ops->associate_indicator) {
-                priv->lane2_ops->associate_indicator(dev, mac_addr,
-                                                     tlvs, sizeoftlvs);
-        }
-        return;
+        /* tell MPOA about the TLVs we saw */
+        if (priv->lane2_ops && priv->lane2_ops->associate_indicator) {
+                priv->lane2_ops->associate_indicator(dev, mac_addr,
+                                                     tlvs, sizeoftlvs);
+        }
+        return;
 }
 
 /*
@@ -1395,7 +1438,6 @@ static void lane2_associate_ind (struct net_device *dev, u8 *mac_addr,
  *
  * lec_arpc.c was added here when making
  * lane client modular. October 1997
- *
  */
 
 #include <linux/types.h>
@@ -1406,7 +1448,6 @@ static void lane2_associate_ind (struct net_device *dev, u8 *mac_addr,
 #include <linux/inetdevice.h>
 #include <net/route.h>
 
-
 #if 0
 #define DPRINTK(format,args...)
 /*
@@ -1417,7 +1458,7 @@ static void lane2_associate_ind (struct net_device *dev, u8 *mac_addr,
 
 #define LEC_ARP_REFRESH_INTERVAL (3*HZ)
 
-static void lec_arp_check_expire(unsigned long data);
+static void lec_arp_check_expire(void *data);
 static void lec_arp_expire_arp(unsigned long data);
 
 /* 
@@ -1429,474 +1470,397 @@ static void lec_arp_expire_arp(unsigned long data);
 /*
  * Initialization of arp-cache
  */
-static void 
-lec_arp_init(struct lec_priv *priv)
+static void lec_arp_init(struct lec_priv *priv)
 {
-        unsigned short i;
+        unsigned short i;
 
-        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                priv->lec_arp_tables[i] = NULL;
-        }        
+        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
+                INIT_HLIST_HEAD(&priv->lec_arp_tables[i]);
+        }
+        INIT_HLIST_HEAD(&priv->lec_arp_empty_ones);
+        INIT_HLIST_HEAD(&priv->lec_no_forward);
+        INIT_HLIST_HEAD(&priv->mcast_fwds);
         spin_lock_init(&priv->lec_arp_lock);
-        init_timer(&priv->lec_arp_timer);
-        priv->lec_arp_timer.expires = jiffies + LEC_ARP_REFRESH_INTERVAL;
-        priv->lec_arp_timer.data = (unsigned long)priv;
-        priv->lec_arp_timer.function = lec_arp_check_expire;
-        add_timer(&priv->lec_arp_timer);
+        INIT_WORK(&priv->lec_arp_work, lec_arp_check_expire, priv);
+        schedule_delayed_work(&priv->lec_arp_work, LEC_ARP_REFRESH_INTERVAL);
 }
 
-static void
-lec_arp_clear_vccs(struct lec_arp_table *entry)
+static void lec_arp_clear_vccs(struct lec_arp_table *entry)
 {
-        if (entry->vcc) {
+        if (entry->vcc) {
                 struct atm_vcc *vcc = entry->vcc;
                 struct lec_vcc_priv *vpriv = LEC_VCC_PRIV(vcc);
-                struct net_device *dev = (struct net_device*) vcc->proto_data;
+                struct net_device *dev = (struct net_device *)vcc->proto_data;
 
-                vcc->pop = vpriv->old_pop;
+                vcc->pop = vpriv->old_pop;
                 if (vpriv->xoff)
                         netif_wake_queue(dev);
                 kfree(vpriv);
                 vcc->user_back = NULL;
-                vcc->push = entry->old_push;
+                vcc->push = entry->old_push;
                 vcc_release_async(vcc, -EPIPE);
-                vcc = NULL;
-        }
-        if (entry->recv_vcc) {
-                entry->recv_vcc->push = entry->old_recv_push;
+                entry->vcc = NULL;
+        }
+        if (entry->recv_vcc) {
+                entry->recv_vcc->push = entry->old_recv_push;
                 vcc_release_async(entry->recv_vcc, -EPIPE);
-                entry->recv_vcc = NULL;
-        }        
+                entry->recv_vcc = NULL;
+        }
 }
 
 /*
  * Insert entry to lec_arp_table
  * LANE2: Add to the end of the list to satisfy 8.1.13
  */
-static inline void 
-lec_arp_add(struct lec_priv *priv, struct lec_arp_table *to_add)
+static inline void
+lec_arp_add(struct lec_priv *priv, struct lec_arp_table *entry)
 {
-        unsigned short place;
-        struct lec_arp_table *tmp;
-
-        place = HASH(to_add->mac_addr[ETH_ALEN-1]);
-        tmp = priv->lec_arp_tables[place];
-        to_add->next = NULL;
-        if (tmp == NULL)
-                priv->lec_arp_tables[place] = to_add;
-  
-        else {  /* add to the end */
-                while (tmp->next)
-                        tmp = tmp->next;
-                tmp->next = to_add;
-        }
-
-        DPRINTK("LEC_ARP: Added entry:%2.2x %2.2x %2.2x %2.2x %2.2x %2.2x\n",
-                0xff&to_add->mac_addr[0], 0xff&to_add->mac_addr[1],
-                0xff&to_add->mac_addr[2], 0xff&to_add->mac_addr[3],
-                0xff&to_add->mac_addr[4], 0xff&to_add->mac_addr[5]);
+        struct hlist_head *tmp;
+
+        tmp = &priv->lec_arp_tables[HASH(entry->mac_addr[ETH_ALEN - 1])];
+        hlist_add_head(&entry->next, tmp);
+
+        DPRINTK("LEC_ARP: Added entry:%2.2x %2.2x %2.2x %2.2x %2.2x %2.2x\n",
+                0xff & entry->mac_addr[0], 0xff & entry->mac_addr[1],
+                0xff & entry->mac_addr[2], 0xff & entry->mac_addr[3],
+                0xff & entry->mac_addr[4], 0xff & entry->mac_addr[5]);
 }
 
 /*
  * Remove entry from lec_arp_table
  */
-static int 
-lec_arp_remove(struct lec_priv *priv,
-               struct lec_arp_table *to_remove)
+static int
+lec_arp_remove(struct lec_priv *priv, struct lec_arp_table *to_remove)
 {
-        unsigned short place;
-        struct lec_arp_table *tmp;
-        int remove_vcc=1;
-
-        if (!to_remove) {
-                return -1;
-        }
-        place = HASH(to_remove->mac_addr[ETH_ALEN-1]);
-        tmp = priv->lec_arp_tables[place];
-        if (tmp == to_remove) {
-                priv->lec_arp_tables[place] = tmp->next;
-        } else {
-                while(tmp && tmp->next != to_remove) {
-                        tmp = tmp->next;
-                }
-                if (!tmp) {/* Entry was not found */
-                        return -1;
-                }
-        }
-        tmp->next = to_remove->next;
-        del_timer(&to_remove->timer);
-  
-        /* If this is the only MAC connected to this VCC, also tear down
-           the VCC */
-        if (to_remove->status >= ESI_FLUSH_PENDING) {
-                /*
-                 * ESI_FLUSH_PENDING, ESI_FORWARD_DIRECT
-                 */
-                for(place = 0; place < LEC_ARP_TABLE_SIZE; place++) {
-                        for(tmp = priv->lec_arp_tables[place]; tmp != NULL; tmp = tmp->next) {
-                                if (memcmp(tmp->atm_addr, to_remove->atm_addr,
-                                           ATM_ESA_LEN)==0) {
-                                        remove_vcc=0;
-                                        break;
-                                }
-                        }
-                }
-                if (remove_vcc)
-                        lec_arp_clear_vccs(to_remove);
-        }
-        skb_queue_purge(&to_remove->tx_wait); /* FIXME: good place for this? */
-
-        DPRINTK("LEC_ARP: Removed entry:%2.2x %2.2x %2.2x %2.2x %2.2x %2.2x\n",
-                0xff&to_remove->mac_addr[0], 0xff&to_remove->mac_addr[1],
-                0xff&to_remove->mac_addr[2], 0xff&to_remove->mac_addr[3],
-                0xff&to_remove->mac_addr[4], 0xff&to_remove->mac_addr[5]);
-        return 0;
+        struct hlist_node *node;
+        struct lec_arp_table *entry;
+        int i, remove_vcc = 1;
+
+        if (!to_remove) {
+                return -1;
+        }
+
+        hlist_del(&to_remove->next);
+        del_timer(&to_remove->timer);
+
+        /* If this is the only MAC connected to this VCC, also tear down the VCC */
+        if (to_remove->status >= ESI_FLUSH_PENDING) {
+                /*
+                 * ESI_FLUSH_PENDING, ESI_FORWARD_DIRECT
+                 */
+                for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
+                        hlist_for_each_entry(entry, node, &priv->lec_arp_tables[i], next) {
+                                if (memcmp(to_remove->atm_addr,
+                                           entry->atm_addr, ATM_ESA_LEN) == 0) {
+                                        remove_vcc = 0;
+                                        break;
+                                }
+                        }
+                }
+                if (remove_vcc)
+                        lec_arp_clear_vccs(to_remove);
+        }
+        skb_queue_purge(&to_remove->tx_wait);   /* FIXME: good place for this? */
+
+        DPRINTK("LEC_ARP: Removed entry:%2.2x %2.2x %2.2x %2.2x %2.2x %2.2x\n",
+                0xff & to_remove->mac_addr[0], 0xff & to_remove->mac_addr[1],
+                0xff & to_remove->mac_addr[2], 0xff & to_remove->mac_addr[3],
+                0xff & to_remove->mac_addr[4], 0xff & to_remove->mac_addr[5]);
+        return 0;
 }
 
 #if DEBUG_ARP_TABLE
-static char*
-get_status_string(unsigned char st)
+static char *get_status_string(unsigned char st)
 {
-        switch(st) {
-        case ESI_UNKNOWN:
-                return "ESI_UNKNOWN";
-        case ESI_ARP_PENDING:
-                return "ESI_ARP_PENDING";
-        case ESI_VC_PENDING:
-                return "ESI_VC_PENDING";
-        case ESI_FLUSH_PENDING:
-                return "ESI_FLUSH_PENDING";
-        case ESI_FORWARD_DIRECT:
-                return "ESI_FORWARD_DIRECT";
-        default:
-                return "<UNKNOWN>";
-        }
+        switch (st) {
+        case ESI_UNKNOWN:
+                return "ESI_UNKNOWN";
+        case ESI_ARP_PENDING:
+                return "ESI_ARP_PENDING";
+        case ESI_VC_PENDING:
+                return "ESI_VC_PENDING";
+        case ESI_FLUSH_PENDING:
+                return "ESI_FLUSH_PENDING";
+        case ESI_FORWARD_DIRECT:
+                return "ESI_FORWARD_DIRECT";
+        default:
+                return "<UNKNOWN>";
+        }
 }
-#endif
 
-static void
-dump_arp_table(struct lec_priv *priv)
+static void dump_arp_table(struct lec_priv *priv)
 {
-#if DEBUG_ARP_TABLE
-        int i,j, offset;
-        struct lec_arp_table *rulla;
-        char buf[1024];
-        struct lec_arp_table **lec_arp_tables =
-                (struct lec_arp_table **)priv->lec_arp_tables;
-        struct lec_arp_table *lec_arp_empty_ones =
-                (struct lec_arp_table *)priv->lec_arp_empty_ones;
-        struct lec_arp_table *lec_no_forward =
-                (struct lec_arp_table *)priv->lec_no_forward;
-        struct lec_arp_table *mcast_fwds = priv->mcast_fwds;
-
-
-        printk("Dump %p:\n",priv);
-        for (i=0;i<LEC_ARP_TABLE_SIZE;i++) {
-                rulla = lec_arp_tables[i];
-                offset = 0;
-                offset += sprintf(buf,"%d: %p\n",i, rulla);
-                while (rulla) {
-                        offset += sprintf(buf+offset,"Mac:");
-                        for(j=0;j<ETH_ALEN;j++) {
-                                offset+=sprintf(buf+offset,
-                                                "%2.2x ",
-                                                rulla->mac_addr[j]&0xff);
-                        }
-                        offset +=sprintf(buf+offset,"Atm:");
-                        for(j=0;j<ATM_ESA_LEN;j++) {
-                                offset+=sprintf(buf+offset,
-                                                "%2.2x ",
-                                                rulla->atm_addr[j]&0xff);
-                        }      
-                        offset+=sprintf(buf+offset,
-                                        "Vcc vpi:%d vci:%d, Recv_vcc vpi:%d vci:%d Last_used:%lx, Timestamp:%lx, No_tries:%d ",
-                                        rulla->vcc?rulla->vcc->vpi:0, 
-                                        rulla->vcc?rulla->vcc->vci:0,
-                                        rulla->recv_vcc?rulla->recv_vcc->vpi:0,
-                                        rulla->recv_vcc?rulla->recv_vcc->vci:0,
-                                        rulla->last_used,
-                                        rulla->timestamp, rulla->no_tries);
-                        offset+=sprintf(buf+offset,
-                                        "Flags:%x, Packets_flooded:%x, Status: %s ",
-                                        rulla->flags, rulla->packets_flooded, 
-                                        get_status_string(rulla->status));
-                        offset+=sprintf(buf+offset,"->%p\n",rulla->next);
-                        rulla = rulla->next;
-                }
-                printk("%s",buf);
-        }
-        rulla = lec_no_forward;
-        if (rulla)
-                printk("No forward\n");  
-        while(rulla) {
-                offset=0;
-                offset += sprintf(buf+offset,"Mac:");
-                for(j=0;j<ETH_ALEN;j++) {
-                        offset+=sprintf(buf+offset,"%2.2x ",
-                                        rulla->mac_addr[j]&0xff);
-                }
-                offset +=sprintf(buf+offset,"Atm:");
-                for(j=0;j<ATM_ESA_LEN;j++) {
-                        offset+=sprintf(buf+offset,"%2.2x ",
-                                        rulla->atm_addr[j]&0xff);
-                }      
-                offset+=sprintf(buf+offset,
-                                "Vcc vpi:%d vci:%d, Recv_vcc vpi:%d vci:%d Last_used:%lx, Timestamp:%lx, No_tries:%d ",
-                                rulla->vcc?rulla->vcc->vpi:0, 
-                                rulla->vcc?rulla->vcc->vci:0, 
-                                rulla->recv_vcc?rulla->recv_vcc->vpi:0,
-                                rulla->recv_vcc?rulla->recv_vcc->vci:0,
-                                rulla->last_used, 
-                                rulla->timestamp, rulla->no_tries);
-                offset+=sprintf(buf+offset,
-                                "Flags:%x, Packets_flooded:%x, Status: %s ",
-                                rulla->flags, rulla->packets_flooded, 
-                                get_status_string(rulla->status));
-                offset+=sprintf(buf+offset,"->%lx\n",(long)rulla->next);
-                rulla = rulla->next;
-                printk("%s",buf);
-        }
-        rulla = lec_arp_empty_ones;
-        if (rulla)
-                printk("Empty ones\n");  
-        while(rulla) {
-                offset=0;
-                offset += sprintf(buf+offset,"Mac:");
-                for(j=0;j<ETH_ALEN;j++) {
-                        offset+=sprintf(buf+offset,"%2.2x ",
-                                        rulla->mac_addr[j]&0xff);
-                }
-                offset +=sprintf(buf+offset,"Atm:");
-                for(j=0;j<ATM_ESA_LEN;j++) {
-                        offset+=sprintf(buf+offset,"%2.2x ",
-                                        rulla->atm_addr[j]&0xff);
-                }      
-                offset+=sprintf(buf+offset,
-                                "Vcc vpi:%d vci:%d, Recv_vcc vpi:%d vci:%d Last_used:%lx, Timestamp:%lx, No_tries:%d ",
-                                rulla->vcc?rulla->vcc->vpi:0, 
-                                rulla->vcc?rulla->vcc->vci:0, 
-                                rulla->recv_vcc?rulla->recv_vcc->vpi:0,
-                                rulla->recv_vcc?rulla->recv_vcc->vci:0,
-                                rulla->last_used, 
-                                rulla->timestamp, rulla->no_tries);
-                offset+=sprintf(buf+offset,
-                                "Flags:%x, Packets_flooded:%x, Status: %s ",
-                                rulla->flags, rulla->packets_flooded, 
-                                get_status_string(rulla->status));
-                offset+=sprintf(buf+offset,"->%lx\n",(long)rulla->next);
-                rulla = rulla->next;
-                printk("%s",buf);
-        }
-
-        rulla = mcast_fwds;
-        if (rulla)
-                printk("Multicast Forward VCCs\n");  
-        while(rulla) {
-                offset=0;
-                offset += sprintf(buf+offset,"Mac:");
-                for(j=0;j<ETH_ALEN;j++) {
-                        offset+=sprintf(buf+offset,"%2.2x ",
-                                        rulla->mac_addr[j]&0xff);
-                }
-                offset +=sprintf(buf+offset,"Atm:");
-                for(j=0;j<ATM_ESA_LEN;j++) {
-                        offset+=sprintf(buf+offset,"%2.2x ",
-                                        rulla->atm_addr[j]&0xff);
-                }      
-                offset+=sprintf(buf+offset,
-                                "Vcc vpi:%d vci:%d, Recv_vcc vpi:%d vci:%d Last_used:%lx, Timestamp:%lx, No_tries:%d ",
-                                rulla->vcc?rulla->vcc->vpi:0, 
-                                rulla->vcc?rulla->vcc->vci:0, 
-                                rulla->recv_vcc?rulla->recv_vcc->vpi:0,
-                                rulla->recv_vcc?rulla->recv_vcc->vci:0,
-                                rulla->last_used, 
-                                rulla->timestamp, rulla->no_tries);
-                offset+=sprintf(buf+offset,
-                                "Flags:%x, Packets_flooded:%x, Status: %s ",
-                                rulla->flags, rulla->packets_flooded, 
-                                get_status_string(rulla->status));
-                offset+=sprintf(buf+offset,"->%lx\n",(long)rulla->next);
-                rulla = rulla->next;
-                printk("%s",buf);
-        }
+        struct hlist_node *node;
+        struct lec_arp_table *rulla;
+        char buf[256];
+        int i, j, offset;
+
+        printk("Dump %p:\n", priv);
+        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
+                hlist_for_each_entry(rulla, node, &priv->lec_arp_tables[i], next) {
+                        offset = 0;
+                        offset += sprintf(buf, "%d: %p\n", i, rulla);
+                        offset += sprintf(buf + offset, "Mac:");
+                        for (j = 0; j < ETH_ALEN; j++) {
+                                offset += sprintf(buf + offset,
+                                                  "%2.2x ",
+                                                  rulla->mac_addr[j] & 0xff);
+                        }
+                        offset += sprintf(buf + offset, "Atm:");
+                        for (j = 0; j < ATM_ESA_LEN; j++) {
+                                offset += sprintf(buf + offset,
+                                                  "%2.2x ",
+                                                  rulla->atm_addr[j] & 0xff);
+                        }
+                        offset += sprintf(buf + offset,
+                                          "Vcc vpi:%d vci:%d, Recv_vcc vpi:%d vci:%d Last_used:%lx, Timestamp:%lx, No_tries:%d ",
+                                          rulla->vcc ? rulla->vcc->vpi : 0,
+                                          rulla->vcc ? rulla->vcc->vci : 0,
+                                          rulla->recv_vcc ? rulla->recv_vcc->
+                                          vpi : 0,
+                                          rulla->recv_vcc ? rulla->recv_vcc->
+                                          vci : 0, rulla->last_used,
+                                          rulla->timestamp, rulla->no_tries);
+                        offset +=
+                            sprintf(buf + offset,
+                                    "Flags:%x, Packets_flooded:%x, Status: %s ",
+                                    rulla->flags, rulla->packets_flooded,
+                                    get_status_string(rulla->status));
+                        printk("%s\n", buf);
+                }
+        }
+
+        if (!hlist_empty(&priv->lec_no_forward))
+                printk("No forward\n");
+        hlist_for_each_entry(rulla, node, &priv->lec_no_forward, next) {
+                offset = 0;
+                offset += sprintf(buf + offset, "Mac:");
+                for (j = 0; j < ETH_ALEN; j++) {
+                        offset += sprintf(buf + offset, "%2.2x ",
+                                          rulla->mac_addr[j] & 0xff);
+                }
+                offset += sprintf(buf + offset, "Atm:");
+                for (j = 0; j < ATM_ESA_LEN; j++) {
+                        offset += sprintf(buf + offset, "%2.2x ",
+                                          rulla->atm_addr[j] & 0xff);
+                }
+                offset += sprintf(buf + offset,
+                                  "Vcc vpi:%d vci:%d, Recv_vcc vpi:%d vci:%d Last_used:%lx, Timestamp:%lx, No_tries:%d ",
+                                  rulla->vcc ? rulla->vcc->vpi : 0,
+                                  rulla->vcc ? rulla->vcc->vci : 0,
+                                  rulla->recv_vcc ? rulla->recv_vcc->vpi : 0,
+                                  rulla->recv_vcc ? rulla->recv_vcc->vci : 0,
+                                  rulla->last_used,
+                                  rulla->timestamp, rulla->no_tries);
+                offset += sprintf(buf + offset,
+                                  "Flags:%x, Packets_flooded:%x, Status: %s ",
+                                  rulla->flags, rulla->packets_flooded,
+                                  get_status_string(rulla->status));
+                printk("%s\n", buf);
+        }
+
+        if (!hlist_empty(&priv->lec_arp_empty_ones))
+                printk("Empty ones\n");
+        hlist_for_each_entry(rulla, node, &priv->lec_arp_empty_ones, next) {
+                offset = 0;
+                offset += sprintf(buf + offset, "Mac:");
+                for (j = 0; j < ETH_ALEN; j++) {
+                        offset += sprintf(buf + offset, "%2.2x ",
+                                          rulla->mac_addr[j] & 0xff);
+                }
+                offset += sprintf(buf + offset, "Atm:");
+                for (j = 0; j < ATM_ESA_LEN; j++) {
+                        offset += sprintf(buf + offset, "%2.2x ",
+                                          rulla->atm_addr[j] & 0xff);
+                }
+                offset += sprintf(buf + offset,
+                                  "Vcc vpi:%d vci:%d, Recv_vcc vpi:%d vci:%d Last_used:%lx, Timestamp:%lx, No_tries:%d ",
+                                  rulla->vcc ? rulla->vcc->vpi : 0,
+                                  rulla->vcc ? rulla->vcc->vci : 0,
+                                  rulla->recv_vcc ? rulla->recv_vcc->vpi : 0,
+                                  rulla->recv_vcc ? rulla->recv_vcc->vci : 0,
+                                  rulla->last_used,
+                                  rulla->timestamp, rulla->no_tries);
+                offset += sprintf(buf + offset,
+                                  "Flags:%x, Packets_flooded:%x, Status: %s ",
+                                  rulla->flags, rulla->packets_flooded,
+                                  get_status_string(rulla->status));
+                printk("%s", buf);
+        }
+
+        if (!hlist_empty(&priv->mcast_fwds))
+                printk("Multicast Forward VCCs\n");
+        hlist_for_each_entry(rulla, node, &priv->mcast_fwds, next) {
+                offset = 0;
+                offset += sprintf(buf + offset, "Mac:");
+                for (j = 0; j < ETH_ALEN; j++) {
+                        offset += sprintf(buf + offset, "%2.2x ",
+                                          rulla->mac_addr[j] & 0xff);
+                }
+                offset += sprintf(buf + offset, "Atm:");
+                for (j = 0; j < ATM_ESA_LEN; j++) {
+                        offset += sprintf(buf + offset, "%2.2x ",
+                                          rulla->atm_addr[j] & 0xff);
+                }
+                offset += sprintf(buf + offset,
+                                  "Vcc vpi:%d vci:%d, Recv_vcc vpi:%d vci:%d Last_used:%lx, Timestamp:%lx, No_tries:%d ",
+                                  rulla->vcc ? rulla->vcc->vpi : 0,
+                                  rulla->vcc ? rulla->vcc->vci : 0,
+                                  rulla->recv_vcc ? rulla->recv_vcc->vpi : 0,
+                                  rulla->recv_vcc ? rulla->recv_vcc->vci : 0,
+                                  rulla->last_used,
+                                  rulla->timestamp, rulla->no_tries);
+                offset += sprintf(buf + offset,
+                                  "Flags:%x, Packets_flooded:%x, Status: %s ",
+                                  rulla->flags, rulla->packets_flooded,
+                                  get_status_string(rulla->status));
+                printk("%s\n", buf);
+        }
 
-#endif
 }
+#else
+#define dump_arp_table(priv) do { } while (0)
+#endif
 
 /*
  * Destruction of arp-cache
  */
-static void
-lec_arp_destroy(struct lec_priv *priv)
+static void lec_arp_destroy(struct lec_priv *priv)
 {
         unsigned long flags;
-        struct lec_arp_table *entry, *next;
-        int i;
+        struct hlist_node *node, *next;
+        struct lec_arp_table *entry;
+        int i;
+
+        cancel_rearming_delayed_work(&priv->lec_arp_work);
 
-        del_timer_sync(&priv->lec_arp_timer);
-        
-        /*
-         * Remove all entries
-         */
+        /*
+         * Remove all entries
+         */
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                for(entry = priv->lec_arp_tables[i]; entry != NULL; entry=next) {
-                        next = entry->next;
-                        lec_arp_remove(priv, entry);
-                        kfree(entry);
-                }
-        }
-        entry = priv->lec_arp_empty_ones;
-        while(entry) {
-                next = entry->next;
-                del_timer_sync(&entry->timer);
-                lec_arp_clear_vccs(entry);
-                kfree(entry);
-                entry = next;
-        }
-        priv->lec_arp_empty_ones = NULL;
-        entry = priv->lec_no_forward;
-        while(entry) {
-                next = entry->next;
-                del_timer_sync(&entry->timer);
-                lec_arp_clear_vccs(entry);
-                kfree(entry);
-                entry = next;
-        }
-        priv->lec_no_forward = NULL;
-        entry = priv->mcast_fwds;
-        while(entry) {
-                next = entry->next;
-                /* No timer, LANEv2 7.1.20 and 2.3.5.3 */
-                lec_arp_clear_vccs(entry);
-                kfree(entry);
-                entry = next;
-        }
-        priv->mcast_fwds = NULL;
-        priv->mcast_vcc = NULL;
-        memset(priv->lec_arp_tables, 0, 
-               sizeof(struct lec_arp_table *) * LEC_ARP_TABLE_SIZE);
+        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
+                hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_tables[i], next) {
+                        lec_arp_remove(priv, entry);
+                        lec_arp_put(entry);
+                }
+                INIT_HLIST_HEAD(&priv->lec_arp_tables[i]);
+        }
+
+        hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_empty_ones, next) {
+                del_timer_sync(&entry->timer);
+                lec_arp_clear_vccs(entry);
+                hlist_del(&entry->next);
+                lec_arp_put(entry);
+        }
+        INIT_HLIST_HEAD(&priv->lec_arp_empty_ones);
+
+        hlist_for_each_entry_safe(entry, node, next, &priv->lec_no_forward, next) {
+                del_timer_sync(&entry->timer);
+                lec_arp_clear_vccs(entry);
+                hlist_del(&entry->next);
+                lec_arp_put(entry);
+        }
+        INIT_HLIST_HEAD(&priv->lec_no_forward);
+
+        hlist_for_each_entry_safe(entry, node, next, &priv->mcast_fwds, next) {
+                /* No timer, LANEv2 7.1.20 and 2.3.5.3 */
+                lec_arp_clear_vccs(entry);
+                hlist_del(&entry->next);
+                lec_arp_put(entry);
+        }
+        INIT_HLIST_HEAD(&priv->mcast_fwds);
+        priv->mcast_vcc = NULL;
         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
 }
 
-
 /* 
  * Find entry by mac_address
  */
-static struct lec_arp_table*
-lec_arp_find(struct lec_priv *priv,
-             unsigned char *mac_addr)
+static struct lec_arp_table *lec_arp_find(struct lec_priv *priv,
+                                          unsigned char *mac_addr)
 {
-        unsigned short place;
-        struct lec_arp_table *to_return;
-
-        DPRINTK("LEC_ARP: lec_arp_find :%2.2x %2.2x %2.2x %2.2x %2.2x %2.2x\n",
-                mac_addr[0]&0xff, mac_addr[1]&0xff, mac_addr[2]&0xff, 
-                mac_addr[3]&0xff, mac_addr[4]&0xff, mac_addr[5]&0xff);
-        place = HASH(mac_addr[ETH_ALEN-1]);
-  
-        to_return = priv->lec_arp_tables[place];
-        while(to_return) {
-                if (!compare_ether_addr(mac_addr, to_return->mac_addr)) {
-                        return to_return;
-                }
-                to_return = to_return->next;
-        }
-        return NULL;
+        struct hlist_node *node;
+        struct hlist_head *head;
+        struct lec_arp_table *entry;
+
+        DPRINTK("LEC_ARP: lec_arp_find :%2.2x %2.2x %2.2x %2.2x %2.2x %2.2x\n",
+                mac_addr[0] & 0xff, mac_addr[1] & 0xff, mac_addr[2] & 0xff,
+                mac_addr[3] & 0xff, mac_addr[4] & 0xff, mac_addr[5] & 0xff);
+
+        head = &priv->lec_arp_tables[HASH(mac_addr[ETH_ALEN - 1])];
+        hlist_for_each_entry(entry, node, head, next) {
+                if (!compare_ether_addr(mac_addr, entry->mac_addr)) {
+                        return entry;
+                }
+        }
+        return NULL;
 }
 
-static struct lec_arp_table*
-make_entry(struct lec_priv *priv, unsigned char *mac_addr)
+static struct lec_arp_table *make_entry(struct lec_priv *priv,
+                                        unsigned char *mac_addr)
 {
-        struct lec_arp_table *to_return;
-
-        to_return = kzalloc(sizeof(struct lec_arp_table), GFP_ATOMIC);
-        if (!to_return) {
-                printk("LEC: Arp entry kmalloc failed\n");
-                return NULL;
-        }
-        memcpy(to_return->mac_addr, mac_addr, ETH_ALEN);
-        init_timer(&to_return->timer);
-        to_return->timer.function = lec_arp_expire_arp;
-        to_return->timer.data = (unsigned long) to_return;
-        to_return->last_used = jiffies;
-        to_return->priv = priv;
-        skb_queue_head_init(&to_return->tx_wait);
-        return to_return;
+        struct lec_arp_table *to_return;
+
+        to_return = kzalloc(sizeof(struct lec_arp_table), GFP_ATOMIC);
+        if (!to_return) {
+                printk("LEC: Arp entry kmalloc failed\n");
+                return NULL;
+        }
+        memcpy(to_return->mac_addr, mac_addr, ETH_ALEN);
+        INIT_HLIST_NODE(&to_return->next);
+        init_timer(&to_return->timer);
+        to_return->timer.function = lec_arp_expire_arp;
+        to_return->timer.data = (unsigned long)to_return;
+        to_return->last_used = jiffies;
+        to_return->priv = priv;
+        skb_queue_head_init(&to_return->tx_wait);
+        atomic_set(&to_return->usage, 1);
+        return to_return;
 }
 
-/*
- *
- * Arp sent timer expired
- *
- */
-static void
-lec_arp_expire_arp(unsigned long data)
+/* Arp sent timer expired */
+static void lec_arp_expire_arp(unsigned long data)
 {
-        struct lec_arp_table *entry;
-
-        entry = (struct lec_arp_table *)data;
-
-        DPRINTK("lec_arp_expire_arp\n");
-        if (entry->status == ESI_ARP_PENDING) {
-                if (entry->no_tries <= entry->priv->max_retry_count) {
-                        if (entry->is_rdesc)
-                                send_to_lecd(entry->priv, l_rdesc_arp_xmt, entry->mac_addr, NULL, NULL);
-                        else
-                                send_to_lecd(entry->priv, l_arp_xmt, entry->mac_addr, NULL, NULL);
-                        entry->no_tries++;
-                }
-                mod_timer(&entry->timer, jiffies + (1*HZ));
-        }
+        struct lec_arp_table *entry;
+
+        entry = (struct lec_arp_table *)data;
+
+        DPRINTK("lec_arp_expire_arp\n");
+        if (entry->status == ESI_ARP_PENDING) {
+                if (entry->no_tries <= entry->priv->max_retry_count) {
+                        if (entry->is_rdesc)
+                                send_to_lecd(entry->priv, l_rdesc_arp_xmt,
+                                             entry->mac_addr, NULL, NULL);
+                        else
+                                send_to_lecd(entry->priv, l_arp_xmt,
+                                             entry->mac_addr, NULL, NULL);
+                        entry->no_tries++;
+                }
+                mod_timer(&entry->timer, jiffies + (1 * HZ));
+        }
 }
 
-/*
- *
- * Unknown/unused vcc expire, remove associated entry
- *
- */
-static void
-lec_arp_expire_vcc(unsigned long data)
+/* Unknown/unused vcc expire, remove associated entry */
+static void lec_arp_expire_vcc(unsigned long data)
 {
         unsigned long flags;
-        struct lec_arp_table *to_remove = (struct lec_arp_table*)data;
-        struct lec_priv *priv = (struct lec_priv *)to_remove->priv;
-        struct lec_arp_table *entry = NULL;
+        struct lec_arp_table *to_remove = (struct lec_arp_table *)data;
+        struct lec_priv *priv = (struct lec_priv *)to_remove->priv;
 
-        del_timer(&to_remove->timer);
+        del_timer(&to_remove->timer);
 
-        DPRINTK("LEC_ARP %p %p: lec_arp_expire_vcc vpi:%d vci:%d\n",
-                to_remove, priv, 
-                to_remove->vcc?to_remove->recv_vcc->vpi:0,
-                to_remove->vcc?to_remove->recv_vcc->vci:0);
-        DPRINTK("eo:%p nf:%p\n",priv->lec_arp_empty_ones,priv->lec_no_forward);
+        DPRINTK("LEC_ARP %p %p: lec_arp_expire_vcc vpi:%d vci:%d\n",
+                to_remove, priv,
+                to_remove->vcc ? to_remove->recv_vcc->vpi : 0,
+                to_remove->vcc ? to_remove->recv_vcc->vci : 0);
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        if (to_remove == priv->lec_arp_empty_ones)
-                priv->lec_arp_empty_ones = to_remove->next;
-        else {
-                entry = priv->lec_arp_empty_ones;
-                while (entry && entry->next != to_remove)
-                        entry = entry->next;
-                if (entry)
-                        entry->next = to_remove->next;
-        }
-        if (!entry) {
-                if (to_remove == priv->lec_no_forward) {
-                        priv->lec_no_forward = to_remove->next;
-                } else {
-                        entry = priv->lec_no_forward;
-                        while (entry && entry->next != to_remove)
-                                entry = entry->next;
-                        if (entry)
-                                entry->next = to_remove->next;
-                }
-        }
+        hlist_del(&to_remove->next);
         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
 
-        lec_arp_clear_vccs(to_remove);
-        kfree(to_remove);
+        lec_arp_clear_vccs(to_remove);
+        lec_arp_put(to_remove);
 }
 
 /*
@@ -1915,158 +1879,171 @@ lec_arp_expire_vcc(unsigned long data)
  *       to ESI_FORWARD_DIRECT. This causes the flush period to end
  *       regardless of the progress of the flush protocol.
  */
-static void
-lec_arp_check_expire(unsigned long data)
+static void lec_arp_check_expire(void *data)
 {
         unsigned long flags;
-        struct lec_priv *priv = (struct lec_priv *)data;
-        struct lec_arp_table *entry, *next;
-        unsigned long now;
-        unsigned long time_to_check;
-        int i;
-
-        DPRINTK("lec_arp_check_expire %p\n",priv);
-        DPRINTK("expire: eo:%p nf:%p\n",priv->lec_arp_empty_ones,
-                priv->lec_no_forward);
+        struct lec_priv *priv = data;
+        struct hlist_node *node, *next;
+        struct lec_arp_table *entry;
+        unsigned long now;
+        unsigned long time_to_check;
+        int i;
+
+        DPRINTK("lec_arp_check_expire %p\n", priv);
         now = jiffies;
+restart:
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        for(i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                for(entry = priv->lec_arp_tables[i]; entry != NULL; ) {
-                        if ((entry->flags) & LEC_REMOTE_FLAG && 
+        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
+                hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_tables[i], next) {
+                        if ((entry->flags) & LEC_REMOTE_FLAG &&
                             priv->topology_change)
                                 time_to_check = priv->forward_delay_time;
                         else
                                 time_to_check = priv->aging_time;
 
                         DPRINTK("About to expire: %lx - %lx > %lx\n",
-                                now,entry->last_used, time_to_check);
-                        if( time_after(now, entry->last_used+
-                           time_to_check) && 
-                            !(entry->flags & LEC_PERMANENT_FLAG) &&
-                            !(entry->mac_addr[0] & 0x01) ) { /* LANE2: 7.1.20 */
+                                now, entry->last_used, time_to_check);
+                        if (time_after(now, entry->last_used + time_to_check)
+                            && !(entry->flags & LEC_PERMANENT_FLAG)
+                            && !(entry->mac_addr[0] & 0x01)) {  /* LANE2: 7.1.20 */
                                 /* Remove entry */
                                 DPRINTK("LEC:Entry timed out\n");
-                                next = entry->next;      
                                 lec_arp_remove(priv, entry);
-                                kfree(entry);
-                                entry = next;
+                                lec_arp_put(entry);
                         } else {
                                 /* Something else */
                                 if ((entry->status == ESI_VC_PENDING ||
-                                     entry->status == ESI_ARP_PENDING) 
+                                     entry->status == ESI_ARP_PENDING)
                                     && time_after_eq(now,
-                                    entry->timestamp +
-                                    priv->max_unknown_frame_time)) {
+                                                     entry->timestamp +
+                                                     priv->
+                                                     max_unknown_frame_time)) {
                                         entry->timestamp = jiffies;
                                         entry->packets_flooded = 0;
                                         if (entry->status == ESI_VC_PENDING)
-                                                send_to_lecd(priv, l_svc_setup, entry->mac_addr, entry->atm_addr, NULL);
+                                                send_to_lecd(priv, l_svc_setup,
+                                                             entry->mac_addr,
+                                                             entry->atm_addr,
+                                                             NULL);
                                 }
-                                if (entry->status == ESI_FLUSH_PENDING 
-                                   &&
-                                   time_after_eq(now, entry->timestamp+
-                                   priv->path_switching_delay)) {
+                                if (entry->status == ESI_FLUSH_PENDING
+                                    &&
+                                    time_after_eq(now, entry->timestamp +
+                                                  priv->path_switching_delay)) {
                                         struct sk_buff *skb;
+                                        struct atm_vcc *vcc = entry->vcc;
 
+                                        lec_arp_hold(entry);
+                                        spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
                                         while ((skb = skb_dequeue(&entry->tx_wait)) != NULL)
-                                                lec_send(entry->vcc, skb, entry->priv);
+                                                lec_send(vcc, skb, entry->priv);
                                         entry->last_used = jiffies;
-                                        entry->status = 
-                                                ESI_FORWARD_DIRECT;
+                                        entry->status = ESI_FORWARD_DIRECT;
+                                        lec_arp_put(entry);
+                                        goto restart;
                                 }
-                                entry = entry->next;
                         }
                 }
         }
         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
 
-        mod_timer(&priv->lec_arp_timer, jiffies + LEC_ARP_REFRESH_INTERVAL);
+        schedule_delayed_work(&priv->lec_arp_work, LEC_ARP_REFRESH_INTERVAL);
 }
+
 /*
  * Try to find vcc where mac_address is attached.
  * 
  */
-static struct atm_vcc*
-lec_arp_resolve(struct lec_priv *priv, unsigned char *mac_to_find,
-                int is_rdesc, struct lec_arp_table **ret_entry)
+static struct atm_vcc *lec_arp_resolve(struct lec_priv *priv,
+                                       unsigned char *mac_to_find, int is_rdesc,
+                                       struct lec_arp_table **ret_entry)
 {
         unsigned long flags;
-        struct lec_arp_table *entry;
+        struct lec_arp_table *entry;
         struct atm_vcc *found;
 
-        if (mac_to_find[0] & 0x01) {
-                switch (priv->lane_version) {
-                case 1:
-                        return priv->mcast_vcc;
-                        break;
-                case 2:  /* LANE2 wants arp for multicast addresses */
-                        if (!compare_ether_addr(mac_to_find, bus_mac))
-                                return priv->mcast_vcc;
-                        break;
-                default:
-                        break;
-                }
-        }
+        if (mac_to_find[0] & 0x01) {
+                switch (priv->lane_version) {
+                case 1:
+                        return priv->mcast_vcc;
+                        break;
+                case 2: /* LANE2 wants arp for multicast addresses */
+                        if (!compare_ether_addr(mac_to_find, bus_mac))
+                                return priv->mcast_vcc;
+                        break;
+                default:
+                        break;
+                }
+        }
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        entry = lec_arp_find(priv, mac_to_find);
-  
-        if (entry) {
-                if (entry->status == ESI_FORWARD_DIRECT) {
-                        /* Connection Ok */
-                        entry->last_used = jiffies;
-                        *ret_entry = entry;
-                        found = entry->vcc;
+        entry = lec_arp_find(priv, mac_to_find);
+
+        if (entry) {
+                if (entry->status == ESI_FORWARD_DIRECT) {
+                        /* Connection Ok */
+                        entry->last_used = jiffies;
+                        lec_arp_hold(entry);
+                        *ret_entry = entry;
+                        found = entry->vcc;
                         goto out;
-                }
-                /* If the LE_ARP cache entry is still pending, reset count to 0
+                }
+                /*
+                 * If the LE_ARP cache entry is still pending, reset count to 0
                  * so another LE_ARP request can be made for this frame.
                  */
                 if (entry->status == ESI_ARP_PENDING) {
                         entry->no_tries = 0;
                 }
-                /* Data direct VC not yet set up, check to see if the unknown
-                   frame count is greater than the limit. If the limit has
-                   not been reached, allow the caller to send packet to
-                   BUS. */
-                if (entry->status != ESI_FLUSH_PENDING &&
-                    entry->packets_flooded<priv->maximum_unknown_frame_count) {
-                        entry->packets_flooded++;
-                        DPRINTK("LEC_ARP: Flooding..\n");
-                        found = priv->mcast_vcc;
+                /*
+                 * Data direct VC not yet set up, check to see if the unknown
+                 * frame count is greater than the limit. If the limit has
+                 * not been reached, allow the caller to send packet to
+                 * BUS.
+                 */
+                if (entry->status != ESI_FLUSH_PENDING &&
+                    entry->packets_flooded <
+                    priv->maximum_unknown_frame_count) {
+                        entry->packets_flooded++;
+                        DPRINTK("LEC_ARP: Flooding..\n");
+                        found = priv->mcast_vcc;
                         goto out;
-                }
-                /* We got here because entry->status == ESI_FLUSH_PENDING
+                }
+                /*
+                 * We got here because entry->status == ESI_FLUSH_PENDING
                  * or BUS flood limit was reached for an entry which is
                  * in ESI_ARP_PENDING or ESI_VC_PENDING state.
                  */
-                *ret_entry = entry;
-                DPRINTK("lec: entry->status %d entry->vcc %p\n", entry->status, entry->vcc);
-                found = NULL;
-        } else {
-                /* No matching entry was found */
-                entry = make_entry(priv, mac_to_find);
-                DPRINTK("LEC_ARP: Making entry\n");
-                if (!entry) {
-                        found = priv->mcast_vcc;
+                lec_arp_hold(entry);
+                *ret_entry = entry;
+                DPRINTK("lec: entry->status %d entry->vcc %p\n", entry->status,
+                        entry->vcc);
+                found = NULL;
+        } else {
+                /* No matching entry was found */
+                entry = make_entry(priv, mac_to_find);
+                DPRINTK("LEC_ARP: Making entry\n");
+                if (!entry) {
+                        found = priv->mcast_vcc;
                         goto out;
-                }
-                lec_arp_add(priv, entry);
-                /* We want arp-request(s) to be sent */
-                entry->packets_flooded =1;
-                entry->status = ESI_ARP_PENDING;
-                entry->no_tries = 1;
-                entry->last_used = entry->timestamp = jiffies;
-                entry->is_rdesc = is_rdesc;
-                if (entry->is_rdesc)
-                        send_to_lecd(priv, l_rdesc_arp_xmt, mac_to_find, NULL, NULL);
-                else
-                        send_to_lecd(priv, l_arp_xmt, mac_to_find, NULL, NULL);
-                entry->timer.expires = jiffies + (1*HZ);
-                entry->timer.function = lec_arp_expire_arp;
-                add_timer(&entry->timer);
-                found = priv->mcast_vcc;
-        }
+                }
+                lec_arp_add(priv, entry);
+                /* We want arp-request(s) to be sent */
+                entry->packets_flooded = 1;
+                entry->status = ESI_ARP_PENDING;
+                entry->no_tries = 1;
+                entry->last_used = entry->timestamp = jiffies;
+                entry->is_rdesc = is_rdesc;
+                if (entry->is_rdesc)
+                        send_to_lecd(priv, l_rdesc_arp_xmt, mac_to_find, NULL,
+                                     NULL);
+                else
+                        send_to_lecd(priv, l_arp_xmt, mac_to_find, NULL, NULL);
+                entry->timer.expires = jiffies + (1 * HZ);
+                entry->timer.function = lec_arp_expire_arp;
+                add_timer(&entry->timer);
+                found = priv->mcast_vcc;
+        }
 
 out:
         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
@@ -2074,30 +2051,30 @@ out:
 }
 
 static int
-lec_addr_delete(struct lec_priv *priv, unsigned char *atm_addr, 
-                unsigned long permanent)
+lec_addr_delete(struct lec_priv *priv, unsigned char *atm_addr,
+                unsigned long permanent)
 {
         unsigned long flags;
-        struct lec_arp_table *entry, *next;
-        int i;
+        struct hlist_node *node, *next;
+        struct lec_arp_table *entry;
+        int i;
 
-        DPRINTK("lec_addr_delete\n");
+        DPRINTK("lec_addr_delete\n");
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        for(i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                for(entry = priv->lec_arp_tables[i]; entry != NULL; entry = next) {
-                        next = entry->next;
-                        if (!memcmp(atm_addr, entry->atm_addr, ATM_ESA_LEN)
-                            && (permanent || 
-                                !(entry->flags & LEC_PERMANENT_FLAG))) {
+        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
+                hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_tables[i], next) {
+                        if (!memcmp(atm_addr, entry->atm_addr, ATM_ESA_LEN)
+                            && (permanent ||
+                                !(entry->flags & LEC_PERMANENT_FLAG))) {
                                 lec_arp_remove(priv, entry);
-                                kfree(entry);
-                        }
+                                lec_arp_put(entry);
+                        }
                         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
-                        return 0;
-                }
-        }
+                        return 0;
+                }
+        }
         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
-        return -1;
+        return -1;
 }
 
 /*
@@ -2105,109 +2082,98 @@ lec_addr_delete(struct lec_priv *priv, unsigned char *atm_addr,
  */
 static void
 lec_arp_update(struct lec_priv *priv, unsigned char *mac_addr,
-               unsigned char *atm_addr, unsigned long remoteflag,
-               unsigned int targetless_le_arp)
+               unsigned char *atm_addr, unsigned long remoteflag,
+               unsigned int targetless_le_arp)
 {
         unsigned long flags;
-        struct lec_arp_table *entry, *tmp;
-        int i;
+        struct hlist_node *node, *next;
+        struct lec_arp_table *entry, *tmp;
+        int i;
 
-        DPRINTK("lec:%s", (targetless_le_arp) ? "targetless ": " ");
-        DPRINTK("lec_arp_update mac:%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
-                mac_addr[0],mac_addr[1],mac_addr[2],mac_addr[3],
-                mac_addr[4],mac_addr[5]);
+        DPRINTK("lec:%s", (targetless_le_arp) ? "targetless " : " ");
+        DPRINTK("lec_arp_update mac:%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
+                mac_addr[0], mac_addr[1], mac_addr[2], mac_addr[3],
+                mac_addr[4], mac_addr[5]);
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        entry = lec_arp_find(priv, mac_addr);
-        if (entry == NULL && targetless_le_arp)
-                goto out;   /* LANE2: ignore targetless LE_ARPs for which
-                             * we have no entry in the cache. 7.1.30
-                             */
-        if (priv->lec_arp_empty_ones) {
-                entry = priv->lec_arp_empty_ones;
-                if (!memcmp(entry->atm_addr, atm_addr, ATM_ESA_LEN)) {
-                        priv->lec_arp_empty_ones = entry->next;
-                } else {
-                        while(entry->next && memcmp(entry->next->atm_addr, 
-                                                    atm_addr, ATM_ESA_LEN))
-                                entry = entry->next;
-                        if (entry->next) {
-                                tmp = entry;
-                                entry = entry->next;
-                                tmp->next = entry->next;
-                        } else
-                                entry = NULL;
-                        
-                }
-                if (entry) {
-                        del_timer(&entry->timer);
-                        tmp = lec_arp_find(priv, mac_addr);
-                        if (tmp) {
-                                del_timer(&tmp->timer);
-                                tmp->status = ESI_FORWARD_DIRECT;
-                                memcpy(tmp->atm_addr, atm_addr, ATM_ESA_LEN);
-                                tmp->vcc = entry->vcc;
-                                tmp->old_push = entry->old_push;
-                                tmp->last_used = jiffies;
-                                del_timer(&entry->timer);
-                                kfree(entry);
-                                entry=tmp;
-                        } else {
-                                entry->status = ESI_FORWARD_DIRECT;
-                                memcpy(entry->mac_addr, mac_addr, ETH_ALEN);
-                                entry->last_used = jiffies;
-                                lec_arp_add(priv, entry);
-                        }
-                        if (remoteflag)
-                                entry->flags|=LEC_REMOTE_FLAG;
-                        else
-                                entry->flags&=~LEC_REMOTE_FLAG;
-                        DPRINTK("After update\n");
-                        dump_arp_table(priv);
-                        goto out;
-                }
-        }
-        entry = lec_arp_find(priv, mac_addr);
-        if (!entry) {
-                entry = make_entry(priv, mac_addr);
-                if (!entry)
+        entry = lec_arp_find(priv, mac_addr);
+        if (entry == NULL && targetless_le_arp)
+                goto out;       /*
+                                 * LANE2: ignore targetless LE_ARPs for which
+                                 * we have no entry in the cache. 7.1.30
+                                 */
+        if (!hlist_empty(&priv->lec_arp_empty_ones)) {
+                hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_empty_ones, next) {
+                        if (memcmp(entry->atm_addr, atm_addr, ATM_ESA_LEN) == 0) {
+                                hlist_del(&entry->next);
+                                del_timer(&entry->timer);
+                                tmp = lec_arp_find(priv, mac_addr);
+                                if (tmp) {
+                                        del_timer(&tmp->timer);
+                                        tmp->status = ESI_FORWARD_DIRECT;
+                                        memcpy(tmp->atm_addr, atm_addr, ATM_ESA_LEN);
+                                        tmp->vcc = entry->vcc;
+                                        tmp->old_push = entry->old_push;
+                                        tmp->last_used = jiffies;
+                                        del_timer(&entry->timer);
+                                        lec_arp_put(entry);
+                                        entry = tmp;
+                                } else {
+                                        entry->status = ESI_FORWARD_DIRECT;
+                                        memcpy(entry->mac_addr, mac_addr, ETH_ALEN);
+                                        entry->last_used = jiffies;
+                                        lec_arp_add(priv, entry);
+                                }
+                                if (remoteflag)
+                                        entry->flags |= LEC_REMOTE_FLAG;
+                                else
+                                        entry->flags &= ~LEC_REMOTE_FLAG;
+                                DPRINTK("After update\n");
+                                dump_arp_table(priv);
+                                goto out;
+                        }
+                }
+        }
+
+        entry = lec_arp_find(priv, mac_addr);
+        if (!entry) {
+                entry = make_entry(priv, mac_addr);
+                if (!entry)
                         goto out;
-                entry->status = ESI_UNKNOWN;
-                lec_arp_add(priv, entry);
-                /* Temporary, changes before end of function */
-        }
-        memcpy(entry->atm_addr, atm_addr, ATM_ESA_LEN);
-        del_timer(&entry->timer);
-        for(i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                for(tmp = priv->lec_arp_tables[i]; tmp; tmp=tmp->next) {
-                        if (entry != tmp &&
-                            !memcmp(tmp->atm_addr, atm_addr,
-                                    ATM_ESA_LEN)) { 
-                                /* Vcc to this host exists */
-                                if (tmp->status > ESI_VC_PENDING) {
-                                        /*
-                                         * ESI_FLUSH_PENDING,
-                                         * ESI_FORWARD_DIRECT
-                                         */
-                                        entry->vcc = tmp->vcc;
-                                        entry->old_push=tmp->old_push;
-                                }
-                                entry->status=tmp->status;
-                                break;
-                        }
-                }
-        }
-        if (remoteflag)
-                entry->flags|=LEC_REMOTE_FLAG;
-        else
-                entry->flags&=~LEC_REMOTE_FLAG;
-        if (entry->status == ESI_ARP_PENDING ||
-            entry->status == ESI_UNKNOWN) {
-                entry->status = ESI_VC_PENDING;
-                send_to_lecd(priv, l_svc_setup, entry->mac_addr, atm_addr, NULL);
-        }
-        DPRINTK("After update2\n");
-        dump_arp_table(priv);
+                entry->status = ESI_UNKNOWN;
+                lec_arp_add(priv, entry);
+                /* Temporary, changes before end of function */
+        }
+        memcpy(entry->atm_addr, atm_addr, ATM_ESA_LEN);
+        del_timer(&entry->timer);
+        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
+                hlist_for_each_entry(tmp, node, &priv->lec_arp_tables[i], next) {
+                        if (entry != tmp &&
+                            !memcmp(tmp->atm_addr, atm_addr, ATM_ESA_LEN)) {
+                                /* Vcc to this host exists */
+                                if (tmp->status > ESI_VC_PENDING) {
+                                        /*
+                                         * ESI_FLUSH_PENDING,
+                                         * ESI_FORWARD_DIRECT
+                                         */
+                                        entry->vcc = tmp->vcc;
+                                        entry->old_push = tmp->old_push;
+                                }
+                                entry->status = tmp->status;
+                                break;
+                        }
+                }
+        }
+        if (remoteflag)
+                entry->flags |= LEC_REMOTE_FLAG;
+        else
+                entry->flags &= ~LEC_REMOTE_FLAG;
+        if (entry->status == ESI_ARP_PENDING || entry->status == ESI_UNKNOWN) {
+                entry->status = ESI_VC_PENDING;
+                send_to_lecd(priv, l_svc_setup, entry->mac_addr, atm_addr, NULL);
+        }
+        DPRINTK("After update2\n");
+        dump_arp_table(priv);
 out:
         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
 }
@@ -2217,299 +2183,299 @@ out:
  */
 static void
 lec_vcc_added(struct lec_priv *priv, struct atmlec_ioc *ioc_data,
-              struct atm_vcc *vcc,
-              void (*old_push)(struct atm_vcc *vcc, struct sk_buff *skb))
+              struct atm_vcc *vcc,
+              void (*old_push) (struct atm_vcc *vcc, struct sk_buff *skb))
 {
         unsigned long flags;
-        struct lec_arp_table *entry;
-        int i, found_entry=0;
+        struct hlist_node *node;
+        struct lec_arp_table *entry;
+        int i, found_entry = 0;
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        if (ioc_data->receive == 2) {
-                /* Vcc for Multicast Forward. No timer, LANEv2 7.1.20 and 2.3.5.3 */
+        if (ioc_data->receive == 2) {
+                /* Vcc for Multicast Forward. No timer, LANEv2 7.1.20 and 2.3.5.3 */
 
-                DPRINTK("LEC_ARP: Attaching mcast forward\n");
+                DPRINTK("LEC_ARP: Attaching mcast forward\n");
 #if 0
-                entry = lec_arp_find(priv, bus_mac);
-                if (!entry) {
-                        printk("LEC_ARP: Multicast entry not found!\n");
+                entry = lec_arp_find(priv, bus_mac);
+                if (!entry) {
+                        printk("LEC_ARP: Multicast entry not found!\n");
                         goto out;
-                }
-                memcpy(entry->atm_addr, ioc_data->atm_addr, ATM_ESA_LEN);
-                entry->recv_vcc = vcc;
-                entry->old_recv_push = old_push;
+                }
+                memcpy(entry->atm_addr, ioc_data->atm_addr, ATM_ESA_LEN);
+                entry->recv_vcc = vcc;
+                entry->old_recv_push = old_push;
 #endif
-                entry = make_entry(priv, bus_mac);
-                if (entry == NULL)
+                entry = make_entry(priv, bus_mac);
+                if (entry == NULL)
                         goto out;
-                del_timer(&entry->timer);
-                memcpy(entry->atm_addr, ioc_data->atm_addr, ATM_ESA_LEN);
-                entry->recv_vcc = vcc;
-                entry->old_recv_push = old_push;
-                entry->next = priv->mcast_fwds;
-                priv->mcast_fwds = entry;
-                goto out;
-        } else if (ioc_data->receive == 1) {
-                /* Vcc which we don't want to make default vcc, attach it
-                   anyway. */
-                DPRINTK("LEC_ARP:Attaching data direct, not default :%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
-                        ioc_data->atm_addr[0],ioc_data->atm_addr[1],
-                        ioc_data->atm_addr[2],ioc_data->atm_addr[3],
-                        ioc_data->atm_addr[4],ioc_data->atm_addr[5],
-                        ioc_data->atm_addr[6],ioc_data->atm_addr[7],
-                        ioc_data->atm_addr[8],ioc_data->atm_addr[9],
-                        ioc_data->atm_addr[10],ioc_data->atm_addr[11],
-                        ioc_data->atm_addr[12],ioc_data->atm_addr[13],
-                        ioc_data->atm_addr[14],ioc_data->atm_addr[15],
-                        ioc_data->atm_addr[16],ioc_data->atm_addr[17],
-                        ioc_data->atm_addr[18],ioc_data->atm_addr[19]);
-                entry = make_entry(priv, bus_mac);
-                if (entry == NULL)
+                del_timer(&entry->timer);
+                memcpy(entry->atm_addr, ioc_data->atm_addr, ATM_ESA_LEN);
+                entry->recv_vcc = vcc;
+                entry->old_recv_push = old_push;
+                hlist_add_head(&entry->next, &priv->mcast_fwds);
+                goto out;
+        } else if (ioc_data->receive == 1) {
+                /*
+                 * Vcc which we don't want to make default vcc,
+                 * attach it anyway.
+                 */
+                DPRINTK
+                    ("LEC_ARP:Attaching data direct, not default: "
+                     "%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
+                     ioc_data->atm_addr[0], ioc_data->atm_addr[1],
+                     ioc_data->atm_addr[2], ioc_data->atm_addr[3],
+                     ioc_data->atm_addr[4], ioc_data->atm_addr[5],
+                     ioc_data->atm_addr[6], ioc_data->atm_addr[7],
+                     ioc_data->atm_addr[8], ioc_data->atm_addr[9],
+                     ioc_data->atm_addr[10], ioc_data->atm_addr[11],
+                     ioc_data->atm_addr[12], ioc_data->atm_addr[13],
+                     ioc_data->atm_addr[14], ioc_data->atm_addr[15],
+                     ioc_data->atm_addr[16], ioc_data->atm_addr[17],
+                     ioc_data->atm_addr[18], ioc_data->atm_addr[19]);
+                entry = make_entry(priv, bus_mac);
+                if (entry == NULL)
                         goto out;
-                memcpy(entry->atm_addr, ioc_data->atm_addr, ATM_ESA_LEN);
-                memset(entry->mac_addr, 0, ETH_ALEN);
-                entry->recv_vcc = vcc;
-                entry->old_recv_push = old_push;
-                entry->status = ESI_UNKNOWN;
-                entry->timer.expires = jiffies + priv->vcc_timeout_period;
-                entry->timer.function = lec_arp_expire_vcc;
-                add_timer(&entry->timer);
-                entry->next = priv->lec_no_forward;
-                priv->lec_no_forward = entry;
+                memcpy(entry->atm_addr, ioc_data->atm_addr, ATM_ESA_LEN);
+                memset(entry->mac_addr, 0, ETH_ALEN);
+                entry->recv_vcc = vcc;
+                entry->old_recv_push = old_push;
+                entry->status = ESI_UNKNOWN;
+                entry->timer.expires = jiffies + priv->vcc_timeout_period;
+                entry->timer.function = lec_arp_expire_vcc;
+                hlist_add_head(&entry->next, &priv->lec_no_forward);
+                add_timer(&entry->timer);
                 dump_arp_table(priv);
                 goto out;
-        }
-        DPRINTK("LEC_ARP:Attaching data direct, default:%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
-                ioc_data->atm_addr[0],ioc_data->atm_addr[1],
-                ioc_data->atm_addr[2],ioc_data->atm_addr[3],
-                ioc_data->atm_addr[4],ioc_data->atm_addr[5],
-                ioc_data->atm_addr[6],ioc_data->atm_addr[7],
-                ioc_data->atm_addr[8],ioc_data->atm_addr[9],
-                ioc_data->atm_addr[10],ioc_data->atm_addr[11],
-                ioc_data->atm_addr[12],ioc_data->atm_addr[13],
-                ioc_data->atm_addr[14],ioc_data->atm_addr[15],
-                ioc_data->atm_addr[16],ioc_data->atm_addr[17],
-                ioc_data->atm_addr[18],ioc_data->atm_addr[19]);
-        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                for (entry = priv->lec_arp_tables[i]; entry; entry=entry->next) {
-                        if (memcmp(ioc_data->atm_addr, entry->atm_addr, 
-                                   ATM_ESA_LEN)==0) {
-                                DPRINTK("LEC_ARP: Attaching data direct\n");
-                                DPRINTK("Currently -> Vcc: %d, Rvcc:%d\n",
-                                        entry->vcc?entry->vcc->vci:0,
-                                        entry->recv_vcc?entry->recv_vcc->vci:0);
-                                found_entry=1;
-                                del_timer(&entry->timer);
-                                entry->vcc = vcc;
-                                entry->old_push = old_push;
-                                if (entry->status == ESI_VC_PENDING) {
-                                        if(priv->maximum_unknown_frame_count
-                                           ==0)
-                                                entry->status = 
-                                                        ESI_FORWARD_DIRECT;
-                                        else {
-                                                entry->timestamp = jiffies;
-                                                entry->status = 
-                                                        ESI_FLUSH_PENDING;
+        }
+        DPRINTK
+            ("LEC_ARP:Attaching data direct, default: "
+             "%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
+             ioc_data->atm_addr[0], ioc_data->atm_addr[1],
+             ioc_data->atm_addr[2], ioc_data->atm_addr[3],
+             ioc_data->atm_addr[4], ioc_data->atm_addr[5],
+             ioc_data->atm_addr[6], ioc_data->atm_addr[7],
+             ioc_data->atm_addr[8], ioc_data->atm_addr[9],
+             ioc_data->atm_addr[10], ioc_data->atm_addr[11],
+             ioc_data->atm_addr[12], ioc_data->atm_addr[13],
+             ioc_data->atm_addr[14], ioc_data->atm_addr[15],
+             ioc_data->atm_addr[16], ioc_data->atm_addr[17],
+             ioc_data->atm_addr[18], ioc_data->atm_addr[19]);
+        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
+                hlist_for_each_entry(entry, node, &priv->lec_arp_tables[i], next) {
+                        if (memcmp
+                            (ioc_data->atm_addr, entry->atm_addr,
+                             ATM_ESA_LEN) == 0) {
+                                DPRINTK("LEC_ARP: Attaching data direct\n");
+                                DPRINTK("Currently -> Vcc: %d, Rvcc:%d\n",
+                                        entry->vcc ? entry->vcc->vci : 0,
+                                        entry->recv_vcc ? entry->recv_vcc->
+                                        vci : 0);
+                                found_entry = 1;
+                                del_timer(&entry->timer);
+                                entry->vcc = vcc;
+                                entry->old_push = old_push;
+                                if (entry->status == ESI_VC_PENDING) {
+                                        if (priv->maximum_unknown_frame_count
+                                            == 0)
+                                                entry->status =
+                                                    ESI_FORWARD_DIRECT;
+                                        else {
+                                                entry->timestamp = jiffies;
+                                                entry->status =
+                                                    ESI_FLUSH_PENDING;
 #if 0
-                                                send_to_lecd(priv,l_flush_xmt,
-                                                             NULL,
-                                                             entry->atm_addr,
-                                                             NULL);
+                                                send_to_lecd(priv, l_flush_xmt,
+                                                             NULL,
+                                                             entry->atm_addr,
+                                                             NULL);
 #endif
-                                        }
-                                } else {
-                                        /* They were forming a connection
-                                           to us, and we to them. Our
-                                           ATM address is numerically lower
-                                           than theirs, so we make connection
-                                           we formed into default VCC (8.1.11).
-                                           Connection they made gets torn
-                                           down. This might confuse some
-                                           clients. Can be changed if
-                                           someone reports trouble... */
-                                        ;
-                                }
-                        }
-                }
-        }
-        if (found_entry) {
-                DPRINTK("After vcc was added\n");
-                dump_arp_table(priv);
+                                        }
+                                } else {
+                                        /*
+                                         * They were forming a connection
+                                         * to us, and we to them. Our
+                                         * ATM address is numerically lower
+                                         * than theirs, so we make connection
+                                         * we formed into default VCC (8.1.11).
+                                         * Connection they made gets torn
+                                         * down. This might confuse some
+                                         * clients. Can be changed if
+                                         * someone reports trouble...
+                                         */
+                                        ;
+                                }
+                        }
+                }
+        }
+        if (found_entry) {
+                DPRINTK("After vcc was added\n");
+                dump_arp_table(priv);
                 goto out;
-        }
-        /* Not found, snatch address from first data packet that arrives from
-           this vcc */
-        entry = make_entry(priv, bus_mac);
-        if (!entry)
+        }
+        /*
+         * Not found, snatch address from first data packet that arrives
+         * from this vcc
+         */
+        entry = make_entry(priv, bus_mac);
+        if (!entry)
                 goto out;
-        entry->vcc = vcc;
-        entry->old_push = old_push;
-        memcpy(entry->atm_addr, ioc_data->atm_addr, ATM_ESA_LEN);
-        memset(entry->mac_addr, 0, ETH_ALEN);
-        entry->status = ESI_UNKNOWN;
-        entry->next = priv->lec_arp_empty_ones;
-        priv->lec_arp_empty_ones = entry;
-        entry->timer.expires = jiffies + priv->vcc_timeout_period;
-        entry->timer.function = lec_arp_expire_vcc;
-        add_timer(&entry->timer);
-        DPRINTK("After vcc was added\n");
+        entry->vcc = vcc;
+        entry->old_push = old_push;
+        memcpy(entry->atm_addr, ioc_data->atm_addr, ATM_ESA_LEN);
+        memset(entry->mac_addr, 0, ETH_ALEN);
+        entry->status = ESI_UNKNOWN;
+        hlist_add_head(&entry->next, &priv->lec_arp_empty_ones);
+        entry->timer.expires = jiffies + priv->vcc_timeout_period;
+        entry->timer.function = lec_arp_expire_vcc;
+        add_timer(&entry->timer);
+        DPRINTK("After vcc was added\n");
         dump_arp_table(priv);
 out:
         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
 }
 
-static void
-lec_flush_complete(struct lec_priv *priv, unsigned long tran_id)
+static void lec_flush_complete(struct lec_priv *priv, unsigned long tran_id)
 {
         unsigned long flags;
-        struct lec_arp_table *entry;
-        int i;
-  
-        DPRINTK("LEC:lec_flush_complete %lx\n",tran_id);
+        struct hlist_node *node;
+        struct lec_arp_table *entry;
+        int i;
+
+        DPRINTK("LEC:lec_flush_complete %lx\n", tran_id);
+restart:
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                for (entry = priv->lec_arp_tables[i]; entry; entry=entry->next) {
-                        if (entry->flush_tran_id == tran_id &&
-                            entry->status == ESI_FLUSH_PENDING) {
-                                struct sk_buff *skb;
-
-                                while ((skb = skb_dequeue(&entry->tx_wait)) != NULL)
-                                        lec_send(entry->vcc, skb, entry->priv);
-                                entry->status = ESI_FORWARD_DIRECT;
-                                DPRINTK("LEC_ARP: Flushed\n");
-                        }
-                }
-        }
+        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
+                hlist_for_each_entry(entry, node, &priv->lec_arp_tables[i], next) {
+                        if (entry->flush_tran_id == tran_id
+                            && entry->status == ESI_FLUSH_PENDING) {
+                                struct sk_buff *skb;
+                                struct atm_vcc *vcc = entry->vcc;
+
+                                lec_arp_hold(entry);
+                                spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
+                                while ((skb = skb_dequeue(&entry->tx_wait)) != NULL)
+                                        lec_send(vcc, skb, entry->priv);
+                                entry->last_used = jiffies;
+                                entry->status = ESI_FORWARD_DIRECT;
+                                lec_arp_put(entry);
+                                DPRINTK("LEC_ARP: Flushed\n");
+                                goto restart;
+                        }
+                }
+        }
         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
-        dump_arp_table(priv);
+        dump_arp_table(priv);
 }
 
 static void
 lec_set_flush_tran_id(struct lec_priv *priv,
-                      unsigned char *atm_addr, unsigned long tran_id)
+                      unsigned char *atm_addr, unsigned long tran_id)
 {
         unsigned long flags;
-        struct lec_arp_table *entry;
-        int i;
+        struct hlist_node *node;
+        struct lec_arp_table *entry;
+        int i;
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++)
-                for(entry = priv->lec_arp_tables[i]; entry; entry=entry->next)
-                        if (!memcmp(atm_addr, entry->atm_addr, ATM_ESA_LEN)) {
-                                entry->flush_tran_id = tran_id;
-                                DPRINTK("Set flush transaction id to %lx for %p\n",tran_id,entry);
-                        }
+        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++)
+                hlist_for_each_entry(entry, node, &priv->lec_arp_tables[i], next) {
+                        if (!memcmp(atm_addr, entry->atm_addr, ATM_ESA_LEN)) {
+                                entry->flush_tran_id = tran_id;
+                                DPRINTK("Set flush transaction id to %lx for %p\n",
+                                        tran_id, entry);
+                        }
+                }
         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
 }
 
-static int 
-lec_mcast_make(struct lec_priv *priv, struct atm_vcc *vcc)
+static int lec_mcast_make(struct lec_priv *priv, struct atm_vcc *vcc)
 {
         unsigned long flags;
-        unsigned char mac_addr[] = {
-                0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-        struct lec_arp_table *to_add;
+        unsigned char mac_addr[] = {
+                0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+        };
+        struct lec_arp_table *to_add;
         struct lec_vcc_priv *vpriv;
         int err = 0;
-  
+
         if (!(vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL)))
                 return -ENOMEM;
         vpriv->xoff = 0;
         vpriv->old_pop = vcc->pop;
         vcc->user_back = vpriv;
-        vcc->pop = lec_pop;
+        vcc->pop = lec_pop;
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        to_add = make_entry(priv, mac_addr);
-        if (!to_add) {
+        to_add = make_entry(priv, mac_addr);
+        if (!to_add) {
                 vcc->pop = vpriv->old_pop;
                 kfree(vpriv);
-                err = -ENOMEM;
+                err = -ENOMEM;
                 goto out;
-        }
-        memcpy(to_add->atm_addr, vcc->remote.sas_addr.prv, ATM_ESA_LEN);
-        to_add->status = ESI_FORWARD_DIRECT;
-        to_add->flags |= LEC_PERMANENT_FLAG;
-        to_add->vcc = vcc;
-        to_add->old_push = vcc->push;
-        vcc->push = lec_push;
-        priv->mcast_vcc = vcc;
-        lec_arp_add(priv, to_add);
+        }
+        memcpy(to_add->atm_addr, vcc->remote.sas_addr.prv, ATM_ESA_LEN);
+        to_add->status = ESI_FORWARD_DIRECT;
+        to_add->flags |= LEC_PERMANENT_FLAG;
+        to_add->vcc = vcc;
+        to_add->old_push = vcc->push;
+        vcc->push = lec_push;
+        priv->mcast_vcc = vcc;
+        lec_arp_add(priv, to_add);
 out:
         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
-        return err;
+        return err;
 }
 
-static void
-lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
+static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
 {
         unsigned long flags;
-        struct lec_arp_table *entry, *next;
-        int i;
+        struct hlist_node *node, *next;
+        struct lec_arp_table *entry;
+        int i;
+
+        DPRINTK("LEC_ARP: lec_vcc_close vpi:%d vci:%d\n", vcc->vpi, vcc->vci);
+        dump_arp_table(priv);
 
-        DPRINTK("LEC_ARP: lec_vcc_close vpi:%d vci:%d\n",vcc->vpi,vcc->vci);
-        dump_arp_table(priv);
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        for(i=0;i<LEC_ARP_TABLE_SIZE;i++) {
-                for(entry = priv->lec_arp_tables[i];entry; entry=next) {
-                        next = entry->next;
-                        if (vcc == entry->vcc) {
-                                lec_arp_remove(priv, entry);
-                                kfree(entry);
-                                if (priv->mcast_vcc == vcc) {
-                                        priv->mcast_vcc = NULL;
-                                }
-                        }
-                }
-        }
-
-        entry = priv->lec_arp_empty_ones;
-        priv->lec_arp_empty_ones = NULL;
-        while (entry != NULL) {
-                next = entry->next;
-                if (entry->vcc == vcc) { /* leave it out from the list */
-                        lec_arp_clear_vccs(entry);
-                        del_timer(&entry->timer);
-                        kfree(entry);
-                }
-                else {              /* put it back to the list */
-                        entry->next = priv->lec_arp_empty_ones;
-                        priv->lec_arp_empty_ones = entry;
-                }
-                entry = next;
-        }
-        
-        entry = priv->lec_no_forward;
-        priv->lec_no_forward = NULL;
-        while (entry != NULL) {
-                next = entry->next;
-                if (entry->recv_vcc == vcc) {
-                        lec_arp_clear_vccs(entry);
-                        del_timer(&entry->timer);
-                        kfree(entry);
-                }
-                else {
-                        entry->next = priv->lec_no_forward;
-                        priv->lec_no_forward = entry;
-                }
-                entry = next;
-        }
-
-        entry = priv->mcast_fwds;
-        priv->mcast_fwds = NULL;
-        while (entry != NULL) {
-                next = entry->next;
-                if (entry->recv_vcc == vcc) {
-                        lec_arp_clear_vccs(entry);
-                        /* No timer, LANEv2 7.1.20 and 2.3.5.3 */
-                        kfree(entry);
-                }
-                else {
-                        entry->next = priv->mcast_fwds;
-                        priv->mcast_fwds = entry;
-                }
-                entry = next;
-        }
+
+        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
+                hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_tables[i], next) {
+                        if (vcc == entry->vcc) {
+                                lec_arp_remove(priv, entry);
+                                lec_arp_put(entry);
+                                if (priv->mcast_vcc == vcc) {
+                                        priv->mcast_vcc = NULL;
+                                }
+                        }
+                }
+        }
+
+        hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_empty_ones, next) {
+                if (entry->vcc == vcc) {
+                        lec_arp_clear_vccs(entry);
+                        del_timer(&entry->timer);
+                        hlist_del(&entry->next);
+                        lec_arp_put(entry);
+                }
+        }
+
+        hlist_for_each_entry_safe(entry, node, next, &priv->lec_no_forward, next) {
+                if (entry->recv_vcc == vcc) {
+                        lec_arp_clear_vccs(entry);
+                        del_timer(&entry->timer);
+                        hlist_del(&entry->next);
+                        lec_arp_put(entry);
+                }
+        }
+
+        hlist_for_each_entry_safe(entry, node, next, &priv->mcast_fwds, next) {
+                if (entry->recv_vcc == vcc) {
+                        lec_arp_clear_vccs(entry);
+                        /* No timer, LANEv2 7.1.20 and 2.3.5.3 */
+                        hlist_del(&entry->next);
+                        lec_arp_put(entry);
+                }
+        }
 
         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
         dump_arp_table(priv);
@@ -2517,57 +2483,42 @@ lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
 
 static void
 lec_arp_check_empties(struct lec_priv *priv,
-                      struct atm_vcc *vcc, struct sk_buff *skb)
+                      struct atm_vcc *vcc, struct sk_buff *skb)
 {
-        unsigned long flags;
-        struct lec_arp_table *entry, *prev;
-        struct lecdatahdr_8023 *hdr = (struct lecdatahdr_8023 *)skb->data;
-        unsigned char *src;
+        unsigned long flags;
+        struct hlist_node *node, *next;
+        struct lec_arp_table *entry, *tmp;
+        struct lecdatahdr_8023 *hdr = (struct lecdatahdr_8023 *)skb->data;
+        unsigned char *src;
 #ifdef CONFIG_TR
-        struct lecdatahdr_8025 *tr_hdr = (struct lecdatahdr_8025 *)skb->data;
+        struct lecdatahdr_8025 *tr_hdr = (struct lecdatahdr_8025 *)skb->data;
 
-        if (priv->is_trdev) src = tr_hdr->h_source;
-        else
+        if (priv->is_trdev)
+                src = tr_hdr->h_source;
+        else
 #endif
-        src = hdr->h_source;
+                src = hdr->h_source;
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        entry = priv->lec_arp_empty_ones;
-        if (vcc == entry->vcc) {
-                del_timer(&entry->timer);
-                memcpy(entry->mac_addr, src, ETH_ALEN);
-                entry->status = ESI_FORWARD_DIRECT;
-                entry->last_used = jiffies;
-                priv->lec_arp_empty_ones = entry->next;
-                /* We might have got an entry */
-                if ((prev = lec_arp_find(priv,src))) {
-                        lec_arp_remove(priv, prev);
-                        kfree(prev);
-                }
-                lec_arp_add(priv, entry);
-                goto out;
-        }
-        prev = entry;
-        entry = entry->next;
-        while (entry && entry->vcc != vcc) {
-                prev= entry;
-                entry = entry->next;
-        }
-        if (!entry) {
-                DPRINTK("LEC_ARP: Arp_check_empties: entry not found!\n");
-                goto out;
-        }
-        del_timer(&entry->timer);
-        memcpy(entry->mac_addr, src, ETH_ALEN);
-        entry->status = ESI_FORWARD_DIRECT;
-        entry->last_used = jiffies;
-        prev->next = entry->next;
-        if ((prev = lec_arp_find(priv, src))) {
-                lec_arp_remove(priv, prev);
-                kfree(prev);
-        }
-        lec_arp_add(priv, entry);
+        hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_empty_ones, next) {
+                if (vcc == entry->vcc) {
+                        del_timer(&entry->timer);
+                        memcpy(entry->mac_addr, src, ETH_ALEN);
+                        entry->status = ESI_FORWARD_DIRECT;
+                        entry->last_used = jiffies;
+                        /* We might have got an entry */
+                        if ((tmp = lec_arp_find(priv, src))) {
+                                lec_arp_remove(priv, tmp);
+                                lec_arp_put(tmp);
+                        }
+                        hlist_del(&entry->next);
+                        lec_arp_add(priv, entry);
+                        goto out;
+                }
+        }
+        DPRINTK("LEC_ARP: Arp_check_empties: entry not found!\n");
 out:
         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
 }
+
 MODULE_LICENSE("GPL");
diff --git a/net/atm/lec.h b/net/atm/lec.h
index c22a8bfa1f81..877f50939696 100644
--- a/net/atm/lec.h
+++ b/net/atm/lec.h
@@ -1,9 +1,7 @@
 /*
- *
  * Lan Emulation client header file
  *
- * Marko Kiiskila mkiiskila@yahoo.com
- *
+ * Marko Kiiskila <mkiiskila@yahoo.com>
  */
 
 #ifndef _LEC_H_
@@ -16,18 +14,18 @@
 #define LEC_HEADER_LEN 16
 
 struct lecdatahdr_8023 {
-  unsigned short le_header;
-  unsigned char h_dest[ETH_ALEN];
-  unsigned char h_source[ETH_ALEN];
-  unsigned short h_type;
+        unsigned short le_header;
+        unsigned char h_dest[ETH_ALEN];
+        unsigned char h_source[ETH_ALEN];
+        unsigned short h_type;
 };
 
 struct lecdatahdr_8025 {
-  unsigned short le_header;
-  unsigned char ac_pad;
-  unsigned char fc;
-  unsigned char h_dest[ETH_ALEN];
-  unsigned char h_source[ETH_ALEN];
+        unsigned short le_header;
+        unsigned char ac_pad;
+        unsigned char fc;
+        unsigned char h_dest[ETH_ALEN];
+        unsigned char h_source[ETH_ALEN];
 };
 
 #define LEC_MINIMUM_8023_SIZE   62
@@ -44,17 +42,18 @@ struct lecdatahdr_8025 {
  *
  */
 struct lane2_ops {
-        int  (*resolve)(struct net_device *dev, u8 *dst_mac, int force,
-                        u8 **tlvs, u32 *sizeoftlvs);
-        int  (*associate_req)(struct net_device *dev, u8 *lan_dst,
-                              u8 *tlvs, u32 sizeoftlvs);
-        void (*associate_indicator)(struct net_device *dev, u8 *mac_addr,
-                                    u8 *tlvs, u32 sizeoftlvs);
+        int (*resolve) (struct net_device *dev, u8 *dst_mac, int force,
+                        u8 **tlvs, u32 *sizeoftlvs);
+        int (*associate_req) (struct net_device *dev, u8 *lan_dst,
+                              u8 *tlvs, u32 sizeoftlvs);
+        void (*associate_indicator) (struct net_device *dev, u8 *mac_addr,
+                                     u8 *tlvs, u32 sizeoftlvs);
 };
 
 /*
  * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
  * frames. 
+ *
  * 1. Dix Ethernet EtherType frames encoded by placing EtherType
  *    field in h_type field. Data follows immediatelly after header.
  * 2. LLC Data frames whose total length, including LLC field and data,
@@ -70,72 +69,88 @@ struct lane2_ops {
 #define LEC_ARP_TABLE_SIZE 16
 
 struct lec_priv {
-        struct net_device_stats stats;
-        unsigned short lecid;      /* Lecid of this client */
-        struct lec_arp_table *lec_arp_empty_ones;
-        /* Used for storing VCC's that don't have a MAC address attached yet */
-        struct lec_arp_table *lec_arp_tables[LEC_ARP_TABLE_SIZE];
-        /* Actual LE ARP table */
-        struct lec_arp_table *lec_no_forward;
-        /* Used for storing VCC's (and forward packets from) which are to
-           age out by not using them to forward packets. 
-           This is because to some LE clients there will be 2 VCCs. Only
-           one of them gets used. */
-        struct lec_arp_table *mcast_fwds;
-        /* With LANEv2 it is possible that BUS (or a special multicast server)
-           establishes multiple Multicast Forward VCCs to us. This list
-           collects all those VCCs. LANEv1 client has only one item in this
-           list. These entries are not aged out. */
-        spinlock_t lec_arp_lock;
-        struct atm_vcc *mcast_vcc; /* Default Multicast Send VCC */
-        struct atm_vcc *lecd;
-        struct timer_list lec_arp_timer;
-        /* C10 */
-        unsigned int maximum_unknown_frame_count;
-/* Within the period of time defined by this variable, the client will send 
-   no more than C10 frames to BUS for a given unicast destination. (C11) */
-        unsigned long max_unknown_frame_time;
-/* If no traffic has been sent in this vcc for this period of time,
-   vcc will be torn down (C12)*/
-        unsigned long vcc_timeout_period;
-/* An LE Client MUST not retry an LE_ARP_REQUEST for a 
-   given frame's LAN Destination more than maximum retry count times,
-   after the first LEC_ARP_REQUEST (C13)*/
-        unsigned short max_retry_count;
-/* Max time the client will maintain an entry in its arp cache in
-   absence of a verification of that relationship (C17)*/
-        unsigned long aging_time;
-/* Max time the client will maintain an entry in cache when
-   topology change flag is true (C18) */
-        unsigned long forward_delay_time;
-/* Topology change flag  (C19)*/
-        int topology_change;
-/* Max time the client expects an LE_ARP_REQUEST/LE_ARP_RESPONSE
-   cycle to take (C20)*/
-        unsigned long arp_response_time;
-/* Time limit ot wait to receive an LE_FLUSH_RESPONSE after the
-   LE_FLUSH_REQUEST has been sent before taking recover action. (C21)*/
-        unsigned long flush_timeout;
-/* The time since sending a frame to the bus after which the
-   LE Client may assume that the frame has been either discarded or
-   delivered to the recipient (C22) */
-        unsigned long path_switching_delay;
+        struct net_device_stats stats;
+        unsigned short lecid;                   /* Lecid of this client */
+        struct hlist_head lec_arp_empty_ones;
+                                                /* Used for storing VCC's that don't have a MAC address attached yet */
+        struct hlist_head lec_arp_tables[LEC_ARP_TABLE_SIZE];
+                                                /* Actual LE ARP table */
+        struct hlist_head lec_no_forward;
+                                                /*
+                                                 * Used for storing VCC's (and forward packets from) which are to
+                                                 * age out by not using them to forward packets.
+                                                 * This is because to some LE clients there will be 2 VCCs. Only
+                                                 * one of them gets used.
+                                                 */
+        struct hlist_head mcast_fwds;
+                                                /*
+                                                 * With LANEv2 it is possible that BUS (or a special multicast server)
+                                                 * establishes multiple Multicast Forward VCCs to us. This list
+                                                 * collects all those VCCs. LANEv1 client has only one item in this
+                                                 * list. These entries are not aged out.
+                                                 */
+        spinlock_t lec_arp_lock;
+        struct atm_vcc *mcast_vcc;              /* Default Multicast Send VCC */
+        struct atm_vcc *lecd;
+        struct work_struct lec_arp_work;        /* C10 */
+        unsigned int maximum_unknown_frame_count;
+                                                /*
+                                                 * Within the period of time defined by this variable, the client will send
+                                                 * no more than C10 frames to BUS for a given unicast destination. (C11)
+                                                 */
+        unsigned long max_unknown_frame_time;
+                                                /*
+                                                 * If no traffic has been sent in this vcc for this period of time,
+                                                 * vcc will be torn down (C12)
+                                                 */
+        unsigned long vcc_timeout_period;
+                                                /*
+                                                 * An LE Client MUST not retry an LE_ARP_REQUEST for a
+                                                 * given frame's LAN Destination more than maximum retry count times,
+                                                 * after the first LEC_ARP_REQUEST (C13)
+                                                 */
+        unsigned short max_retry_count;
+                                                /*
+                                                 * Max time the client will maintain an entry in its arp cache in
+                                                 * absence of a verification of that relationship (C17)
+                                                 */
+        unsigned long aging_time;
+                                                /*
+                                                 * Max time the client will maintain an entry in cache when
+                                                 * topology change flag is true (C18)
+                                                 */
+        unsigned long forward_delay_time;       /* Topology change flag (C19) */
+        int topology_change;
+                                                /*
+                                                 * Max time the client expects an LE_ARP_REQUEST/LE_ARP_RESPONSE
+                                                 * cycle to take (C20)
+                                                 */
+        unsigned long arp_response_time;
+                                                /*
+                                                 * Time limit ot wait to receive an LE_FLUSH_RESPONSE after the
+                                                 * LE_FLUSH_REQUEST has been sent before taking recover action. (C21)
+                                                 */
+        unsigned long flush_timeout;
+                                                /* The time since sending a frame to the bus after which the
+                                                 * LE Client may assume that the frame has been either discarded or
+                                                 * delivered to the recipient (C22)
+                                                 */
+        unsigned long path_switching_delay;
 
-        u8 *tlvs;          /* LANE2: TLVs are new                */
-        u32 sizeoftlvs;    /* The size of the tlv array in bytes */
-        int lane_version;  /* LANE2                              */
-        int itfnum;        /* e.g. 2 for lec2, 5 for lec5        */
-        struct lane2_ops *lane2_ops; /* can be NULL for LANE v1  */
-        int is_proxy;      /* bridge between ATM and Ethernet    */
-        int is_trdev;      /* Device type, 0 = Ethernet, 1 = TokenRing */
+        u8 *tlvs;                               /* LANE2: TLVs are new */
+        u32 sizeoftlvs;                         /* The size of the tlv array in bytes */
+        int lane_version;                       /* LANE2 */
+        int itfnum;                             /* e.g. 2 for lec2, 5 for lec5 */
+        struct lane2_ops *lane2_ops;            /* can be NULL for LANE v1 */
+        int is_proxy;                           /* bridge between ATM and Ethernet */
+        int is_trdev;                           /* Device type, 0 = Ethernet, 1 = TokenRing */
 };
 
 struct lec_vcc_priv {
-        void (*old_pop)(struct atm_vcc *vcc, struct sk_buff *skb);
+        void (*old_pop) (struct atm_vcc *vcc, struct sk_buff *skb);
         int xoff;
 };
 
 #define LEC_VCC_PRIV(vcc)       ((struct lec_vcc_priv *)((vcc)->user_back))
 
-#endif /* _LEC_H_ */
-
+#endif                          /* _LEC_H_ */
diff --git a/net/atm/lec_arpc.h b/net/atm/lec_arpc.h
index 397448094648..ec67435a40a6 100644
--- a/net/atm/lec_arpc.h
+++ b/net/atm/lec_arpc.h
@@ -1,92 +1,96 @@
 /*
  * Lec arp cache
- * Marko Kiiskila mkiiskila@yahoo.com
  *
+ * Marko Kiiskila <mkiiskila@yahoo.com>
  */
-#ifndef _LEC_ARP_H
-#define _LEC_ARP_H
+#ifndef _LEC_ARP_H_
+#define _LEC_ARP_H_
 #include <linux/atm.h>
 #include <linux/atmdev.h>
 #include <linux/if_ether.h>
 #include <linux/atmlec.h>
 
 struct lec_arp_table {
-        struct lec_arp_table *next;          /* Linked entry list */
-        unsigned char atm_addr[ATM_ESA_LEN]; /* Atm address */
-        unsigned char mac_addr[ETH_ALEN];    /* Mac address */
-        int is_rdesc;                        /* Mac address is a route descriptor */
-        struct atm_vcc *vcc;                 /* Vcc this entry is attached */
-        struct atm_vcc *recv_vcc;            /* Vcc we receive data from */
-        void (*old_push)(struct atm_vcc *vcc,struct sk_buff *skb); 
-                                             /* Push that leads to daemon */
-        void (*old_recv_push)(struct atm_vcc *vcc, struct sk_buff *skb);
-                                             /* Push that leads to daemon */
-        void (*old_close)(struct atm_vcc *vcc);
-                                             /* We want to see when this
-                                              * vcc gets closed */
-        unsigned long last_used;             /* For expiry */
-        unsigned long timestamp;             /* Used for various timestamping
-                                              * things:
-                                              * 1. FLUSH started 
-                                              *    (status=ESI_FLUSH_PENDING)
-                                              * 2. Counting to 
-                                              *    max_unknown_frame_time
-                                              *    (status=ESI_ARP_PENDING||
-                                              *     status=ESI_VC_PENDING)
-                                              */
-        unsigned char no_tries;              /* No of times arp retry has been 
-                                                tried */
-        unsigned char status;                /* Status of this entry */
-        unsigned short flags;                /* Flags for this entry */
-        unsigned short packets_flooded;      /* Data packets flooded */
-        unsigned long flush_tran_id;         /* Transaction id in flush protocol */
-        struct timer_list timer;             /* Arping timer */
-        struct lec_priv *priv;               /* Pointer back */
+        struct hlist_node next;         /* Linked entry list */
+        unsigned char atm_addr[ATM_ESA_LEN];    /* Atm address */
+        unsigned char mac_addr[ETH_ALEN];       /* Mac address */
+        int is_rdesc;                   /* Mac address is a route descriptor */
+        struct atm_vcc *vcc;            /* Vcc this entry is attached */
+        struct atm_vcc *recv_vcc;       /* Vcc we receive data from */
 
-        u8  *tlvs;             /* LANE2: Each MAC address can have TLVs    */
-        u32 sizeoftlvs;        /* associated with it. sizeoftlvs tells the */
-                               /* the length of the tlvs array             */
-        struct sk_buff_head tx_wait; /* wait queue for outgoing packets    */
+        void (*old_push) (struct atm_vcc *vcc, struct sk_buff *skb);
+                                        /* Push that leads to daemon */
+
+        void (*old_recv_push) (struct atm_vcc *vcc, struct sk_buff *skb);
+                                        /* Push that leads to daemon */
+
+        unsigned long last_used;        /* For expiry */
+        unsigned long timestamp;        /* Used for various timestamping things:
+                                         * 1. FLUSH started
+                                         *    (status=ESI_FLUSH_PENDING)
+                                         * 2. Counting to
+                                         *    max_unknown_frame_time
+                                         *    (status=ESI_ARP_PENDING||
+                                         *     status=ESI_VC_PENDING)
+                                         */
+        unsigned char no_tries;         /* No of times arp retry has been tried */
+        unsigned char status;           /* Status of this entry */
+        unsigned short flags;           /* Flags for this entry */
+        unsigned short packets_flooded; /* Data packets flooded */
+        unsigned long flush_tran_id;    /* Transaction id in flush protocol */
+        struct timer_list timer;        /* Arping timer */
+        struct lec_priv *priv;          /* Pointer back */
+        u8 *tlvs;
+        u32 sizeoftlvs;                 /*
+                                         * LANE2: Each MAC address can have TLVs
+                                         * associated with it.  sizeoftlvs tells the
+                                         * the length of the tlvs array
+                                         */
+        struct sk_buff_head tx_wait;    /* wait queue for outgoing packets */
+        atomic_t usage;                 /* usage count */
 };
 
-struct tlv {                   /* LANE2: Template tlv struct for accessing */
-                               /* the tlvs in the lec_arp_table->tlvs array*/
-        u32 type;
-        u8  length;
-        u8  value[255];
+/*
+ * LANE2: Template tlv struct for accessing
+ * the tlvs in the lec_arp_table->tlvs array
+ */
+struct tlv {
+        u32 type;
+        u8 length;
+        u8 value[255];
 };
 
 /* Status fields */
-#define ESI_UNKNOWN 0       /*
-                             * Next packet sent to this mac address
-                             * causes ARP-request to be sent 
-                             */
-#define ESI_ARP_PENDING 1   /*
-                             * There is no ATM address associated with this
-                             * 48-bit address.  The LE-ARP protocol is in
-                             * progress.
-                             */
-#define ESI_VC_PENDING 2    /*
-                             * There is a valid ATM address associated with 
-                             * this 48-bit address but there is no VC set 
-                             * up to that ATM address.  The signaling 
-                             * protocol is in process.
-                             */
-#define ESI_FLUSH_PENDING 4 /*
-                             * The LEC has been notified of the FLUSH_START
-                             * status and it is assumed that the flush 
-                             * protocol is in process.
-                             */
-#define ESI_FORWARD_DIRECT 5 /*
-                              * Either the Path Switching Delay (C22) has 
-                              * elapsed or the LEC has notified the Mapping 
-                              * that the flush protocol has completed.  In 
-                              * either case, it is safe to forward packets 
-                              * to this address via the data direct VC.
-                              */
+#define ESI_UNKNOWN 0           /*
+                                 * Next packet sent to this mac address
+                                 * causes ARP-request to be sent
+                                 */
+#define ESI_ARP_PENDING 1       /*
+                                 * There is no ATM address associated with this
+                                 * 48-bit address.  The LE-ARP protocol is in
+                                 * progress.
+                                 */
+#define ESI_VC_PENDING 2        /*
+                                 * There is a valid ATM address associated with
+                                 * this 48-bit address but there is no VC set
+                                 * up to that ATM address.  The signaling
+                                 * protocol is in process.
+                                 */
+#define ESI_FLUSH_PENDING 4     /*
+                                 * The LEC has been notified of the FLUSH_START
+                                 * status and it is assumed that the flush
+                                 * protocol is in process.
+                                 */
+#define ESI_FORWARD_DIRECT 5    /*
+                                 * Either the Path Switching Delay (C22) has
+                                 * elapsed or the LEC has notified the Mapping
+                                 * that the flush protocol has completed.  In
+                                 * either case, it is safe to forward packets
+                                 * to this address via the data direct VC.
+                                 */
 
 /* Flag values */
 #define LEC_REMOTE_FLAG      0x0001
 #define LEC_PERMANENT_FLAG   0x0002
 
-#endif
+#endif /* _LEC_ARP_H_ */
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index b87c2a88bdce..0d2b994af511 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -560,7 +560,6 @@ static int atm_mpoa_vcc_attach(struct atm_vcc *vcc, void __user *arg)
         struct atmmpc_ioc ioc_data;
         in_cache_entry *in_entry;
         uint32_t  ipaddr;
-        unsigned char *ip;
 
         bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmmpc_ioc));
         if (bytes_left != 0) {
@@ -583,9 +582,8 @@ static int atm_mpoa_vcc_attach(struct atm_vcc *vcc, void __user *arg)
                         if (in_entry != NULL) mpc->in_ops->put(in_entry);
                         return -EINVAL;
                 }
-                ip = (unsigned char*)&in_entry->ctrl_info.in_dst_ip;
                 printk("mpoa: (%s) mpc_vcc_attach: attaching ingress SVC, entry = %u.%u.%u.%u\n",
-                       mpc->dev->name, ip[0], ip[1], ip[2], ip[3]);
+                       mpc->dev->name, NIPQUAD(in_entry->ctrl_info.in_dst_ip));
                 in_entry->shortcut = vcc;
                 mpc->in_ops->put(in_entry);
         } else {
@@ -616,10 +614,8 @@ static void mpc_vcc_close(struct atm_vcc *vcc, struct net_device *dev)
         dprintk("mpoa: (%s) mpc_vcc_close:\n", dev->name);
         in_entry = mpc->in_ops->get_by_vcc(vcc, mpc);
         if (in_entry) {
-                unsigned char *ip __attribute__ ((unused)) =
-                    (unsigned char *)&in_entry->ctrl_info.in_dst_ip;
                 dprintk("mpoa: (%s) mpc_vcc_close: ingress SVC closed ip = %u.%u.%u.%u\n",
-                       mpc->dev->name, ip[0], ip[1], ip[2], ip[3]);
+                       mpc->dev->name, NIPQUAD(in_entry->ctrl_info.in_dst_ip));
                 in_entry->shortcut = NULL;
                 mpc->in_ops->put(in_entry);
         }
@@ -1154,18 +1150,17 @@ static void ingress_purge_rcvd(struct k_message *msg, struct mpoa_client *mpc)
 {
         uint32_t dst_ip = msg->content.in_info.in_dst_ip;
         uint32_t mask = msg->ip_mask;
-        unsigned char *ip = (unsigned char *)&dst_ip;
         in_cache_entry *entry = mpc->in_ops->get_with_mask(dst_ip, mpc, mask);
 
         if(entry == NULL){
                 printk("mpoa: (%s) ingress_purge_rcvd: purge for a non-existing entry, ", mpc->dev->name);
-                printk("ip = %u.%u.%u.%u\n", ip[0], ip[1], ip[2], ip[3]);
+                printk("ip = %u.%u.%u.%u\n", NIPQUAD(dst_ip));
                 return;
         }
 
         do {
                 dprintk("mpoa: (%s) ingress_purge_rcvd: removing an ingress entry, ip = %u.%u.%u.%u\n" ,
-                        mpc->dev->name, ip[0], ip[1], ip[2], ip[3]);
+                        mpc->dev->name, NIPQUAD(dst_ip));
                 write_lock_bh(&mpc->ingress_lock);
                 mpc->in_ops->remove_entry(entry, mpc);
                 write_unlock_bh(&mpc->ingress_lock);
diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c
index 781ed1b9329d..fbf13cdcf46e 100644
--- a/net/atm/mpoa_caches.c
+++ b/net/atm/mpoa_caches.c
@@ -87,7 +87,6 @@ static in_cache_entry *in_cache_get_by_vcc(struct atm_vcc *vcc,
 static in_cache_entry *in_cache_add_entry(uint32_t dst_ip,
                                           struct mpoa_client *client)
 {
-        unsigned char *ip __attribute__ ((unused)) = (unsigned char *)&dst_ip;
         in_cache_entry* entry = kmalloc(sizeof(in_cache_entry), GFP_KERNEL);
 
         if (entry == NULL) {
@@ -95,7 +94,7 @@ static in_cache_entry *in_cache_add_entry(uint32_t dst_ip,
                 return NULL;
         }
 
-        dprintk("mpoa: mpoa_caches.c: adding an ingress entry, ip = %u.%u.%u.%u\n", ip[0], ip[1], ip[2], ip[3]);
+        dprintk("mpoa: mpoa_caches.c: adding an ingress entry, ip = %u.%u.%u.%u\n", NIPQUAD(dst_ip));
         memset(entry,0,sizeof(in_cache_entry));
 
         atomic_set(&entry->use, 1);
@@ -152,10 +151,7 @@ static int cache_hit(in_cache_entry *entry, struct mpoa_client *mpc)
 
         if( entry->count > mpc->parameters.mpc_p1 &&
             entry->entry_state == INGRESS_INVALID){
-                unsigned char *ip __attribute__ ((unused)) =
-                    (unsigned char *)&entry->ctrl_info.in_dst_ip;
-
-                dprintk("mpoa: (%s) mpoa_caches.c: threshold exceeded for ip %u.%u.%u.%u, sending MPOA res req\n", mpc->dev->name, ip[0], ip[1], ip[2], ip[3]);
+                dprintk("mpoa: (%s) mpoa_caches.c: threshold exceeded for ip %u.%u.%u.%u, sending MPOA res req\n", mpc->dev->name, NIPQUAD(entry->ctrl_info.in_dst_ip));
                 entry->entry_state = INGRESS_RESOLVING;
                 msg.type =  SND_MPOA_RES_RQST;
                 memcpy(msg.MPS_ctrl, mpc->mps_ctrl_addr, ATM_ESA_LEN );
@@ -187,11 +183,9 @@ static void in_cache_remove_entry(in_cache_entry *entry,
 {
         struct atm_vcc *vcc;
         struct k_message msg;
-        unsigned char *ip;
 
         vcc = entry->shortcut;
-        ip = (unsigned char *)&entry->ctrl_info.in_dst_ip;
-        dprintk("mpoa: mpoa_caches.c: removing an ingress entry, ip = %u.%u.%u.%u\n",ip[0], ip[1], ip[2], ip[3]);
+        dprintk("mpoa: mpoa_caches.c: removing an ingress entry, ip = %u.%u.%u.%u\n",NIPQUAD(entry->ctrl_info.in_dst_ip));
 
         if (entry->prev != NULL)
                 entry->prev->next = entry->next;
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 788ea7a2b744..67df99e2e5c8 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -48,41 +48,56 @@
 #define BT_DBG(D...)
 #endif
 
-#define VERSION "2.10"
+#define VERSION "2.11"
 
 /* Bluetooth sockets */
 #define BT_MAX_PROTO    8
 static struct net_proto_family *bt_proto[BT_MAX_PROTO];
+static DEFINE_RWLOCK(bt_proto_lock);
 
 int bt_sock_register(int proto, struct net_proto_family *ops)
 {
+        int err = 0;
+
         if (proto < 0 || proto >= BT_MAX_PROTO)
                 return -EINVAL;
 
+        write_lock(&bt_proto_lock);
+
         if (bt_proto[proto])
-                return -EEXIST;
+                err = -EEXIST;
+        else
+                bt_proto[proto] = ops;
 
-        bt_proto[proto] = ops;
-        return 0;
+        write_unlock(&bt_proto_lock);
+
+        return err;
 }
 EXPORT_SYMBOL(bt_sock_register);
 
 int bt_sock_unregister(int proto)
 {
+        int err = 0;
+
         if (proto < 0 || proto >= BT_MAX_PROTO)
                 return -EINVAL;
 
+        write_lock(&bt_proto_lock);
+
         if (!bt_proto[proto])
-                return -ENOENT;
+                err = -ENOENT;
+        else
+                bt_proto[proto] = NULL;
 
-        bt_proto[proto] = NULL;
-        return 0;
+        write_unlock(&bt_proto_lock);
+
+        return err;
 }
 EXPORT_SYMBOL(bt_sock_unregister);
 
 static int bt_sock_create(struct socket *sock, int proto)
 {
-        int err = 0;
+        int err;
 
         if (proto < 0 || proto >= BT_MAX_PROTO)
                 return -EINVAL;
@@ -92,11 +107,18 @@ static int bt_sock_create(struct socket *sock, int proto)
                 request_module("bt-proto-%d", proto);
         }
 #endif
+
         err = -EPROTONOSUPPORT;
+
+        read_lock(&bt_proto_lock);
+
         if (bt_proto[proto] && try_module_get(bt_proto[proto]->owner)) {
                 err = bt_proto[proto]->create(sock, proto);
                 module_put(bt_proto[proto]->owner);
         }
+
+        read_unlock(&bt_proto_lock);
+
         return err; 
 }
 
@@ -276,7 +298,7 @@ int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
                 set_current_state(TASK_INTERRUPTIBLE);
 
                 if (!timeo) {
-                        err = -EAGAIN;
+                        err = -EINPROGRESS;
                         break;
                 }
 
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index e620061fb50f..4d3424c2421c 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -51,6 +51,7 @@
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/l2cap.h>
 
 #include "bnep.h"
@@ -515,6 +516,24 @@ static int bnep_session(void *arg)
         return 0;
 }
 
+static struct device *bnep_get_device(struct bnep_session *session)
+{
+        bdaddr_t *src = &bt_sk(session->sock->sk)->src;
+        bdaddr_t *dst = &bt_sk(session->sock->sk)->dst;
+        struct hci_dev *hdev;
+        struct hci_conn *conn;
+
+        hdev = hci_get_route(dst, src);
+        if (!hdev)
+                return NULL;
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
+
+        hci_dev_put(hdev);
+
+        return conn ? &conn->dev : NULL;
+}
+
 int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
 {
         struct net_device *dev;
@@ -534,7 +553,6 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
         if (!dev)
                 return -ENOMEM;
 
-
         down_write(&bnep_session_sem);
 
         ss = __bnep_get_session(dst);
@@ -551,7 +569,7 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
         memcpy(s->eh.h_source, &dst, ETH_ALEN);
         memcpy(dev->dev_addr, s->eh.h_dest, ETH_ALEN);
 
-        s->dev = dev;
+        s->dev   = dev;
         s->sock  = sock;
         s->role  = req->role;
         s->state = BT_CONNECTED;
@@ -568,6 +586,8 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
         bnep_set_default_proto_filter(s);
 #endif
 
+        SET_NETDEV_DEV(dev, bnep_get_device(s));
+
         err = register_netdev(dev);
         if (err) {
                 goto failed;
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
index 28c55835422a..5563db1bf526 100644
--- a/net/bluetooth/bnep/sock.c
+++ b/net/bluetooth/bnep/sock.c
@@ -43,6 +43,7 @@
 #include <linux/ioctl.h>
 #include <linux/file.h>
 #include <linux/init.h>
+#include <linux/compat.h>
 #include <net/sock.h>
 
 #include <asm/system.h>
@@ -146,24 +147,56 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
         return 0;
 }
 
+#ifdef CONFIG_COMPAT
+static int bnep_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+        if (cmd == BNEPGETCONNLIST) {
+                struct bnep_connlist_req cl;
+                uint32_t uci;
+                int err;
+
+                if (get_user(cl.cnum, (uint32_t __user *) arg) ||
+                                get_user(uci, (u32 __user *) (arg + 4)))
+                        return -EFAULT;
+
+                cl.ci = compat_ptr(uci);
+
+                if (cl.cnum <= 0)
+                        return -EINVAL;
+        
+                err = bnep_get_connlist(&cl);
+
+                if (!err && put_user(cl.cnum, (uint32_t __user *) arg))
+                        err = -EFAULT;
+
+                return err;
+        }
+
+        return bnep_sock_ioctl(sock, cmd, arg);
+}
+#endif
+
 static const struct proto_ops bnep_sock_ops = {
-        .family     = PF_BLUETOOTH,
-        .owner      = THIS_MODULE,
-        .release    = bnep_sock_release,
-        .ioctl      = bnep_sock_ioctl,
-        .bind       = sock_no_bind,
-        .getname    = sock_no_getname,
-        .sendmsg    = sock_no_sendmsg,
-        .recvmsg    = sock_no_recvmsg,
-        .poll       = sock_no_poll,
-        .listen     = sock_no_listen,
-        .shutdown   = sock_no_shutdown,
-        .setsockopt = sock_no_setsockopt,
-        .getsockopt = sock_no_getsockopt,
-        .connect    = sock_no_connect,
-        .socketpair = sock_no_socketpair,
-        .accept     = sock_no_accept,
-        .mmap       = sock_no_mmap
+        .family         = PF_BLUETOOTH,
+        .owner          = THIS_MODULE,
+        .release        = bnep_sock_release,
+        .ioctl          = bnep_sock_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = bnep_sock_compat_ioctl,
+#endif
+        .bind           = sock_no_bind,
+        .getname        = sock_no_getname,
+        .sendmsg        = sock_no_sendmsg,
+        .recvmsg        = sock_no_recvmsg,
+        .poll           = sock_no_poll,
+        .listen         = sock_no_listen,
+        .shutdown       = sock_no_shutdown,
+        .setsockopt     = sock_no_setsockopt,
+        .getsockopt     = sock_no_getsockopt,
+        .connect        = sock_no_connect,
+        .socketpair     = sock_no_socketpair,
+        .accept         = sock_no_accept,
+        .mmap           = sock_no_mmap
 };
 
 static struct proto bnep_proto = {
@@ -181,7 +214,7 @@ static int bnep_sock_create(struct socket *sock, int protocol)
         if (sock->type != SOCK_RAW)
                 return -ESOCKTNOSUPPORT;
 
-        sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &bnep_proto, 1);
+        sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &bnep_proto, 1);
         if (!sk)
                 return -ENOMEM;
 
diff --git a/net/bluetooth/cmtp/sock.c b/net/bluetooth/cmtp/sock.c
index 10ad7fd91d83..53295d33dc5c 100644
--- a/net/bluetooth/cmtp/sock.c
+++ b/net/bluetooth/cmtp/sock.c
@@ -34,6 +34,7 @@
 #include <linux/socket.h>
 #include <linux/ioctl.h>
 #include <linux/file.h>
+#include <linux/compat.h>
 #include <net/sock.h>
 
 #include <linux/isdn/capilli.h>
@@ -137,11 +138,43 @@ static int cmtp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
         return -EINVAL;
 }
 
+#ifdef CONFIG_COMPAT
+static int cmtp_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+        if (cmd == CMTPGETCONNLIST) {
+                struct cmtp_connlist_req cl;
+                uint32_t uci;
+                int err;
+
+                if (get_user(cl.cnum, (uint32_t __user *) arg) ||
+                                get_user(uci, (u32 __user *) (arg + 4)))
+                        return -EFAULT;
+
+                cl.ci = compat_ptr(uci);
+
+                if (cl.cnum <= 0)
+                        return -EINVAL;
+        
+                err = cmtp_get_connlist(&cl);
+
+                if (!err && put_user(cl.cnum, (uint32_t __user *) arg))
+                        err = -EFAULT;
+
+                return err;
+        }
+
+        return cmtp_sock_ioctl(sock, cmd, arg);
+}
+#endif
+
 static const struct proto_ops cmtp_sock_ops = {
         .family         = PF_BLUETOOTH,
         .owner          = THIS_MODULE,
         .release        = cmtp_sock_release,
         .ioctl          = cmtp_sock_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = cmtp_sock_compat_ioctl,
+#endif
         .bind           = sock_no_bind,
         .getname        = sock_no_getname,
         .sendmsg        = sock_no_sendmsg,
@@ -172,7 +205,7 @@ static int cmtp_sock_create(struct socket *sock, int protocol)
         if (sock->type != SOCK_RAW)
                 return -ESOCKTNOSUPPORT;
 
-        sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &cmtp_proto, 1);
+        sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &cmtp_proto, 1);
         if (!sk)
                 return -ENOMEM;
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 420ed4d7e57e..6cd5711fa28a 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -51,7 +51,7 @@
 #define BT_DBG(D...)
 #endif
 
-static void hci_acl_connect(struct hci_conn *conn)
+void hci_acl_connect(struct hci_conn *conn)
 {
         struct hci_dev *hdev = conn->hdev;
         struct inquiry_entry *ie;
@@ -63,6 +63,8 @@ static void hci_acl_connect(struct hci_conn *conn)
         conn->out   = 1;
         conn->link_mode = HCI_LM_MASTER;
 
+        conn->attempt++;
+
         memset(&cp, 0, sizeof(cp));
         bacpy(&cp.bdaddr, &conn->dst);
         cp.pscan_rep_mode = 0x02;
@@ -80,10 +82,24 @@ static void hci_acl_connect(struct hci_conn *conn)
                 cp.role_switch  = 0x01;
         else
                 cp.role_switch  = 0x00;
-                
+
         hci_send_cmd(hdev, OGF_LINK_CTL, OCF_CREATE_CONN, sizeof(cp), &cp);
 }
 
+static void hci_acl_connect_cancel(struct hci_conn *conn)
+{
+        struct hci_cp_create_conn_cancel cp;
+
+        BT_DBG("%p", conn);
+
+        if (conn->hdev->hci_ver < 2)
+                return;
+
+        bacpy(&cp.bdaddr, &conn->dst);
+        hci_send_cmd(conn->hdev, OGF_LINK_CTL,
+                                OCF_CREATE_CONN_CANCEL, sizeof(cp), &cp);
+}
+
 void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
 {
         struct hci_cp_disconnect cp;
@@ -94,7 +110,8 @@ void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
 
         cp.handle = __cpu_to_le16(conn->handle);
         cp.reason = reason;
-        hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_DISCONNECT, sizeof(cp), &cp);
+        hci_send_cmd(conn->hdev, OGF_LINK_CTL,
+                                OCF_DISCONNECT, sizeof(cp), &cp);
 }
 
 void hci_add_sco(struct hci_conn *conn, __u16 handle)
@@ -124,12 +141,20 @@ static void hci_conn_timeout(unsigned long arg)
                 return;
 
         hci_dev_lock(hdev);
-        if (conn->state == BT_CONNECTED)
+
+        switch (conn->state) {
+        case BT_CONNECT:
+                hci_acl_connect_cancel(conn);
+                break;
+        case BT_CONNECTED:
                 hci_acl_disconn(conn, 0x13);
-        else
+                break;
+        default:
                 conn->state = BT_CLOSED;
+                break;
+        }
+
         hci_dev_unlock(hdev);
-        return;
 }
 
 static void hci_conn_idle(unsigned long arg)
@@ -179,6 +204,8 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         if (hdev->notify)
                 hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
 
+        hci_conn_add_sysfs(conn);
+
         tasklet_enable(&hdev->tx_task);
 
         return conn;
@@ -211,6 +238,8 @@ int hci_conn_del(struct hci_conn *conn)
 
         tasklet_disable(&hdev->tx_task);
 
+        hci_conn_del_sysfs(conn);
+
         hci_conn_hash_del(hdev, conn);
         if (hdev->notify)
                 hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
@@ -221,7 +250,9 @@ int hci_conn_del(struct hci_conn *conn)
 
         hci_dev_put(hdev);
 
-        kfree(conn);
+        /* will free via device release */
+        put_device(&conn->dev);
+
         return 0;
 }
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 5ed474277903..338ae977a31b 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -206,6 +206,9 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
         /* Read Local Supported Features */
         hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_LOCAL_FEATURES, 0, NULL);
 
+        /* Read Local Version */
+        hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_LOCAL_VERSION, 0, NULL);
+
         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
         hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BUFFER_SIZE, 0, NULL);
 
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 3896dabab11d..65f094845719 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -62,6 +62,7 @@ static void hci_cc_link_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb
 
         switch (ocf) {
         case OCF_INQUIRY_CANCEL:
+        case OCF_EXIT_PERIODIC_INQ:
                 status = *((__u8 *) skb->data);
 
                 if (status) {
@@ -297,6 +298,7 @@ static void hci_cc_host_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb
 /* Command Complete OGF INFO_PARAM  */
 static void hci_cc_info_param(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
 {
+        struct hci_rp_read_loc_version *lv;
         struct hci_rp_read_local_features *lf;
         struct hci_rp_read_buffer_size *bs;
         struct hci_rp_read_bd_addr *ba;
@@ -304,6 +306,23 @@ static void hci_cc_info_param(struct hci_dev *hdev, __u16 ocf, struct sk_buff *s
         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
 
         switch (ocf) {
+        case OCF_READ_LOCAL_VERSION:
+                lv = (struct hci_rp_read_loc_version *) skb->data;
+
+                if (lv->status) {
+                        BT_DBG("%s READ_LOCAL_VERSION failed %d", hdev->name, lf->status);
+                        break;
+                }
+
+                hdev->hci_ver = lv->hci_ver;
+                hdev->hci_rev = btohs(lv->hci_rev);
+                hdev->manufacturer = btohs(lv->manufacturer);
+
+                BT_DBG("%s: manufacturer %d hci_ver %d hci_rev %d", hdev->name,
+                                hdev->manufacturer, hdev->hci_ver, hdev->hci_rev);
+
+                break;
+
         case OCF_READ_LOCAL_FEATURES:
                 lf = (struct hci_rp_read_local_features *) skb->data;
 
@@ -328,7 +347,8 @@ static void hci_cc_info_param(struct hci_dev *hdev, __u16 ocf, struct sk_buff *s
                 if (hdev->features[1] & LMP_HV3)
                         hdev->pkt_type |= (HCI_HV3);
 
-                BT_DBG("%s: features 0x%x 0x%x 0x%x", hdev->name, lf->features[0], lf->features[1], lf->features[2]);
+                BT_DBG("%s: features 0x%x 0x%x 0x%x", hdev->name,
+                                lf->features[0], lf->features[1], lf->features[2]);
 
                 break;
 
@@ -394,9 +414,12 @@ static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
 
         if (status) {
                 if (conn && conn->state == BT_CONNECT) {
-                        conn->state = BT_CLOSED;
-                        hci_proto_connect_cfm(conn, status);
-                        hci_conn_del(conn);
+                        if (status != 0x0c || conn->attempt > 2) {
+                                conn->state = BT_CLOSED;
+                                hci_proto_connect_cfm(conn, status);
+                                hci_conn_del(conn);
+                        } else
+                                conn->state = BT_CONNECT2;
                 }
         } else {
                 if (!conn) {
@@ -708,7 +731,7 @@ static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *sk
 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_conn_complete *ev = (struct hci_ev_conn_complete *) skb->data;
-        struct hci_conn *conn;
+        struct hci_conn *conn, *pend;
 
         BT_DBG("%s", hdev->name);
 
@@ -757,6 +780,10 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
 
                         hci_send_cmd(hdev, OGF_LINK_CTL,
                                 OCF_CHANGE_CONN_PTYPE, sizeof(cp), &cp);
+                } else {
+                        /* Update disconnect timer */
+                        hci_conn_hold(conn);
+                        hci_conn_put(conn);
                 }
         } else
                 conn->state = BT_CLOSED;
@@ -777,6 +804,10 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
         if (ev->status)
                 hci_conn_del(conn);
 
+        pend = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
+        if (pend)
+                hci_acl_connect(pend);
+
         hci_dev_unlock(hdev);
 }
 
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 1a35d343e08a..f26a9eb49945 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -618,7 +618,7 @@ static int hci_sock_create(struct socket *sock, int protocol)
 
         sock->ops = &hci_sock_ops;
 
-        sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &hci_sk_proto, 1);
+        sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto, 1);
         if (!sk)
                 return -ENOMEM;
 
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 3987d167f04e..954eb74eb370 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -13,16 +13,32 @@
 #define BT_DBG(D...)
 #endif
 
-static ssize_t show_name(struct device *dev, struct device_attribute *attr, char *buf)
+static inline char *typetostr(int type)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
-        return sprintf(buf, "%s\n", hdev->name);
+        switch (type) {
+        case HCI_VIRTUAL:
+                return "VIRTUAL";
+        case HCI_USB:
+                return "USB";
+        case HCI_PCCARD:
+                return "PCCARD";
+        case HCI_UART:
+                return "UART";
+        case HCI_RS232:
+                return "RS232";
+        case HCI_PCI:
+                return "PCI";
+        case HCI_SDIO:
+                return "SDIO";
+        default:
+                return "UNKNOWN";
+        }
 }
 
 static ssize_t show_type(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
-        return sprintf(buf, "%d\n", hdev->type);
+        return sprintf(buf, "%s\n", typetostr(hdev->type));
 }
 
 static ssize_t show_address(struct device *dev, struct device_attribute *attr, char *buf)
@@ -33,10 +49,22 @@ static ssize_t show_address(struct device *dev, struct device_attribute *attr, c
         return sprintf(buf, "%s\n", batostr(&bdaddr));
 }
 
-static ssize_t show_flags(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_manufacturer(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
-        return sprintf(buf, "0x%lx\n", hdev->flags);
+        return sprintf(buf, "%d\n", hdev->manufacturer);
+}
+
+static ssize_t show_hci_version(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct hci_dev *hdev = dev_get_drvdata(dev);
+        return sprintf(buf, "%d\n", hdev->hci_ver);
+}
+
+static ssize_t show_hci_revision(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct hci_dev *hdev = dev_get_drvdata(dev);
+        return sprintf(buf, "%d\n", hdev->hci_rev);
 }
 
 static ssize_t show_inquiry_cache(struct device *dev, struct device_attribute *attr, char *buf)
@@ -141,10 +169,11 @@ static ssize_t store_sniff_min_interval(struct device *dev, struct device_attrib
         return count;
 }
 
-static DEVICE_ATTR(name, S_IRUGO, show_name, NULL);
 static DEVICE_ATTR(type, S_IRUGO, show_type, NULL);
 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
-static DEVICE_ATTR(flags, S_IRUGO, show_flags, NULL);
+static DEVICE_ATTR(manufacturer, S_IRUGO, show_manufacturer, NULL);
+static DEVICE_ATTR(hci_version, S_IRUGO, show_hci_version, NULL);
+static DEVICE_ATTR(hci_revision, S_IRUGO, show_hci_revision, NULL);
 static DEVICE_ATTR(inquiry_cache, S_IRUGO, show_inquiry_cache, NULL);
 
 static DEVICE_ATTR(idle_timeout, S_IRUGO | S_IWUSR,
@@ -155,10 +184,11 @@ static DEVICE_ATTR(sniff_min_interval, S_IRUGO | S_IWUSR,
                                 show_sniff_min_interval, store_sniff_min_interval);
 
 static struct device_attribute *bt_attrs[] = {
-        &dev_attr_name,
         &dev_attr_type,
         &dev_attr_address,
-        &dev_attr_flags,
+        &dev_attr_manufacturer,
+        &dev_attr_hci_version,
+        &dev_attr_hci_revision,
         &dev_attr_inquiry_cache,
         &dev_attr_idle_timeout,
         &dev_attr_sniff_max_interval,
@@ -166,6 +196,32 @@ static struct device_attribute *bt_attrs[] = {
         NULL
 };
 
+static ssize_t show_conn_type(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct hci_conn *conn = dev_get_drvdata(dev);
+        return sprintf(buf, "%s\n", conn->type == ACL_LINK ? "ACL" : "SCO");
+}
+
+static ssize_t show_conn_address(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct hci_conn *conn = dev_get_drvdata(dev);
+        bdaddr_t bdaddr;
+        baswap(&bdaddr, &conn->dst);
+        return sprintf(buf, "%s\n", batostr(&bdaddr));
+}
+
+#define CONN_ATTR(_name,_mode,_show,_store) \
+struct device_attribute conn_attr_##_name = __ATTR(_name,_mode,_show,_store)
+
+static CONN_ATTR(type, S_IRUGO, show_conn_type, NULL);
+static CONN_ATTR(address, S_IRUGO, show_conn_address, NULL);
+
+static struct device_attribute *conn_attrs[] = {
+        &conn_attr_type,
+        &conn_attr_address,
+        NULL
+};
+
 struct class *bt_class = NULL;
 EXPORT_SYMBOL_GPL(bt_class);
 
@@ -177,8 +233,61 @@ static struct platform_device *bt_platform;
 
 static void bt_release(struct device *dev)
 {
-        struct hci_dev *hdev = dev_get_drvdata(dev);
-        kfree(hdev);
+        void *data = dev_get_drvdata(dev);
+        kfree(data);
+}
+
+static void add_conn(void *data)
+{
+        struct hci_conn *conn = data;
+        int i;
+
+        if (device_register(&conn->dev) < 0) {
+                BT_ERR("Failed to register connection device");
+                return;
+        }
+
+        for (i = 0; conn_attrs[i]; i++)
+                if (device_create_file(&conn->dev, conn_attrs[i]) < 0)
+                        BT_ERR("Failed to create connection attribute");
+}
+
+void hci_conn_add_sysfs(struct hci_conn *conn)
+{
+        struct hci_dev *hdev = conn->hdev;
+        bdaddr_t *ba = &conn->dst;
+
+        BT_DBG("conn %p", conn);
+
+        conn->dev.parent  = &hdev->dev;
+        conn->dev.release = bt_release;
+
+        snprintf(conn->dev.bus_id, BUS_ID_SIZE,
+                        "%s%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X",
+                        conn->type == ACL_LINK ? "acl" : "sco",
+                        ba->b[5], ba->b[4], ba->b[3],
+                        ba->b[2], ba->b[1], ba->b[0]);
+
+        dev_set_drvdata(&conn->dev, conn);
+
+        INIT_WORK(&conn->work, add_conn, (void *) conn);
+
+        schedule_work(&conn->work);
+}
+
+static void del_conn(void *data)
+{
+        struct hci_conn *conn = data;
+        device_del(&conn->dev);
+}
+
+void hci_conn_del_sysfs(struct hci_conn *conn)
+{
+        BT_DBG("conn %p", conn);
+
+        INIT_WORK(&conn->work, del_conn, (void *) conn);
+
+        schedule_work(&conn->work);
 }
 
 int hci_register_sysfs(struct hci_dev *hdev)
@@ -190,11 +299,7 @@ int hci_register_sysfs(struct hci_dev *hdev)
         BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
 
         dev->class = bt_class;
-
-        if (hdev->parent)
-                dev->parent = hdev->parent;
-        else
-                dev->parent = &bt_platform->dev;
+        dev->parent = hdev->parent;
 
         strlcpy(dev->bus_id, hdev->name, BUS_ID_SIZE);
 
@@ -207,18 +312,17 @@ int hci_register_sysfs(struct hci_dev *hdev)
                 return err;
 
         for (i = 0; bt_attrs[i]; i++)
-                device_create_file(dev, bt_attrs[i]);
+                if (device_create_file(dev, bt_attrs[i]) < 0)
+                        BT_ERR("Failed to create device attribute");
 
         return 0;
 }
 
 void hci_unregister_sysfs(struct hci_dev *hdev)
 {
-        struct device *dev = &hdev->dev;
-
         BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
 
-        device_del(dev);
+        device_del(&hdev->dev);
 }
 
 int __init bt_sysfs_init(void)
@@ -245,7 +349,7 @@ int __init bt_sysfs_init(void)
         return 0;
 }
 
-void __exit bt_sysfs_cleanup(void)
+void bt_sysfs_cleanup(void)
 {
         class_destroy(bt_class);
 
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index c6e3a2c27c6e..66782010f82c 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -40,6 +40,7 @@
 #include <linux/input.h>
 
 #include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/l2cap.h>
 
 #include "hidp.h"
@@ -506,14 +507,12 @@ static int hidp_session(void *arg)
 
         hidp_del_timer(session);
 
-        if (intr_sk->sk_state != BT_CONNECTED)
-                wait_event_timeout(*(ctrl_sk->sk_sleep), (ctrl_sk->sk_state == BT_CLOSED), HZ);
-
-        fput(session->ctrl_sock->file);
+        fput(session->intr_sock->file);
 
-        wait_event_timeout(*(intr_sk->sk_sleep), (intr_sk->sk_state == BT_CLOSED), HZ);
+        wait_event_timeout(*(ctrl_sk->sk_sleep),
+                (ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500));
 
-        fput(session->intr_sock->file);
+        fput(session->ctrl_sock->file);
 
         __hidp_unlink_session(session);
 
@@ -528,6 +527,24 @@ static int hidp_session(void *arg)
         return 0;
 }
 
+static struct device *hidp_get_device(struct hidp_session *session)
+{
+        bdaddr_t *src = &bt_sk(session->ctrl_sock->sk)->src;
+        bdaddr_t *dst = &bt_sk(session->ctrl_sock->sk)->dst;
+        struct hci_dev *hdev;
+        struct hci_conn *conn;
+
+        hdev = hci_get_route(dst, src);
+        if (!hdev)
+                return NULL;
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
+
+        hci_dev_put(hdev);
+
+        return conn ? &conn->dev : NULL;
+}
+
 static inline void hidp_setup_input(struct hidp_session *session, struct hidp_connadd_req *req)
 {
         struct input_dev *input = session->input;
@@ -566,6 +583,8 @@ static inline void hidp_setup_input(struct hidp_session *session, struct hidp_co
                 input->relbit[0] |= BIT(REL_WHEEL);
         }
 
+        input->cdev.dev = hidp_get_device(session);
+
         input->event = hidp_input_event;
 
         input_register_device(input);
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 099646e4e2ef..407fba43c1b9 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -35,6 +35,7 @@
 #include <linux/ioctl.h>
 #include <linux/file.h>
 #include <linux/init.h>
+#include <linux/compat.h>
 #include <net/sock.h>
 
 #include "hidp.h"
@@ -143,11 +144,88 @@ static int hidp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
         return -EINVAL;
 }
 
+#ifdef CONFIG_COMPAT
+struct compat_hidp_connadd_req {
+        int   ctrl_sock;        // Connected control socket
+        int   intr_sock;        // Connteted interrupt socket
+        __u16 parser;
+        __u16 rd_size;
+        compat_uptr_t rd_data;
+        __u8  country;
+        __u8  subclass;
+        __u16 vendor;
+        __u16 product;
+        __u16 version;
+        __u32 flags;
+        __u32 idle_to;
+        char  name[128];
+};
+
+static int hidp_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+        if (cmd == HIDPGETCONNLIST) {
+                struct hidp_connlist_req cl;
+                uint32_t uci;
+                int err;
+
+                if (get_user(cl.cnum, (uint32_t __user *) arg) ||
+                                get_user(uci, (u32 __user *) (arg + 4)))
+                        return -EFAULT;
+
+                cl.ci = compat_ptr(uci);
+
+                if (cl.cnum <= 0)
+                        return -EINVAL;
+
+                err = hidp_get_connlist(&cl);
+
+                if (!err && put_user(cl.cnum, (uint32_t __user *) arg))
+                        err = -EFAULT;
+
+                return err;
+        } else if (cmd == HIDPCONNADD) {
+                struct compat_hidp_connadd_req ca;
+                struct hidp_connadd_req __user *uca;
+
+                uca = compat_alloc_user_space(sizeof(*uca));
+
+                if (copy_from_user(&ca, (void *) arg, sizeof(ca)))
+                        return -EFAULT;
+
+                if (put_user(ca.ctrl_sock, &uca->ctrl_sock) ||
+                                put_user(ca.intr_sock, &uca->intr_sock) ||
+                                put_user(ca.parser, &uca->parser) ||
+                                put_user(ca.rd_size, &uca->parser) ||
+                                put_user(compat_ptr(ca.rd_data), &uca->rd_data) ||
+                                put_user(ca.country, &uca->country) ||
+                                put_user(ca.subclass, &uca->subclass) ||
+                                put_user(ca.vendor, &uca->vendor) ||
+                                put_user(ca.product, &uca->product) ||
+                                put_user(ca.version, &uca->version) ||
+                                put_user(ca.flags, &uca->flags) ||
+                                put_user(ca.idle_to, &uca->idle_to) ||
+                                copy_to_user(&uca->name[0], &ca.name[0], 128))
+                        return -EFAULT;
+                
+                arg = (unsigned long) uca;
+
+                /* Fall through. We don't actually write back any _changes_
+                   to the structure anyway, so there's no need to copy back
+                   into the original compat version */
+        }
+
+        return hidp_sock_ioctl(sock, cmd, arg);
+}
+#endif
+
 static const struct proto_ops hidp_sock_ops = {
         .family         = PF_BLUETOOTH,
         .owner          = THIS_MODULE,
         .release        = hidp_sock_release,
         .ioctl          = hidp_sock_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = hidp_sock_compat_ioctl,
+#endif
         .bind           = sock_no_bind,
         .getname        = sock_no_getname,
         .sendmsg        = sock_no_sendmsg,
@@ -178,7 +256,7 @@ static int hidp_sock_create(struct socket *sock, int protocol)
         if (sock->type != SOCK_RAW)
                 return -ESOCKTNOSUPPORT;
 
-        sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &hidp_proto, 1);
+        sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &hidp_proto, 1);
         if (!sk)
                 return -ENOMEM;
 
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index d56f60b392ac..2b3dcb8f90fa 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -559,7 +559,7 @@ static int l2cap_sock_create(struct socket *sock, int protocol)
 
         sock->ops = &l2cap_sock_ops;
 
-        sk = l2cap_sock_alloc(sock, protocol, GFP_KERNEL);
+        sk = l2cap_sock_alloc(sock, protocol, GFP_ATOMIC);
         if (!sk)
                 return -ENOMEM;
 
@@ -2216,7 +2216,8 @@ static int __init l2cap_init(void)
                 goto error;
         }
 
-        class_create_file(bt_class, &class_attr_l2cap);
+        if (class_create_file(bt_class, &class_attr_l2cap) < 0)
+                BT_ERR("Failed to create L2CAP info file");
 
         BT_INFO("L2CAP ver %s", VERSION);
         BT_INFO("L2CAP socket layer initialized");
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 332dd8f436ea..ddc4e9d5963e 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -644,7 +644,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = htobs(RFCOMM_PSM);
         *err = sock->ops->connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
-        if (*err == 0 || *err == -EAGAIN)
+        if (*err == 0 || *err == -EINPROGRESS)
                 return s;
 
         rfcomm_session_del(s);
@@ -2058,7 +2058,8 @@ static int __init rfcomm_init(void)
 
         kernel_thread(rfcomm_run, NULL, CLONE_KERNEL);
 
-        class_create_file(bt_class, &class_attr_rfcomm_dlc);
+        if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
+                BT_ERR("Failed to create RFCOMM info file");
 
         rfcomm_init_sockets();
 
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 220fee04e7f2..544d65b7baa7 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -336,7 +336,8 @@ static int rfcomm_sock_create(struct socket *sock, int protocol)
 
         sock->ops = &rfcomm_sock_ops;
 
-        if (!(sk = rfcomm_sock_alloc(sock, protocol, GFP_KERNEL)))
+        sk = rfcomm_sock_alloc(sock, protocol, GFP_ATOMIC);
+        if (!sk)
                 return -ENOMEM;
 
         rfcomm_sock_init(sk, NULL);
@@ -944,7 +945,8 @@ int __init rfcomm_init_sockets(void)
         if (err < 0)
                 goto error;
 
-        class_create_file(bt_class, &class_attr_rfcomm);
+        if (class_create_file(bt_class, &class_attr_rfcomm) < 0)
+                BT_ERR("Failed to create RFCOMM info file");
 
         BT_INFO("RFCOMM socket layer initialized");
 
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index bd8d671a0ba6..b8e3a5f1c8a8 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -38,6 +38,7 @@
 #include <linux/skbuff.h>
 
 #include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/rfcomm.h>
 
 #ifndef CONFIG_BT_RFCOMM_DEBUG
@@ -161,6 +162,22 @@ static inline struct rfcomm_dev *rfcomm_dev_get(int id)
         return dev;
 }
 
+static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
+{
+        struct hci_dev *hdev;
+        struct hci_conn *conn;
+
+        hdev = hci_get_route(&dev->dst, &dev->src);
+        if (!hdev)
+                return NULL;
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
+
+        hci_dev_put(hdev);
+
+        return conn ? &conn->dev : NULL;
+}
+
 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 {
         struct rfcomm_dev *dev;
@@ -244,7 +261,7 @@ out:
                 return err;
         }
 
-        tty_register_device(rfcomm_tty_driver, dev->id, NULL);
+        tty_register_device(rfcomm_tty_driver, dev->id, rfcomm_get_device(dev));
 
         return dev->id;
 }
@@ -748,6 +765,9 @@ static void rfcomm_tty_set_termios(struct tty_struct *tty, struct termios *old)
 
         BT_DBG("tty %p termios %p", tty, old);
 
+        if (!dev)
+                return;
+
         /* Handle turning off CRTSCTS */
         if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS)) 
                 BT_DBG("Turning off CRTSCTS unsupported");
@@ -992,7 +1012,7 @@ static int rfcomm_tty_tiocmset(struct tty_struct *tty, struct file *filp, unsign
 
 /* ---- TTY structure ---- */
 
-static struct tty_operations rfcomm_ops = {
+static const struct tty_operations rfcomm_ops = {
         .open                   = rfcomm_tty_open,
         .close                  = rfcomm_tty_close,
         .write                  = rfcomm_tty_write,
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 7714a2ec3854..5d13d4f31753 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -452,7 +452,8 @@ static int sco_sock_create(struct socket *sock, int protocol)
 
         sock->ops = &sco_sock_ops;
 
-        if (!(sk = sco_sock_alloc(sock, protocol, GFP_KERNEL)))
+        sk = sco_sock_alloc(sock, protocol, GFP_ATOMIC);
+        if (!sk)
                 return -ENOMEM;
 
         sco_sock_init(sk, NULL);
@@ -967,7 +968,8 @@ static int __init sco_init(void)
                 goto error;
         }
 
-        class_create_file(bt_class, &class_attr_sco);
+        if (class_create_file(bt_class, &class_attr_sco) < 0)
+                BT_ERR("Failed to create SCO info file");
 
         BT_INFO("SCO (Voice Link) ver %s", VERSION);
         BT_INFO("SCO socket layer initialized");
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 3a73b8c94271..d9f04864d15d 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -128,7 +128,10 @@ void br_fdb_cleanup(unsigned long _data)
         mod_timer(&br->gc_timer, jiffies + HZ/10);
 }
 
-void br_fdb_delete_by_port(struct net_bridge *br, struct net_bridge_port *p)
+
+void br_fdb_delete_by_port(struct net_bridge *br,
+                           const struct net_bridge_port *p,
+                           int do_all)
 {
         int i;
 
@@ -142,6 +145,8 @@ void br_fdb_delete_by_port(struct net_bridge *br, struct net_bridge_port *p)
                         if (f->dst != p) 
                                 continue;
 
+                        if (f->is_static && !do_all)
+                                continue;
                         /*
                          * if multiple ports all have the same device address
                          * then when one port is deleted, assign
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index b1211d5342f6..f753c40c11d2 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -163,7 +163,7 @@ static void del_nbp(struct net_bridge_port *p)
         br_stp_disable_port(p);
         spin_unlock_bh(&br->lock);
 
-        br_fdb_delete_by_port(br, p);
+        br_fdb_delete_by_port(br, p, 1);
 
         list_del_rcu(&p->list);
 
@@ -448,7 +448,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 
         return 0;
 err2:
-        br_fdb_delete_by_port(br, p);
+        br_fdb_delete_by_port(br, p, 1);
 err1:
         kobject_del(&p->kobj);
 err0:
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index c491fb2f280e..74258d86f256 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -143,7 +143,7 @@ extern void br_fdb_changeaddr(struct net_bridge_port *p,
                               const unsigned char *newaddr);
 extern void br_fdb_cleanup(unsigned long arg);
 extern void br_fdb_delete_by_port(struct net_bridge *br,
-                           struct net_bridge_port *p);
+                                  const struct net_bridge_port *p, int do_all);
 extern struct net_bridge_fdb_entry *__br_fdb_get(struct net_bridge *br,
                                                  const unsigned char *addr);
 extern struct net_bridge_fdb_entry *br_fdb_get(struct net_bridge *br,
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 14cd025079af..d294224592db 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -113,6 +113,8 @@ void br_stp_disable_port(struct net_bridge_port *p)
         del_timer(&p->forward_delay_timer);
         del_timer(&p->hold_timer);
 
+        br_fdb_delete_by_port(br, p, 0);
+
         br_configuration_update(br);
 
         br_port_state_selection(br);
diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c
index d19fc4b328dc..0aa7b9910a86 100644
--- a/net/bridge/netfilter/ebt_arpreply.c
+++ b/net/bridge/netfilter/ebt_arpreply.c
@@ -20,7 +20,7 @@ static int ebt_target_reply(struct sk_buff **pskb, unsigned int hooknr,
    const void *data, unsigned int datalen)
 {
         struct ebt_arpreply_info *info = (struct ebt_arpreply_info *)data;
-        u32 _sip, *siptr, _dip, *diptr;
+        __be32 _sip, *siptr, _dip, *diptr;
         struct arphdr _ah, *ap;
         unsigned char _sha[ETH_ALEN], *shp;
         struct sk_buff *skb = *pskb;
diff --git a/net/bridge/netfilter/ebt_mark.c b/net/bridge/netfilter/ebt_mark.c
index 770c0df972a3..b54306a934e5 100644
--- a/net/bridge/netfilter/ebt_mark.c
+++ b/net/bridge/netfilter/ebt_mark.c
@@ -22,24 +22,37 @@ static int ebt_target_mark(struct sk_buff **pskb, unsigned int hooknr,
    const void *data, unsigned int datalen)
 {
         struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
+        int action = info->target & -16;
 
-        if ((*pskb)->nfmark != info->mark)
+        if (action == MARK_SET_VALUE)
                 (*pskb)->nfmark = info->mark;
+        else if (action == MARK_OR_VALUE)
+                (*pskb)->nfmark |= info->mark;
+        else if (action == MARK_AND_VALUE)
+                (*pskb)->nfmark &= info->mark;
+        else
+                (*pskb)->nfmark ^= info->mark;
 
-        return info->target;
+        return info->target | -16;
 }
 
 static int ebt_target_mark_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
         struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
+        int tmp;
 
         if (datalen != EBT_ALIGN(sizeof(struct ebt_mark_t_info)))
                 return -EINVAL;
-        if (BASE_CHAIN && info->target == EBT_RETURN)
+        tmp = info->target | -16;
+        if (BASE_CHAIN && tmp == EBT_RETURN)
                 return -EINVAL;
         CLEAR_BASE_CHAIN_BIT;
-        if (INVALID_TARGET)
+        if (tmp < -NUM_STANDARD_TARGETS || tmp >= 0)
+                return -EINVAL;
+        tmp = info->target & -16;
+        if (tmp != MARK_SET_VALUE && tmp != MARK_OR_VALUE &&
+            tmp != MARK_AND_VALUE && tmp != MARK_XOR_VALUE)
                 return -EINVAL;
         return 0;
 }
diff --git a/net/compat.c b/net/compat.c
index d5d69fa15d07..52d32f1bc728 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -285,8 +285,7 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
 
         if (i > 0) {
                 int cmlen = CMSG_COMPAT_LEN(i * sizeof(int));
-                if (!err)
-                        err = put_user(SOL_SOCKET, &cm->cmsg_level);
+                err = put_user(SOL_SOCKET, &cm->cmsg_level);
                 if (!err)
                         err = put_user(SCM_RIGHTS, &cm->cmsg_type);
                 if (!err)
diff --git a/net/core/dev.c b/net/core/dev.c
index 14de297d024d..81c426adcd1e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1480,14 +1480,16 @@ gso:
         if (q->enqueue) {
                 /* Grab device queue */
                 spin_lock(&dev->queue_lock);
+                q = dev->qdisc;
+                if (q->enqueue) {
+                        rc = q->enqueue(skb, q);
+                        qdisc_run(dev);
+                        spin_unlock(&dev->queue_lock);
 
-                rc = q->enqueue(skb, q);
-
-                qdisc_run(dev);
-
+                        rc = rc == NET_XMIT_BYPASS ? NET_XMIT_SUCCESS : rc;
+                        goto out;
+                }
                 spin_unlock(&dev->queue_lock);
-                rc = rc == NET_XMIT_BYPASS ? NET_XMIT_SUCCESS : rc;
-                goto out;
         }
 
         /* The device has no queue. Common case for software devices:
@@ -3500,8 +3502,6 @@ static int __init net_dev_init(void)
 
         BUG_ON(!dev_boot_phase);
 
-        net_random_init();
-
         if (dev_proc_init())
                 goto out;
 
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index e0ca04f38cef..87dc556fd9d6 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -806,13 +806,6 @@ int dev_ethtool(struct ifreq *ifr)
         int rc;
         unsigned long old_features;
 
-        /*
-         * XXX: This can be pushed down into the ethtool_* handlers that
-         * need it.  Keep existing behaviour for the moment.
-         */
-        if (!capable(CAP_NET_ADMIN))
-                return -EPERM;
-
         if (!dev || !netif_device_present(dev))
                 return -ENODEV;
 
@@ -822,6 +815,27 @@ int dev_ethtool(struct ifreq *ifr)
         if (copy_from_user(&ethcmd, useraddr, sizeof (ethcmd)))
                 return -EFAULT;
 
+        /* Allow some commands to be done by anyone */
+        switch(ethcmd) {
+        case ETHTOOL_GDRVINFO:
+        case ETHTOOL_GMSGLVL:
+        case ETHTOOL_GCOALESCE:
+        case ETHTOOL_GRINGPARAM:
+        case ETHTOOL_GPAUSEPARAM:
+        case ETHTOOL_GRXCSUM:
+        case ETHTOOL_GTXCSUM:
+        case ETHTOOL_GSG:
+        case ETHTOOL_GSTRINGS:
+        case ETHTOOL_GTSO:
+        case ETHTOOL_GPERMADDR:
+        case ETHTOOL_GUFO:
+        case ETHTOOL_GGSO:
+                break;
+        default:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
+        }
+
         if(dev->ethtool_ops->begin)
                 if ((rc = dev->ethtool_ops->begin(dev)) < 0)
                         return rc;
@@ -947,6 +961,10 @@ int dev_ethtool(struct ifreq *ifr)
         return rc;
 
  ioctl:
+        /* Keep existing behaviour for the moment.       */
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
         if (dev->do_ioctl)
                 return dev->do_ioctl(dev, ifr, SIOCETHTOOL);
         return -EOPNOTSUPP;
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index a99d87d82b7f..6b0e63cacd93 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -8,7 +8,6 @@
  * Authors:     Thomas Graf <tgraf@suug.ch>
  */
 
-#include <linux/config.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
diff --git a/net/core/flow.c b/net/core/flow.c
index f23e7e386543..b16d31ae5e54 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -85,6 +85,14 @@ static void flow_cache_new_hashrnd(unsigned long arg)
         add_timer(&flow_hash_rnd_timer);
 }
 
+static void flow_entry_kill(int cpu, struct flow_cache_entry *fle)
+{
+        if (fle->object)
+                atomic_dec(fle->object_ref);
+        kmem_cache_free(flow_cachep, fle);
+        flow_count(cpu)--;
+}
+
 static void __flow_cache_shrink(int cpu, int shrink_to)
 {
         struct flow_cache_entry *fle, **flp;
@@ -100,10 +108,7 @@ static void __flow_cache_shrink(int cpu, int shrink_to)
                 }
                 while ((fle = *flp) != NULL) {
                         *flp = fle->next;
-                        if (fle->object)
-                                atomic_dec(fle->object_ref);
-                        kmem_cache_free(flow_cachep, fle);
-                        flow_count(cpu)--;
+                        flow_entry_kill(cpu, fle);
                 }
         }
 }
@@ -220,24 +225,33 @@ void *flow_cache_lookup(struct flowi *key, u16 family, u8 dir,
 
 nocache:
         {
+                int err;
                 void *obj;
                 atomic_t *obj_ref;
 
-                resolver(key, family, dir, &obj, &obj_ref);
+                err = resolver(key, family, dir, &obj, &obj_ref);
 
                 if (fle) {
-                        fle->genid = atomic_read(&flow_cache_genid);
-
-                        if (fle->object)
-                                atomic_dec(fle->object_ref);
-
-                        fle->object = obj;
-                        fle->object_ref = obj_ref;
-                        if (obj)
-                                atomic_inc(fle->object_ref);
+                        if (err) {
+                                /* Force security policy check on next lookup */
+                                *head = fle->next;
+                                flow_entry_kill(cpu, fle);
+                        } else {
+                                fle->genid = atomic_read(&flow_cache_genid);
+
+                                if (fle->object)
+                                        atomic_dec(fle->object_ref);
+
+                                fle->object = obj;
+                                fle->object_ref = obj_ref;
+                                if (obj)
+                                        atomic_inc(fle->object_ref);
+                        }
                 }
                 local_bh_enable();
 
+                if (err)
+                        obj = ERR_PTR(err);
                 return obj;
         }
 }
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index b6c69e1463e8..b4b478353b27 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -344,12 +344,12 @@ struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
 {
         struct neighbour *n;
         int key_len = tbl->key_len;
-        u32 hash_val = tbl->hash(pkey, dev) & tbl->hash_mask;
+        u32 hash_val = tbl->hash(pkey, dev);
         
         NEIGH_CACHE_STAT_INC(tbl, lookups);
 
         read_lock_bh(&tbl->lock);
-        for (n = tbl->hash_buckets[hash_val]; n; n = n->next) {
+        for (n = tbl->hash_buckets[hash_val & tbl->hash_mask]; n; n = n->next) {
                 if (dev == n->dev && !memcmp(n->primary_key, pkey, key_len)) {
                         neigh_hold(n);
                         NEIGH_CACHE_STAT_INC(tbl, hits);
@@ -364,12 +364,12 @@ struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, const void *pkey)
 {
         struct neighbour *n;
         int key_len = tbl->key_len;
-        u32 hash_val = tbl->hash(pkey, NULL) & tbl->hash_mask;
+        u32 hash_val = tbl->hash(pkey, NULL);
 
         NEIGH_CACHE_STAT_INC(tbl, lookups);
 
         read_lock_bh(&tbl->lock);
-        for (n = tbl->hash_buckets[hash_val]; n; n = n->next) {
+        for (n = tbl->hash_buckets[hash_val & tbl->hash_mask]; n; n = n->next) {
                 if (!memcmp(n->primary_key, pkey, key_len)) {
                         neigh_hold(n);
                         NEIGH_CACHE_STAT_INC(tbl, hits);
@@ -1079,7 +1079,7 @@ struct neighbour *neigh_event_ns(struct neigh_table *tbl,
 }
 
 static void neigh_hh_init(struct neighbour *n, struct dst_entry *dst,
-                          u16 protocol)
+                          __be16 protocol)
 {
         struct hh_cache *hh;
         struct net_device *dev = dst->dev;
@@ -1998,12 +1998,12 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
         int rc, h, s_h = cb->args[1];
         int idx, s_idx = idx = cb->args[2];
 
+        read_lock_bh(&tbl->lock);
         for (h = 0; h <= tbl->hash_mask; h++) {
                 if (h < s_h)
                         continue;
                 if (h > s_h)
                         s_idx = 0;
-                read_lock_bh(&tbl->lock);
                 for (n = tbl->hash_buckets[h], idx = 0; n; n = n->next, idx++) {
                         if (idx < s_idx)
                                 continue;
@@ -2016,8 +2016,8 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
                                 goto out;
                         }
                 }
-                read_unlock_bh(&tbl->lock);
         }
+        read_unlock_bh(&tbl->lock);
         rc = skb->len;
 out:
         cb->args[1] = h;
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 13472762b18b..f47f319bb7dc 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -344,8 +344,6 @@ static ssize_t wireless_show(struct class_device *cd, char *buf,
                 if(dev->wireless_handlers &&
                    dev->wireless_handlers->get_wireless_stats)
                         iw = dev->wireless_handlers->get_wireless_stats(dev);
-                else if (dev->get_wireless_stats)
-                        iw = dev->get_wireless_stats(dev);
                 if (iw != NULL)
                         ret = (*format)(iw, buf);
         }
@@ -465,8 +463,7 @@ int netdev_register_sysfs(struct net_device *net)
                 *groups++ = &netstat_group;
 
 #ifdef WIRELESS_EXT
-        if (net->get_wireless_stats
-            || (net->wireless_handlers && net->wireless_handlers->get_wireless_stats))
+        if (net->wireless_handlers && net->wireless_handlers->get_wireless_stats)
                 *groups++ = &wireless_group;
 #endif
 
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index ead5920c26d6..9308af060b44 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -335,13 +335,13 @@ void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
         memcpy(skb->data, msg, len);
         skb->len += len;
 
-        udph = (struct udphdr *) skb_push(skb, sizeof(*udph));
+        skb->h.uh = udph = (struct udphdr *) skb_push(skb, sizeof(*udph));
         udph->source = htons(np->local_port);
         udph->dest = htons(np->remote_port);
         udph->len = htons(udp_len);
         udph->check = 0;
 
-        iph = (struct iphdr *)skb_push(skb, sizeof(*iph));
+        skb->nh.iph = iph = (struct iphdr *)skb_push(skb, sizeof(*iph));
 
         /* iph->version = 4; iph->ihl = 5; */
         put_unaligned(0x45, (unsigned char *)iph);
@@ -357,8 +357,8 @@ void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
         iph->check    = ip_fast_csum((unsigned char *)iph, iph->ihl);
 
         eth = (struct ethhdr *) skb_push(skb, ETH_HLEN);
-
-        eth->h_proto = htons(ETH_P_IP);
+        skb->mac.raw = skb->data;
+        skb->protocol = eth->h_proto = htons(ETH_P_IP);
         memcpy(eth->h_source, np->local_mac, 6);
         memcpy(eth->h_dest, np->remote_mac, 6);
 
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 72145d4a2600..dd023fd28304 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -109,6 +109,8 @@
  *
  * MPLS support by Steven Whitehouse <steve@chygwyn.com>
  *
+ * 802.1Q/Q-in-Q support by Francesco Fondelli (FF) <francesco.fondelli@gmail.com>
+ *
  */
 #include <linux/sys.h>
 #include <linux/types.h>
@@ -137,6 +139,7 @@
 #include <linux/inetdevice.h>
 #include <linux/rtnetlink.h>
 #include <linux/if_arp.h>
+#include <linux/if_vlan.h>
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
@@ -157,7 +160,7 @@
 #include <asm/div64.h>          /* do_div */
 #include <asm/timex.h>
 
-#define VERSION  "pktgen v2.67: Packet Generator for packet performance testing.\n"
+#define VERSION  "pktgen v2.68: Packet Generator for packet performance testing.\n"
 
 /* #define PG_DEBUG(a) a */
 #define PG_DEBUG(a)
@@ -178,6 +181,8 @@
 #define F_TXSIZE_RND  (1<<6)    /* Transmit size is random */
 #define F_IPV6        (1<<7)    /* Interface in IPV6 Mode */
 #define F_MPLS_RND    (1<<8)    /* Random MPLS labels */
+#define F_VID_RND     (1<<9)    /* Random VLAN ID */
+#define F_SVID_RND    (1<<10)   /* Random SVLAN ID */
 
 /* Thread control flag bits */
 #define T_TERMINATE   (1<<0)
@@ -198,6 +203,9 @@ static struct proc_dir_entry *pg_proc_dir = NULL;
 
 #define MAX_CFLOWS  65536
 
+#define VLAN_TAG_SIZE(x) ((x)->vlan_id == 0xffff ? 0 : 4)
+#define SVLAN_TAG_SIZE(x) ((x)->svlan_id == 0xffff ? 0 : 4)
+
 struct flow_state {
         __u32 cur_daddr;
         int count;
@@ -284,10 +292,23 @@ struct pktgen_dev {
         __u16 udp_dst_min;      /* inclusive, dest UDP port */
         __u16 udp_dst_max;      /* exclusive, dest UDP port */
 
+        /* DSCP + ECN */
+        __u8 tos;            /* six most significant bits of (former) IPv4 TOS are for dscp codepoint */
+        __u8 traffic_class;  /* ditto for the (former) Traffic Class in IPv6 (see RFC 3260, sec. 4) */
+
         /* MPLS */
         unsigned nr_labels;     /* Depth of stack, 0 = no MPLS */
         __be32 labels[MAX_MPLS_LABELS];
 
+        /* VLAN/SVLAN (802.1Q/Q-in-Q) */
+        __u8  vlan_p;
+        __u8  vlan_cfi;
+        __u16 vlan_id;  /* 0xffff means no vlan tag */
+
+        __u8  svlan_p;
+        __u8  svlan_cfi;
+        __u16 svlan_id; /* 0xffff means no svlan tag */
+
         __u32 src_mac_count;    /* How many MACs to iterate through */
         __u32 dst_mac_count;    /* How many MACs to iterate through */
 
@@ -644,6 +665,24 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
                                    i == pkt_dev->nr_labels-1 ? "\n" : ", ");
         }
 
+        if (pkt_dev->vlan_id != 0xffff) {
+                seq_printf(seq, "     vlan_id: %u  vlan_p: %u  vlan_cfi: %u\n",
+                           pkt_dev->vlan_id, pkt_dev->vlan_p, pkt_dev->vlan_cfi);
+        }
+
+        if (pkt_dev->svlan_id != 0xffff) {
+                seq_printf(seq, "     svlan_id: %u  vlan_p: %u  vlan_cfi: %u\n",
+                           pkt_dev->svlan_id, pkt_dev->svlan_p, pkt_dev->svlan_cfi);
+        }
+
+        if (pkt_dev->tos) {
+                seq_printf(seq, "     tos: 0x%02x\n", pkt_dev->tos);
+        }
+
+        if (pkt_dev->traffic_class) {
+                seq_printf(seq, "     traffic_class: 0x%02x\n", pkt_dev->traffic_class);
+        }
+
         seq_printf(seq, "     Flags: ");
 
         if (pkt_dev->flags & F_IPV6)
@@ -673,6 +712,12 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
         if (pkt_dev->flags & F_MACDST_RND)
                 seq_printf(seq, "MACDST_RND  ");
 
+        if (pkt_dev->flags & F_VID_RND)
+                seq_printf(seq, "VID_RND  ");
+
+        if (pkt_dev->flags & F_SVID_RND)
+                seq_printf(seq, "SVID_RND  ");
+
         seq_puts(seq, "\n");
 
         sa = pkt_dev->started_at;
@@ -715,12 +760,12 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
 }
 
 
-static int hex32_arg(const char __user *user_buffer, __u32 *num)
+static int hex32_arg(const char __user *user_buffer, unsigned long maxlen, __u32 *num)
 {
         int i = 0;
         *num = 0;
 
-        for(; i < 8; i++) {
+        for(; i < maxlen; i++) {
                 char c;
                 *num <<= 4;
                 if (get_user(c, &user_buffer[i]))
@@ -815,7 +860,7 @@ static ssize_t get_labels(const char __user *buffer, struct pktgen_dev *pkt_dev)
         pkt_dev->nr_labels = 0;
         do {
                 __u32 tmp;
-                len = hex32_arg(&buffer[i], &tmp);
+                len = hex32_arg(&buffer[i], 8, &tmp);
                 if (len <= 0)
                         return len;
                 pkt_dev->labels[n] = htonl(tmp);
@@ -1140,11 +1185,27 @@ static ssize_t pktgen_if_write(struct file *file,
                 else if (strcmp(f, "!MPLS_RND") == 0)
                         pkt_dev->flags &= ~F_MPLS_RND;
 
+                else if (strcmp(f, "VID_RND") == 0)
+                        pkt_dev->flags |= F_VID_RND;
+
+                else if (strcmp(f, "!VID_RND") == 0)
+                        pkt_dev->flags &= ~F_VID_RND;
+
+                else if (strcmp(f, "SVID_RND") == 0)
+                        pkt_dev->flags |= F_SVID_RND;
+
+                else if (strcmp(f, "!SVID_RND") == 0)
+                        pkt_dev->flags &= ~F_SVID_RND;
+
+                else if (strcmp(f, "!IPV6") == 0)
+                        pkt_dev->flags &= ~F_IPV6;
+
                 else {
                         sprintf(pg_result,
                                 "Flag -:%s:- unknown\nAvailable flags, (prepend ! to un-set flag):\n%s",
                                 f,
-                                "IPSRC_RND, IPDST_RND, TXSIZE_RND, UDPSRC_RND, UDPDST_RND, MACSRC_RND, MACDST_RND\n");
+                                "IPSRC_RND, IPDST_RND, UDPSRC_RND, UDPDST_RND, "
+                                "MACSRC_RND, MACDST_RND, TXSIZE_RND, IPV6, MPLS_RND, VID_RND, SVID_RND\n");
                         return count;
                 }
                 sprintf(pg_result, "OK: flags=0x%x", pkt_dev->flags);
@@ -1445,6 +1506,160 @@ static ssize_t pktgen_if_write(struct file *file,
                         offset += sprintf(pg_result + offset,
                                           "%08x%s", ntohl(pkt_dev->labels[n]),
                                           n == pkt_dev->nr_labels-1 ? "" : ",");
+
+                if (pkt_dev->nr_labels && pkt_dev->vlan_id != 0xffff) {
+                        pkt_dev->vlan_id = 0xffff; /* turn off VLAN/SVLAN */
+                        pkt_dev->svlan_id = 0xffff;
+
+                        if (debug)
+                                printk("pktgen: VLAN/SVLAN auto turned off\n");
+                }
+                return count;
+        }
+
+        if (!strcmp(name, "vlan_id")) {
+                len = num_arg(&user_buffer[i], 4, &value);
+                if (len < 0) {
+                        return len;
+                }
+                i += len;
+                if (value <= 4095) {
+                        pkt_dev->vlan_id = value;  /* turn on VLAN */
+
+                        if (debug)
+                                printk("pktgen: VLAN turned on\n");
+
+                        if (debug && pkt_dev->nr_labels)
+                                printk("pktgen: MPLS auto turned off\n");
+
+                        pkt_dev->nr_labels = 0;    /* turn off MPLS */
+                        sprintf(pg_result, "OK: vlan_id=%u", pkt_dev->vlan_id);
+                } else {
+                        pkt_dev->vlan_id = 0xffff; /* turn off VLAN/SVLAN */
+                        pkt_dev->svlan_id = 0xffff;
+
+                        if (debug)
+                                printk("pktgen: VLAN/SVLAN turned off\n");
+                }
+                return count;
+        }
+
+        if (!strcmp(name, "vlan_p")) {
+                len = num_arg(&user_buffer[i], 1, &value);
+                if (len < 0) {
+                        return len;
+                }
+                i += len;
+                if ((value <= 7) && (pkt_dev->vlan_id != 0xffff)) {
+                        pkt_dev->vlan_p = value;
+                        sprintf(pg_result, "OK: vlan_p=%u", pkt_dev->vlan_p);
+                } else {
+                        sprintf(pg_result, "ERROR: vlan_p must be 0-7");
+                }
+                return count;
+        }
+
+        if (!strcmp(name, "vlan_cfi")) {
+                len = num_arg(&user_buffer[i], 1, &value);
+                if (len < 0) {
+                        return len;
+                }
+                i += len;
+                if ((value <= 1) && (pkt_dev->vlan_id != 0xffff)) {
+                        pkt_dev->vlan_cfi = value;
+                        sprintf(pg_result, "OK: vlan_cfi=%u", pkt_dev->vlan_cfi);
+                } else {
+                        sprintf(pg_result, "ERROR: vlan_cfi must be 0-1");
+                }
+                return count;
+        }
+
+        if (!strcmp(name, "svlan_id")) {
+                len = num_arg(&user_buffer[i], 4, &value);
+                if (len < 0) {
+                        return len;
+                }
+                i += len;
+                if ((value <= 4095) && ((pkt_dev->vlan_id != 0xffff))) {
+                        pkt_dev->svlan_id = value;  /* turn on SVLAN */
+
+                        if (debug)
+                                printk("pktgen: SVLAN turned on\n");
+
+                        if (debug && pkt_dev->nr_labels)
+                                printk("pktgen: MPLS auto turned off\n");
+
+                        pkt_dev->nr_labels = 0;    /* turn off MPLS */
+                        sprintf(pg_result, "OK: svlan_id=%u", pkt_dev->svlan_id);
+                } else {
+                        pkt_dev->vlan_id = 0xffff; /* turn off VLAN/SVLAN */
+                        pkt_dev->svlan_id = 0xffff;
+
+                        if (debug)
+                                printk("pktgen: VLAN/SVLAN turned off\n");
+                }
+                return count;
+        }
+
+        if (!strcmp(name, "svlan_p")) {
+                len = num_arg(&user_buffer[i], 1, &value);
+                if (len < 0) {
+                        return len;
+                }
+                i += len;
+                if ((value <= 7) && (pkt_dev->svlan_id != 0xffff)) {
+                        pkt_dev->svlan_p = value;
+                        sprintf(pg_result, "OK: svlan_p=%u", pkt_dev->svlan_p);
+                } else {
+                        sprintf(pg_result, "ERROR: svlan_p must be 0-7");
+                }
+                return count;
+        }
+
+        if (!strcmp(name, "svlan_cfi")) {
+                len = num_arg(&user_buffer[i], 1, &value);
+                if (len < 0) {
+                        return len;
+                }
+                i += len;
+                if ((value <= 1) && (pkt_dev->svlan_id != 0xffff)) {
+                        pkt_dev->svlan_cfi = value;
+                        sprintf(pg_result, "OK: svlan_cfi=%u", pkt_dev->svlan_cfi);
+                } else {
+                        sprintf(pg_result, "ERROR: svlan_cfi must be 0-1");
+                }
+                return count;
+        }
+
+        if (!strcmp(name, "tos")) {
+                __u32 tmp_value = 0;
+                len = hex32_arg(&user_buffer[i], 2, &tmp_value);
+                if (len < 0) {
+                        return len;
+                }
+                i += len;
+                if (len == 2) {
+                        pkt_dev->tos = tmp_value;
+                        sprintf(pg_result, "OK: tos=0x%02x", pkt_dev->tos);
+                } else {
+                        sprintf(pg_result, "ERROR: tos must be 00-ff");
+                }
+                return count;
+        }
+
+        if (!strcmp(name, "traffic_class")) {
+                __u32 tmp_value = 0;
+                len = hex32_arg(&user_buffer[i], 2, &tmp_value);
+                if (len < 0) {
+                        return len;
+                }
+                i += len;
+                if (len == 2) {
+                        pkt_dev->traffic_class = tmp_value;
+                        sprintf(pg_result, "OK: traffic_class=0x%02x", pkt_dev->traffic_class);
+                } else {
+                        sprintf(pg_result, "ERROR: traffic_class must be 00-ff");
+                }
                 return count;
         }
 
@@ -1949,6 +2164,14 @@ static void mod_cur_headers(struct pktgen_dev *pkt_dev)
                                                       htonl(0x000fffff));
         }
 
+        if ((pkt_dev->flags & F_VID_RND) && (pkt_dev->vlan_id != 0xffff)) {
+                pkt_dev->vlan_id = pktgen_random() % 4096;
+        }
+
+        if ((pkt_dev->flags & F_SVID_RND) && (pkt_dev->svlan_id != 0xffff)) {
+                pkt_dev->svlan_id = pktgen_random() % 4096;
+        }
+
         if (pkt_dev->udp_src_min < pkt_dev->udp_src_max) {
                 if (pkt_dev->flags & F_UDPSRC_RND)
                         pkt_dev->cur_udp_src =
@@ -2092,10 +2315,18 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         struct pktgen_hdr *pgh = NULL;
         __be16 protocol = __constant_htons(ETH_P_IP);
         __be32 *mpls;
+        __be16 *vlan_tci = NULL;                 /* Encapsulates priority and VLAN ID */
+        __be16 *vlan_encapsulated_proto = NULL;  /* packet type ID field (or len) for VLAN tag */
+        __be16 *svlan_tci = NULL;                /* Encapsulates priority and SVLAN ID */
+        __be16 *svlan_encapsulated_proto = NULL; /* packet type ID field (or len) for SVLAN tag */
+
 
         if (pkt_dev->nr_labels)
                 protocol = __constant_htons(ETH_P_MPLS_UC);
 
+        if (pkt_dev->vlan_id != 0xffff)
+                protocol = __constant_htons(ETH_P_8021Q);
+
         /* Update any of the values, used when we're incrementing various
          * fields.
          */
@@ -2103,7 +2334,9 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
 
         datalen = (odev->hard_header_len + 16) & ~0xf;
         skb = alloc_skb(pkt_dev->cur_pkt_size + 64 + datalen +
-                        pkt_dev->nr_labels*sizeof(u32), GFP_ATOMIC);
+                        pkt_dev->nr_labels*sizeof(u32) +
+                        VLAN_TAG_SIZE(pkt_dev) + SVLAN_TAG_SIZE(pkt_dev),
+                        GFP_ATOMIC);
         if (!skb) {
                 sprintf(pkt_dev->result, "No memory");
                 return NULL;
@@ -2116,6 +2349,24 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         mpls = (__be32 *)skb_put(skb, pkt_dev->nr_labels*sizeof(__u32));
         if (pkt_dev->nr_labels)
                 mpls_push(mpls, pkt_dev);
+
+        if (pkt_dev->vlan_id != 0xffff) {
+                if(pkt_dev->svlan_id != 0xffff) {
+                        svlan_tci = (__be16 *)skb_put(skb, sizeof(__be16));
+                        *svlan_tci = htons(pkt_dev->svlan_id);
+                        *svlan_tci |= pkt_dev->svlan_p << 5;
+                        *svlan_tci |= pkt_dev->svlan_cfi << 4;
+                        svlan_encapsulated_proto = (__be16 *)skb_put(skb, sizeof(__be16));
+                        *svlan_encapsulated_proto = __constant_htons(ETH_P_8021Q);
+                }
+                vlan_tci = (__be16 *)skb_put(skb, sizeof(__be16));
+                *vlan_tci = htons(pkt_dev->vlan_id);
+                *vlan_tci |= pkt_dev->vlan_p << 5;
+                *vlan_tci |= pkt_dev->vlan_cfi << 4;
+                vlan_encapsulated_proto = (__be16 *)skb_put(skb, sizeof(__be16));
+                *vlan_encapsulated_proto = __constant_htons(ETH_P_IP);
+        }
+
         iph = (struct iphdr *)skb_put(skb, sizeof(struct iphdr));
         udph = (struct udphdr *)skb_put(skb, sizeof(struct udphdr));
 
@@ -2124,7 +2375,7 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
 
         /* Eth + IPh + UDPh + mpls */
         datalen = pkt_dev->cur_pkt_size - 14 - 20 - 8 -
-                  pkt_dev->nr_labels*sizeof(u32);
+                  pkt_dev->nr_labels*sizeof(u32) - VLAN_TAG_SIZE(pkt_dev) - SVLAN_TAG_SIZE(pkt_dev);
         if (datalen < sizeof(struct pktgen_hdr))
                 datalen = sizeof(struct pktgen_hdr);
 
@@ -2136,7 +2387,7 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         iph->ihl = 5;
         iph->version = 4;
         iph->ttl = 32;
-        iph->tos = 0;
+        iph->tos = pkt_dev->tos;
         iph->protocol = IPPROTO_UDP;    /* UDP */
         iph->saddr = pkt_dev->cur_saddr;
         iph->daddr = pkt_dev->cur_daddr;
@@ -2146,7 +2397,8 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         iph->check = 0;
         iph->check = ip_fast_csum((void *)iph, iph->ihl);
         skb->protocol = protocol;
-        skb->mac.raw = ((u8 *) iph) - 14 - pkt_dev->nr_labels*sizeof(u32);
+        skb->mac.raw = ((u8 *) iph) - 14 - pkt_dev->nr_labels*sizeof(u32) -
+                VLAN_TAG_SIZE(pkt_dev) - SVLAN_TAG_SIZE(pkt_dev);
         skb->dev = odev;
         skb->pkt_type = PACKET_HOST;
         skb->nh.iph = iph;
@@ -2218,7 +2470,6 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
                 pgh->tv_sec = htonl(timestamp.tv_sec);
                 pgh->tv_usec = htonl(timestamp.tv_usec);
         }
-        pkt_dev->seq_num++;
 
         return skb;
 }
@@ -2402,17 +2653,26 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         struct pktgen_hdr *pgh = NULL;
         __be16 protocol = __constant_htons(ETH_P_IPV6);
         __be32 *mpls;
+        __be16 *vlan_tci = NULL;                 /* Encapsulates priority and VLAN ID */
+        __be16 *vlan_encapsulated_proto = NULL;  /* packet type ID field (or len) for VLAN tag */
+        __be16 *svlan_tci = NULL;                /* Encapsulates priority and SVLAN ID */
+        __be16 *svlan_encapsulated_proto = NULL; /* packet type ID field (or len) for SVLAN tag */
 
         if (pkt_dev->nr_labels)
                 protocol = __constant_htons(ETH_P_MPLS_UC);
 
+        if (pkt_dev->vlan_id != 0xffff)
+                protocol = __constant_htons(ETH_P_8021Q);
+
         /* Update any of the values, used when we're incrementing various
          * fields.
          */
         mod_cur_headers(pkt_dev);
 
         skb = alloc_skb(pkt_dev->cur_pkt_size + 64 + 16 +
-                        pkt_dev->nr_labels*sizeof(u32), GFP_ATOMIC);
+                        pkt_dev->nr_labels*sizeof(u32) +
+                        VLAN_TAG_SIZE(pkt_dev) + SVLAN_TAG_SIZE(pkt_dev),
+                        GFP_ATOMIC);
         if (!skb) {
                 sprintf(pkt_dev->result, "No memory");
                 return NULL;
@@ -2425,16 +2685,34 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         mpls = (__be32 *)skb_put(skb, pkt_dev->nr_labels*sizeof(__u32));
         if (pkt_dev->nr_labels)
                 mpls_push(mpls, pkt_dev);
+
+        if (pkt_dev->vlan_id != 0xffff) {
+                if(pkt_dev->svlan_id != 0xffff) {
+                        svlan_tci = (__be16 *)skb_put(skb, sizeof(__be16));
+                        *svlan_tci = htons(pkt_dev->svlan_id);
+                        *svlan_tci |= pkt_dev->svlan_p << 5;
+                        *svlan_tci |= pkt_dev->svlan_cfi << 4;
+                        svlan_encapsulated_proto = (__be16 *)skb_put(skb, sizeof(__be16));
+                        *svlan_encapsulated_proto = __constant_htons(ETH_P_8021Q);
+                }
+                vlan_tci = (__be16 *)skb_put(skb, sizeof(__be16));
+                *vlan_tci = htons(pkt_dev->vlan_id);
+                *vlan_tci |= pkt_dev->vlan_p << 5;
+                *vlan_tci |= pkt_dev->vlan_cfi << 4;
+                vlan_encapsulated_proto = (__be16 *)skb_put(skb, sizeof(__be16));
+                *vlan_encapsulated_proto = __constant_htons(ETH_P_IPV6);
+        }
+
         iph = (struct ipv6hdr *)skb_put(skb, sizeof(struct ipv6hdr));
         udph = (struct udphdr *)skb_put(skb, sizeof(struct udphdr));
 
         memcpy(eth, pkt_dev->hh, 12);
-        *(u16 *) & eth[12] = __constant_htons(ETH_P_IPV6);
+        *(u16 *) & eth[12] = protocol;
 
         /* Eth + IPh + UDPh + mpls */
         datalen = pkt_dev->cur_pkt_size - 14 -
                   sizeof(struct ipv6hdr) - sizeof(struct udphdr) -
-                  pkt_dev->nr_labels*sizeof(u32);
+                  pkt_dev->nr_labels*sizeof(u32) - VLAN_TAG_SIZE(pkt_dev) - SVLAN_TAG_SIZE(pkt_dev);
 
         if (datalen < sizeof(struct pktgen_hdr)) {
                 datalen = sizeof(struct pktgen_hdr);
@@ -2450,6 +2728,11 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
 
         *(u32 *) iph = __constant_htonl(0x60000000);    /* Version + flow */
 
+        if (pkt_dev->traffic_class) {
+                /* Version + traffic class + flow (0) */
+                *(u32 *)iph |= htonl(0x60000000 | (pkt_dev->traffic_class << 20));
+        }
+
         iph->hop_limit = 32;
 
         iph->payload_len = htons(sizeof(struct udphdr) + datalen);
@@ -2458,7 +2741,8 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         ipv6_addr_copy(&iph->daddr, &pkt_dev->cur_in6_daddr);
         ipv6_addr_copy(&iph->saddr, &pkt_dev->cur_in6_saddr);
 
-        skb->mac.raw = ((u8 *) iph) - 14 - pkt_dev->nr_labels*sizeof(u32);
+        skb->mac.raw = ((u8 *) iph) - 14 - pkt_dev->nr_labels*sizeof(u32) -
+                VLAN_TAG_SIZE(pkt_dev) - SVLAN_TAG_SIZE(pkt_dev);
         skb->protocol = protocol;
         skb->dev = odev;
         skb->pkt_type = PACKET_HOST;
@@ -2531,7 +2815,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
                 pgh->tv_sec = htonl(timestamp.tv_sec);
                 pgh->tv_usec = htonl(timestamp.tv_usec);
         }
-        pkt_dev->seq_num++;
+        /* pkt_dev->seq_num++; FF: you really mean this? */
 
         return skb;
 }
@@ -3177,6 +3461,13 @@ static int pktgen_add_device(struct pktgen_thread *t, const char *ifname)
         pkt_dev->udp_dst_min = 9;
         pkt_dev->udp_dst_max = 9;
 
+        pkt_dev->vlan_p = 0;
+        pkt_dev->vlan_cfi = 0;
+        pkt_dev->vlan_id = 0xffff;
+        pkt_dev->svlan_p = 0;
+        pkt_dev->svlan_cfi = 0;
+        pkt_dev->svlan_id = 0xffff;
+
         strncpy(pkt_dev->ifname, ifname, IFNAMSIZ);
 
         if (!pktgen_setup_dev(pkt_dev)) {
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index d8e25e08cb7e..02f3c7947898 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -562,7 +562,7 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 
         err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFLA_MAX, ifla_policy);
         if (err < 0)
-                goto errout;
+                return err;
 
         ifm = nlmsg_data(nlh);
         if (ifm->ifi_index >= 0) {
@@ -602,7 +602,7 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
                 goto errout;
         }
 
-        err = rtnl_unicast(skb, NETLINK_CB(skb).pid);
+        err = rtnl_unicast(nskb, NETLINK_CB(skb).pid);
 errout:
         kfree(iw_buf);
         dev_put(dev);
diff --git a/net/core/scm.c b/net/core/scm.c
index 649d01ef35b6..271cf060ef8c 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -245,8 +245,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
         if (i > 0)
         {
                 int cmlen = CMSG_LEN(i*sizeof(int));
-                if (!err)
-                        err = put_user(SOL_SOCKET, &cm->cmsg_level);
+                err = put_user(SOL_SOCKET, &cm->cmsg_level);
                 if (!err)
                         err = put_user(SCM_RIGHTS, &cm->cmsg_type);
                 if (!err)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index c448c7f6fde2..3c23760c5827 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -156,7 +156,8 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
 
         /* Get the DATA. Size must match skb_add_mtu(). */
         size = SKB_DATA_ALIGN(size);
-        data = ____kmalloc(size + sizeof(struct skb_shared_info), gfp_mask);
+        data = kmalloc_track_caller(size + sizeof(struct skb_shared_info),
+                        gfp_mask);
         if (!data)
                 goto nodata;
 
diff --git a/net/core/sock.c b/net/core/sock.c
index b77e155cbe6c..d472db4776c3 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -823,7 +823,7 @@ static void inline sock_lock_init(struct sock *sk)
                                    af_family_slock_key_strings[sk->sk_family]);
         lockdep_init_map(&sk->sk_lock.dep_map,
                          af_family_key_strings[sk->sk_family],
-                         af_family_keys + sk->sk_family);
+                         af_family_keys + sk->sk_family, 0);
 }
 
 /**
diff --git a/net/core/utils.c b/net/core/utils.c
index 2682490777de..d93fe64f6693 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -3,7 +3,7 @@
  *
  *      Authors:
  *      net_random Alan Cox
- *      net_ratelimit Andy Kleen
+ *      net_ratelimit Andi Kleen
  *      in{4,6}_pton YOSHIFUJI Hideaki, Copyright (C)2006 USAGI/WIDE Project
  *
  *      Created by Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
@@ -30,119 +30,6 @@
 #include <asm/system.h>
 #include <asm/uaccess.h>
 
-/*
-  This is a maximally equidistributed combined Tausworthe generator
-  based on code from GNU Scientific Library 1.5 (30 Jun 2004)
-
-   x_n = (s1_n ^ s2_n ^ s3_n) 
-
-   s1_{n+1} = (((s1_n & 4294967294) <<12) ^ (((s1_n <<13) ^ s1_n) >>19))
-   s2_{n+1} = (((s2_n & 4294967288) << 4) ^ (((s2_n << 2) ^ s2_n) >>25))
-   s3_{n+1} = (((s3_n & 4294967280) <<17) ^ (((s3_n << 3) ^ s3_n) >>11))
-
-   The period of this generator is about 2^88.
-
-   From: P. L'Ecuyer, "Maximally Equidistributed Combined Tausworthe
-   Generators", Mathematics of Computation, 65, 213 (1996), 203--213.
-
-   This is available on the net from L'Ecuyer's home page,
-
-   http://www.iro.umontreal.ca/~lecuyer/myftp/papers/tausme.ps
-   ftp://ftp.iro.umontreal.ca/pub/simulation/lecuyer/papers/tausme.ps 
-
-   There is an erratum in the paper "Tables of Maximally
-   Equidistributed Combined LFSR Generators", Mathematics of
-   Computation, 68, 225 (1999), 261--269:
-   http://www.iro.umontreal.ca/~lecuyer/myftp/papers/tausme2.ps
-
-        ... the k_j most significant bits of z_j must be non-
-        zero, for each j. (Note: this restriction also applies to the 
-        computer code given in [4], but was mistakenly not mentioned in
-        that paper.)
-   
-   This affects the seeding procedure by imposing the requirement
-   s1 > 1, s2 > 7, s3 > 15.
-
-*/
-struct nrnd_state {
-        u32 s1, s2, s3;
-};
-
-static DEFINE_PER_CPU(struct nrnd_state, net_rand_state);
-
-static u32 __net_random(struct nrnd_state *state)
-{
-#define TAUSWORTHE(s,a,b,c,d) ((s&c)<<d) ^ (((s <<a) ^ s)>>b)
-
-        state->s1 = TAUSWORTHE(state->s1, 13, 19, 4294967294UL, 12);
-        state->s2 = TAUSWORTHE(state->s2, 2, 25, 4294967288UL, 4);
-        state->s3 = TAUSWORTHE(state->s3, 3, 11, 4294967280UL, 17);
-
-        return (state->s1 ^ state->s2 ^ state->s3);
-}
-
-static void __net_srandom(struct nrnd_state *state, unsigned long s)
-{
-        if (s == 0)
-                s = 1;      /* default seed is 1 */
-
-#define LCG(n) (69069 * n)
-        state->s1 = LCG(s);
-        state->s2 = LCG(state->s1);
-        state->s3 = LCG(state->s2);
-
-        /* "warm it up" */
-        __net_random(state);
-        __net_random(state);
-        __net_random(state);
-        __net_random(state);
-        __net_random(state);
-        __net_random(state);
-}
-
-
-unsigned long net_random(void)
-{
-        unsigned long r;
-        struct nrnd_state *state = &get_cpu_var(net_rand_state);
-        r = __net_random(state);
-        put_cpu_var(state);
-        return r;
-}
-
-
-void net_srandom(unsigned long entropy)
-{
-        struct nrnd_state *state = &get_cpu_var(net_rand_state);
-        __net_srandom(state, state->s1^entropy);
-        put_cpu_var(state);
-}
-
-void __init net_random_init(void)
-{
-        int i;
-
-        for_each_possible_cpu(i) {
-                struct nrnd_state *state = &per_cpu(net_rand_state,i);
-                __net_srandom(state, i+jiffies);
-        }
-}
-
-static int net_random_reseed(void)
-{
-        int i;
-        unsigned long seed;
-
-        for_each_possible_cpu(i) {
-                struct nrnd_state *state = &per_cpu(net_rand_state,i);
-
-                get_random_bytes(&seed, sizeof(seed));
-                __net_srandom(state, seed);
-        }
-        return 0;
-}
-late_initcall(net_random_reseed);
-
 int net_msg_cost = 5*HZ;
 int net_msg_burst = 10;
 
@@ -153,10 +40,7 @@ int net_ratelimit(void)
 {
         return __printk_ratelimit(net_msg_cost, net_msg_burst);
 }
-
-EXPORT_SYMBOL(net_random);
 EXPORT_SYMBOL(net_ratelimit);
-EXPORT_SYMBOL(net_srandom);
 
 /*
  * Convert an ASCII string to binary IP.
diff --git a/net/core/wireless.c b/net/core/wireless.c
index 3168fca312f7..ffff0da46c6e 100644
--- a/net/core/wireless.c
+++ b/net/core/wireless.c
@@ -68,6 +68,14 @@
  *
  * v8 - 17.02.06 - Jean II
  *      o RtNetlink requests support (SET/GET)
+ *
+ * v8b - 03.08.06 - Herbert Xu
+ *      o Fix Wireless Event locking issues.
+ *
+ * v9 - 14.3.06 - Jean II
+ *      o Change length in ESSID and NICK to strlen() instead of strlen()+1
+ *      o Make standard_ioctl_num and standard_event_num unsigned
+ *      o Remove (struct net_device *)->get_wireless_stats()
  */
 
 /***************************** INCLUDES *****************************/
@@ -234,24 +242,24 @@ static const struct iw_ioctl_description standard_ioctl[] = {
         [SIOCSIWESSID   - SIOCIWFIRST] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
-                .max_tokens     = IW_ESSID_MAX_SIZE + 1,
+                .max_tokens     = IW_ESSID_MAX_SIZE,
                 .flags          = IW_DESCR_FLAG_EVENT,
         },
         [SIOCGIWESSID   - SIOCIWFIRST] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
-                .max_tokens     = IW_ESSID_MAX_SIZE + 1,
+                .max_tokens     = IW_ESSID_MAX_SIZE,
                 .flags          = IW_DESCR_FLAG_DUMP,
         },
         [SIOCSIWNICKN   - SIOCIWFIRST] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
-                .max_tokens     = IW_ESSID_MAX_SIZE + 1,
+                .max_tokens     = IW_ESSID_MAX_SIZE,
         },
         [SIOCGIWNICKN   - SIOCIWFIRST] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = 1,
-                .max_tokens     = IW_ESSID_MAX_SIZE + 1,
+                .max_tokens     = IW_ESSID_MAX_SIZE,
         },
         [SIOCSIWRATE    - SIOCIWFIRST] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
@@ -338,8 +346,8 @@ static const struct iw_ioctl_description standard_ioctl[] = {
                 .max_tokens     = sizeof(struct iw_pmksa),
         },
 };
-static const int standard_ioctl_num = (sizeof(standard_ioctl) /
-                                       sizeof(struct iw_ioctl_description));
+static const unsigned standard_ioctl_num = (sizeof(standard_ioctl) /
+                                            sizeof(struct iw_ioctl_description));
 
 /*
  * Meta-data about all the additional standard Wireless Extension events
@@ -389,8 +397,8 @@ static const struct iw_ioctl_description standard_event[] = {
                 .max_tokens     = sizeof(struct iw_pmkid_cand),
         },
 };
-static const int standard_event_num = (sizeof(standard_event) /
-                                       sizeof(struct iw_ioctl_description));
+static const unsigned standard_event_num = (sizeof(standard_event) /
+                                            sizeof(struct iw_ioctl_description));
 
 /* Size (in bytes) of the various private data types */
 static const char iw_priv_type_size[] = {
@@ -465,17 +473,6 @@ static inline struct iw_statistics *get_wireless_stats(struct net_device *dev)
            (dev->wireless_handlers->get_wireless_stats != NULL))
                 return dev->wireless_handlers->get_wireless_stats(dev);
 
-        /* Old location, field to be removed in next WE */
-        if(dev->get_wireless_stats) {
-                static int printed_message;
-
-                if (!printed_message++)
-                        printk(KERN_DEBUG "%s (WE) : Driver using old /proc/net/wireless support, please fix driver !\n",
-                                dev->name);
-
-                return dev->get_wireless_stats(dev);
-        }
-
         /* Not found */
         return (struct iw_statistics *) NULL;
 }
@@ -1843,8 +1840,33 @@ int wireless_rtnetlink_set(struct net_device *	dev,
  */
 
 #ifdef WE_EVENT_RTNETLINK
+/* ---------------------------------------------------------------- */
+/*
+ * Locking...
+ * ----------
+ *
+ * Thanks to Herbert Xu <herbert@gondor.apana.org.au> for fixing
+ * the locking issue in here and implementing this code !
+ *
+ * The issue : wireless_send_event() is often called in interrupt context,
+ * while the Netlink layer can never be called in interrupt context.
+ * The fully formed RtNetlink events are queued, and then a tasklet is run
+ * to feed those to Netlink.
+ * The skb_queue is interrupt safe, and its lock is not held while calling
+ * Netlink, so there is no possibility of dealock.
+ * Jean II
+ */
+
 static struct sk_buff_head wireless_nlevent_queue;
 
+static int __init wireless_nlevent_init(void)
+{
+        skb_queue_head_init(&wireless_nlevent_queue);
+        return 0;
+}
+
+subsys_initcall(wireless_nlevent_init);
+
 static void wireless_nlevent_process(unsigned long data)
 {
         struct sk_buff *skb;
@@ -1921,13 +1943,6 @@ static inline void rtmsg_iwinfo(struct net_device *	dev,
         tasklet_schedule(&wireless_nlevent_tasklet);
 }
 
-static int __init wireless_nlevent_init(void)
-{
-        skb_queue_head_init(&wireless_nlevent_queue);
-        return 0;
-}
-
-subsys_initcall(wireless_nlevent_init);
 #endif  /* WE_EVENT_RTNETLINK */
 
 /* ---------------------------------------------------------------- */
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 66be29b6f508..7e746c4c1688 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -50,7 +50,7 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         struct dccp_sock *dp = dccp_sk(sk);
         const struct sockaddr_in *usin = (struct sockaddr_in *)uaddr;
         struct rtable *rt;
-        u32 daddr, nexthop;
+        __be32 daddr, nexthop;
         int tmp;
         int err;
 
@@ -311,7 +311,7 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
         }
 
         if (sk->sk_state == DCCP_TIME_WAIT) {
-                inet_twsk_put((struct inet_timewait_sock *)sk);
+                inet_twsk_put(inet_twsk(sk));
                 return;
         }
 
@@ -614,7 +614,7 @@ static struct sock *dccp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
                         bh_lock_sock(nsk);
                         return nsk;
                 }
-                inet_twsk_put((struct inet_timewait_sock *)nsk);
+                inet_twsk_put(inet_twsk(nsk));
                 return NULL;
         }
 
@@ -980,7 +980,7 @@ discard_and_relse:
         goto discard_it;
 
 do_time_wait:
-        inet_twsk_put((struct inet_timewait_sock *)sk);
+        inet_twsk_put(inet_twsk(sk));
         goto no_dccp_socket;
 }
 
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 7a47399cf31f..7171a78671aa 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -285,7 +285,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         }
 
         if (sk->sk_state == DCCP_TIME_WAIT) {
-                inet_twsk_put((struct inet_timewait_sock *)sk);
+                inet_twsk_put(inet_twsk(sk));
                 return;
         }
 
@@ -663,7 +663,7 @@ static struct sock *dccp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
                         bh_lock_sock(nsk);
                         return nsk;
                 }
-                inet_twsk_put((struct inet_timewait_sock *)nsk);
+                inet_twsk_put(inet_twsk(nsk));
                 return NULL;
         }
 
@@ -1109,7 +1109,7 @@ discard_and_relse:
         goto discard_it;
 
 do_time_wait:
-        inet_twsk_put((struct inet_timewait_sock *)sk);
+        inet_twsk_put(inet_twsk(sk));
         goto no_dccp_socket;
 }
 
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 70e027375682..3456cd331835 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1178,8 +1178,10 @@ static int dn_getname(struct socket *sock, struct sockaddr *uaddr,int *uaddr_len
         if (peer) {
                 if ((sock->state != SS_CONNECTED && 
                      sock->state != SS_CONNECTING) && 
-                    scp->accept_mode == ACC_IMMED)
+                    scp->accept_mode == ACC_IMMED) {
+                        release_sock(sk);
                         return -ENOTCONN;
+                }
 
                 memcpy(sa, &scp->peer, sizeof(struct sockaddr_dn));
         } else {
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index dd0761e3d280..23489f7232d2 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -267,9 +267,14 @@ static void dn_dst_link_failure(struct sk_buff *skb)
 
 static inline int compare_keys(struct flowi *fl1, struct flowi *fl2)
 {
-        return memcmp(&fl1->nl_u.dn_u, &fl2->nl_u.dn_u, sizeof(fl1->nl_u.dn_u)) == 0 &&
-                fl1->oif == fl2->oif &&
-                fl1->iif == fl2->iif;
+        return ((fl1->nl_u.dn_u.daddr ^ fl2->nl_u.dn_u.daddr) |
+                (fl1->nl_u.dn_u.saddr ^ fl2->nl_u.dn_u.saddr) |
+#ifdef CONFIG_DECNET_ROUTE_FWMARK
+                (fl1->nl_u.dn_u.fwmark ^ fl2->nl_u.dn_u.fwmark) |
+#endif
+                (fl1->nl_u.dn_u.scope ^ fl2->nl_u.dn_u.scope) |
+                (fl1->oif ^ fl2->oif) |
+                (fl1->iif ^ fl2->iif)) == 0;
 }
 
 static int dn_insert_route(struct dn_route *rt, unsigned hash, struct dn_route **rp)
@@ -1270,7 +1275,6 @@ static int dn_route_input_slow(struct sk_buff *skb)
                         goto e_inval;
 
                 res.type = RTN_LOCAL;
-                flags |= RTCF_DIRECTSRC;
         } else {
                 __le16 src_map = fl.fld_src;
                 free_res = 1;
@@ -1341,7 +1345,7 @@ static int dn_route_input_slow(struct sk_buff *skb)
                         goto make_route;
 
                 /* Packet was intra-ethernet, so we know its on-link */
-                if (cb->rt_flags | DN_RT_F_IE) {
+                if (cb->rt_flags & DN_RT_F_IE) {
                         gateway = cb->src;
                         flags |= RTCF_DIRECTSRC;
                         goto make_route;
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 43863933f27f..4bd78c8cfb26 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -223,7 +223,7 @@ static int eth_header_parse(struct sk_buff *skb, unsigned char *haddr)
  */
 int eth_header_cache(struct neighbour *neigh, struct hh_cache *hh)
 {
-        unsigned short type = hh->hh_type;
+        __be16 type = hh->hh_type;
         struct ethhdr *eth;
         struct net_device *dev = neigh->dev;
 
diff --git a/net/ieee80211/softmac/ieee80211softmac_wx.c b/net/ieee80211/softmac/ieee80211softmac_wx.c
index 75320b6842ab..2aa779d18f38 100644
--- a/net/ieee80211/softmac/ieee80211softmac_wx.c
+++ b/net/ieee80211/softmac/ieee80211softmac_wx.c
@@ -80,10 +80,10 @@ ieee80211softmac_wx_set_essid(struct net_device *net_dev,
          * If it's our network, ignore the change, we're already doing it!
          */
         if((sm->associnfo.associating || sm->associated) &&
-           (data->essid.flags && data->essid.length && extra)) {
+           (data->essid.flags && data->essid.length)) {
                 /* Get the associating network */
                 n = ieee80211softmac_get_network_by_bssid(sm, sm->associnfo.bssid);
-                if(n && n->essid.len == (data->essid.length - 1) &&
+                if(n && n->essid.len == data->essid.length &&
                    !memcmp(n->essid.data, extra, n->essid.len)) {
                         dprintk(KERN_INFO PFX "Already associating or associated to "MAC_FMT"\n",
                                 MAC_ARG(sm->associnfo.bssid));
@@ -109,8 +109,8 @@ ieee80211softmac_wx_set_essid(struct net_device *net_dev,
         sm->associnfo.static_essid = 0;
         sm->associnfo.assoc_wait = 0;
 
-        if (data->essid.flags && data->essid.length && extra /*required?*/) {
-                length = min(data->essid.length - 1, IW_ESSID_MAX_SIZE);
+        if (data->essid.flags && data->essid.length) {
+                length = min((int)data->essid.length, IW_ESSID_MAX_SIZE);
                 if (length) {
                         memcpy(sm->associnfo.req_essid.data, extra, length);
                         sm->associnfo.static_essid = 1;
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 30af4a4dfcc8..5572071af735 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -64,7 +64,7 @@ config ASK_IP_FIB_HASH
 config IP_FIB_TRIE
         bool "FIB_TRIE"
         ---help---
-        Use new experimental LC-trie as FIB lookup algoritm. 
+        Use new experimental LC-trie as FIB lookup algorithm. 
         This improves lookup performance if you have a large
         number of routes.
 
@@ -434,6 +434,15 @@ config INET_XFRM_MODE_TUNNEL
 
           If unsure, say Y.
 
+config INET_XFRM_MODE_BEET
+        tristate "IP: IPsec BEET mode"
+        default y
+        select XFRM
+        ---help---
+          Support for IPsec BEET mode.
+
+          If unsure, say Y.
+
 config INET_DIAG
         tristate "INET: socket monitoring interface"
         default y
@@ -526,7 +535,7 @@ config TCP_CONG_HYBLA
         ---help---
         TCP-Hybla is a sender-side only change that eliminates penalization of
         long-RTT, large-bandwidth connections, like when satellite legs are
-        involved, expecially when sharing a common bottleneck with normal
+        involved, especially when sharing a common bottleneck with normal
         terrestrial connections.
 
 config TCP_CONG_VEGAS
@@ -556,7 +565,7 @@ config TCP_CONG_LP
         default n
         ---help---
         TCP Low Priority (TCP-LP), a distributed algorithm whose goal is
-        to utiliza only the excess network bandwidth as compared to the
+        to utilize only the excess network bandwidth as compared to the
         ``fair share`` of bandwidth as targeted by TCP.
         See http://www-ece.rice.edu/networks/TCP-LP/
 
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index f66049e28aeb..15645c51520c 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_INET_AH) += ah4.o
 obj-$(CONFIG_INET_ESP) += esp4.o
 obj-$(CONFIG_INET_IPCOMP) += ipcomp.o
 obj-$(CONFIG_INET_XFRM_TUNNEL) += xfrm4_tunnel.o
+obj-$(CONFIG_INET_XFRM_MODE_BEET) += xfrm4_mode_beet.o
 obj-$(CONFIG_INET_TUNNEL) += tunnel4.o
 obj-$(CONFIG_INET_XFRM_MODE_TRANSPORT) += xfrm4_mode_transport.o
 obj-$(CONFIG_INET_XFRM_MODE_TUNNEL) += xfrm4_mode_tunnel.o
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index fdd89e37b9aa..edcf0932ac6d 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -996,7 +996,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
         struct rtable *rt;
         __u32 old_saddr = inet->saddr;
         __u32 new_saddr;
-        __u32 daddr = inet->daddr;
+        __be32 daddr = inet->daddr;
 
         if (inet->opt && inet->opt->srr)
                 daddr = inet->opt->faddr;
@@ -1043,7 +1043,7 @@ int inet_sk_rebuild_header(struct sock *sk)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct rtable *rt = (struct rtable *)__sk_dst_check(sk, 0);
-        u32 daddr;
+        __be32 daddr;
         int err;
 
         /* Route is OK, nothing to do. */
@@ -1342,10 +1342,10 @@ static int __init inet_init(void)
         rc = 0;
 out:
         return rc;
-out_unregister_tcp_proto:
-        proto_unregister(&tcp_prot);
 out_unregister_udp_proto:
         proto_unregister(&udp_prot);
+out_unregister_tcp_proto:
+        proto_unregister(&tcp_prot);
         goto out;
 }
 
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index c8a3723bc001..cfb5d3de9c84 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1,4 +1,4 @@
-/* linux/net/inet/arp.c
+/* linux/net/ipv4/arp.c
  *
  * Version:     $Id: arp.c,v 1.99 2001/08/30 22:55:42 davem Exp $
  *
@@ -234,7 +234,7 @@ static u32 arp_hash(const void *pkey, const struct net_device *dev)
 
 static int arp_constructor(struct neighbour *neigh)
 {
-        u32 addr = *(u32*)neigh->primary_key;
+        __be32 addr = *(__be32*)neigh->primary_key;
         struct net_device *dev = neigh->dev;
         struct in_device *in_dev;
         struct neigh_parms *parms;
@@ -330,10 +330,10 @@ static void arp_error_report(struct neighbour *neigh, struct sk_buff *skb)
 
 static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
 {
-        u32 saddr = 0;
+        __be32 saddr = 0;
         u8  *dst_ha = NULL;
         struct net_device *dev = neigh->dev;
-        u32 target = *(u32*)neigh->primary_key;
+        __be32 target = *(__be32*)neigh->primary_key;
         int probes = atomic_read(&neigh->probes);
         struct in_device *in_dev = in_dev_get(dev);
 
@@ -385,7 +385,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
 }
 
 static int arp_ignore(struct in_device *in_dev, struct net_device *dev,
-                      u32 sip, u32 tip)
+                      __be32 sip, __be32 tip)
 {
         int scope;
 
@@ -420,7 +420,7 @@ static int arp_ignore(struct in_device *in_dev, struct net_device *dev,
         return !inet_confirm_addr(dev, sip, tip, scope);
 }
 
-static int arp_filter(__u32 sip, __u32 tip, struct net_device *dev)
+static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev)
 {
         struct flowi fl = { .nl_u = { .ip4_u = { .daddr = sip,
                                                  .saddr = tip } } };
@@ -449,7 +449,7 @@ static int arp_filter(__u32 sip, __u32 tip, struct net_device *dev)
  *      is allowed to use this function, it is scheduled to be removed. --ANK
  */
 
-static int arp_set_predefined(int addr_hint, unsigned char * haddr, u32 paddr, struct net_device * dev)
+static int arp_set_predefined(int addr_hint, unsigned char * haddr, __be32 paddr, struct net_device * dev)
 {
         switch (addr_hint) {
         case RTN_LOCAL:
@@ -470,7 +470,7 @@ static int arp_set_predefined(int addr_hint, unsigned char * haddr, u32 paddr, s
 int arp_find(unsigned char *haddr, struct sk_buff *skb)
 {
         struct net_device *dev = skb->dev;
-        u32 paddr;
+        __be32 paddr;
         struct neighbour *n;
 
         if (!skb->dst) {
@@ -511,7 +511,7 @@ int arp_bind_neighbour(struct dst_entry *dst)
         if (dev == NULL)
                 return -EINVAL;
         if (n == NULL) {
-                u32 nexthop = ((struct rtable*)dst)->rt_gateway;
+                __be32 nexthop = ((struct rtable*)dst)->rt_gateway;
                 if (dev->flags&(IFF_LOOPBACK|IFF_POINTOPOINT))
                         nexthop = 0;
                 n = __neigh_lookup_errno(
@@ -560,8 +560,8 @@ static inline int arp_fwd_proxy(struct in_device *in_dev, struct rtable *rt)
  *      Create an arp packet. If (dest_hw == NULL), we create a broadcast
  *      message.
  */
-struct sk_buff *arp_create(int type, int ptype, u32 dest_ip,
-                           struct net_device *dev, u32 src_ip,
+struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
+                           struct net_device *dev, __be32 src_ip,
                            unsigned char *dest_hw, unsigned char *src_hw,
                            unsigned char *target_hw)
 {
@@ -675,8 +675,8 @@ void arp_xmit(struct sk_buff *skb)
 /*
  *      Create and send an arp packet.
  */
-void arp_send(int type, int ptype, u32 dest_ip, 
-              struct net_device *dev, u32 src_ip, 
+void arp_send(int type, int ptype, __be32 dest_ip,
+              struct net_device *dev, __be32 src_ip,
               unsigned char *dest_hw, unsigned char *src_hw,
               unsigned char *target_hw)
 {
@@ -710,7 +710,7 @@ static int arp_process(struct sk_buff *skb)
         unsigned char *arp_ptr;
         struct rtable *rt;
         unsigned char *sha, *tha;
-        u32 sip, tip;
+        __be32 sip, tip;
         u16 dev_type = dev->type;
         int addr_type;
         struct neighbour *n;
@@ -969,13 +969,13 @@ out_of_mem:
 
 static int arp_req_set(struct arpreq *r, struct net_device * dev)
 {
-        u32 ip = ((struct sockaddr_in *) &r->arp_pa)->sin_addr.s_addr;
+        __be32 ip = ((struct sockaddr_in *) &r->arp_pa)->sin_addr.s_addr;
         struct neighbour *neigh;
         int err;
 
         if (r->arp_flags&ATF_PUBL) {
-                u32 mask = ((struct sockaddr_in *) &r->arp_netmask)->sin_addr.s_addr;
-                if (mask && mask != 0xFFFFFFFF)
+                __be32 mask = ((struct sockaddr_in *) &r->arp_netmask)->sin_addr.s_addr;
+                if (mask && mask != htonl(0xFFFFFFFF))
                         return -EINVAL;
                 if (!dev && (r->arp_flags & ATF_COM)) {
                         dev = dev_getbyhwaddr(r->arp_ha.sa_family, r->arp_ha.sa_data);
@@ -1063,7 +1063,7 @@ static unsigned arp_state_to_flags(struct neighbour *neigh)
 
 static int arp_req_get(struct arpreq *r, struct net_device *dev)
 {
-        u32 ip = ((struct sockaddr_in *) &r->arp_pa)->sin_addr.s_addr;
+        __be32 ip = ((struct sockaddr_in *) &r->arp_pa)->sin_addr.s_addr;
         struct neighbour *neigh;
         int err = -ENXIO;
 
@@ -1084,13 +1084,13 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev)
 static int arp_req_delete(struct arpreq *r, struct net_device * dev)
 {
         int err;
-        u32 ip = ((struct sockaddr_in *)&r->arp_pa)->sin_addr.s_addr;
+        __be32 ip = ((struct sockaddr_in *)&r->arp_pa)->sin_addr.s_addr;
         struct neighbour *neigh;
 
         if (r->arp_flags & ATF_PUBL) {
-                u32 mask =
+                __be32 mask =
                        ((struct sockaddr_in *)&r->arp_netmask)->sin_addr.s_addr;
-                if (mask == 0xFFFFFFFF)
+                if (mask == htonl(0xFFFFFFFF))
                         return pneigh_delete(&arp_tbl, &ip, dev);
                 if (mask == 0) {
                         if (dev == NULL) {
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index e6ce0b3ba62a..e2077a3aa8c0 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -43,6 +43,7 @@
 #include <net/tcp.h>
 #include <net/netlabel.h>
 #include <net/cipso_ipv4.h>
+#include <asm/atomic.h>
 #include <asm/bug.h>
 
 struct cipso_v4_domhsh_entry {
@@ -79,7 +80,7 @@ struct cipso_v4_map_cache_entry {
         unsigned char *key;
         size_t key_len;
 
-        struct netlbl_lsm_cache lsm_data;
+        struct netlbl_lsm_cache *lsm_data;
 
         u32 activity;
         struct list_head list;
@@ -188,13 +189,14 @@ static void cipso_v4_doi_domhsh_free(struct rcu_head *entry)
  * @entry: the entry to free
  *
  * Description:
- * This function frees the memory associated with a cache entry.
+ * This function frees the memory associated with a cache entry including the
+ * LSM cache data if there are no longer any users, i.e. reference count == 0.
  *
  */
 static void cipso_v4_cache_entry_free(struct cipso_v4_map_cache_entry *entry)
 {
-        if (entry->lsm_data.free)
-                entry->lsm_data.free(entry->lsm_data.data);
+        if (entry->lsm_data)
+                netlbl_secattr_cache_free(entry->lsm_data);
         kfree(entry->key);
         kfree(entry);
 }
@@ -315,8 +317,8 @@ static int cipso_v4_cache_check(const unsigned char *key,
                     entry->key_len == key_len &&
                     memcmp(entry->key, key, key_len) == 0) {
                         entry->activity += 1;
-                        secattr->cache.free = entry->lsm_data.free;
-                        secattr->cache.data = entry->lsm_data.data;
+                        atomic_inc(&entry->lsm_data->refcount);
+                        secattr->cache = entry->lsm_data;
                         if (prev_entry == NULL) {
                                 spin_unlock_bh(&cipso_v4_cache[bkt].lock);
                                 return 0;
@@ -383,8 +385,8 @@ int cipso_v4_cache_add(const struct sk_buff *skb,
         memcpy(entry->key, cipso_ptr, cipso_ptr_len);
         entry->key_len = cipso_ptr_len;
         entry->hash = cipso_v4_map_cache_hash(cipso_ptr, cipso_ptr_len);
-        entry->lsm_data.free = secattr->cache.free;
-        entry->lsm_data.data = secattr->cache.data;
+        atomic_inc(&secattr->cache->refcount);
+        entry->lsm_data = secattr->cache;
 
         bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETBITS - 1);
         spin_lock_bh(&cipso_v4_cache[bkt].lock);
@@ -474,6 +476,7 @@ doi_add_failure_rlock:
 /**
  * cipso_v4_doi_remove - Remove an existing DOI from the CIPSO protocol engine
  * @doi: the DOI value
+ * @audit_secid: the LSM secid to use in the audit message
  * @callback: the DOI cleanup/free callback
  *
  * Description:
@@ -483,7 +486,9 @@ doi_add_failure_rlock:
  * success and negative values on failure.
  *
  */
-int cipso_v4_doi_remove(u32 doi, void (*callback) (struct rcu_head * head))
+int cipso_v4_doi_remove(u32 doi,
+                        struct netlbl_audit *audit_info,
+                        void (*callback) (struct rcu_head * head))
 {
         struct cipso_v4_doi *doi_def;
         struct cipso_v4_domhsh_entry *dom_iter;
@@ -502,7 +507,8 @@ int cipso_v4_doi_remove(u32 doi, void (*callback) (struct rcu_head * head))
                 spin_unlock(&cipso_v4_doi_list_lock);
                 list_for_each_entry_rcu(dom_iter, &doi_def->dom_list, list)
                         if (dom_iter->valid)
-                                netlbl_domhsh_remove(dom_iter->domain);
+                                netlbl_domhsh_remove(dom_iter->domain,
+                                                     audit_info);
                 cipso_v4_cache_invalidate();
                 rcu_read_unlock();
 
@@ -767,13 +773,15 @@ static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def,
 {
         int cat = -1;
         u32 bitmap_len_bits = bitmap_len * 8;
-        u32 cipso_cat_size = doi_def->map.std->cat.cipso_size;
-        u32 *cipso_array = doi_def->map.std->cat.cipso;
+        u32 cipso_cat_size;
+        u32 *cipso_array;
 
         switch (doi_def->type) {
         case CIPSO_V4_MAP_PASS:
                 return 0;
         case CIPSO_V4_MAP_STD:
+                cipso_cat_size = doi_def->map.std->cat.cipso_size;
+                cipso_array = doi_def->map.std->cat.cipso;
                 for (;;) {
                         cat = cipso_v4_bitmap_walk(bitmap,
                                                    bitmap_len_bits,
@@ -819,19 +827,21 @@ static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def,
         u32 net_spot_max = 0;
         u32 host_clen_bits = host_cat_len * 8;
         u32 net_clen_bits = net_cat_len * 8;
-        u32 host_cat_size = doi_def->map.std->cat.local_size;
-        u32 *host_cat_array = doi_def->map.std->cat.local;
+        u32 host_cat_size;
+        u32 *host_cat_array;
 
         switch (doi_def->type) {
         case CIPSO_V4_MAP_PASS:
-                net_spot_max = host_cat_len - 1;
-                while (net_spot_max > 0 && host_cat[net_spot_max] == 0)
+                net_spot_max = host_cat_len;
+                while (net_spot_max > 0 && host_cat[net_spot_max - 1] == 0)
                         net_spot_max--;
                 if (net_spot_max > net_cat_len)
                         return -EINVAL;
                 memcpy(net_cat, host_cat, net_spot_max);
                 return net_spot_max;
         case CIPSO_V4_MAP_STD:
+                host_cat_size = doi_def->map.std->cat.local_size;
+                host_cat_array = doi_def->map.std->cat.local;
                 for (;;) {
                         host_spot = cipso_v4_bitmap_walk(host_cat,
                                                          host_clen_bits,
@@ -887,8 +897,8 @@ static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
         int net_spot = -1;
         u32 net_clen_bits = net_cat_len * 8;
         u32 host_clen_bits = host_cat_len * 8;
-        u32 net_cat_size = doi_def->map.std->cat.cipso_size;
-        u32 *net_cat_array = doi_def->map.std->cat.cipso;
+        u32 net_cat_size;
+        u32 *net_cat_array;
 
         switch (doi_def->type) {
         case CIPSO_V4_MAP_PASS:
@@ -897,6 +907,8 @@ static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
                 memcpy(host_cat, net_cat, net_cat_len);
                 return net_cat_len;
         case CIPSO_V4_MAP_STD:
+                net_cat_size = doi_def->map.std->cat.cipso_size;
+                net_cat_array = doi_def->map.std->cat.cipso;
                 for (;;) {
                         net_spot = cipso_v4_bitmap_walk(net_cat,
                                                         net_clen_bits,
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index ec5da4fbd9f4..7b068a891953 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -25,7 +25,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         struct inet_sock *inet = inet_sk(sk);
         struct sockaddr_in *usin = (struct sockaddr_in *) uaddr;
         struct rtable *rt;
-        u32 saddr;
+        __be32 saddr;
         int oif;
         int err;
 
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 8e8d1f17d77a..7602c79a389b 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -224,7 +224,7 @@ static void inetdev_destroy(struct in_device *in_dev)
         call_rcu(&in_dev->rcu_head, in_dev_rcu_put);
 }
 
-int inet_addr_onlink(struct in_device *in_dev, u32 a, u32 b)
+int inet_addr_onlink(struct in_device *in_dev, __be32 a, __be32 b)
 {
         rcu_read_lock();
         for_primary_ifa(in_dev) {
@@ -429,8 +429,8 @@ struct in_device *inetdev_by_index(int ifindex)
 
 /* Called only from RTNL semaphored context. No locks. */
 
-struct in_ifaddr *inet_ifa_byprefix(struct in_device *in_dev, u32 prefix,
-                                    u32 mask)
+struct in_ifaddr *inet_ifa_byprefix(struct in_device *in_dev, __be32 prefix,
+                                    __be32 mask)
 {
         ASSERT_RTNL();
 
@@ -467,7 +467,7 @@ static int inet_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
         for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL;
              ifap = &ifa->ifa_next) {
                 if (tb[IFA_LOCAL] &&
-                    ifa->ifa_local != nla_get_u32(tb[IFA_LOCAL]))
+                    ifa->ifa_local != nla_get_be32(tb[IFA_LOCAL]))
                         continue;
 
                 if (tb[IFA_LABEL] && nla_strcmp(tb[IFA_LABEL], ifa->ifa_label))
@@ -475,7 +475,7 @@ static int inet_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
 
                 if (tb[IFA_ADDRESS] &&
                     (ifm->ifa_prefixlen != ifa->ifa_prefixlen ||
-                    !inet_ifa_match(nla_get_u32(tb[IFA_ADDRESS]), ifa)))
+                    !inet_ifa_match(nla_get_be32(tb[IFA_ADDRESS]), ifa)))
                         continue;
 
                 __inet_del_ifa(in_dev, ifap, 1, nlh, NETLINK_CB(skb).pid);
@@ -540,14 +540,14 @@ static struct in_ifaddr *rtm_to_ifaddr(struct nlmsghdr *nlh)
         ifa->ifa_scope = ifm->ifa_scope;
         ifa->ifa_dev = in_dev;
 
-        ifa->ifa_local = nla_get_u32(tb[IFA_LOCAL]);
-        ifa->ifa_address = nla_get_u32(tb[IFA_ADDRESS]);
+        ifa->ifa_local = nla_get_be32(tb[IFA_LOCAL]);
+        ifa->ifa_address = nla_get_be32(tb[IFA_ADDRESS]);
 
         if (tb[IFA_BROADCAST])
-                ifa->ifa_broadcast = nla_get_u32(tb[IFA_BROADCAST]);
+                ifa->ifa_broadcast = nla_get_be32(tb[IFA_BROADCAST]);
 
         if (tb[IFA_ANYCAST])
-                ifa->ifa_anycast = nla_get_u32(tb[IFA_ANYCAST]);
+                ifa->ifa_anycast = nla_get_be32(tb[IFA_ANYCAST]);
 
         if (tb[IFA_LABEL])
                 nla_strlcpy(ifa->ifa_label, tb[IFA_LABEL], IFNAMSIZ);
@@ -805,7 +805,7 @@ int devinet_ioctl(unsigned int cmd, void __user *arg)
                         break;
                 ret = 0;
                 if (ifa->ifa_mask != sin->sin_addr.s_addr) {
-                        u32 old_mask = ifa->ifa_mask;
+                        __be32 old_mask = ifa->ifa_mask;
                         inet_del_ifa(in_dev, ifap, 0);
                         ifa->ifa_mask = sin->sin_addr.s_addr;
                         ifa->ifa_prefixlen = inet_mask_len(ifa->ifa_mask);
@@ -876,9 +876,9 @@ out:
         return done;
 }
 
-u32 inet_select_addr(const struct net_device *dev, u32 dst, int scope)
+__be32 inet_select_addr(const struct net_device *dev, __be32 dst, int scope)
 {
-        u32 addr = 0;
+        __be32 addr = 0;
         struct in_device *in_dev;
 
         rcu_read_lock();
@@ -927,11 +927,11 @@ out:
         return addr;
 }
 
-static u32 confirm_addr_indev(struct in_device *in_dev, u32 dst,
-                              u32 local, int scope)
+static __be32 confirm_addr_indev(struct in_device *in_dev, __be32 dst,
+                              __be32 local, int scope)
 {
         int same = 0;
-        u32 addr = 0;
+        __be32 addr = 0;
 
         for_ifa(in_dev) {
                 if (!addr &&
@@ -971,9 +971,9 @@ static u32 confirm_addr_indev(struct in_device *in_dev, u32 dst,
  * - local: address, 0=autoselect the local address
  * - scope: maximum allowed scope value for the local address
  */
-u32 inet_confirm_addr(const struct net_device *dev, u32 dst, u32 local, int scope)
+__be32 inet_confirm_addr(const struct net_device *dev, __be32 dst, __be32 local, int scope)
 {
-        u32 addr = 0;
+        __be32 addr = 0;
         struct in_device *in_dev;
 
         if (dev) {
@@ -1138,16 +1138,16 @@ static int inet_fill_ifaddr(struct sk_buff *skb, struct in_ifaddr *ifa,
         ifm->ifa_index = ifa->ifa_dev->dev->ifindex;
 
         if (ifa->ifa_address)
-                NLA_PUT_U32(skb, IFA_ADDRESS, ifa->ifa_address);
+                NLA_PUT_BE32(skb, IFA_ADDRESS, ifa->ifa_address);
 
         if (ifa->ifa_local)
-                NLA_PUT_U32(skb, IFA_LOCAL, ifa->ifa_local);
+                NLA_PUT_BE32(skb, IFA_LOCAL, ifa->ifa_local);
 
         if (ifa->ifa_broadcast)
-                NLA_PUT_U32(skb, IFA_BROADCAST, ifa->ifa_broadcast);
+                NLA_PUT_BE32(skb, IFA_BROADCAST, ifa->ifa_broadcast);
 
         if (ifa->ifa_anycast)
-                NLA_PUT_U32(skb, IFA_ANYCAST, ifa->ifa_anycast);
+                NLA_PUT_BE32(skb, IFA_ANYCAST, ifa->ifa_anycast);
 
         if (ifa->ifa_label[0])
                 NLA_PUT_STRING(skb, IFA_LABEL, ifa->ifa_label);
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 13b29360d102..b5c205b57669 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -253,7 +253,8 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
                  *    as per draft-ietf-ipsec-udp-encaps-06,
                  *    section 3.1.2
                  */
-                if (x->props.mode == XFRM_MODE_TRANSPORT)
+                if (x->props.mode == XFRM_MODE_TRANSPORT ||
+                    x->props.mode == XFRM_MODE_BEET)
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
         }
 
@@ -271,17 +272,28 @@ static u32 esp4_get_max_size(struct xfrm_state *x, int mtu)
 {
         struct esp_data *esp = x->data;
         u32 blksize = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4);
-
-        if (x->props.mode == XFRM_MODE_TUNNEL) {
-                mtu = ALIGN(mtu + 2, blksize);
-        } else {
-                /* The worst case. */
+        int enclen = 0;
+
+        switch (x->props.mode) {
+        case XFRM_MODE_TUNNEL:
+                mtu = ALIGN(mtu +2, blksize);
+                break;
+        default:
+        case XFRM_MODE_TRANSPORT:
+                /* The worst case */
                 mtu = ALIGN(mtu + 2, 4) + blksize - 4;
+                break;
+        case XFRM_MODE_BEET:
+                /* The worst case. */
+                enclen = IPV4_BEET_PHMAXLEN;
+                mtu = ALIGN(mtu + enclen + 2, blksize);
+                break;
         }
+
         if (esp->conf.padlen)
                 mtu = ALIGN(mtu, esp->conf.padlen);
 
-        return mtu + x->props.header_len + esp->auth.icv_trunc_len;
+        return mtu + x->props.header_len + esp->auth.icv_trunc_len - enclen;
 }
 
 static void esp4_err(struct sk_buff *skb, u32 info)
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index cfb527c060e4..af0190d8b6c0 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -122,7 +122,7 @@ static void fib_flush(void)
  *      Find the first device with a given source address.
  */
 
-struct net_device * ip_dev_find(u32 addr)
+struct net_device * ip_dev_find(__be32 addr)
 {
         struct flowi fl = { .nl_u = { .ip4_u = { .daddr = addr } } };
         struct fib_result res;
@@ -146,7 +146,7 @@ out:
         return dev;
 }
 
-unsigned inet_addr_type(u32 addr)
+unsigned inet_addr_type(__be32 addr)
 {
         struct flowi            fl = { .nl_u = { .ip4_u = { .daddr = addr } } };
         struct fib_result       res;
@@ -180,8 +180,8 @@ unsigned inet_addr_type(u32 addr)
    - check, that packet arrived from expected physical interface.
  */
 
-int fib_validate_source(u32 src, u32 dst, u8 tos, int oif,
-                        struct net_device *dev, u32 *spec_dst, u32 *itag)
+int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
+                        struct net_device *dev, __be32 *spec_dst, u32 *itag)
 {
         struct in_device *in_dev;
         struct flowi fl = { .nl_u = { .ip4_u =
@@ -253,7 +253,7 @@ e_inval:
 
 #ifndef CONFIG_IP_NOSIOCRT
 
-static inline u32 sk_extract_addr(struct sockaddr *addr)
+static inline __be32 sk_extract_addr(struct sockaddr *addr)
 {
         return ((struct sockaddr_in *) addr)->sin_addr.s_addr;
 }
@@ -273,7 +273,7 @@ static int put_rtax(struct nlattr *mx, int len, int type, u32 value)
 static int rtentry_to_fib_config(int cmd, struct rtentry *rt,
                                  struct fib_config *cfg)
 {
-        u32 addr;
+        __be32 addr;
         int plen;
 
         memset(cfg, 0, sizeof(*cfg));
@@ -292,7 +292,7 @@ static int rtentry_to_fib_config(int cmd, struct rtentry *rt,
         plen = 32;
         addr = sk_extract_addr(&rt->rt_dst);
         if (!(rt->rt_flags & RTF_HOST)) {
-                u32 mask = sk_extract_addr(&rt->rt_genmask);
+                __be32 mask = sk_extract_addr(&rt->rt_genmask);
 
                 if (rt->rt_genmask.sa_family != AF_INET) {
                         if (mask || rt->rt_genmask.sa_family)
@@ -482,9 +482,7 @@ static int rtm_to_fib_config(struct sk_buff *skb, struct nlmsghdr *nlh,
         memset(cfg, 0, sizeof(*cfg));
 
         rtm = nlmsg_data(nlh);
-        cfg->fc_family = rtm->rtm_family;
         cfg->fc_dst_len = rtm->rtm_dst_len;
-        cfg->fc_src_len = rtm->rtm_src_len;
         cfg->fc_tos = rtm->rtm_tos;
         cfg->fc_table = rtm->rtm_table;
         cfg->fc_protocol = rtm->rtm_protocol;
@@ -499,22 +497,19 @@ static int rtm_to_fib_config(struct sk_buff *skb, struct nlmsghdr *nlh,
         nlmsg_for_each_attr(attr, nlh, sizeof(struct rtmsg), remaining) {
                 switch (attr->nla_type) {
                 case RTA_DST:
-                        cfg->fc_dst = nla_get_u32(attr);
-                        break;
-                case RTA_SRC:
-                        cfg->fc_src = nla_get_u32(attr);
+                        cfg->fc_dst = nla_get_be32(attr);
                         break;
                 case RTA_OIF:
                         cfg->fc_oif = nla_get_u32(attr);
                         break;
                 case RTA_GATEWAY:
-                        cfg->fc_gw = nla_get_u32(attr);
+                        cfg->fc_gw = nla_get_be32(attr);
                         break;
                 case RTA_PRIORITY:
                         cfg->fc_priority = nla_get_u32(attr);
                         break;
                 case RTA_PREFSRC:
-                        cfg->fc_prefsrc = nla_get_u32(attr);
+                        cfg->fc_prefsrc = nla_get_be32(attr);
                         break;
                 case RTA_METRICS:
                         cfg->fc_mx = nla_data(attr);
@@ -627,8 +622,7 @@ out:
    only when netlink is already locked.
  */
 
-static void fib_magic(int cmd, int type, u32 dst, int dst_len,
-                      struct in_ifaddr *ifa)
+static void fib_magic(int cmd, int type, __be32 dst, int dst_len, struct in_ifaddr *ifa)
 {
         struct fib_table *tb;
         struct fib_config cfg = {
@@ -667,9 +661,9 @@ void fib_add_ifaddr(struct in_ifaddr *ifa)
         struct in_device *in_dev = ifa->ifa_dev;
         struct net_device *dev = in_dev->dev;
         struct in_ifaddr *prim = ifa;
-        u32 mask = ifa->ifa_mask;
-        u32 addr = ifa->ifa_local;
-        u32 prefix = ifa->ifa_address&mask;
+        __be32 mask = ifa->ifa_mask;
+        __be32 addr = ifa->ifa_local;
+        __be32 prefix = ifa->ifa_address&mask;
 
         if (ifa->ifa_flags&IFA_F_SECONDARY) {
                 prim = inet_ifa_byprefix(in_dev, prefix, mask);
@@ -685,7 +679,7 @@ void fib_add_ifaddr(struct in_ifaddr *ifa)
                 return;
 
         /* Add broadcast address, if it is explicitly assigned. */
-        if (ifa->ifa_broadcast && ifa->ifa_broadcast != 0xFFFFFFFF)
+        if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF))
                 fib_magic(RTM_NEWROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, prim);
 
         if (!ZERONET(prefix) && !(ifa->ifa_flags&IFA_F_SECONDARY) &&
@@ -707,8 +701,8 @@ static void fib_del_ifaddr(struct in_ifaddr *ifa)
         struct net_device *dev = in_dev->dev;
         struct in_ifaddr *ifa1;
         struct in_ifaddr *prim = ifa;
-        u32 brd = ifa->ifa_address|~ifa->ifa_mask;
-        u32 any = ifa->ifa_address&ifa->ifa_mask;
+        __be32 brd = ifa->ifa_address|~ifa->ifa_mask;
+        __be32 any = ifa->ifa_address&ifa->ifa_mask;
 #define LOCAL_OK        1
 #define BRD_OK          2
 #define BRD0_OK         4
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index 88133b383dc5..107bb6cbb0b3 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -51,7 +51,7 @@ static kmem_cache_t *fn_alias_kmem __read_mostly;
 struct fib_node {
         struct hlist_node       fn_hash;
         struct list_head        fn_alias;
-        u32                     fn_key;
+        __be32                  fn_key;
 };
 
 struct fn_zone {
@@ -64,7 +64,7 @@ struct fn_zone {
 #define FZ_HASHMASK(fz)         ((fz)->fz_hashmask)
 
         int                     fz_order;       /* Zone order           */
-        u32                     fz_mask;
+        __be32                  fz_mask;
 #define FZ_MASK(fz)             ((fz)->fz_mask)
 };
 
@@ -77,7 +77,7 @@ struct fn_hash {
         struct fn_zone  *fn_zone_list;
 };
 
-static inline u32 fn_hash(u32 key, struct fn_zone *fz)
+static inline u32 fn_hash(__be32 key, struct fn_zone *fz)
 {
         u32 h = ntohl(key)>>(32 - fz->fz_order);
         h ^= (h>>20);
@@ -87,7 +87,7 @@ static inline u32 fn_hash(u32 key, struct fn_zone *fz)
         return h;
 }
 
-static inline u32 fz_key(u32 dst, struct fn_zone *fz)
+static inline __be32 fz_key(__be32 dst, struct fn_zone *fz)
 {
         return dst & FZ_MASK(fz);
 }
@@ -254,7 +254,7 @@ fn_hash_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
                 struct hlist_head *head;
                 struct hlist_node *node;
                 struct fib_node *f;
-                u32 k = fz_key(flp->fl4_dst, fz);
+                __be32 k = fz_key(flp->fl4_dst, fz);
 
                 head = &fz->fz_hash[fn_hash(k, fz)];
                 hlist_for_each_entry(f, node, head, fn_hash) {
@@ -365,7 +365,7 @@ static inline void fib_insert_node(struct fn_zone *fz, struct fib_node *f)
 }
 
 /* Return the node in FZ matching KEY. */
-static struct fib_node *fib_find_node(struct fn_zone *fz, u32 key)
+static struct fib_node *fib_find_node(struct fn_zone *fz, __be32 key)
 {
         struct hlist_head *head = &fz->fz_hash[fn_hash(key, fz)];
         struct hlist_node *node;
@@ -387,7 +387,7 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
         struct fn_zone *fz;
         struct fib_info *fi;
         u8 tos = cfg->fc_tos;
-        u32 key;
+        __be32 key;
         int err;
 
         if (cfg->fc_dst_len > 32)
@@ -541,7 +541,7 @@ static int fn_hash_delete(struct fib_table *tb, struct fib_config *cfg)
         struct fib_node *f;
         struct fib_alias *fa, *fa_to_delete;
         struct fn_zone *fz;
-        u32 key;
+        __be32 key;
 
         if (cfg->fc_dst_len > 32)
                 return -EINVAL;
@@ -966,7 +966,7 @@ static void fib_seq_stop(struct seq_file *seq, void *v)
         read_unlock(&fib_hash_lock);
 }
 
-static unsigned fib_flag_trans(int type, u32 mask, struct fib_info *fi)
+static unsigned fib_flag_trans(int type, __be32 mask, struct fib_info *fi)
 {
         static const unsigned type2flags[RTN_MAX + 1] = {
                 [7] = RTF_REJECT, [8] = RTF_REJECT,
@@ -975,7 +975,7 @@ static unsigned fib_flag_trans(int type, u32 mask, struct fib_info *fi)
 
         if (fi && fi->fib_nh->nh_gw)
                 flags |= RTF_GATEWAY;
-        if (mask == 0xFFFFFFFF)
+        if (mask == htonl(0xFFFFFFFF))
                 flags |= RTF_HOST;
         flags |= RTF_UP;
         return flags;
@@ -991,7 +991,7 @@ static int fib_seq_show(struct seq_file *seq, void *v)
 {
         struct fib_iter_state *iter;
         char bf[128];
-        u32 prefix, mask;
+        __be32 prefix, mask;
         unsigned flags;
         struct fib_node *f;
         struct fib_alias *fa;
diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
index fd6f7769f8ab..0e8b70bad4e1 100644
--- a/net/ipv4/fib_lookup.h
+++ b/net/ipv4/fib_lookup.h
@@ -20,16 +20,16 @@ struct fib_alias {
 /* Exported by fib_semantics.c */
 extern int fib_semantic_match(struct list_head *head,
                               const struct flowi *flp,
-                              struct fib_result *res, __u32 zone, __u32 mask,
+                              struct fib_result *res, __be32 zone, __be32 mask,
                                 int prefixlen);
 extern void fib_release_info(struct fib_info *);
 extern struct fib_info *fib_create_info(struct fib_config *cfg);
 extern int fib_nh_match(struct fib_config *cfg, struct fib_info *fi);
 extern int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
-                         u32 tb_id, u8 type, u8 scope, u32 dst,
+                         u32 tb_id, u8 type, u8 scope, __be32 dst,
                          int dst_len, u8 tos, struct fib_info *fi,
                          unsigned int);
-extern void rtmsg_fib(int event, u32 key, struct fib_alias *fa,
+extern void rtmsg_fib(int event, __be32 key, struct fib_alias *fa,
                       int dst_len, u32 tb_id, struct nl_info *info);
 extern struct fib_alias *fib_find_alias(struct list_head *fah,
                                         u8 tos, u32 prio);
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 52b2adae4f22..0852b9cd065a 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -40,10 +40,10 @@ struct fib4_rule
         u8                      dst_len;
         u8                      src_len;
         u8                      tos;
-        u32                     src;
-        u32                     srcmask;
-        u32                     dst;
-        u32                     dstmask;
+        __be32                  src;
+        __be32                  srcmask;
+        __be32                  dst;
+        __be32                  dstmask;
 #ifdef CONFIG_IP_ROUTE_FWMARK
         u32                     fwmark;
         u32                     fwmask;
@@ -150,8 +150,8 @@ void fib_select_default(const struct flowi *flp, struct fib_result *res)
 static int fib4_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 {
         struct fib4_rule *r = (struct fib4_rule *) rule;
-        u32 daddr = fl->fl4_dst;
-        u32 saddr = fl->fl4_src;
+        __be32 daddr = fl->fl4_dst;
+        __be32 saddr = fl->fl4_src;
 
         if (((saddr ^ r->src) & r->srcmask) ||
             ((daddr ^ r->dst) & r->dstmask))
@@ -215,10 +215,10 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
         }
 
         if (tb[FRA_SRC])
-                rule4->src = nla_get_u32(tb[FRA_SRC]);
+                rule4->src = nla_get_be32(tb[FRA_SRC]);
 
         if (tb[FRA_DST])
-                rule4->dst = nla_get_u32(tb[FRA_DST]);
+                rule4->dst = nla_get_be32(tb[FRA_DST]);
 
 #ifdef CONFIG_IP_ROUTE_FWMARK
         if (tb[FRA_FWMARK]) {
@@ -277,10 +277,10 @@ static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
                 return 0;
 #endif
 
-        if (tb[FRA_SRC] && (rule4->src != nla_get_u32(tb[FRA_SRC])))
+        if (tb[FRA_SRC] && (rule4->src != nla_get_be32(tb[FRA_SRC])))
                 return 0;
 
-        if (tb[FRA_DST] && (rule4->dst != nla_get_u32(tb[FRA_DST])))
+        if (tb[FRA_DST] && (rule4->dst != nla_get_be32(tb[FRA_DST])))
                 return 0;
 
         return 1;
@@ -305,10 +305,10 @@ static int fib4_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
 #endif
 
         if (rule4->dst_len)
-                NLA_PUT_U32(skb, FRA_DST, rule4->dst);
+                NLA_PUT_BE32(skb, FRA_DST, rule4->dst);
 
         if (rule4->src_len)
-                NLA_PUT_U32(skb, FRA_SRC, rule4->src);
+                NLA_PUT_BE32(skb, FRA_SRC, rule4->src);
 
 #ifdef CONFIG_NET_CLS_ROUTE
         if (rule4->tclassid)
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 2ead09543f68..884d176e0082 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -203,7 +203,7 @@ static inline unsigned int fib_info_hashfn(const struct fib_info *fi)
         unsigned int val = fi->fib_nhs;
 
         val ^= fi->fib_protocol;
-        val ^= fi->fib_prefsrc;
+        val ^= (__force u32)fi->fib_prefsrc;
         val ^= fi->fib_priority;
 
         return (val ^ (val >> 7) ^ (val >> 12)) & mask;
@@ -248,7 +248,7 @@ static inline unsigned int fib_devindex_hashfn(unsigned int val)
    Used only by redirect accept routine.
  */
 
-int ip_fib_check_default(u32 gw, struct net_device *dev)
+int ip_fib_check_default(__be32 gw, struct net_device *dev)
 {
         struct hlist_head *head;
         struct hlist_node *node;
@@ -273,7 +273,7 @@ int ip_fib_check_default(u32 gw, struct net_device *dev)
         return -1;
 }
 
-void rtmsg_fib(int event, u32 key, struct fib_alias *fa,
+void rtmsg_fib(int event, __be32 key, struct fib_alias *fa,
                int dst_len, u32 tb_id, struct nl_info *info)
 {
         struct sk_buff *skb;
@@ -374,7 +374,7 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,
                         struct nlattr *nla, *attrs = rtnh_attrs(rtnh);
 
                         nla = nla_find(attrs, attrlen, RTA_GATEWAY);
-                        nh->nh_gw = nla ? nla_get_u32(nla) : 0;
+                        nh->nh_gw = nla ? nla_get_be32(nla) : 0;
 #ifdef CONFIG_NET_CLS_ROUTE
                         nla = nla_find(attrs, attrlen, RTA_FLOW);
                         nh->nh_tclassid = nla ? nla_get_u32(nla) : 0;
@@ -427,7 +427,7 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi)
                         struct nlattr *nla, *attrs = rtnh_attrs(rtnh);
 
                         nla = nla_find(attrs, attrlen, RTA_GATEWAY);
-                        if (nla && nla_get_u32(nla) != nh->nh_gw)
+                        if (nla && nla_get_be32(nla) != nh->nh_gw)
                                 return 1;
 #ifdef CONFIG_NET_CLS_ROUTE
                         nla = nla_find(attrs, attrlen, RTA_FLOW);
@@ -568,11 +568,11 @@ out:
         return 0;
 }
 
-static inline unsigned int fib_laddr_hashfn(u32 val)
+static inline unsigned int fib_laddr_hashfn(__be32 val)
 {
         unsigned int mask = (fib_hash_size - 1);
 
-        return (val ^ (val >> 7) ^ (val >> 14)) & mask;
+        return ((__force u32)val ^ ((__force u32)val >> 7) ^ ((__force u32)val >> 14)) & mask;
 }
 
 static struct hlist_head *fib_hash_alloc(int bytes)
@@ -847,7 +847,7 @@ failure:
 
 /* Note! fib_semantic_match intentionally uses  RCU list functions. */
 int fib_semantic_match(struct list_head *head, const struct flowi *flp,
-                       struct fib_result *res, __u32 zone, __u32 mask, 
+                       struct fib_result *res, __be32 zone, __be32 mask,
                         int prefixlen)
 {
         struct fib_alias *fa;
@@ -914,8 +914,7 @@ out_fill_res:
         res->fi = fa->fa_info;
 #ifdef CONFIG_IP_ROUTE_MULTIPATH_CACHED
         res->netmask = mask;
-        res->network = zone &
-                (0xFFFFFFFF >> (32 - prefixlen));
+        res->network = zone & inet_make_mask(prefixlen);
 #endif
         atomic_inc(&res->fi->fib_clntref);
         return 0;
@@ -923,13 +922,13 @@ out_fill_res:
 
 /* Find appropriate source address to this destination */
 
-u32 __fib_res_prefsrc(struct fib_result *res)
+__be32 __fib_res_prefsrc(struct fib_result *res)
 {
         return inet_select_addr(FIB_RES_DEV(*res), FIB_RES_GW(*res), res->scope);
 }
 
 int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
-                  u32 tb_id, u8 type, u8 scope, u32 dst, int dst_len, u8 tos,
+                  u32 tb_id, u8 type, u8 scope, __be32 dst, int dst_len, u8 tos,
                   struct fib_info *fi, unsigned int flags)
 {
         struct nlmsghdr *nlh;
@@ -952,7 +951,7 @@ int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
         rtm->rtm_protocol = fi->fib_protocol;
 
         if (rtm->rtm_dst_len)
-                NLA_PUT_U32(skb, RTA_DST, dst);
+                NLA_PUT_BE32(skb, RTA_DST, dst);
 
         if (fi->fib_priority)
                 NLA_PUT_U32(skb, RTA_PRIORITY, fi->fib_priority);
@@ -961,11 +960,11 @@ int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
                 goto nla_put_failure;
 
         if (fi->fib_prefsrc)
-                NLA_PUT_U32(skb, RTA_PREFSRC, fi->fib_prefsrc);
+                NLA_PUT_BE32(skb, RTA_PREFSRC, fi->fib_prefsrc);
 
         if (fi->fib_nhs == 1) {
                 if (fi->fib_nh->nh_gw)
-                        NLA_PUT_U32(skb, RTA_GATEWAY, fi->fib_nh->nh_gw);
+                        NLA_PUT_BE32(skb, RTA_GATEWAY, fi->fib_nh->nh_gw);
 
                 if (fi->fib_nh->nh_oif)
                         NLA_PUT_U32(skb, RTA_OIF, fi->fib_nh->nh_oif);
@@ -993,7 +992,7 @@ int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
                         rtnh->rtnh_ifindex = nh->nh_oif;
 
                         if (nh->nh_gw)
-                                NLA_PUT_U32(skb, RTA_GATEWAY, nh->nh_gw);
+                                NLA_PUT_BE32(skb, RTA_GATEWAY, nh->nh_gw);
 #ifdef CONFIG_NET_CLS_ROUTE
                         if (nh->nh_tclassid)
                                 NLA_PUT_U32(skb, RTA_FLOW, nh->nh_tclassid);
@@ -1018,7 +1017,7 @@ nla_put_failure:
    - device went down -> we must shutdown all nexthops going via it.
  */
 
-int fib_sync_down(u32 local, struct net_device *dev, int force)
+int fib_sync_down(__be32 local, struct net_device *dev, int force)
 {
         int ret = 0;
         int scope = RT_SCOPE_NOWHERE;
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 9c3ff6ba6e21..d17990ec724f 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1834,7 +1834,7 @@ static int fn_trie_dump_fa(t_key key, int plen, struct list_head *fah, struct fi
         int i, s_i;
         struct fib_alias *fa;
 
-        u32 xkey = htonl(key);
+        __be32 xkey = htonl(key);
 
         s_i = cb->args[4];
         i = 0;
@@ -2281,7 +2281,7 @@ static int fib_trie_seq_show(struct seq_file *seq, void *v)
 
         if (IS_TNODE(n)) {
                 struct tnode *tn = (struct tnode *) n;
-                t_key prf = ntohl(MASK_PFX(tn->key, tn->pos));
+                __be32 prf = htonl(MASK_PFX(tn->key, tn->pos));
 
                 if (!NODE_PARENT(n)) {
                         if (iter->trie == trie_local)
@@ -2297,7 +2297,7 @@ static int fib_trie_seq_show(struct seq_file *seq, void *v)
         } else {
                 struct leaf *l = (struct leaf *) n;
                 int i;
-                u32 val = ntohl(l->key);
+                __be32 val = htonl(l->key);
 
                 seq_indent(seq, iter->depth);
                 seq_printf(seq, "  |-- %d.%d.%d.%d\n", NIPQUAD(val));
@@ -2360,7 +2360,7 @@ static struct file_operations fib_trie_fops = {
         .release = seq_release_private,
 };
 
-static unsigned fib_flag_trans(int type, u32 mask, const struct fib_info *fi)
+static unsigned fib_flag_trans(int type, __be32 mask, const struct fib_info *fi)
 {
         static unsigned type2flags[RTN_MAX + 1] = {
                 [7] = RTF_REJECT, [8] = RTF_REJECT,
@@ -2369,7 +2369,7 @@ static unsigned fib_flag_trans(int type, u32 mask, const struct fib_info *fi)
 
         if (fi && fi->fib_nh->nh_gw)
                 flags |= RTF_GATEWAY;
-        if (mask == 0xFFFFFFFF)
+        if (mask == htonl(0xFFFFFFFF))
                 flags |= RTF_HOST;
         flags |= RTF_UP;
         return flags;
@@ -2403,7 +2403,7 @@ static int fib_route_seq_show(struct seq_file *seq, void *v)
         for (i=32; i>=0; i--) {
                 struct leaf_info *li = find_leaf_info(l, i);
                 struct fib_alias *fa;
-                u32 mask, prefix;
+                __be32 mask, prefix;
 
                 if (!li)
                         continue;
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index c2ad07e48ab4..b39a37a47545 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -104,7 +104,7 @@ struct icmp_bxm {
 
         struct {
                 struct icmphdr icmph;
-                __u32          times[3];
+                __be32         times[3];
         } data;
         int head_len;
         struct ip_options replyopts;
@@ -381,7 +381,7 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
         struct inet_sock *inet = inet_sk(sk);
         struct ipcm_cookie ipc;
         struct rtable *rt = (struct rtable *)skb->dst;
-        u32 daddr;
+        __be32 daddr;
 
         if (ip_options_echo(&icmp_param->replyopts, skb))
                 return;
@@ -430,14 +430,14 @@ out_unlock:
  *                      MUST reply to only the first fragment.
  */
 
-void icmp_send(struct sk_buff *skb_in, int type, int code, u32 info)
+void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
 {
         struct iphdr *iph;
         int room;
         struct icmp_bxm icmp_param;
         struct rtable *rt = (struct rtable *)skb_in->dst;
         struct ipcm_cookie ipc;
-        u32 saddr;
+        __be32 saddr;
         u8  tos;
 
         if (!rt)
@@ -895,7 +895,7 @@ static void icmp_address_reply(struct sk_buff *skb)
         if (in_dev->ifa_list &&
             IN_DEV_LOG_MARTIANS(in_dev) &&
             IN_DEV_FORWARD(in_dev)) {
-                u32 _mask, *mp;
+                __be32 _mask, *mp;
 
                 mp = skb_header_pointer(skb, 0, sizeof(_mask), &_mask);
                 BUG_ON(mp == NULL);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 58be8227b0cb..6eee71647b7c 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -138,14 +138,14 @@
                 time_before(jiffies, (in_dev)->mr_v2_seen)))
 
 static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im);
-static void igmpv3_del_delrec(struct in_device *in_dev, __u32 multiaddr);
+static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr);
 static void igmpv3_clear_delrec(struct in_device *in_dev);
 static int sf_setstate(struct ip_mc_list *pmc);
 static void sf_markstate(struct ip_mc_list *pmc);
 #endif
 static void ip_mc_clear_src(struct ip_mc_list *pmc);
-static int ip_mc_add_src(struct in_device *in_dev, __u32 *pmca, int sfmode,
-                         int sfcount, __u32 *psfsrc, int delta);
+static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
+                         int sfcount, __be32 *psfsrc, int delta);
 
 static void ip_ma_put(struct ip_mc_list *im)
 {
@@ -426,7 +426,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
         first = 1;
         psf_prev = NULL;
         for (psf=*psf_list; psf; psf=psf_next) {
-                u32 *psrc;
+                __be32 *psrc;
 
                 psf_next = psf->sf_next;
 
@@ -439,7 +439,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
                 if (isquery)
                         psf->sf_gsresp = 0;
 
-                if (AVAILABLE(skb) < sizeof(u32) +
+                if (AVAILABLE(skb) < sizeof(__be32) +
                     first*sizeof(struct igmpv3_grec)) {
                         if (truncate && !first)
                                 break;   /* truncate these */
@@ -455,7 +455,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
                         skb = add_grhead(skb, pmc, type, &pgr);
                         first = 0;
                 }
-                psrc = (u32 *)skb_put(skb, sizeof(u32));
+                psrc = (__be32 *)skb_put(skb, sizeof(__be32));
                 *psrc = psf->sf_inaddr;
                 scount++; stotal++;
                 if ((type == IGMPV3_ALLOW_NEW_SOURCES ||
@@ -630,8 +630,8 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
         struct igmphdr *ih;
         struct rtable *rt;
         struct net_device *dev = in_dev->dev;
-        u32     group = pmc ? pmc->multiaddr : 0;
-        u32     dst;
+        __be32  group = pmc ? pmc->multiaddr : 0;
+        __be32  dst;
 
         if (type == IGMPV3_HOST_MEMBERSHIP_REPORT)
                 return igmpv3_send_report(in_dev, pmc);
@@ -748,7 +748,7 @@ static void igmp_timer_expire(unsigned long data)
 }
 
 /* mark EXCLUDE-mode sources */
-static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __u32 *srcs)
+static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
 {
         struct ip_sf_list *psf;
         int i, scount;
@@ -775,7 +775,7 @@ static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __u32 *srcs)
         return 1;
 }
 
-static int igmp_marksources(struct ip_mc_list *pmc, int nsrcs, __u32 *srcs)
+static int igmp_marksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
 {
         struct ip_sf_list *psf;
         int i, scount;
@@ -803,7 +803,7 @@ static int igmp_marksources(struct ip_mc_list *pmc, int nsrcs, __u32 *srcs)
         return 1;
 }
 
-static void igmp_heard_report(struct in_device *in_dev, u32 group)
+static void igmp_heard_report(struct in_device *in_dev, __be32 group)
 {
         struct ip_mc_list *im;
 
@@ -828,7 +828,7 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
         struct igmphdr          *ih = skb->h.igmph;
         struct igmpv3_query *ih3 = (struct igmpv3_query *)ih;
         struct ip_mc_list       *im;
-        u32                     group = ih->group;
+        __be32                  group = ih->group;
         int                     max_delay;
         int                     mark = 0;
 
@@ -862,7 +862,7 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
                 ih3 = (struct igmpv3_query *) skb->h.raw;
                 if (ih3->nsrcs) {
                         if (!pskb_may_pull(skb, sizeof(struct igmpv3_query) 
-                                           + ntohs(ih3->nsrcs)*sizeof(__u32)))
+                                           + ntohs(ih3->nsrcs)*sizeof(__be32)))
                                 return;
                         ih3 = (struct igmpv3_query *) skb->h.raw;
                 }
@@ -985,7 +985,7 @@ drop:
  *      Add a filter to a device
  */
 
-static void ip_mc_filter_add(struct in_device *in_dev, u32 addr)
+static void ip_mc_filter_add(struct in_device *in_dev, __be32 addr)
 {
         char buf[MAX_ADDR_LEN];
         struct net_device *dev = in_dev->dev;
@@ -1005,7 +1005,7 @@ static void ip_mc_filter_add(struct in_device *in_dev, u32 addr)
  *      Remove a filter from a device
  */
 
-static void ip_mc_filter_del(struct in_device *in_dev, u32 addr)
+static void ip_mc_filter_del(struct in_device *in_dev, __be32 addr)
 {
         char buf[MAX_ADDR_LEN];
         struct net_device *dev = in_dev->dev;
@@ -1055,7 +1055,7 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
         spin_unlock_bh(&in_dev->mc_tomb_lock);
 }
 
-static void igmpv3_del_delrec(struct in_device *in_dev, __u32 multiaddr)
+static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr)
 {
         struct ip_mc_list *pmc, *pmc_prev;
         struct ip_sf_list *psf, *psf_next;
@@ -1193,7 +1193,7 @@ static void igmp_group_added(struct ip_mc_list *im)
  *      A socket has joined a multicast group on device dev.
  */
 
-void ip_mc_inc_group(struct in_device *in_dev, u32 addr)
+void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
 {
         struct ip_mc_list *im;
 
@@ -1252,7 +1252,7 @@ out:
  *      A socket has left a multicast group on device dev
  */
 
-void ip_mc_dec_group(struct in_device *in_dev, u32 addr)
+void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
 {
         struct ip_mc_list *i, **ip;
         
@@ -1402,7 +1402,7 @@ int sysctl_igmp_max_msf __read_mostly = IP_MAX_MSF;
 
 
 static int ip_mc_del1_src(struct ip_mc_list *pmc, int sfmode,
-        __u32 *psfsrc)
+        __be32 *psfsrc)
 {
         struct ip_sf_list *psf, *psf_prev;
         int rv = 0;
@@ -1450,8 +1450,8 @@ static int ip_mc_del1_src(struct ip_mc_list *pmc, int sfmode,
 #define igmp_ifc_event(x)       do { } while (0)
 #endif
 
-static int ip_mc_del_src(struct in_device *in_dev, __u32 *pmca, int sfmode,
-                         int sfcount, __u32 *psfsrc, int delta)
+static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
+                         int sfcount, __be32 *psfsrc, int delta)
 {
         struct ip_mc_list *pmc;
         int     changerec = 0;
@@ -1517,7 +1517,7 @@ out_unlock:
  * Add multicast single-source filter to the interface list
  */
 static int ip_mc_add1_src(struct ip_mc_list *pmc, int sfmode,
-        __u32 *psfsrc, int delta)
+        __be32 *psfsrc, int delta)
 {
         struct ip_sf_list *psf, *psf_prev;
 
@@ -1623,8 +1623,8 @@ static int sf_setstate(struct ip_mc_list *pmc)
 /*
  * Add multicast source filter list to the interface list
  */
-static int ip_mc_add_src(struct in_device *in_dev, __u32 *pmca, int sfmode,
-                         int sfcount, __u32 *psfsrc, int delta)
+static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
+                         int sfcount, __be32 *psfsrc, int delta)
 {
         struct ip_mc_list *pmc;
         int     isexclude;
@@ -1717,7 +1717,7 @@ static void ip_mc_clear_src(struct ip_mc_list *pmc)
 int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
 {
         int err;
-        u32 addr = imr->imr_multiaddr.s_addr;
+        __be32 addr = imr->imr_multiaddr.s_addr;
         struct ip_mc_socklist *iml=NULL, *i;
         struct in_device *in_dev;
         struct inet_sock *inet = inet_sk(sk);
@@ -1791,7 +1791,7 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
         struct inet_sock *inet = inet_sk(sk);
         struct ip_mc_socklist *iml, **imlp;
         struct in_device *in_dev;
-        u32 group = imr->imr_multiaddr.s_addr;
+        __be32 group = imr->imr_multiaddr.s_addr;
         u32 ifindex;
         int ret = -EADDRNOTAVAIL;
 
@@ -1829,7 +1829,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
 {
         int err;
         struct ip_mreqn imr;
-        u32 addr = mreqs->imr_multiaddr;
+        __be32 addr = mreqs->imr_multiaddr;
         struct ip_mc_socklist *pmc;
         struct in_device *in_dev = NULL;
         struct inet_sock *inet = inet_sk(sk);
@@ -1883,7 +1883,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                 rv = !0;
                 for (i=0; i<psl->sl_count; i++) {
                         rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
-                                sizeof(__u32));
+                                sizeof(__be32));
                         if (rv == 0)
                                 break;
                 }
@@ -1935,7 +1935,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
         rv = 1; /* > 0 for insert logic below if sl_count is 0 */
         for (i=0; i<psl->sl_count; i++) {
                 rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
-                        sizeof(__u32));
+                        sizeof(__be32));
                 if (rv == 0)
                         break;
         }
@@ -1960,7 +1960,7 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
 {
         int err = 0;
         struct ip_mreqn imr;
-        u32 addr = msf->imsf_multiaddr;
+        __be32 addr = msf->imsf_multiaddr;
         struct ip_mc_socklist *pmc;
         struct in_device *in_dev;
         struct inet_sock *inet = inet_sk(sk);
@@ -2044,7 +2044,7 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
 {
         int err, len, count, copycount;
         struct ip_mreqn imr;
-        u32 addr = msf->imsf_multiaddr;
+        __be32 addr = msf->imsf_multiaddr;
         struct ip_mc_socklist *pmc;
         struct in_device *in_dev;
         struct inet_sock *inet = inet_sk(sk);
@@ -2103,7 +2103,7 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
 {
         int err, i, count, copycount;
         struct sockaddr_in *psin;
-        u32 addr;
+        __be32 addr;
         struct ip_mc_socklist *pmc;
         struct inet_sock *inet = inet_sk(sk);
         struct ip_sf_socklist *psl;
@@ -2156,7 +2156,7 @@ done:
 /*
  * check if a multicast source filter allows delivery for a given <src,dst,intf>
  */
-int ip_mc_sf_allow(struct sock *sk, u32 loc_addr, u32 rmt_addr, int dif)
+int ip_mc_sf_allow(struct sock *sk, __be32 loc_addr, __be32 rmt_addr, int dif)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct ip_mc_socklist *pmc;
@@ -2216,7 +2216,7 @@ void ip_mc_drop_socket(struct sock *sk)
         rtnl_unlock();
 }
 
-int ip_check_mc(struct in_device *in_dev, u32 mc_addr, u32 src_addr, u16 proto)
+int ip_check_mc(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u16 proto)
 {
         struct ip_mc_list *im;
         struct ip_sf_list *psf;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 07204391d083..96bbe2a0aa1b 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -39,7 +39,7 @@ int sysctl_local_port_range[2] = { 1024, 4999 };
 int inet_csk_bind_conflict(const struct sock *sk,
                            const struct inet_bind_bucket *tb)
 {
-        const u32 sk_rcv_saddr = inet_rcv_saddr(sk);
+        const __be32 sk_rcv_saddr = inet_rcv_saddr(sk);
         struct sock *sk2;
         struct hlist_node *node;
         int reuse = sk->sk_reuse;
@@ -52,7 +52,7 @@ int inet_csk_bind_conflict(const struct sock *sk,
                      sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) {
                         if (!reuse || !sk2->sk_reuse ||
                             sk2->sk_state == TCP_LISTEN) {
-                                const u32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
+                                const __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
                                 if (!sk2_rcv_saddr || !sk_rcv_saddr ||
                                     sk2_rcv_saddr == sk_rcv_saddr)
                                         break;
@@ -342,10 +342,10 @@ struct dst_entry* inet_csk_route_req(struct sock *sk,
 
 EXPORT_SYMBOL_GPL(inet_csk_route_req);
 
-static inline u32 inet_synq_hash(const u32 raddr, const u16 rport,
+static inline u32 inet_synq_hash(const __be32 raddr, const __be16 rport,
                                  const u32 rnd, const u16 synq_hsize)
 {
-        return jhash_2words(raddr, (u32)rport, rnd) & (synq_hsize - 1);
+        return jhash_2words((__force u32)raddr, (__force u32)rport, rnd) & (synq_hsize - 1);
 }
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
@@ -356,8 +356,8 @@ static inline u32 inet_synq_hash(const u32 raddr, const u16 rport,
 
 struct request_sock *inet_csk_search_req(const struct sock *sk,
                                          struct request_sock ***prevp,
-                                         const __u16 rport, const __u32 raddr,
-                                         const __u32 laddr)
+                                         const __be16 rport, const __be32 raddr,
+                                         const __be32 laddr)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct listen_sock *lopt = icsk->icsk_accept_queue.listen_opt;
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 492858e6faf0..77761ac4f7bb 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -36,8 +36,8 @@
 static const struct inet_diag_handler **inet_diag_table;
 
 struct inet_diag_entry {
-        u32 *saddr;
-        u32 *daddr;
+        __be32 *saddr;
+        __be32 *daddr;
         u16 sport;
         u16 dport;
         u16 family;
@@ -294,7 +294,7 @@ out:
         return err;
 }
 
-static int bitstring_match(const u32 *a1, const u32 *a2, int bits)
+static int bitstring_match(const __be32 *a1, const __be32 *a2, int bits)
 {
         int words = bits >> 5;
 
@@ -305,8 +305,8 @@ static int bitstring_match(const u32 *a1, const u32 *a2, int bits)
                         return 0;
         }
         if (bits) {
-                __u32 w1, w2;
-                __u32 mask;
+                __be32 w1, w2;
+                __be32 mask;
 
                 w1 = a1[words];
                 w2 = a2[words];
@@ -352,7 +352,7 @@ static int inet_diag_bc_run(const void *bc, int len,
                 case INET_DIAG_BC_S_COND:
                 case INET_DIAG_BC_D_COND: {
                         struct inet_diag_hostcond *cond;
-                        u32 *addr;
+                        __be32 *addr;
 
                         cond = (struct inet_diag_hostcond *)(op + 1);
                         if (cond->port != -1 &&
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index fb296c9a7f3f..244c4f445c7d 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -125,7 +125,7 @@ EXPORT_SYMBOL(inet_listen_wlock);
  * wildcarded during the search since they can never be otherwise.
  */
 static struct sock *inet_lookup_listener_slow(const struct hlist_head *head,
-                                              const u32 daddr,
+                                              const __be32 daddr,
                                               const unsigned short hnum,
                                               const int dif)
 {
@@ -137,7 +137,7 @@ static struct sock *inet_lookup_listener_slow(const struct hlist_head *head,
                 const struct inet_sock *inet = inet_sk(sk);
 
                 if (inet->num == hnum && !ipv6_only_sock(sk)) {
-                        const __u32 rcv_saddr = inet->rcv_saddr;
+                        const __be32 rcv_saddr = inet->rcv_saddr;
                         int score = sk->sk_family == PF_INET ? 1 : 0;
 
                         if (rcv_saddr) {
@@ -163,7 +163,7 @@ static struct sock *inet_lookup_listener_slow(const struct hlist_head *head,
 
 /* Optimize the common listener case. */
 struct sock *__inet_lookup_listener(struct inet_hashinfo *hashinfo,
-                                    const u32 daddr, const unsigned short hnum,
+                                    const __be32 daddr, const unsigned short hnum,
                                     const int dif)
 {
         struct sock *sk = NULL;
@@ -197,11 +197,11 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
         struct inet_sock *inet = inet_sk(sk);
-        u32 daddr = inet->rcv_saddr;
-        u32 saddr = inet->daddr;
+        __be32 daddr = inet->rcv_saddr;
+        __be32 saddr = inet->daddr;
         int dif = sk->sk_bound_dev_if;
         INET_ADDR_COOKIE(acookie, saddr, daddr)
-        const __u32 ports = INET_COMBINED_PORTS(inet->dport, lport);
+        const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
         unsigned int hash = inet_ehashfn(daddr, lport, saddr, inet->dport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
         struct sock *sk2;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index a675602ef295..f072f3875af8 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -94,10 +94,8 @@ int inet_peer_minttl = 120 * HZ;	/* TTL under high load: 120 sec */
 int inet_peer_maxttl = 10 * 60 * HZ;    /* usual time to live: 10 min */
 
 static struct inet_peer *inet_peer_unused_head;
-/* Exported for inet_putpeer inline function.  */
-struct inet_peer **inet_peer_unused_tailp = &inet_peer_unused_head;
-DEFINE_SPINLOCK(inet_peer_unused_lock);
-#define PEER_MAX_CLEANUP_WORK 30
+static struct inet_peer **inet_peer_unused_tailp = &inet_peer_unused_head;
+static DEFINE_SPINLOCK(inet_peer_unused_lock);
 
 static void peer_check_expire(unsigned long dummy);
 static DEFINE_TIMER(peer_periodic_timer, peer_check_expire, 0, 0);
@@ -163,7 +161,7 @@ static void unlink_from_unused(struct inet_peer *p)
         for (u = peer_root; u != peer_avl_empty; ) {            \
                 if (daddr == u->v4daddr)                        \
                         break;                                  \
-                if (daddr < u->v4daddr)                         \
+                if ((__force __u32)daddr < (__force __u32)u->v4daddr)   \
                         v = &u->avl_left;                       \
                 else                                            \
                         v = &u->avl_right;                      \
@@ -340,7 +338,8 @@ static int cleanup_once(unsigned long ttl)
         spin_lock_bh(&inet_peer_unused_lock);
         p = inet_peer_unused_head;
         if (p != NULL) {
-                if (time_after(p->dtime + ttl, jiffies)) {
+                __u32 delta = (__u32)jiffies - p->dtime;
+                if (delta < ttl) {
                         /* Do not prune fresh entries. */
                         spin_unlock_bh(&inet_peer_unused_lock);
                         return -1;
@@ -368,7 +367,7 @@ static int cleanup_once(unsigned long ttl)
 }
 
 /* Called with or without local BH being disabled. */
-struct inet_peer *inet_getpeer(__u32 daddr, int create)
+struct inet_peer *inet_getpeer(__be32 daddr, int create)
 {
         struct inet_peer *p, *n;
         struct inet_peer **stack[PEER_MAXDEPTH], ***stackptr;
@@ -432,7 +431,7 @@ out_free:
 /* Called with local BH disabled. */
 static void peer_check_expire(unsigned long dummy)
 {
-        int i;
+        unsigned long now = jiffies;
         int ttl;
 
         if (peer_total >= inet_peer_threshold)
@@ -441,7 +440,10 @@ static void peer_check_expire(unsigned long dummy)
                 ttl = inet_peer_maxttl
                                 - (inet_peer_maxttl - inet_peer_minttl) / HZ *
                                         peer_total / inet_peer_threshold * HZ;
-        for (i = 0; i < PEER_MAX_CLEANUP_WORK && !cleanup_once(ttl); i++);
+        while (!cleanup_once(ttl)) {
+                if (jiffies != now)
+                        break;
+        }
 
         /* Trigger the timer after inet_peer_gc_mintime .. inet_peer_gc_maxtime
          * interval depending on the total number of entries (more entries,
@@ -455,3 +457,16 @@ static void peer_check_expire(unsigned long dummy)
                                 peer_total / inet_peer_threshold * HZ;
         add_timer(&peer_periodic_timer);
 }
+
+void inet_putpeer(struct inet_peer *p)
+{
+        spin_lock_bh(&inet_peer_unused_lock);
+        if (atomic_dec_and_test(&p->refcnt)) {
+                p->unused_prevp = inet_peer_unused_tailp;
+                p->unused_next = NULL;
+                *inet_peer_unused_tailp = p;
+                inet_peer_unused_tailp = &p->unused_next;
+                p->dtime = (__u32)jiffies;
+        }
+        spin_unlock_bh(&inet_peer_unused_lock);
+}
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 165d72859ddf..74046efdf875 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -77,9 +77,9 @@ struct ipq {
         struct hlist_node list;
         struct list_head lru_list;      /* lru list member                      */
         u32             user;
-        u32             saddr;
-        u32             daddr;
-        u16             id;
+        __be32          saddr;
+        __be32          daddr;
+        __be16          id;
         u8              protocol;
         u8              last_in;
 #define COMPLETE                4
@@ -123,9 +123,10 @@ static __inline__ void ipq_unlink(struct ipq *ipq)
         write_unlock(&ipfrag_lock);
 }
 
-static unsigned int ipqhashfn(u16 id, u32 saddr, u32 daddr, u8 prot)
+static unsigned int ipqhashfn(__be16 id, __be32 saddr, __be32 daddr, u8 prot)
 {
-        return jhash_3words((u32)id << 16 | prot, saddr, daddr,
+        return jhash_3words((__force u32)id << 16 | prot,
+                            (__force u32)saddr, (__force u32)daddr,
                             ipfrag_hash_rnd) & (IPQ_HASHSZ - 1);
 }
 
@@ -387,8 +388,8 @@ out_nomem:
 static inline struct ipq *ip_find(struct iphdr *iph, u32 user)
 {
         __be16 id = iph->id;
-        __u32 saddr = iph->saddr;
-        __u32 daddr = iph->daddr;
+        __be32 saddr = iph->saddr;
+        __be32 daddr = iph->daddr;
         __u8 protocol = iph->protocol;
         unsigned int hash;
         struct ipq *qp;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index f5fba051df3d..d5b5dec075b8 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -611,8 +611,8 @@ static int ipgre_rcv(struct sk_buff *skb)
                  * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
                  */
                 if (flags == 0 &&
-                    skb->protocol == __constant_htons(ETH_P_WCCP)) {
-                        skb->protocol = __constant_htons(ETH_P_IP);
+                    skb->protocol == htons(ETH_P_WCCP)) {
+                        skb->protocol = htons(ETH_P_IP);
                         if ((*(h + offset) & 0xF0) != 0x40) 
                                 offset += 4;
                 }
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index e7437c091326..8dabbfc31267 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -38,7 +38,7 @@
  */
 
 void ip_options_build(struct sk_buff * skb, struct ip_options * opt,
-                            u32 daddr, struct rtable *rt, int is_frag) 
+                            __be32 daddr, struct rtable *rt, int is_frag)
 {
         unsigned char * iph = skb->nh.raw;
 
@@ -57,7 +57,7 @@ void ip_options_build(struct sk_buff * skb, struct ip_options * opt,
                         ip_rt_get_source(iph+opt->ts+iph[opt->ts+2]-9, rt);
                 if (opt->ts_needtime) {
                         struct timeval tv;
-                        __u32 midtime;
+                        __be32 midtime;
                         do_gettimeofday(&tv);
                         midtime = htonl((tv.tv_sec % 86400) * 1000 + tv.tv_usec / 1000);
                         memcpy(iph+opt->ts+iph[opt->ts+2]-5, &midtime, 4);
@@ -91,7 +91,7 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
         unsigned char *sptr, *dptr;
         int soffset, doffset;
         int     optlen;
-        u32     daddr;
+        __be32  daddr;
 
         memset(dopt, 0, sizeof(struct ip_options));
 
@@ -148,7 +148,7 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
                                         dopt->ts_needtime = 0;
 
                                         if (soffset + 8 <= optlen) {
-                                                __u32 addr;
+                                                __be32 addr;
 
                                                 memcpy(&addr, sptr+soffset-1, 4);
                                                 if (inet_addr_type(addr) != RTN_LOCAL) {
@@ -165,7 +165,7 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
         }
         if (sopt->srr) {
                 unsigned char * start = sptr+sopt->srr;
-                u32 faddr;
+                __be32 faddr;
 
                 optlen  = start[1];
                 soffset = start[2];
@@ -362,7 +362,7 @@ int ip_options_compile(struct ip_options * opt, struct sk_buff * skb)
                                 goto error;
                         }
                         if (optptr[2] <= optlen) {
-                                __u32 * timeptr = NULL;
+                                __be32 *timeptr = NULL;
                                 if (optptr[2]+3 > optptr[1]) {
                                         pp_ptr = optptr + 2;
                                         goto error;
@@ -371,7 +371,7 @@ int ip_options_compile(struct ip_options * opt, struct sk_buff * skb)
                                       case IPOPT_TS_TSONLY:
                                         opt->ts = optptr - iph;
                                         if (skb) 
-                                                timeptr = (__u32*)&optptr[optptr[2]-1];
+                                                timeptr = (__be32*)&optptr[optptr[2]-1];
                                         opt->ts_needtime = 1;
                                         optptr[2] += 4;
                                         break;
@@ -383,7 +383,7 @@ int ip_options_compile(struct ip_options * opt, struct sk_buff * skb)
                                         opt->ts = optptr - iph;
                                         if (skb) {
                                                 memcpy(&optptr[optptr[2]-1], &rt->rt_spec_dst, 4);
-                                                timeptr = (__u32*)&optptr[optptr[2]+3];
+                                                timeptr = (__be32*)&optptr[optptr[2]+3];
                                         }
                                         opt->ts_needaddr = 1;
                                         opt->ts_needtime = 1;
@@ -396,12 +396,12 @@ int ip_options_compile(struct ip_options * opt, struct sk_buff * skb)
                                         }
                                         opt->ts = optptr - iph;
                                         {
-                                                u32 addr;
+                                                __be32 addr;
                                                 memcpy(&addr, &optptr[optptr[2]-1], 4);
                                                 if (inet_addr_type(addr) == RTN_UNICAST)
                                                         break;
                                                 if (skb)
-                                                        timeptr = (__u32*)&optptr[optptr[2]+3];
+                                                        timeptr = (__be32*)&optptr[optptr[2]+3];
                                         }
                                         opt->ts_needtime = 1;
                                         optptr[2] += 8;
@@ -415,10 +415,10 @@ int ip_options_compile(struct ip_options * opt, struct sk_buff * skb)
                                 }
                                 if (timeptr) {
                                         struct timeval tv;
-                                        __u32  midtime;
+                                        __be32  midtime;
                                         do_gettimeofday(&tv);
                                         midtime = htonl((tv.tv_sec % 86400) * 1000 + tv.tv_usec / 1000);
-                                        memcpy(timeptr, &midtime, sizeof(__u32));
+                                        memcpy(timeptr, &midtime, sizeof(__be32));
                                         opt->is_changed = 1;
                                 }
                         } else {
@@ -607,7 +607,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
 {
         struct ip_options *opt = &(IPCB(skb)->opt);
         int srrspace, srrptr;
-        u32 nexthop;
+        __be32 nexthop;
         struct iphdr *iph = skb->nh.iph;
         unsigned char * optptr = skb->nh.raw + opt->srr;
         struct rtable *rt = (struct rtable*)skb->dst;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 97aee76fb746..fc195a44fc2e 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -118,7 +118,7 @@ static inline int ip_select_ttl(struct inet_sock *inet, struct dst_entry *dst)
  *
  */
 int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
-                          u32 saddr, u32 daddr, struct ip_options *opt)
+                          __be32 saddr, __be32 daddr, struct ip_options *opt)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct rtable *rt = (struct rtable *)skb->dst;
@@ -306,7 +306,7 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
         /* Make sure we can route this packet. */
         rt = (struct rtable *)__sk_dst_check(sk, 0);
         if (rt == NULL) {
-                u32 daddr;
+                __be32 daddr;
 
                 /* Use correct destination address if we have options. */
                 daddr = inet->daddr;
@@ -1340,7 +1340,7 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
                 char                    data[40];
         } replyopts;
         struct ipcm_cookie ipc;
-        u32 daddr;
+        __be32 daddr;
         struct rtable *rt = (struct rtable*)skb->dst;
 
         if (ip_options_echo(&replyopts.opt, skb))
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 2d05c4133d3e..4b132953bcc2 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -254,7 +254,7 @@ int ip_ra_control(struct sock *sk, unsigned char on, void (*destructor)(struct s
 }
 
 void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err, 
-                   u16 port, u32 info, u8 *payload)
+                   __be16 port, u32 info, u8 *payload)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct sock_exterr_skb *serr;
@@ -283,7 +283,7 @@ void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
                 kfree_skb(skb);
 }
 
-void ip_local_error(struct sock *sk, int err, u32 daddr, u16 port, u32 info)
+void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 info)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct sock_exterr_skb *serr;
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 17342430a843..3839b706142e 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -183,7 +183,7 @@ out_ok:
 
 static void ipcomp4_err(struct sk_buff *skb, u32 info)
 {
-        u32 spi;
+        __be32 spi;
         struct iphdr *iph = (struct iphdr *)skb->data;
         struct ip_comp_hdr *ipch = (struct ip_comp_hdr *)(skb->data+(iph->ihl<<2));
         struct xfrm_state *x;
@@ -206,6 +206,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
 static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
 {
         struct xfrm_state *t;
+        u8 mode = XFRM_MODE_TUNNEL;
         
         t = xfrm_state_alloc();
         if (t == NULL)
@@ -216,7 +217,9 @@ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
         t->id.daddr.a4 = x->id.daddr.a4;
         memcpy(&t->sel, &x->sel, sizeof(t->sel));
         t->props.family = AF_INET;
-        t->props.mode = XFRM_MODE_TUNNEL;
+        if (x->props.mode == XFRM_MODE_BEET)
+                mode = x->props.mode;
+        t->props.mode = mode;
         t->props.saddr.a4 = x->props.saddr.a4;
         t->props.flags = x->props.flags;
 
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 1fbb38415b19..f8ce84759159 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -366,7 +366,7 @@ static int __init ic_defaults(void)
          */
          
         if (!ic_host_name_set)
-                sprintf(system_utsname.nodename, "%u.%u.%u.%u", NIPQUAD(ic_myaddr));
+                sprintf(init_utsname()->nodename, "%u.%u.%u.%u", NIPQUAD(ic_myaddr));
 
         if (root_server_addr == INADDR_NONE)
                 root_server_addr = ic_servaddr;
@@ -805,7 +805,7 @@ static void __init ic_do_bootp_ext(u8 *ext)
                         }
                         break;
                 case 12:        /* Host name */
-                        ic_bootp_string(system_utsname.nodename, ext+1, *ext, __NEW_UTS_LEN);
+                        ic_bootp_string(utsname()->nodename, ext+1, *ext, __NEW_UTS_LEN);
                         ic_host_name_set = 1;
                         break;
                 case 15:        /* Domain name (DNS) */
@@ -816,7 +816,7 @@ static void __init ic_do_bootp_ext(u8 *ext)
                                 ic_bootp_string(root_server_path, ext+1, *ext, sizeof(root_server_path));
                         break;
                 case 40:        /* NIS Domain name (_not_ DNS) */
-                        ic_bootp_string(system_utsname.domainname, ext+1, *ext, __NEW_UTS_LEN);
+                        ic_bootp_string(utsname()->domainname, ext+1, *ext, __NEW_UTS_LEN);
                         break;
         }
 }
@@ -1368,7 +1368,7 @@ static int __init ip_auto_config(void)
         printk(", mask=%u.%u.%u.%u", NIPQUAD(ic_netmask));
         printk(", gw=%u.%u.%u.%u", NIPQUAD(ic_gateway));
         printk(",\n     host=%s, domain=%s, nis-domain=%s",
-               system_utsname.nodename, ic_domain, system_utsname.domainname);
+               utsname()->nodename, ic_domain, utsname()->domainname);
         printk(",\n     bootserver=%u.%u.%u.%u", NIPQUAD(ic_servaddr));
         printk(", rootserver=%u.%u.%u.%u", NIPQUAD(root_server_addr));
         printk(", rootpath=%s", root_server_path);
@@ -1478,11 +1478,11 @@ static int __init ip_auto_config_setup(char *addrs)
                         case 4:
                                 if ((dp = strchr(ip, '.'))) {
                                         *dp++ = '\0';
-                                        strlcpy(system_utsname.domainname, dp,
-                                                sizeof(system_utsname.domainname));
+                                        strlcpy(utsname()->domainname, dp,
+                                                sizeof(utsname()->domainname));
                                 }
-                                strlcpy(system_utsname.nodename, ip,
-                                        sizeof(system_utsname.nodename));
+                                strlcpy(utsname()->nodename, ip,
+                                        sizeof(utsname()->nodename));
                                 ic_host_name_set = 1;
                                 break;
                         case 5:
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index ba49588da242..97cfa97c8abb 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -462,7 +462,7 @@ static int vif_add(struct vifctl *vifc, int mrtsock)
         return 0;
 }
 
-static struct mfc_cache *ipmr_cache_find(__u32 origin, __u32 mcastgrp)
+static struct mfc_cache *ipmr_cache_find(__be32 origin, __be32 mcastgrp)
 {
         int line=MFC_HASH(mcastgrp,origin);
         struct mfc_cache *c;
@@ -1097,7 +1097,7 @@ static struct notifier_block ip_mr_notifier={
  *      important for multicast video.
  */
  
-static void ip_encap(struct sk_buff *skb, u32 saddr, u32 daddr)
+static void ip_encap(struct sk_buff *skb, __be32 saddr, __be32 daddr)
 {
         struct iphdr *iph = (struct iphdr *)skb_push(skb,sizeof(struct iphdr));
 
diff --git a/net/ipv4/ipvs/Kconfig b/net/ipv4/ipvs/Kconfig
index c9820bfc493a..891b9355cf96 100644
--- a/net/ipv4/ipvs/Kconfig
+++ b/net/ipv4/ipvs/Kconfig
@@ -81,7 +81,7 @@ config	IP_VS_PROTO_ESP
         bool "ESP load balancing support"
         depends on IP_VS
         ---help---
-          This option enables support for load balancing ESP (Encapsultion
+          This option enables support for load balancing ESP (Encapsulation
           Security Payload) transport protocol. Say Y if unsure.
 
 config  IP_VS_PROTO_AH
@@ -204,7 +204,7 @@ config	IP_VS_SED
           connections to the server with the shortest expected delay. The 
           expected delay that the job will experience is (Ci + 1) / Ui if 
           sent to the ith server, in which Ci is the number of connections
-          on the the ith server and Ui is the fixed service rate (weight)
+          on the ith server and Ui is the fixed service rate (weight)
           of the ith server.
 
           If you want to compile it in kernel, say Y. To compile it as a
diff --git a/net/ipv4/ipvs/ip_vs_conn.c b/net/ipv4/ipvs/ip_vs_conn.c
index 87b83813cf2c..8832eb517d52 100644
--- a/net/ipv4/ipvs/ip_vs_conn.c
+++ b/net/ipv4/ipvs/ip_vs_conn.c
@@ -115,9 +115,9 @@ static inline void ct_write_unlock_bh(unsigned key)
 /*
  *      Returns hash value for IPVS connection entry
  */
-static unsigned int ip_vs_conn_hashkey(unsigned proto, __u32 addr, __u16 port)
+static unsigned int ip_vs_conn_hashkey(unsigned proto, __be32 addr, __be16 port)
 {
-        return jhash_3words(addr, port, proto, ip_vs_conn_rnd)
+        return jhash_3words((__force u32)addr, (__force u32)port, proto, ip_vs_conn_rnd)
                 & IP_VS_CONN_TAB_MASK;
 }
 
@@ -188,7 +188,7 @@ static inline int ip_vs_conn_unhash(struct ip_vs_conn *cp)
  *      d_addr, d_port: pkt dest address (load balancer)
  */
 static inline struct ip_vs_conn *__ip_vs_conn_in_get
-(int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port)
+(int protocol, __be32 s_addr, __be16 s_port, __be32 d_addr, __be16 d_port)
 {
         unsigned hash;
         struct ip_vs_conn *cp;
@@ -215,7 +215,7 @@ static inline struct ip_vs_conn *__ip_vs_conn_in_get
 }
 
 struct ip_vs_conn *ip_vs_conn_in_get
-(int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port)
+(int protocol, __be32 s_addr, __be16 s_port, __be32 d_addr, __be16 d_port)
 {
         struct ip_vs_conn *cp;
 
@@ -234,7 +234,7 @@ struct ip_vs_conn *ip_vs_conn_in_get
 
 /* Get reference to connection template */
 struct ip_vs_conn *ip_vs_ct_in_get
-(int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port)
+(int protocol, __be32 s_addr, __be16 s_port, __be32 d_addr, __be16 d_port)
 {
         unsigned hash;
         struct ip_vs_conn *cp;
@@ -274,7 +274,7 @@ struct ip_vs_conn *ip_vs_ct_in_get
  *      d_addr, d_port: pkt dest address (foreign host)
  */
 struct ip_vs_conn *ip_vs_conn_out_get
-(int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port)
+(int protocol, __be32 s_addr, __be16 s_port, __be32 d_addr, __be16 d_port)
 {
         unsigned hash;
         struct ip_vs_conn *cp, *ret=NULL;
@@ -324,7 +324,7 @@ void ip_vs_conn_put(struct ip_vs_conn *cp)
 /*
  *      Fill a no_client_port connection with a client port number
  */
-void ip_vs_conn_fill_cport(struct ip_vs_conn *cp, __u16 cport)
+void ip_vs_conn_fill_cport(struct ip_vs_conn *cp, __be16 cport)
 {
         if (ip_vs_conn_unhash(cp)) {
                 spin_lock(&cp->lock);
@@ -508,10 +508,10 @@ int ip_vs_check_template(struct ip_vs_conn *ct)
                 /*
                  * Invalidate the connection template
                  */
-                if (ct->vport != 65535) {
+                if (ct->vport != htons(0xffff)) {
                         if (ip_vs_conn_unhash(ct)) {
-                                ct->dport = 65535;
-                                ct->vport = 65535;
+                                ct->dport = htons(0xffff);
+                                ct->vport = htons(0xffff);
                                 ct->cport = 0;
                                 ip_vs_conn_hash(ct);
                         }
@@ -596,8 +596,8 @@ void ip_vs_conn_expire_now(struct ip_vs_conn *cp)
  *      Create a new connection entry and hash it into the ip_vs_conn_tab
  */
 struct ip_vs_conn *
-ip_vs_conn_new(int proto, __u32 caddr, __u16 cport, __u32 vaddr, __u16 vport,
-               __u32 daddr, __u16 dport, unsigned flags,
+ip_vs_conn_new(int proto, __be32 caddr, __be16 cport, __be32 vaddr, __be16 vport,
+               __be32 daddr, __be16 dport, unsigned flags,
                struct ip_vs_dest *dest)
 {
         struct ip_vs_conn *cp;
diff --git a/net/ipv4/ipvs/ip_vs_core.c b/net/ipv4/ipvs/ip_vs_core.c
index 3f47ad8e1cad..1445bb47fea4 100644
--- a/net/ipv4/ipvs/ip_vs_core.c
+++ b/net/ipv4/ipvs/ip_vs_core.c
@@ -209,14 +209,14 @@ int ip_vs_make_skb_writable(struct sk_buff **pskb, int writable_len)
 static struct ip_vs_conn *
 ip_vs_sched_persist(struct ip_vs_service *svc,
                     const struct sk_buff *skb,
-                    __u16 ports[2])
+                    __be16 ports[2])
 {
         struct ip_vs_conn *cp = NULL;
         struct iphdr *iph = skb->nh.iph;
         struct ip_vs_dest *dest;
         struct ip_vs_conn *ct;
-        __u16  dport;    /* destination port to forward */
-        __u32  snet;     /* source network of the client, after masking */
+        __be16  dport;   /* destination port to forward */
+        __be32  snet;    /* source network of the client, after masking */
 
         /* Mask saddr with the netmask to adjust template granularity */
         snet = iph->saddr & svc->netmask;
@@ -383,7 +383,7 @@ ip_vs_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
         struct ip_vs_conn *cp = NULL;
         struct iphdr *iph = skb->nh.iph;
         struct ip_vs_dest *dest;
-        __u16 _ports[2], *pptr;
+        __be16 _ports[2], *pptr;
 
         pptr = skb_header_pointer(skb, iph->ihl*4,
                                   sizeof(_ports), _ports);
@@ -446,7 +446,7 @@ ip_vs_schedule(struct ip_vs_service *svc, const struct sk_buff *skb)
 int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
                 struct ip_vs_protocol *pp)
 {
-        __u16 _ports[2], *pptr;
+        __be16 _ports[2], *pptr;
         struct iphdr *iph = skb->nh.iph;
 
         pptr = skb_header_pointer(skb, iph->ihl*4,
@@ -576,7 +576,7 @@ void ip_vs_nat_icmp(struct sk_buff *skb, struct ip_vs_protocol *pp,
 
         /* the TCP/UDP port */
         if (IPPROTO_TCP == ciph->protocol || IPPROTO_UDP == ciph->protocol) {
-                __u16 *ports = (void *)ciph + ciph->ihl*4;
+                __be16 *ports = (void *)ciph + ciph->ihl*4;
 
                 if (inout)
                         ports[1] = cp->vport;
@@ -775,7 +775,7 @@ ip_vs_out(unsigned int hooknum, struct sk_buff **pskb,
                 if (sysctl_ip_vs_nat_icmp_send &&
                     (pp->protocol == IPPROTO_TCP ||
                      pp->protocol == IPPROTO_UDP)) {
-                        __u16 _ports[2], *pptr;
+                        __be16 _ports[2], *pptr;
 
                         pptr = skb_header_pointer(skb, ihl,
                                                   sizeof(_ports), _ports);
@@ -813,6 +813,16 @@ ip_vs_out(unsigned int hooknum, struct sk_buff **pskb,
         skb->nh.iph->saddr = cp->vaddr;
         ip_send_check(skb->nh.iph);
 
+        /* For policy routing, packets originating from this
+         * machine itself may be routed differently to packets
+         * passing through.  We want this packet to be routed as
+         * if it came from this machine itself.  So re-compute
+         * the routing information.
+         */
+        if (ip_route_me_harder(pskb, RTN_LOCAL) != 0)
+                goto drop;
+        skb = *pskb;
+
         IP_VS_DBG_PKT(10, pp, skb, 0, "After SNAT");
 
         ip_vs_out_stats(cp, skb);
diff --git a/net/ipv4/ipvs/ip_vs_ctl.c b/net/ipv4/ipvs/ip_vs_ctl.c
index 6a28fafe910c..f261616e4602 100644
--- a/net/ipv4/ipvs/ip_vs_ctl.c
+++ b/net/ipv4/ipvs/ip_vs_ctl.c
@@ -283,7 +283,7 @@ static atomic_t ip_vs_nullsvc_counter = ATOMIC_INIT(0);
  *      Returns hash value for virtual service
  */
 static __inline__ unsigned
-ip_vs_svc_hashkey(unsigned proto, __u32 addr, __u16 port)
+ip_vs_svc_hashkey(unsigned proto, __be32 addr, __be16 port)
 {
         register unsigned porth = ntohs(port);
 
@@ -365,7 +365,7 @@ static int ip_vs_svc_unhash(struct ip_vs_service *svc)
  *      Get service by {proto,addr,port} in the service table.
  */
 static __inline__ struct ip_vs_service *
-__ip_vs_service_get(__u16 protocol, __u32 vaddr, __u16 vport)
+__ip_vs_service_get(__u16 protocol, __be32 vaddr, __be16 vport)
 {
         unsigned hash;
         struct ip_vs_service *svc;
@@ -410,7 +410,7 @@ static __inline__ struct ip_vs_service *__ip_vs_svc_fwm_get(__u32 fwmark)
 }
 
 struct ip_vs_service *
-ip_vs_service_get(__u32 fwmark, __u16 protocol, __u32 vaddr, __u16 vport)
+ip_vs_service_get(__u32 fwmark, __u16 protocol, __be32 vaddr, __be16 vport)
 {
         struct ip_vs_service *svc;
 
@@ -480,7 +480,7 @@ __ip_vs_unbind_svc(struct ip_vs_dest *dest)
 /*
  *      Returns hash value for real service
  */
-static __inline__ unsigned ip_vs_rs_hashkey(__u32 addr, __u16 port)
+static __inline__ unsigned ip_vs_rs_hashkey(__be32 addr, __be16 port)
 {
         register unsigned porth = ntohs(port);
 
@@ -531,7 +531,7 @@ static int ip_vs_rs_unhash(struct ip_vs_dest *dest)
  *      Lookup real service by <proto,addr,port> in the real service table.
  */
 struct ip_vs_dest *
-ip_vs_lookup_real_service(__u16 protocol, __u32 daddr, __u16 dport)
+ip_vs_lookup_real_service(__u16 protocol, __be32 daddr, __be16 dport)
 {
         unsigned hash;
         struct ip_vs_dest *dest;
@@ -562,7 +562,7 @@ ip_vs_lookup_real_service(__u16 protocol, __u32 daddr, __u16 dport)
  *      Lookup destination by {addr,port} in the given service
  */
 static struct ip_vs_dest *
-ip_vs_lookup_dest(struct ip_vs_service *svc, __u32 daddr, __u16 dport)
+ip_vs_lookup_dest(struct ip_vs_service *svc, __be32 daddr, __be16 dport)
 {
         struct ip_vs_dest *dest;
 
@@ -591,7 +591,7 @@ ip_vs_lookup_dest(struct ip_vs_service *svc, __u32 daddr, __u16 dport)
  *  scheduling.
  */
 static struct ip_vs_dest *
-ip_vs_trash_get_dest(struct ip_vs_service *svc, __u32 daddr, __u16 dport)
+ip_vs_trash_get_dest(struct ip_vs_service *svc, __be32 daddr, __be16 dport)
 {
         struct ip_vs_dest *dest, *nxt;
 
@@ -773,8 +773,8 @@ static int
 ip_vs_add_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest)
 {
         struct ip_vs_dest *dest;
-        __u32 daddr = udest->addr;
-        __u16 dport = udest->port;
+        __be32 daddr = udest->addr;
+        __be16 dport = udest->port;
         int ret;
 
         EnterFunction(2);
@@ -879,8 +879,8 @@ static int
 ip_vs_edit_dest(struct ip_vs_service *svc, struct ip_vs_dest_user *udest)
 {
         struct ip_vs_dest *dest;
-        __u32 daddr = udest->addr;
-        __u16 dport = udest->port;
+        __be32 daddr = udest->addr;
+        __be16 dport = udest->port;
 
         EnterFunction(2);
 
@@ -991,8 +991,8 @@ static int
 ip_vs_del_dest(struct ip_vs_service *svc,struct ip_vs_dest_user *udest)
 {
         struct ip_vs_dest *dest;
-        __u32 daddr = udest->addr;
-        __u16 dport = udest->port;
+        __be32 daddr = udest->addr;
+        __be16 dport = udest->port;
 
         EnterFunction(2);
 
diff --git a/net/ipv4/ipvs/ip_vs_dh.c b/net/ipv4/ipvs/ip_vs_dh.c
index 9fee19c4c617..502111fba872 100644
--- a/net/ipv4/ipvs/ip_vs_dh.c
+++ b/net/ipv4/ipvs/ip_vs_dh.c
@@ -66,7 +66,7 @@ struct ip_vs_dh_bucket {
 /*
  *      Returns hash value for IPVS DH entry
  */
-static inline unsigned ip_vs_dh_hashkey(__u32 addr)
+static inline unsigned ip_vs_dh_hashkey(__be32 addr)
 {
         return (ntohl(addr)*2654435761UL) & IP_VS_DH_TAB_MASK;
 }
@@ -76,7 +76,7 @@ static inline unsigned ip_vs_dh_hashkey(__u32 addr)
  *      Get ip_vs_dest associated with supplied parameters.
  */
 static inline struct ip_vs_dest *
-ip_vs_dh_get(struct ip_vs_dh_bucket *tbl, __u32 addr)
+ip_vs_dh_get(struct ip_vs_dh_bucket *tbl, __be32 addr)
 {
         return (tbl[ip_vs_dh_hashkey(addr)]).dest;
 }
diff --git a/net/ipv4/ipvs/ip_vs_ftp.c b/net/ipv4/ipvs/ip_vs_ftp.c
index 37fafb1fbcff..6d398f10aa91 100644
--- a/net/ipv4/ipvs/ip_vs_ftp.c
+++ b/net/ipv4/ipvs/ip_vs_ftp.c
@@ -32,6 +32,7 @@
 #include <linux/ip.h>
 #include <net/protocol.h>
 #include <net/tcp.h>
+#include <asm/unaligned.h>
 
 #include <net/ip_vs.h>
 
@@ -44,8 +45,8 @@
  * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper
  * First port is set to the default port.
  */
-static int ports[IP_VS_APP_MAX_PORTS] = {21, 0};
-module_param_array(ports, int, NULL, 0);
+static unsigned short ports[IP_VS_APP_MAX_PORTS] = {21, 0};
+module_param_array(ports, ushort, NULL, 0);
 MODULE_PARM_DESC(ports, "Ports to monitor for FTP control commands");
 
 
@@ -74,7 +75,7 @@ ip_vs_ftp_done_conn(struct ip_vs_app *app, struct ip_vs_conn *cp)
  */
 static int ip_vs_ftp_get_addrport(char *data, char *data_limit,
                                   const char *pattern, size_t plen, char term,
-                                  __u32 *addr, __u16 *port,
+                                  __be32 *addr, __be16 *port,
                                   char **start, char **end)
 {
         unsigned char p[6];
@@ -114,8 +115,8 @@ static int ip_vs_ftp_get_addrport(char *data, char *data_limit,
         if (i != 5)
                 return -1;
 
-        *addr = (p[3]<<24) | (p[2]<<16) | (p[1]<<8) | p[0];
-        *port = (p[5]<<8) | p[4];
+        *addr = get_unaligned((__be32 *)p);
+        *port = get_unaligned((__be16 *)(p + 4));
         return 1;
 }
 
@@ -140,8 +141,8 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
         struct tcphdr *th;
         char *data, *data_limit;
         char *start, *end;
-        __u32 from;
-        __u16 port;
+        __be32 from;
+        __be16 port;
         struct ip_vs_conn *n_cp;
         char buf[24];           /* xxx.xxx.xxx.xxx,ppp,ppp\000 */
         unsigned buf_len;
@@ -199,7 +200,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                 from = n_cp->vaddr;
                 port = n_cp->vport;
                 sprintf(buf,"%d,%d,%d,%d,%d,%d", NIPQUAD(from),
-                        port&255, (port>>8)&255);
+                        ntohs(port)&255, (ntohs(port)>>8)&255);
                 buf_len = strlen(buf);
 
                 /*
@@ -243,8 +244,8 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
         struct tcphdr *th;
         char *data, *data_start, *data_limit;
         char *start, *end;
-        __u32 to;
-        __u16 port;
+        __be32 to;
+        __be16 port;
         struct ip_vs_conn *n_cp;
 
         /* no diff required for incoming packets */
@@ -273,7 +274,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
         while (data <= data_limit - 6) {
                 if (strnicmp(data, "PASV\r\n", 6) == 0) {
                         /* Passive mode on */
-                        IP_VS_DBG(7, "got PASV at %zd of %zd\n",
+                        IP_VS_DBG(7, "got PASV at %td of %td\n",
                                   data - data_start,
                                   data_limit - data_start);
                         cp->app_data = &ip_vs_ftp_pasv;
@@ -365,12 +366,6 @@ static int __init ip_vs_ftp_init(void)
         for (i=0; i<IP_VS_APP_MAX_PORTS; i++) {
                 if (!ports[i])
                         continue;
-                if (ports[i] < 0 || ports[i] > 0xffff) {
-                        IP_VS_WARNING("ip_vs_ftp: Ignoring invalid "
-                                      "configuration port[%d] = %d\n",
-                                      i, ports[i]);
-                        continue;
-                }
                 ret = register_ip_vs_app_inc(app, app->protocol, ports[i]);
                 if (ret)
                         break;
diff --git a/net/ipv4/ipvs/ip_vs_lblc.c b/net/ipv4/ipvs/ip_vs_lblc.c
index 6e5cb92a5c83..524751e031de 100644
--- a/net/ipv4/ipvs/ip_vs_lblc.c
+++ b/net/ipv4/ipvs/ip_vs_lblc.c
@@ -87,7 +87,7 @@ static int sysctl_ip_vs_lblc_expiration = 24*60*60*HZ;
  */
 struct ip_vs_lblc_entry {
         struct list_head        list;
-        __u32                   addr;           /* destination IP address */
+        __be32                  addr;           /* destination IP address */
         struct ip_vs_dest       *dest;          /* real server (cache) */
         unsigned long           lastuse;        /* last used time */
 };
@@ -160,7 +160,7 @@ static struct ctl_table_header * sysctl_header;
  *      IP address to a server.
  */
 static inline struct ip_vs_lblc_entry *
-ip_vs_lblc_new(__u32 daddr, struct ip_vs_dest *dest)
+ip_vs_lblc_new(__be32 daddr, struct ip_vs_dest *dest)
 {
         struct ip_vs_lblc_entry *en;
 
@@ -195,7 +195,7 @@ static inline void ip_vs_lblc_free(struct ip_vs_lblc_entry *en)
 /*
  *      Returns hash value for IPVS LBLC entry
  */
-static inline unsigned ip_vs_lblc_hashkey(__u32 addr)
+static inline unsigned ip_vs_lblc_hashkey(__be32 addr)
 {
         return (ntohl(addr)*2654435761UL) & IP_VS_LBLC_TAB_MASK;
 }
@@ -234,7 +234,7 @@ ip_vs_lblc_hash(struct ip_vs_lblc_table *tbl, struct ip_vs_lblc_entry *en)
  *  Get ip_vs_lblc_entry associated with supplied parameters.
  */
 static inline struct ip_vs_lblc_entry *
-ip_vs_lblc_get(struct ip_vs_lblc_table *tbl, __u32 addr)
+ip_vs_lblc_get(struct ip_vs_lblc_table *tbl, __be32 addr)
 {
         unsigned hash;
         struct ip_vs_lblc_entry *en;
diff --git a/net/ipv4/ipvs/ip_vs_lblcr.c b/net/ipv4/ipvs/ip_vs_lblcr.c
index 32ba37ba72d8..08990192b6ec 100644
--- a/net/ipv4/ipvs/ip_vs_lblcr.c
+++ b/net/ipv4/ipvs/ip_vs_lblcr.c
@@ -276,7 +276,7 @@ static inline struct ip_vs_dest *ip_vs_dest_set_max(struct ip_vs_dest_set *set)
  */
 struct ip_vs_lblcr_entry {
         struct list_head        list;
-        __u32                   addr;           /* destination IP address */
+        __be32                   addr;           /* destination IP address */
         struct ip_vs_dest_set   set;            /* destination server set */
         unsigned long           lastuse;        /* last used time */
 };
@@ -348,7 +348,7 @@ static struct ctl_table_header * sysctl_header;
  *      new/free a ip_vs_lblcr_entry, which is a mapping of a destination
  *      IP address to a server.
  */
-static inline struct ip_vs_lblcr_entry *ip_vs_lblcr_new(__u32 daddr)
+static inline struct ip_vs_lblcr_entry *ip_vs_lblcr_new(__be32 daddr)
 {
         struct ip_vs_lblcr_entry *en;
 
@@ -381,7 +381,7 @@ static inline void ip_vs_lblcr_free(struct ip_vs_lblcr_entry *en)
 /*
  *      Returns hash value for IPVS LBLCR entry
  */
-static inline unsigned ip_vs_lblcr_hashkey(__u32 addr)
+static inline unsigned ip_vs_lblcr_hashkey(__be32 addr)
 {
         return (ntohl(addr)*2654435761UL) & IP_VS_LBLCR_TAB_MASK;
 }
@@ -420,7 +420,7 @@ ip_vs_lblcr_hash(struct ip_vs_lblcr_table *tbl, struct ip_vs_lblcr_entry *en)
  *  Get ip_vs_lblcr_entry associated with supplied parameters.
  */
 static inline struct ip_vs_lblcr_entry *
-ip_vs_lblcr_get(struct ip_vs_lblcr_table *tbl, __u32 addr)
+ip_vs_lblcr_get(struct ip_vs_lblcr_table *tbl, __be32 addr)
 {
         unsigned hash;
         struct ip_vs_lblcr_entry *en;
diff --git a/net/ipv4/ipvs/ip_vs_proto.c b/net/ipv4/ipvs/ip_vs_proto.c
index 867d4e9c6594..c4528b5c800d 100644
--- a/net/ipv4/ipvs/ip_vs_proto.c
+++ b/net/ipv4/ipvs/ip_vs_proto.c
@@ -176,7 +176,7 @@ ip_vs_tcpudp_debug_packet(struct ip_vs_protocol *pp,
                         pp->name, NIPQUAD(ih->saddr),
                         NIPQUAD(ih->daddr));
         else {
-                __u16 _ports[2], *pptr
+                __be16 _ports[2], *pptr
 ;
                 pptr = skb_header_pointer(skb, offset + ih->ihl*4,
                                           sizeof(_ports), _ports);
diff --git a/net/ipv4/ipvs/ip_vs_proto_tcp.c b/net/ipv4/ipvs/ip_vs_proto_tcp.c
index 820e8318d10d..bfe779e74590 100644
--- a/net/ipv4/ipvs/ip_vs_proto_tcp.c
+++ b/net/ipv4/ipvs/ip_vs_proto_tcp.c
@@ -29,7 +29,7 @@ static struct ip_vs_conn *
 tcp_conn_in_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
                 const struct iphdr *iph, unsigned int proto_off, int inverse)
 {
-        __u16 _ports[2], *pptr;
+        __be16 _ports[2], *pptr;
 
         pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
         if (pptr == NULL)
@@ -50,7 +50,7 @@ static struct ip_vs_conn *
 tcp_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
                  const struct iphdr *iph, unsigned int proto_off, int inverse)
 {
-        __u16 _ports[2], *pptr;
+        __be16 _ports[2], *pptr;
 
         pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
         if (pptr == NULL)
@@ -112,12 +112,12 @@ tcp_conn_schedule(struct sk_buff *skb,
 
 
 static inline void
-tcp_fast_csum_update(struct tcphdr *tcph, u32 oldip, u32 newip,
-                     u16 oldport, u16 newport)
+tcp_fast_csum_update(struct tcphdr *tcph, __be32 oldip, __be32 newip,
+                     __be16 oldport, __be16 newport)
 {
         tcph->check =
                 ip_vs_check_diff(~oldip, newip,
-                                 ip_vs_check_diff(oldport ^ 0xFFFF,
+                                 ip_vs_check_diff(oldport ^ htonl(0xFFFF),
                                                   newport, tcph->check));
 }
 
diff --git a/net/ipv4/ipvs/ip_vs_proto_udp.c b/net/ipv4/ipvs/ip_vs_proto_udp.c
index 90c8166c0ec1..54aa7603591f 100644
--- a/net/ipv4/ipvs/ip_vs_proto_udp.c
+++ b/net/ipv4/ipvs/ip_vs_proto_udp.c
@@ -29,7 +29,7 @@ udp_conn_in_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
                 const struct iphdr *iph, unsigned int proto_off, int inverse)
 {
         struct ip_vs_conn *cp;
-        __u16 _ports[2], *pptr;
+        __be16 _ports[2], *pptr;
 
         pptr = skb_header_pointer(skb, proto_off, sizeof(_ports), _ports);
         if (pptr == NULL)
@@ -54,7 +54,7 @@ udp_conn_out_get(const struct sk_buff *skb, struct ip_vs_protocol *pp,
                  const struct iphdr *iph, unsigned int proto_off, int inverse)
 {
         struct ip_vs_conn *cp;
-        __u16 _ports[2], *pptr;
+        __be16 _ports[2], *pptr;
 
         pptr = skb_header_pointer(skb, skb->nh.iph->ihl*4,
                                   sizeof(_ports), _ports);
@@ -117,15 +117,15 @@ udp_conn_schedule(struct sk_buff *skb, struct ip_vs_protocol *pp,
 
 
 static inline void
-udp_fast_csum_update(struct udphdr *uhdr, u32 oldip, u32 newip,
-                     u16 oldport, u16 newport)
+udp_fast_csum_update(struct udphdr *uhdr, __be32 oldip, __be32 newip,
+                     __be16 oldport, __be16 newport)
 {
         uhdr->check =
                 ip_vs_check_diff(~oldip, newip,
-                                 ip_vs_check_diff(oldport ^ 0xFFFF,
+                                 ip_vs_check_diff(oldport ^ htonl(0xFFFF),
                                                   newport, uhdr->check));
         if (!uhdr->check)
-                uhdr->check = 0xFFFF;
+                uhdr->check = htonl(0xFFFF);
 }
 
 static int
@@ -173,7 +173,7 @@ udp_snat_handler(struct sk_buff **pskb,
                                                 cp->protocol,
                                                 (*pskb)->csum);
                 if (udph->check == 0)
-                        udph->check = 0xFFFF;
+                        udph->check = htonl(0xFFFF);
                 IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
                           pp->name, udph->check,
                           (char*)&(udph->check) - (char*)udph);
diff --git a/net/ipv4/ipvs/ip_vs_sh.c b/net/ipv4/ipvs/ip_vs_sh.c
index 7775e6cc68be..338668f88fe2 100644
--- a/net/ipv4/ipvs/ip_vs_sh.c
+++ b/net/ipv4/ipvs/ip_vs_sh.c
@@ -63,7 +63,7 @@ struct ip_vs_sh_bucket {
 /*
  *      Returns hash value for IPVS SH entry
  */
-static inline unsigned ip_vs_sh_hashkey(__u32 addr)
+static inline unsigned ip_vs_sh_hashkey(__be32 addr)
 {
         return (ntohl(addr)*2654435761UL) & IP_VS_SH_TAB_MASK;
 }
@@ -73,7 +73,7 @@ static inline unsigned ip_vs_sh_hashkey(__u32 addr)
  *      Get ip_vs_dest associated with supplied parameters.
  */
 static inline struct ip_vs_dest *
-ip_vs_sh_get(struct ip_vs_sh_bucket *tbl, __u32 addr)
+ip_vs_sh_get(struct ip_vs_sh_bucket *tbl, __be32 addr)
 {
         return (tbl[ip_vs_sh_hashkey(addr)]).dest;
 }
diff --git a/net/ipv4/ipvs/ip_vs_sync.c b/net/ipv4/ipvs/ip_vs_sync.c
index 1bca714bda3d..91a075edd68e 100644
--- a/net/ipv4/ipvs/ip_vs_sync.c
+++ b/net/ipv4/ipvs/ip_vs_sync.c
@@ -48,16 +48,16 @@ struct ip_vs_sync_conn {
 
         /* Protocol, addresses and port numbers */
         __u8                    protocol;       /* Which protocol (TCP/UDP) */
-        __u16                   cport;
-        __u16                   vport;
-        __u16                   dport;
-        __u32                   caddr;          /* client address */
-        __u32                   vaddr;          /* virtual address */
-        __u32                   daddr;          /* destination address */
+        __be16                  cport;
+        __be16                  vport;
+        __be16                  dport;
+        __be32                  caddr;          /* client address */
+        __be32                  vaddr;          /* virtual address */
+        __be32                  daddr;          /* destination address */
 
         /* Flags and state transition */
-        __u16                   flags;          /* status flags */
-        __u16                   state;          /* state info */
+        __be16                  flags;          /* status flags */
+        __be16                  state;          /* state info */
 
         /* The sequence options start here */
 };
@@ -464,7 +464,7 @@ join_mcast_group(struct sock *sk, struct in_addr *addr, char *ifname)
 static int bind_mcastif_addr(struct socket *sock, char *ifname)
 {
         struct net_device *dev;
-        u32 addr;
+        __be32 addr;
         struct sockaddr_in sin;
 
         if ((dev = __dev_get_by_name(ifname)) == NULL)
@@ -836,7 +836,7 @@ static int fork_sync_thread(void *startup)
 
 int start_sync_thread(int state, char *mcast_ifn, __u8 syncid)
 {
-        DECLARE_COMPLETION(startup);
+        DECLARE_COMPLETION_ONSTACK(startup);
         pid_t pid;
 
         if ((state == IP_VS_STATE_MASTER && sync_master_pid) ||
diff --git a/net/ipv4/ipvs/ip_vs_xmit.c b/net/ipv4/ipvs/ip_vs_xmit.c
index 52c12e9edbbc..e1f77bd7c9a5 100644
--- a/net/ipv4/ipvs/ip_vs_xmit.c
+++ b/net/ipv4/ipvs/ip_vs_xmit.c
@@ -232,7 +232,7 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 
         /* check if it is a connection of no-client-port */
         if (unlikely(cp->flags & IP_VS_CONN_F_NO_CPORT)) {
-                __u16 _pt, *p;
+                __be16 _pt, *p;
                 p = skb_header_pointer(skb, iph->ihl*4, sizeof(_pt), &_pt);
                 if (p == NULL)
                         goto tx_error;
diff --git a/net/ipv4/multipath_wrandom.c b/net/ipv4/multipath_wrandom.c
index d25ec4ae09e5..92b04823e034 100644
--- a/net/ipv4/multipath_wrandom.c
+++ b/net/ipv4/multipath_wrandom.c
@@ -60,8 +60,8 @@ struct multipath_dest {
         struct list_head        list;
 
         const struct fib_nh     *nh_info;
-        __u32                   netmask;
-        __u32                   network;
+        __be32                  netmask;
+        __be32                  network;
         unsigned char           prefixlen;
 
         struct rcu_head         rcu;
@@ -76,7 +76,7 @@ struct multipath_route {
         struct list_head        list;
 
         int                     oif;
-        __u32                   gw;
+        __be32                  gw;
         struct list_head        dests;
 
         struct rcu_head         rcu;
@@ -128,8 +128,8 @@ static unsigned char __multipath_lookup_weight(const struct flowi *fl,
 
         /* find state entry for destination */
         list_for_each_entry_rcu(d, &target_route->dests, list) {
-                __u32 targetnetwork = fl->fl4_dst & 
-                        (0xFFFFFFFF >> (32 - d->prefixlen));
+                __be32 targetnetwork = fl->fl4_dst &
+                        inet_make_mask(d->prefixlen);
 
                 if ((targetnetwork & d->netmask) == d->network) {
                         weight = d->nh_info->nh_weight;
@@ -217,8 +217,8 @@ static void wrandom_select_route(const struct flowi *flp,
         *rp = decision;
 }
 
-static void wrandom_set_nhinfo(__u32 network,
-                               __u32 netmask,
+static void wrandom_set_nhinfo(__be32 network,
+                               __be32 netmask,
                                unsigned char prefixlen,
                                const struct fib_nh *nh)
 {
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index f88347de21a9..e2005c6810a4 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -8,7 +8,7 @@
 #include <net/ip.h>
 
 /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */
-int ip_route_me_harder(struct sk_buff **pskb)
+int ip_route_me_harder(struct sk_buff **pskb, unsigned addr_type)
 {
         struct iphdr *iph = (*pskb)->nh.iph;
         struct rtable *rt;
@@ -16,10 +16,13 @@ int ip_route_me_harder(struct sk_buff **pskb)
         struct dst_entry *odst;
         unsigned int hh_len;
 
+        if (addr_type == RTN_UNSPEC)
+                addr_type = inet_addr_type(iph->saddr);
+
         /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
          * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
          */
-        if (inet_addr_type(iph->saddr) == RTN_LOCAL) {
+        if (addr_type == RTN_LOCAL) {
                 fl.nl_u.ip4_u.daddr = iph->daddr;
                 fl.nl_u.ip4_u.saddr = iph->saddr;
                 fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
@@ -128,8 +131,8 @@ EXPORT_SYMBOL(ip_nat_decode_session);
  */
 
 struct ip_rt_info {
-        u_int32_t daddr;
-        u_int32_t saddr;
+        __be32 daddr;
+        __be32 saddr;
         u_int8_t tos;
 };
 
@@ -156,7 +159,7 @@ static int nf_ip_reroute(struct sk_buff **pskb, const struct nf_info *info)
                 if (!(iph->tos == rt_info->tos
                       && iph->daddr == rt_info->daddr
                       && iph->saddr == rt_info->saddr))
-                        return ip_route_me_harder(pskb);
+                        return ip_route_me_harder(pskb, RTN_UNSPEC);
         }
         return 0;
 }
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index a55b8ff70ded..d88c292f118c 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -373,7 +373,7 @@ config IP_NF_TARGET_ULOG
           daemon using netlink multicast sockets; unlike the LOG target
           which can only be viewed through syslog.
 
-          The apropriate userspace logging daemon (ulogd) may be obtained from
+          The appropriate userspace logging daemon (ulogd) may be obtained from
           <http://www.gnumonks.org/projects/ulogd/>
 
           To compile it as a module, choose M here.  If unsure, say N.
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 85f0d73ebfb4..0849f1cced13 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -80,7 +80,7 @@ static inline int arp_packet_match(const struct arphdr *arphdr,
 {
         char *arpptr = (char *)(arphdr + 1);
         char *src_devaddr, *tgt_devaddr;
-        u32 src_ipaddr, tgt_ipaddr;
+        __be32 src_ipaddr, tgt_ipaddr;
         int i, ret;
 
 #define FWINV(bool,invflg) ((bool) ^ !!(arpinfo->invflags & invflg))
@@ -1196,6 +1196,8 @@ err1:
 static void __exit arp_tables_fini(void)
 {
         nf_unregister_sockopt(&arpt_sockopts);
+        xt_unregister_target(&arpt_error_target);
+        xt_unregister_target(&arpt_standard_target);
         xt_proto_fini(NF_ARP);
 }
 
diff --git a/net/ipv4/netfilter/ip_conntrack_amanda.c b/net/ipv4/netfilter/ip_conntrack_amanda.c
index 0a7bd7f04061..6c7383a8e42b 100644
--- a/net/ipv4/netfilter/ip_conntrack_amanda.c
+++ b/net/ipv4/netfilter/ip_conntrack_amanda.c
@@ -155,11 +155,11 @@ static int help(struct sk_buff **pskb,
                 exp->tuple.dst.protonum = IPPROTO_TCP;
                 exp->tuple.dst.u.tcp.port = htons(port);
 
-                exp->mask.src.ip = 0xFFFFFFFF;
+                exp->mask.src.ip = htonl(0xFFFFFFFF);
                 exp->mask.src.u.tcp.port = 0;
-                exp->mask.dst.ip = 0xFFFFFFFF;
+                exp->mask.dst.ip = htonl(0xFFFFFFFF);
                 exp->mask.dst.protonum = 0xFF;
-                exp->mask.dst.u.tcp.port = 0xFFFF;
+                exp->mask.dst.u.tcp.port = htons(0xFFFF);
 
                 if (ip_nat_amanda_hook)
                         ret = ip_nat_amanda_hook(pskb, ctinfo, off - dataoff,
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index c432b3163609..143c4668538b 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -149,8 +149,8 @@ static unsigned int ip_conntrack_hash_rnd;
 static u_int32_t __hash_conntrack(const struct ip_conntrack_tuple *tuple,
                             unsigned int size, unsigned int rnd)
 {
-        return (jhash_3words(tuple->src.ip,
-                             (tuple->dst.ip ^ tuple->dst.protonum),
+        return (jhash_3words((__force u32)tuple->src.ip,
+                             ((__force u32)tuple->dst.ip ^ tuple->dst.protonum),
                              (tuple->src.u.all | (tuple->dst.u.all << 16)),
                              rnd) % size);
 }
@@ -1169,9 +1169,9 @@ void __ip_ct_refresh_acct(struct ip_conntrack *ct,
 int ip_ct_port_tuple_to_nfattr(struct sk_buff *skb,
                                const struct ip_conntrack_tuple *tuple)
 {
-        NFA_PUT(skb, CTA_PROTO_SRC_PORT, sizeof(u_int16_t),
+        NFA_PUT(skb, CTA_PROTO_SRC_PORT, sizeof(__be16),
                 &tuple->src.u.tcp.port);
-        NFA_PUT(skb, CTA_PROTO_DST_PORT, sizeof(u_int16_t),
+        NFA_PUT(skb, CTA_PROTO_DST_PORT, sizeof(__be16),
                 &tuple->dst.u.tcp.port);
         return 0;
 
@@ -1186,9 +1186,9 @@ int ip_ct_port_nfattr_to_tuple(struct nfattr *tb[],
                 return -EINVAL;
 
         t->src.u.tcp.port =
-                *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_SRC_PORT-1]);
+                *(__be16 *)NFA_DATA(tb[CTA_PROTO_SRC_PORT-1]);
         t->dst.u.tcp.port =
-                *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_DST_PORT-1]);
+                *(__be16 *)NFA_DATA(tb[CTA_PROTO_DST_PORT-1]);
 
         return 0;
 }
diff --git a/net/ipv4/netfilter/ip_conntrack_ftp.c b/net/ipv4/netfilter/ip_conntrack_ftp.c
index 1d18c863f064..93dcf960662f 100644
--- a/net/ipv4/netfilter/ip_conntrack_ftp.c
+++ b/net/ipv4/netfilter/ip_conntrack_ftp.c
@@ -425,8 +425,8 @@ static int help(struct sk_buff **pskb,
         exp->tuple.src.u.tcp.port = 0; /* Don't care. */
         exp->tuple.dst.protonum = IPPROTO_TCP;
         exp->mask = ((struct ip_conntrack_tuple)
-                { { 0xFFFFFFFF, { 0 } },
-                  { 0xFFFFFFFF, { .tcp = { 0xFFFF } }, 0xFF }});
+                { { htonl(0xFFFFFFFF), { 0 } },
+                  { htonl(0xFFFFFFFF), { .tcp = { htons(0xFFFF) } }, 0xFF }});
 
         exp->expectfn = NULL;
         exp->flags = 0;
@@ -488,7 +488,7 @@ static int __init ip_conntrack_ftp_init(void)
         for (i = 0; i < ports_c; i++) {
                 ftp[i].tuple.src.u.tcp.port = htons(ports[i]);
                 ftp[i].tuple.dst.protonum = IPPROTO_TCP;
-                ftp[i].mask.src.u.tcp.port = 0xFFFF;
+                ftp[i].mask.src.u.tcp.port = htons(0xFFFF);
                 ftp[i].mask.dst.protonum = 0xFF;
                 ftp[i].max_expected = 1;
                 ftp[i].timeout = 5 * 60; /* 5 minutes */
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323.c b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
index 9a39e2969712..7b7441202bfd 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
@@ -49,11 +49,11 @@ MODULE_PARM_DESC(callforward_filter, "only create call forwarding expectations "
 int (*set_h245_addr_hook) (struct sk_buff ** pskb,
                            unsigned char **data, int dataoff,
                            H245_TransportAddress * addr,
-                           u_int32_t ip, u_int16_t port);
+                           __be32 ip, u_int16_t port);
 int (*set_h225_addr_hook) (struct sk_buff ** pskb,
                            unsigned char **data, int dataoff,
                            TransportAddress * addr,
-                           u_int32_t ip, u_int16_t port);
+                           __be32 ip, u_int16_t port);
 int (*set_sig_addr_hook) (struct sk_buff ** pskb,
                           struct ip_conntrack * ct,
                           enum ip_conntrack_info ctinfo,
@@ -209,7 +209,7 @@ static int get_tpkt_data(struct sk_buff **pskb, struct ip_conntrack *ct,
 
 /****************************************************************************/
 static int get_h245_addr(unsigned char *data, H245_TransportAddress * addr,
-                         u_int32_t * ip, u_int16_t * port)
+                         __be32 * ip, u_int16_t * port)
 {
         unsigned char *p;
 
@@ -232,7 +232,7 @@ static int expect_rtp_rtcp(struct sk_buff **pskb, struct ip_conntrack *ct,
 {
         int dir = CTINFO2DIR(ctinfo);
         int ret = 0;
-        u_int32_t ip;
+        __be32 ip;
         u_int16_t port;
         u_int16_t rtp_port;
         struct ip_conntrack_expect *rtp_exp;
@@ -254,10 +254,10 @@ static int expect_rtp_rtcp(struct sk_buff **pskb, struct ip_conntrack *ct,
         rtp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
         rtp_exp->tuple.dst.u.udp.port = htons(rtp_port);
         rtp_exp->tuple.dst.protonum = IPPROTO_UDP;
-        rtp_exp->mask.src.ip = 0xFFFFFFFF;
+        rtp_exp->mask.src.ip = htonl(0xFFFFFFFF);
         rtp_exp->mask.src.u.udp.port = 0;
-        rtp_exp->mask.dst.ip = 0xFFFFFFFF;
-        rtp_exp->mask.dst.u.udp.port = 0xFFFF;
+        rtp_exp->mask.dst.ip = htonl(0xFFFFFFFF);
+        rtp_exp->mask.dst.u.udp.port = htons(0xFFFF);
         rtp_exp->mask.dst.protonum = 0xFF;
         rtp_exp->flags = 0;
 
@@ -271,10 +271,10 @@ static int expect_rtp_rtcp(struct sk_buff **pskb, struct ip_conntrack *ct,
         rtcp_exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
         rtcp_exp->tuple.dst.u.udp.port = htons(rtp_port + 1);
         rtcp_exp->tuple.dst.protonum = IPPROTO_UDP;
-        rtcp_exp->mask.src.ip = 0xFFFFFFFF;
+        rtcp_exp->mask.src.ip = htonl(0xFFFFFFFF);
         rtcp_exp->mask.src.u.udp.port = 0;
-        rtcp_exp->mask.dst.ip = 0xFFFFFFFF;
-        rtcp_exp->mask.dst.u.udp.port = 0xFFFF;
+        rtcp_exp->mask.dst.ip = htonl(0xFFFFFFFF);
+        rtcp_exp->mask.dst.u.udp.port = htons(0xFFFF);
         rtcp_exp->mask.dst.protonum = 0xFF;
         rtcp_exp->flags = 0;
 
@@ -325,7 +325,7 @@ static int expect_t120(struct sk_buff **pskb,
 {
         int dir = CTINFO2DIR(ctinfo);
         int ret = 0;
-        u_int32_t ip;
+        __be32 ip;
         u_int16_t port;
         struct ip_conntrack_expect *exp = NULL;
 
@@ -342,10 +342,10 @@ static int expect_t120(struct sk_buff **pskb,
         exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
         exp->tuple.dst.u.tcp.port = htons(port);
         exp->tuple.dst.protonum = IPPROTO_TCP;
-        exp->mask.src.ip = 0xFFFFFFFF;
+        exp->mask.src.ip = htonl(0xFFFFFFFF);
         exp->mask.src.u.tcp.port = 0;
-        exp->mask.dst.ip = 0xFFFFFFFF;
-        exp->mask.dst.u.tcp.port = 0xFFFF;
+        exp->mask.dst.ip = htonl(0xFFFFFFFF);
+        exp->mask.dst.u.tcp.port = htons(0xFFFF);
         exp->mask.dst.protonum = 0xFF;
         exp->flags = IP_CT_EXPECT_PERMANENT;    /* Accept multiple channels */
 
@@ -626,7 +626,7 @@ void ip_conntrack_h245_expect(struct ip_conntrack *new,
 
 /****************************************************************************/
 int get_h225_addr(unsigned char *data, TransportAddress * addr,
-                  u_int32_t * ip, u_int16_t * port)
+                  __be32 * ip, u_int16_t * port)
 {
         unsigned char *p;
 
@@ -648,7 +648,7 @@ static int expect_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
 {
         int dir = CTINFO2DIR(ctinfo);
         int ret = 0;
-        u_int32_t ip;
+        __be32 ip;
         u_int16_t port;
         struct ip_conntrack_expect *exp = NULL;
 
@@ -665,10 +665,10 @@ static int expect_h245(struct sk_buff **pskb, struct ip_conntrack *ct,
         exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
         exp->tuple.dst.u.tcp.port = htons(port);
         exp->tuple.dst.protonum = IPPROTO_TCP;
-        exp->mask.src.ip = 0xFFFFFFFF;
+        exp->mask.src.ip = htonl(0xFFFFFFFF);
         exp->mask.src.u.tcp.port = 0;
-        exp->mask.dst.ip = 0xFFFFFFFF;
-        exp->mask.dst.u.tcp.port = 0xFFFF;
+        exp->mask.dst.ip = htonl(0xFFFFFFFF);
+        exp->mask.dst.u.tcp.port = htons(0xFFFF);
         exp->mask.dst.protonum = 0xFF;
         exp->flags = 0;
 
@@ -709,7 +709,7 @@ static int expect_callforwarding(struct sk_buff **pskb,
 {
         int dir = CTINFO2DIR(ctinfo);
         int ret = 0;
-        u_int32_t ip;
+        __be32 ip;
         u_int16_t port;
         struct ip_conntrack_expect *exp = NULL;
 
@@ -751,10 +751,10 @@ static int expect_callforwarding(struct sk_buff **pskb,
         exp->tuple.dst.ip = ip;
         exp->tuple.dst.u.tcp.port = htons(port);
         exp->tuple.dst.protonum = IPPROTO_TCP;
-        exp->mask.src.ip = 0xFFFFFFFF;
+        exp->mask.src.ip = htonl(0xFFFFFFFF);
         exp->mask.src.u.tcp.port = 0;
-        exp->mask.dst.ip = 0xFFFFFFFF;
-        exp->mask.dst.u.tcp.port = 0xFFFF;
+        exp->mask.dst.ip = htonl(0xFFFFFFFF);
+        exp->mask.dst.u.tcp.port = htons(0xFFFF);
         exp->mask.dst.protonum = 0xFF;
         exp->flags = 0;
 
@@ -791,7 +791,7 @@ static int process_setup(struct sk_buff **pskb, struct ip_conntrack *ct,
         int dir = CTINFO2DIR(ctinfo);
         int ret;
         int i;
-        u_int32_t ip;
+        __be32 ip;
         u_int16_t port;
 
         DEBUGP("ip_ct_q931: Setup\n");
@@ -1188,7 +1188,7 @@ static unsigned char *get_udp_data(struct sk_buff **pskb, int *datalen)
 
 /****************************************************************************/
 static struct ip_conntrack_expect *find_expect(struct ip_conntrack *ct,
-                                               u_int32_t ip, u_int16_t port)
+                                               __be32 ip, u_int16_t port)
 {
         struct ip_conntrack_expect *exp;
         struct ip_conntrack_tuple tuple;
@@ -1228,7 +1228,7 @@ static int expect_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
         int dir = CTINFO2DIR(ctinfo);
         int ret = 0;
         int i;
-        u_int32_t ip;
+        __be32 ip;
         u_int16_t port;
         struct ip_conntrack_expect *exp;
 
@@ -1251,10 +1251,10 @@ static int expect_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
         exp->tuple.dst.ip = ct->tuplehash[!dir].tuple.dst.ip;
         exp->tuple.dst.u.tcp.port = htons(port);
         exp->tuple.dst.protonum = IPPROTO_TCP;
-        exp->mask.src.ip = gkrouted_only ? 0xFFFFFFFF : 0;
+        exp->mask.src.ip = gkrouted_only ? htonl(0xFFFFFFFF) : 0;
         exp->mask.src.u.tcp.port = 0;
-        exp->mask.dst.ip = 0xFFFFFFFF;
-        exp->mask.dst.u.tcp.port = 0xFFFF;
+        exp->mask.dst.ip = htonl(0xFFFFFFFF);
+        exp->mask.dst.u.tcp.port = htons(0xFFFF);
         exp->mask.dst.protonum = 0xFF;
         exp->flags = IP_CT_EXPECT_PERMANENT;    /* Accept multiple calls */
 
@@ -1307,7 +1307,7 @@ static int process_gcf(struct sk_buff **pskb, struct ip_conntrack *ct,
 {
         int dir = CTINFO2DIR(ctinfo);
         int ret = 0;
-        u_int32_t ip;
+        __be32 ip;
         u_int16_t port;
         struct ip_conntrack_expect *exp;
 
@@ -1333,10 +1333,10 @@ static int process_gcf(struct sk_buff **pskb, struct ip_conntrack *ct,
         exp->tuple.dst.ip = ip;
         exp->tuple.dst.u.tcp.port = htons(port);
         exp->tuple.dst.protonum = IPPROTO_UDP;
-        exp->mask.src.ip = 0xFFFFFFFF;
+        exp->mask.src.ip = htonl(0xFFFFFFFF);
         exp->mask.src.u.tcp.port = 0;
-        exp->mask.dst.ip = 0xFFFFFFFF;
-        exp->mask.dst.u.tcp.port = 0xFFFF;
+        exp->mask.dst.ip = htonl(0xFFFFFFFF);
+        exp->mask.dst.u.tcp.port = htons(0xFFFF);
         exp->mask.dst.protonum = 0xFF;
         exp->flags = 0;
         exp->expectfn = ip_conntrack_ras_expect;
@@ -1477,7 +1477,7 @@ static int process_arq(struct sk_buff **pskb, struct ip_conntrack *ct,
 {
         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
         int dir = CTINFO2DIR(ctinfo);
-        u_int32_t ip;
+        __be32 ip;
         u_int16_t port;
 
         DEBUGP("ip_ct_ras: ARQ\n");
@@ -1513,7 +1513,7 @@ static int process_acf(struct sk_buff **pskb, struct ip_conntrack *ct,
 {
         int dir = CTINFO2DIR(ctinfo);
         int ret = 0;
-        u_int32_t ip;
+        __be32 ip;
         u_int16_t port;
         struct ip_conntrack_expect *exp;
 
@@ -1538,10 +1538,10 @@ static int process_acf(struct sk_buff **pskb, struct ip_conntrack *ct,
         exp->tuple.dst.ip = ip;
         exp->tuple.dst.u.tcp.port = htons(port);
         exp->tuple.dst.protonum = IPPROTO_TCP;
-        exp->mask.src.ip = 0xFFFFFFFF;
+        exp->mask.src.ip = htonl(0xFFFFFFFF);
         exp->mask.src.u.tcp.port = 0;
-        exp->mask.dst.ip = 0xFFFFFFFF;
-        exp->mask.dst.u.tcp.port = 0xFFFF;
+        exp->mask.dst.ip = htonl(0xFFFFFFFF);
+        exp->mask.dst.u.tcp.port = htons(0xFFFF);
         exp->mask.dst.protonum = 0xFF;
         exp->flags = IP_CT_EXPECT_PERMANENT;
         exp->expectfn = ip_conntrack_q931_expect;
@@ -1581,7 +1581,7 @@ static int process_lcf(struct sk_buff **pskb, struct ip_conntrack *ct,
 {
         int dir = CTINFO2DIR(ctinfo);
         int ret = 0;
-        u_int32_t ip;
+        __be32 ip;
         u_int16_t port;
         struct ip_conntrack_expect *exp = NULL;
 
@@ -1598,10 +1598,10 @@ static int process_lcf(struct sk_buff **pskb, struct ip_conntrack *ct,
         exp->tuple.dst.ip = ip;
         exp->tuple.dst.u.tcp.port = htons(port);
         exp->tuple.dst.protonum = IPPROTO_TCP;
-        exp->mask.src.ip = 0xFFFFFFFF;
+        exp->mask.src.ip = htonl(0xFFFFFFFF);
         exp->mask.src.u.tcp.port = 0;
-        exp->mask.dst.ip = 0xFFFFFFFF;
-        exp->mask.dst.u.tcp.port = 0xFFFF;
+        exp->mask.dst.ip = htonl(0xFFFFFFFF);
+        exp->mask.dst.u.tcp.port = htons(0xFFFF);
         exp->mask.dst.protonum = 0xFF;
         exp->flags = IP_CT_EXPECT_PERMANENT;
         exp->expectfn = ip_conntrack_q931_expect;
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_pptp.c b/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
index fb0aee691721..a2af5e0c7f99 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
@@ -242,10 +242,10 @@ exp_gre(struct ip_conntrack *ct,
         exp_orig->tuple.dst.u.gre.key = callid;
         exp_orig->tuple.dst.protonum = IPPROTO_GRE;
 
-        exp_orig->mask.src.ip = 0xffffffff;
+        exp_orig->mask.src.ip = htonl(0xffffffff);
         exp_orig->mask.src.u.all = 0;
         exp_orig->mask.dst.u.gre.key = htons(0xffff);
-        exp_orig->mask.dst.ip = 0xffffffff;
+        exp_orig->mask.dst.ip = htonl(0xffffffff);
         exp_orig->mask.dst.protonum = 0xff;
 
         exp_orig->master = ct;
diff --git a/net/ipv4/netfilter/ip_conntrack_irc.c b/net/ipv4/netfilter/ip_conntrack_irc.c
index 44889075f3b2..75f7c3db1619 100644
--- a/net/ipv4/netfilter/ip_conntrack_irc.c
+++ b/net/ipv4/netfilter/ip_conntrack_irc.c
@@ -218,7 +218,8 @@ static int help(struct sk_buff **pskb,
                                     IPPROTO_TCP }});
                         exp->mask = ((struct ip_conntrack_tuple)
                                 { { 0, { 0 } },
-                                  { 0xFFFFFFFF, { .tcp = { 0xFFFF } }, 0xFF }});
+                                  { htonl(0xFFFFFFFF),
+                                        { .tcp = { htons(0xFFFF) } }, 0xFF }});
                         exp->expectfn = NULL;
                         exp->flags = 0;
                         if (ip_nat_irc_hook)
@@ -266,7 +267,7 @@ static int __init ip_conntrack_irc_init(void)
                 hlpr = &irc_helpers[i];
                 hlpr->tuple.src.u.tcp.port = htons(ports[i]);
                 hlpr->tuple.dst.protonum = IPPROTO_TCP;
-                hlpr->mask.src.u.tcp.port = 0xFFFF;
+                hlpr->mask.src.u.tcp.port = htons(0xFFFF);
                 hlpr->mask.dst.protonum = 0xFF;
                 hlpr->max_expected = max_dcc_channels;
                 hlpr->timeout = dcc_timeout;
diff --git a/net/ipv4/netfilter/ip_conntrack_netbios_ns.c b/net/ipv4/netfilter/ip_conntrack_netbios_ns.c
index 3d0b438783db..a1d6a89f64aa 100644
--- a/net/ipv4/netfilter/ip_conntrack_netbios_ns.c
+++ b/net/ipv4/netfilter/ip_conntrack_netbios_ns.c
@@ -48,7 +48,7 @@ static int help(struct sk_buff **pskb,
         struct iphdr *iph = (*pskb)->nh.iph;
         struct rtable *rt = (struct rtable *)(*pskb)->dst;
         struct in_device *in_dev;
-        u_int32_t mask = 0;
+        __be32 mask = 0;
 
         /* we're only interested in locally generated packets */
         if ((*pskb)->sk == NULL)
@@ -78,12 +78,12 @@ static int help(struct sk_buff **pskb,
                 goto out;
 
         exp->tuple                = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
-        exp->tuple.src.u.udp.port = ntohs(NMBD_PORT);
+        exp->tuple.src.u.udp.port = htons(NMBD_PORT);
 
         exp->mask.src.ip          = mask;
-        exp->mask.src.u.udp.port  = 0xFFFF;
-        exp->mask.dst.ip          = 0xFFFFFFFF;
-        exp->mask.dst.u.udp.port  = 0xFFFF;
+        exp->mask.src.u.udp.port  = htons(0xFFFF);
+        exp->mask.dst.ip          = htonl(0xFFFFFFFF);
+        exp->mask.dst.u.udp.port  = htons(0xFFFF);
         exp->mask.dst.protonum    = 0xFF;
 
         exp->expectfn             = NULL;
@@ -115,7 +115,7 @@ static struct ip_conntrack_helper helper = {
                 .src = {
                         .u = {
                                 .udp = {
-                                        .port   = 0xFFFF,
+                                        .port   = __constant_htons(0xFFFF),
                                 }
                         }
                 },
diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index 52eddea27e93..262d0d44ec1b 100644
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -44,13 +44,6 @@ MODULE_LICENSE("GPL");
 
 static char __initdata version[] = "0.90";
 
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
-
 static inline int
 ctnetlink_dump_tuples_proto(struct sk_buff *skb, 
                             const struct ip_conntrack_tuple *tuple,
@@ -78,8 +71,8 @@ ctnetlink_dump_tuples_ip(struct sk_buff *skb,
 {
         struct nfattr *nest_parms = NFA_NEST(skb, CTA_TUPLE_IP);
         
-        NFA_PUT(skb, CTA_IP_V4_SRC, sizeof(u_int32_t), &tuple->src.ip);
-        NFA_PUT(skb, CTA_IP_V4_DST, sizeof(u_int32_t), &tuple->dst.ip);
+        NFA_PUT(skb, CTA_IP_V4_SRC, sizeof(__be32), &tuple->src.ip);
+        NFA_PUT(skb, CTA_IP_V4_DST, sizeof(__be32), &tuple->dst.ip);
 
         NFA_NEST_END(skb, nest_parms);
 
@@ -110,7 +103,7 @@ ctnetlink_dump_tuples(struct sk_buff *skb,
 static inline int
 ctnetlink_dump_status(struct sk_buff *skb, const struct ip_conntrack *ct)
 {
-        u_int32_t status = htonl((u_int32_t) ct->status);
+        __be32 status = htonl((u_int32_t) ct->status);
         NFA_PUT(skb, CTA_STATUS, sizeof(status), &status);
         return 0;
 
@@ -122,7 +115,7 @@ static inline int
 ctnetlink_dump_timeout(struct sk_buff *skb, const struct ip_conntrack *ct)
 {
         long timeout_l = ct->timeout.expires - jiffies;
-        u_int32_t timeout;
+        __be32 timeout;
 
         if (timeout_l < 0)
                 timeout = 0;
@@ -192,13 +185,13 @@ ctnetlink_dump_counters(struct sk_buff *skb, const struct ip_conntrack *ct,
 {
         enum ctattr_type type = dir ? CTA_COUNTERS_REPLY: CTA_COUNTERS_ORIG;
         struct nfattr *nest_count = NFA_NEST(skb, type);
-        u_int32_t tmp;
+        __be32 tmp;
 
         tmp = htonl(ct->counters[dir].packets);
-        NFA_PUT(skb, CTA_COUNTERS32_PACKETS, sizeof(u_int32_t), &tmp);
+        NFA_PUT(skb, CTA_COUNTERS32_PACKETS, sizeof(__be32), &tmp);
 
         tmp = htonl(ct->counters[dir].bytes);
-        NFA_PUT(skb, CTA_COUNTERS32_BYTES, sizeof(u_int32_t), &tmp);
+        NFA_PUT(skb, CTA_COUNTERS32_BYTES, sizeof(__be32), &tmp);
 
         NFA_NEST_END(skb, nest_count);
 
@@ -215,9 +208,9 @@ nfattr_failure:
 static inline int
 ctnetlink_dump_mark(struct sk_buff *skb, const struct ip_conntrack *ct)
 {
-        u_int32_t mark = htonl(ct->mark);
+        __be32 mark = htonl(ct->mark);
 
-        NFA_PUT(skb, CTA_MARK, sizeof(u_int32_t), &mark);
+        NFA_PUT(skb, CTA_MARK, sizeof(__be32), &mark);
         return 0;
 
 nfattr_failure:
@@ -230,8 +223,8 @@ nfattr_failure:
 static inline int
 ctnetlink_dump_id(struct sk_buff *skb, const struct ip_conntrack *ct)
 {
-        u_int32_t id = htonl(ct->id);
-        NFA_PUT(skb, CTA_ID, sizeof(u_int32_t), &id);
+        __be32 id = htonl(ct->id);
+        NFA_PUT(skb, CTA_ID, sizeof(__be32), &id);
         return 0;
 
 nfattr_failure:
@@ -241,9 +234,9 @@ nfattr_failure:
 static inline int
 ctnetlink_dump_use(struct sk_buff *skb, const struct ip_conntrack *ct)
 {
-        u_int32_t use = htonl(atomic_read(&ct->ct_general.use));
+        __be32 use = htonl(atomic_read(&ct->ct_general.use));
         
-        NFA_PUT(skb, CTA_USE, sizeof(u_int32_t), &use);
+        NFA_PUT(skb, CTA_USE, sizeof(__be32), &use);
         return 0;
 
 nfattr_failure:
@@ -398,7 +391,6 @@ nfattr_failure:
 
 static int ctnetlink_done(struct netlink_callback *cb)
 {
-        DEBUGP("entered %s\n", __FUNCTION__);
         if (cb->args[1])
                 ip_conntrack_put((struct ip_conntrack *)cb->args[1]);
         return 0;
@@ -411,9 +403,6 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct ip_conntrack_tuple_hash *h;
         struct list_head *i;
 
-        DEBUGP("entered %s, last bucket=%lu id=%u\n", __FUNCTION__, 
-                        cb->args[0], *id);
-
         read_lock_bh(&ip_conntrack_lock);
         last = (struct ip_conntrack *)cb->args[1];
         for (; cb->args[0] < ip_conntrack_htable_size; cb->args[0]++) {
@@ -452,13 +441,12 @@ out:
         if (last)
                 ip_conntrack_put(last);
 
-        DEBUGP("leaving, last bucket=%lu id=%u\n", cb->args[0], *id);
         return skb->len;
 }
 
 static const size_t cta_min_ip[CTA_IP_MAX] = {
-        [CTA_IP_V4_SRC-1]       = sizeof(u_int32_t),
-        [CTA_IP_V4_DST-1]       = sizeof(u_int32_t),
+        [CTA_IP_V4_SRC-1]       = sizeof(__be32),
+        [CTA_IP_V4_DST-1]       = sizeof(__be32),
 };
 
 static inline int
@@ -466,8 +454,6 @@ ctnetlink_parse_tuple_ip(struct nfattr *attr, struct ip_conntrack_tuple *tuple)
 {
         struct nfattr *tb[CTA_IP_MAX];
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_IP_MAX, attr);
 
         if (nfattr_bad_size(tb, CTA_IP_MAX, cta_min_ip))
@@ -475,13 +461,11 @@ ctnetlink_parse_tuple_ip(struct nfattr *attr, struct ip_conntrack_tuple *tuple)
 
         if (!tb[CTA_IP_V4_SRC-1])
                 return -EINVAL;
-        tuple->src.ip = *(u_int32_t *)NFA_DATA(tb[CTA_IP_V4_SRC-1]);
+        tuple->src.ip = *(__be32 *)NFA_DATA(tb[CTA_IP_V4_SRC-1]);
 
         if (!tb[CTA_IP_V4_DST-1])
                 return -EINVAL;
-        tuple->dst.ip = *(u_int32_t *)NFA_DATA(tb[CTA_IP_V4_DST-1]);
-
-        DEBUGP("leaving\n");
+        tuple->dst.ip = *(__be32 *)NFA_DATA(tb[CTA_IP_V4_DST-1]);
 
         return 0;
 }
@@ -503,8 +487,6 @@ ctnetlink_parse_tuple_proto(struct nfattr *attr,
         struct ip_conntrack_protocol *proto;
         int ret = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_PROTO_MAX, attr);
 
         if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
@@ -531,8 +513,6 @@ ctnetlink_parse_tuple(struct nfattr *cda[], struct ip_conntrack_tuple *tuple,
         struct nfattr *tb[CTA_TUPLE_MAX];
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         memset(tuple, 0, sizeof(*tuple));
 
         nfattr_parse_nested(tb, CTA_TUPLE_MAX, cda[type-1]);
@@ -557,10 +537,6 @@ ctnetlink_parse_tuple(struct nfattr *cda[], struct ip_conntrack_tuple *tuple,
         else
                 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
 
-        DUMP_TUPLE(tuple);
-
-        DEBUGP("leaving\n");
-
         return 0;
 }
 
@@ -577,8 +553,6 @@ static int ctnetlink_parse_nat_proto(struct nfattr *attr,
         struct nfattr *tb[CTA_PROTONAT_MAX];
         struct ip_nat_protocol *npt;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_PROTONAT_MAX, attr);
 
         if (nfattr_bad_size(tb, CTA_PROTONAT_MAX, cta_min_protonat))
@@ -597,13 +571,12 @@ static int ctnetlink_parse_nat_proto(struct nfattr *attr,
 
         ip_nat_proto_put(npt);
 
-        DEBUGP("leaving\n");
         return 0;
 }
 
 static const size_t cta_min_nat[CTA_NAT_MAX] = {
-        [CTA_NAT_MINIP-1]       = sizeof(u_int32_t),
-        [CTA_NAT_MAXIP-1]       = sizeof(u_int32_t),
+        [CTA_NAT_MINIP-1]       = sizeof(__be32),
+        [CTA_NAT_MAXIP-1]       = sizeof(__be32),
 };
 
 static inline int
@@ -613,8 +586,6 @@ ctnetlink_parse_nat(struct nfattr *nat,
         struct nfattr *tb[CTA_NAT_MAX];
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         memset(range, 0, sizeof(*range));
         
         nfattr_parse_nested(tb, CTA_NAT_MAX, nat);
@@ -623,12 +594,12 @@ ctnetlink_parse_nat(struct nfattr *nat,
                 return -EINVAL;
 
         if (tb[CTA_NAT_MINIP-1])
-                range->min_ip = *(u_int32_t *)NFA_DATA(tb[CTA_NAT_MINIP-1]);
+                range->min_ip = *(__be32 *)NFA_DATA(tb[CTA_NAT_MINIP-1]);
 
         if (!tb[CTA_NAT_MAXIP-1])
                 range->max_ip = range->min_ip;
         else
-                range->max_ip = *(u_int32_t *)NFA_DATA(tb[CTA_NAT_MAXIP-1]);
+                range->max_ip = *(__be32 *)NFA_DATA(tb[CTA_NAT_MAXIP-1]);
 
         if (range->min_ip)
                 range->flags |= IP_NAT_RANGE_MAP_IPS;
@@ -640,7 +611,6 @@ ctnetlink_parse_nat(struct nfattr *nat,
         if (err < 0)
                 return err;
 
-        DEBUGP("leaving\n");
         return 0;
 }
 #endif
@@ -650,8 +620,6 @@ ctnetlink_parse_help(struct nfattr *attr, char **helper_name)
 {
         struct nfattr *tb[CTA_HELP_MAX];
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_HELP_MAX, attr);
 
         if (!tb[CTA_HELP_NAME-1])
@@ -663,11 +631,11 @@ ctnetlink_parse_help(struct nfattr *attr, char **helper_name)
 }
 
 static const size_t cta_min[CTA_MAX] = {
-        [CTA_STATUS-1]          = sizeof(u_int32_t),
-        [CTA_TIMEOUT-1]         = sizeof(u_int32_t),
-        [CTA_MARK-1]            = sizeof(u_int32_t),
-        [CTA_USE-1]             = sizeof(u_int32_t),
-        [CTA_ID-1]              = sizeof(u_int32_t)
+        [CTA_STATUS-1]          = sizeof(__be32),
+        [CTA_TIMEOUT-1]         = sizeof(__be32),
+        [CTA_MARK-1]            = sizeof(__be32),
+        [CTA_USE-1]             = sizeof(__be32),
+        [CTA_ID-1]              = sizeof(__be32)
 };
 
 static int
@@ -679,8 +647,6 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
         struct ip_conntrack *ct;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nfattr_bad_size(cda, CTA_MAX, cta_min))
                 return -EINVAL;
 
@@ -698,15 +664,13 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 return err;
 
         h = ip_conntrack_find_get(&tuple, NULL);
-        if (!h) {
-                DEBUGP("tuple not found in conntrack hash\n");
+        if (!h)
                 return -ENOENT;
-        }
 
         ct = tuplehash_to_ctrack(h);
         
         if (cda[CTA_ID-1]) {
-                u_int32_t id = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_ID-1]));
+                u_int32_t id = ntohl(*(__be32 *)NFA_DATA(cda[CTA_ID-1]));
                 if (ct->id != id) {
                         ip_conntrack_put(ct);
                         return -ENOENT;
@@ -716,7 +680,6 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 ct->timeout.function((unsigned long)ct);
 
         ip_conntrack_put(ct);
-        DEBUGP("leaving\n");
 
         return 0;
 }
@@ -731,8 +694,6 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
         struct sk_buff *skb2 = NULL;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 struct nfgenmsg *msg = NLMSG_DATA(nlh);
                 u32 rlen;
@@ -770,11 +731,9 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 return err;
 
         h = ip_conntrack_find_get(&tuple, NULL);
-        if (!h) {
-                DEBUGP("tuple not found in conntrack hash");
+        if (!h)
                 return -ENOENT;
-        }
-        DEBUGP("tuple found\n");
+
         ct = tuplehash_to_ctrack(h);
 
         err = -ENOMEM;
@@ -795,7 +754,6 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
         if (err < 0)
                 goto out;
 
-        DEBUGP("leaving\n");
         return 0;
 
 free:
@@ -808,7 +766,7 @@ static inline int
 ctnetlink_change_status(struct ip_conntrack *ct, struct nfattr *cda[])
 {
         unsigned long d;
-        unsigned status = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_STATUS-1]));
+        unsigned status = ntohl(*(__be32 *)NFA_DATA(cda[CTA_STATUS-1]));
         d = ct->status ^ status;
 
         if (d & (IPS_EXPECTED|IPS_CONFIRMED|IPS_DYING))
@@ -866,8 +824,6 @@ ctnetlink_change_helper(struct ip_conntrack *ct, struct nfattr *cda[])
         char *helpname;
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         /* don't change helper of sibling connections */
         if (ct->master)
                 return -EINVAL;
@@ -903,7 +859,7 @@ ctnetlink_change_helper(struct ip_conntrack *ct, struct nfattr *cda[])
 static inline int
 ctnetlink_change_timeout(struct ip_conntrack *ct, struct nfattr *cda[])
 {
-        u_int32_t timeout = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_TIMEOUT-1]));
+        u_int32_t timeout = ntohl(*(__be32 *)NFA_DATA(cda[CTA_TIMEOUT-1]));
         
         if (!del_timer(&ct->timeout))
                 return -ETIME;
@@ -938,8 +894,6 @@ ctnetlink_change_conntrack(struct ip_conntrack *ct, struct nfattr *cda[])
 {
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (cda[CTA_HELP-1]) {
                 err = ctnetlink_change_helper(ct, cda);
                 if (err < 0)
@@ -966,10 +920,9 @@ ctnetlink_change_conntrack(struct ip_conntrack *ct, struct nfattr *cda[])
 
 #if defined(CONFIG_IP_NF_CONNTRACK_MARK)
         if (cda[CTA_MARK-1])
-                ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
+                ct->mark = ntohl(*(__be32 *)NFA_DATA(cda[CTA_MARK-1]));
 #endif
 
-        DEBUGP("all done\n");
         return 0;
 }
 
@@ -981,15 +934,13 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
         struct ip_conntrack *ct;
         int err = -EINVAL;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         ct = ip_conntrack_alloc(otuple, rtuple);
         if (ct == NULL || IS_ERR(ct))
                 return -ENOMEM; 
 
         if (!cda[CTA_TIMEOUT-1])
                 goto err;
-        ct->timeout.expires = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_TIMEOUT-1]));
+        ct->timeout.expires = ntohl(*(__be32 *)NFA_DATA(cda[CTA_TIMEOUT-1]));
 
         ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
         ct->status |= IPS_CONFIRMED;
@@ -1006,7 +957,7 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
 
 #if defined(CONFIG_IP_NF_CONNTRACK_MARK)
         if (cda[CTA_MARK-1])
-                ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
+                ct->mark = ntohl(*(__be32 *)NFA_DATA(cda[CTA_MARK-1]));
 #endif
 
         ct->helper = ip_conntrack_helper_find_get(rtuple);
@@ -1017,7 +968,6 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
         if (ct->helper)
                 ip_conntrack_helper_put(ct->helper);
 
-        DEBUGP("conntrack with id %u inserted\n", ct->id);
         return 0;
 
 err:    
@@ -1033,8 +983,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
         struct ip_conntrack_tuple_hash *h = NULL;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nfattr_bad_size(cda, CTA_MAX, cta_min))
                 return -EINVAL;
 
@@ -1058,7 +1006,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
 
         if (h == NULL) {
                 write_unlock_bh(&ip_conntrack_lock);
-                DEBUGP("no such conntrack, create new\n");
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE)
                         err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);
@@ -1074,7 +1021,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
 
         /* We manipulate the conntrack inside the global conntrack table lock,
          * so there's no need to increase the refcount */
-        DEBUGP("conntrack found\n");
         err = -EEXIST;
         if (!(nlh->nlmsg_flags & NLM_F_EXCL))
                 err = ctnetlink_change_conntrack(tuplehash_to_ctrack(h), cda);
@@ -1138,8 +1084,8 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
                           const struct ip_conntrack_expect *exp)
 {
         struct ip_conntrack *master = exp->master;
-        u_int32_t timeout = htonl((exp->timeout.expires - jiffies) / HZ);
-        u_int32_t id = htonl(exp->id);
+        __be32 timeout = htonl((exp->timeout.expires - jiffies) / HZ);
+        __be32 id = htonl(exp->id);
 
         if (ctnetlink_exp_dump_tuple(skb, &exp->tuple, CTA_EXPECT_TUPLE) < 0)
                 goto nfattr_failure;
@@ -1150,8 +1096,8 @@ ctnetlink_exp_dump_expect(struct sk_buff *skb,
                                  CTA_EXPECT_MASTER) < 0)
                 goto nfattr_failure;
         
-        NFA_PUT(skb, CTA_EXPECT_TIMEOUT, sizeof(timeout), &timeout);
-        NFA_PUT(skb, CTA_EXPECT_ID, sizeof(u_int32_t), &id);
+        NFA_PUT(skb, CTA_EXPECT_TIMEOUT, sizeof(__be32), &timeout);
+        NFA_PUT(skb, CTA_EXPECT_ID, sizeof(__be32), &id);
 
         return 0;
         
@@ -1249,8 +1195,6 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct list_head *i;
         u_int32_t *id = (u_int32_t *) &cb->args[0];
 
-        DEBUGP("entered %s, last id=%llu\n", __FUNCTION__, *id);
-
         read_lock_bh(&ip_conntrack_lock);
         list_for_each_prev(i, &ip_conntrack_expect_list) {
                 exp = (struct ip_conntrack_expect *) i;
@@ -1266,14 +1210,12 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 out:    
         read_unlock_bh(&ip_conntrack_lock);
 
-        DEBUGP("leaving, last id=%llu\n", *id);
-
         return skb->len;
 }
 
 static const size_t cta_min_exp[CTA_EXPECT_MAX] = {
-        [CTA_EXPECT_TIMEOUT-1]          = sizeof(u_int32_t),
-        [CTA_EXPECT_ID-1]               = sizeof(u_int32_t)
+        [CTA_EXPECT_TIMEOUT-1]          = sizeof(__be32),
+        [CTA_EXPECT_ID-1]               = sizeof(__be32)
 };
 
 static int
@@ -1285,8 +1227,6 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
         struct sk_buff *skb2;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
                 return -EINVAL;
 
@@ -1321,7 +1261,7 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
                 return -ENOENT;
 
         if (cda[CTA_EXPECT_ID-1]) {
-                u_int32_t id = *(u_int32_t *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
+                __be32 id = *(__be32 *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
                 if (exp->id != ntohl(id)) {
                         ip_conntrack_expect_put(exp);
                         return -ENOENT;
@@ -1375,8 +1315,8 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                         return -ENOENT;
 
                 if (cda[CTA_EXPECT_ID-1]) {
-                        u_int32_t id = 
-                                *(u_int32_t *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
+                        __be32 id =
+                                *(__be32 *)NFA_DATA(cda[CTA_EXPECT_ID-1]);
                         if (exp->id != ntohl(id)) {
                                 ip_conntrack_expect_put(exp);
                                 return -ENOENT;
@@ -1437,8 +1377,6 @@ ctnetlink_create_expect(struct nfattr *cda[])
         struct ip_conntrack *ct;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         /* caller guarantees that those three CTA_EXPECT_* exist */
         err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE);
         if (err < 0)
@@ -1490,8 +1428,6 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
         struct ip_conntrack_expect *exp;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);   
-
         if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
                 return -EINVAL;
 
@@ -1520,8 +1456,6 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
                 err = ctnetlink_change_expect(exp, cda);
         write_unlock_bh(&ip_conntrack_lock);
 
-        DEBUGP("leaving\n");
-        
         return err;
 }
 
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
index 09c40ebe3345..295b6fa340db 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
@@ -261,7 +261,7 @@ icmp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
 static int icmp_tuple_to_nfattr(struct sk_buff *skb,
                                 const struct ip_conntrack_tuple *t)
 {
-        NFA_PUT(skb, CTA_PROTO_ICMP_ID, sizeof(u_int16_t),
+        NFA_PUT(skb, CTA_PROTO_ICMP_ID, sizeof(__be16),
                 &t->src.u.icmp.id);
         NFA_PUT(skb, CTA_PROTO_ICMP_TYPE, sizeof(u_int8_t),
                 &t->dst.u.icmp.type);
@@ -287,7 +287,7 @@ static int icmp_nfattr_to_tuple(struct nfattr *tb[],
         tuple->dst.u.icmp.code =
                         *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMP_CODE-1]);
         tuple->src.u.icmp.id =
-                        *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_ICMP_ID-1]);
+                        *(__be16 *)NFA_DATA(tb[CTA_PROTO_ICMP_ID-1]);
 
         if (tuple->dst.u.icmp.type >= sizeof(invmap)
             || !invmap[tuple->dst.u.icmp.type])
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
index b908a4842e18..2443322e4128 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
@@ -210,7 +210,7 @@ static int sctp_print_conntrack(struct seq_file *s,
 for (offset = skb->nh.iph->ihl * 4 + sizeof(sctp_sctphdr_t), count = 0; \
         offset < skb->len &&                                            \
         (sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch));   \
-        offset += (htons(sch->length) + 3) & ~3, count++)
+        offset += (ntohs(sch->length) + 3) & ~3, count++)
 
 /* Some validity checks to make sure the chunks are fine */
 static int do_basic_checks(struct ip_conntrack *conntrack,
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
index 03ae9a04cb37..06e4e8a6dd9f 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -519,8 +519,8 @@ static void tcp_sack(const struct sk_buff *skb,
 
         /* Fast path for timestamp-only option */
         if (length == TCPOLEN_TSTAMP_ALIGNED*4
-            && *(__u32 *)ptr ==
-                __constant_ntohl((TCPOPT_NOP << 24) 
+            && *(__be32 *)ptr ==
+                __constant_htonl((TCPOPT_NOP << 24)
                                  | (TCPOPT_NOP << 16)
                                  | (TCPOPT_TIMESTAMP << 8)
                                  | TCPOLEN_TIMESTAMP))
@@ -551,7 +551,7 @@ static void tcp_sack(const struct sk_buff *skb,
                                 for (i = 0;
                                      i < (opsize - TCPOLEN_SACK_BASE);
                                      i += TCPOLEN_SACK_PERBLOCK) {
-                                        tmp = ntohl(*((u_int32_t *)(ptr+i)+1));
+                                        tmp = ntohl(*((__be32 *)(ptr+i)+1));
                                         
                                         if (after(tmp, *sack))
                                                 *sack = tmp;
diff --git a/net/ipv4/netfilter/ip_conntrack_sip.c b/net/ipv4/netfilter/ip_conntrack_sip.c
index 2893e9c74850..f4f75995a9e4 100644
--- a/net/ipv4/netfilter/ip_conntrack_sip.c
+++ b/net/ipv4/netfilter/ip_conntrack_sip.c
@@ -193,7 +193,7 @@ static int skp_digits_len(const char *dptr, const char *limit, int *shift)
 
 /* Simple ipaddr parser.. */
 static int parse_ipaddr(const char *cp, const char **endp,
-                        u_int32_t *ipaddr, const char *limit)
+                        __be32 *ipaddr, const char *limit)
 {
         unsigned long int val;
         int i, digit = 0;
@@ -227,7 +227,7 @@ static int parse_ipaddr(const char *cp,	const char **endp,
 static int epaddr_len(const char *dptr, const char *limit, int *shift)
 {
         const char *aux = dptr;
-        u_int32_t ip;
+        __be32 ip;
 
         if (parse_ipaddr(dptr, &dptr, &ip, limit) < 0) {
                 DEBUGP("ip: %s parse failed.!\n", dptr);
@@ -302,7 +302,7 @@ int ct_sip_get_info(const char *dptr, size_t dlen,
 static int set_expected_rtp(struct sk_buff **pskb,
                             struct ip_conntrack *ct,
                             enum ip_conntrack_info ctinfo,
-                            u_int32_t ipaddr, u_int16_t port,
+                            __be32 ipaddr, u_int16_t port,
                             const char *dptr)
 {
         struct ip_conntrack_expect *exp;
@@ -319,10 +319,10 @@ static int set_expected_rtp(struct sk_buff **pskb,
         exp->tuple.dst.u.udp.port = htons(port);
         exp->tuple.dst.protonum = IPPROTO_UDP;
 
-        exp->mask.src.ip = 0xFFFFFFFF;
+        exp->mask.src.ip = htonl(0xFFFFFFFF);
         exp->mask.src.u.udp.port = 0;
-        exp->mask.dst.ip = 0xFFFFFFFF;
-        exp->mask.dst.u.udp.port = 0xFFFF;
+        exp->mask.dst.ip = htonl(0xFFFFFFFF);
+        exp->mask.dst.u.udp.port = htons(0xFFFF);
         exp->mask.dst.protonum = 0xFF;
 
         exp->expectfn = NULL;
@@ -349,7 +349,7 @@ static int sip_help(struct sk_buff **pskb,
         const char *dptr;
         int ret = NF_ACCEPT;
         int matchoff, matchlen;
-        u_int32_t ipaddr;
+        __be32 ipaddr;
         u_int16_t port;
 
         /* No Data ? */
@@ -439,7 +439,7 @@ static int __init init(void)
 
                 sip[i].tuple.dst.protonum = IPPROTO_UDP;
                 sip[i].tuple.src.u.udp.port = htons(ports[i]);
-                sip[i].mask.src.u.udp.port = 0xFFFF;
+                sip[i].mask.src.u.udp.port = htons(0xFFFF);
                 sip[i].mask.dst.protonum = 0xFF;
                 sip[i].max_expected = 2;
                 sip[i].timeout = 3 * 60; /* 3 minutes */
diff --git a/net/ipv4/netfilter/ip_conntrack_tftp.c b/net/ipv4/netfilter/ip_conntrack_tftp.c
index 7e33d3bed5e3..fe0b634dd377 100644
--- a/net/ipv4/netfilter/ip_conntrack_tftp.c
+++ b/net/ipv4/netfilter/ip_conntrack_tftp.c
@@ -70,10 +70,10 @@ static int tftp_help(struct sk_buff **pskb,
                         return NF_DROP;
 
                 exp->tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
-                exp->mask.src.ip = 0xffffffff;
+                exp->mask.src.ip = htonl(0xffffffff);
                 exp->mask.src.u.udp.port = 0;
-                exp->mask.dst.ip = 0xffffffff;
-                exp->mask.dst.u.udp.port = 0xffff;
+                exp->mask.dst.ip = htonl(0xffffffff);
+                exp->mask.dst.u.udp.port = htons(0xffff);
                 exp->mask.dst.protonum = 0xff;
                 exp->expectfn = NULL;
                 exp->flags = 0;
@@ -129,7 +129,7 @@ static int __init ip_conntrack_tftp_init(void)
                 tftp[i].tuple.dst.protonum = IPPROTO_UDP;
                 tftp[i].tuple.src.u.udp.port = htons(ports[i]);
                 tftp[i].mask.dst.protonum = 0xFF;
-                tftp[i].mask.src.u.udp.port = 0xFFFF;
+                tftp[i].mask.src.u.udp.port = htons(0xFFFF);
                 tftp[i].max_expected = 1;
                 tftp[i].timeout = 5 * 60; /* 5 minutes */
                 tftp[i].me = THIS_MODULE;
diff --git a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c
index 71f3e09cbc84..4b6260a97408 100644
--- a/net/ipv4/netfilter/ip_nat_core.c
+++ b/net/ipv4/netfilter/ip_nat_core.c
@@ -82,7 +82,7 @@ static inline unsigned int
 hash_by_src(const struct ip_conntrack_tuple *tuple)
 {
         /* Original src, to ensure we map it consistently if poss. */
-        return jhash_3words(tuple->src.ip, tuple->src.u.all,
+        return jhash_3words((__force u32)tuple->src.ip, tuple->src.u.all,
                             tuple->dst.protonum, 0) % ip_nat_htable_size;
 }
 
@@ -190,7 +190,7 @@ find_best_ips_proto(struct ip_conntrack_tuple *tuple,
                     const struct ip_conntrack *conntrack,
                     enum ip_nat_manip_type maniptype)
 {
-        u_int32_t *var_ipp;
+        __be32 *var_ipp;
         /* Host order */
         u_int32_t minip, maxip, j;
 
@@ -217,7 +217,7 @@ find_best_ips_proto(struct ip_conntrack_tuple *tuple,
          * like this), even across reboots. */
         minip = ntohl(range->min_ip);
         maxip = ntohl(range->max_ip);
-        j = jhash_2words(tuple->src.ip, tuple->dst.ip, 0);
+        j = jhash_2words((__force u32)tuple->src.ip, (__force u32)tuple->dst.ip, 0);
         *var_ipp = htonl(minip + j % (maxip - minip + 1));
 }
 
@@ -534,9 +534,9 @@ int
 ip_nat_port_range_to_nfattr(struct sk_buff *skb, 
                             const struct ip_nat_range *range)
 {
-        NFA_PUT(skb, CTA_PROTONAT_PORT_MIN, sizeof(u_int16_t),
+        NFA_PUT(skb, CTA_PROTONAT_PORT_MIN, sizeof(__be16),
                 &range->min.tcp.port);
-        NFA_PUT(skb, CTA_PROTONAT_PORT_MAX, sizeof(u_int16_t),
+        NFA_PUT(skb, CTA_PROTONAT_PORT_MAX, sizeof(__be16),
                 &range->max.tcp.port);
 
         return 0;
@@ -555,7 +555,7 @@ ip_nat_port_nfattr_to_range(struct nfattr *tb[], struct ip_nat_range *range)
         if (tb[CTA_PROTONAT_PORT_MIN-1]) {
                 ret = 1;
                 range->min.tcp.port = 
-                        *(u_int16_t *)NFA_DATA(tb[CTA_PROTONAT_PORT_MIN-1]);
+                        *(__be16 *)NFA_DATA(tb[CTA_PROTONAT_PORT_MIN-1]);
         }
         
         if (!tb[CTA_PROTONAT_PORT_MAX-1]) {
@@ -564,7 +564,7 @@ ip_nat_port_nfattr_to_range(struct nfattr *tb[], struct ip_nat_range *range)
         } else {
                 ret = 1;
                 range->max.tcp.port = 
-                        *(u_int16_t *)NFA_DATA(tb[CTA_PROTONAT_PORT_MAX-1]);
+                        *(__be16 *)NFA_DATA(tb[CTA_PROTONAT_PORT_MAX-1]);
         }
 
         return ret;
diff --git a/net/ipv4/netfilter/ip_nat_ftp.c b/net/ipv4/netfilter/ip_nat_ftp.c
index 3328fc5c5f50..a71c233d8112 100644
--- a/net/ipv4/netfilter/ip_nat_ftp.c
+++ b/net/ipv4/netfilter/ip_nat_ftp.c
@@ -34,7 +34,7 @@ MODULE_DESCRIPTION("ftp NAT helper");
 
 static int
 mangle_rfc959_packet(struct sk_buff **pskb,
-                     u_int32_t newip,
+                     __be32 newip,
                      u_int16_t port,
                      unsigned int matchoff,
                      unsigned int matchlen,
@@ -57,7 +57,7 @@ mangle_rfc959_packet(struct sk_buff **pskb,
 /* |1|132.235.1.2|6275| */
 static int
 mangle_eprt_packet(struct sk_buff **pskb,
-                   u_int32_t newip,
+                   __be32 newip,
                    u_int16_t port,
                    unsigned int matchoff,
                    unsigned int matchlen,
@@ -79,7 +79,7 @@ mangle_eprt_packet(struct sk_buff **pskb,
 /* |1|132.235.1.2|6275| */
 static int
 mangle_epsv_packet(struct sk_buff **pskb,
-                   u_int32_t newip,
+                   __be32 newip,
                    u_int16_t port,
                    unsigned int matchoff,
                    unsigned int matchlen,
@@ -98,7 +98,7 @@ mangle_epsv_packet(struct sk_buff **pskb,
                                         matchlen, buffer, strlen(buffer));
 }
 
-static int (*mangle[])(struct sk_buff **, u_int32_t, u_int16_t,
+static int (*mangle[])(struct sk_buff **, __be32, u_int16_t,
                      unsigned int,
                      unsigned int,
                      struct ip_conntrack *,
@@ -120,7 +120,7 @@ static unsigned int ip_nat_ftp(struct sk_buff **pskb,
                                struct ip_conntrack_expect *exp,
                                u32 *seq)
 {
-        u_int32_t newip;
+        __be32 newip;
         u_int16_t port;
         int dir = CTINFO2DIR(ctinfo);
         struct ip_conntrack *ct = exp->master;
diff --git a/net/ipv4/netfilter/ip_nat_helper.c b/net/ipv4/netfilter/ip_nat_helper.c
index 7f6a75984f6c..3bf858480558 100644
--- a/net/ipv4/netfilter/ip_nat_helper.c
+++ b/net/ipv4/netfilter/ip_nat_helper.c
@@ -189,7 +189,7 @@ ip_nat_mangle_tcp_packet(struct sk_buff **pskb,
                                                         datalen, 0));
         } else
                 tcph->check = nf_proto_csum_update(*pskb,
-                                                   htons(oldlen) ^ 0xFFFF,
+                                                   htons(oldlen) ^ htons(0xFFFF),
                                                    htons(datalen),
                                                    tcph->check, 1);
 
@@ -267,7 +267,7 @@ ip_nat_mangle_udp_packet(struct sk_buff **pskb,
                         udph->check = -1;
         } else
                 udph->check = nf_proto_csum_update(*pskb,
-                                                   htons(oldlen) ^ 0xFFFF,
+                                                   htons(oldlen) ^ htons(0xFFFF),
                                                    htons(datalen),
                                                    udph->check, 1);
         return 1;
@@ -283,27 +283,25 @@ sack_adjust(struct sk_buff *skb,
             struct ip_nat_seq *natseq)
 {
         while (sackoff < sackend) {
-                struct tcp_sack_block *sack;
-                u_int32_t new_start_seq, new_end_seq;
+                struct tcp_sack_block_wire *sack;
+                __be32 new_start_seq, new_end_seq;
 
                 sack = (void *)skb->data + sackoff;
                 if (after(ntohl(sack->start_seq) - natseq->offset_before,
                           natseq->correction_pos))
-                        new_start_seq = ntohl(sack->start_seq) 
-                                        - natseq->offset_after;
+                        new_start_seq = htonl(ntohl(sack->start_seq)
+                                        - natseq->offset_after);
                 else
-                        new_start_seq = ntohl(sack->start_seq) 
-                                        - natseq->offset_before;
-                new_start_seq = htonl(new_start_seq);
+                        new_start_seq = htonl(ntohl(sack->start_seq)
+                                        - natseq->offset_before);
 
                 if (after(ntohl(sack->end_seq) - natseq->offset_before,
                           natseq->correction_pos))
-                        new_end_seq = ntohl(sack->end_seq)
-                                      - natseq->offset_after;
+                        new_end_seq = htonl(ntohl(sack->end_seq)
+                                      - natseq->offset_after);
                 else
-                        new_end_seq = ntohl(sack->end_seq)
-                                      - natseq->offset_before;
-                new_end_seq = htonl(new_end_seq);
+                        new_end_seq = htonl(ntohl(sack->end_seq)
+                                      - natseq->offset_before);
 
                 DEBUGP("sack_adjust: start_seq: %d->%d, end_seq: %d->%d\n",
                         ntohl(sack->start_seq), new_start_seq,
@@ -375,7 +373,8 @@ ip_nat_seq_adjust(struct sk_buff **pskb,
                   enum ip_conntrack_info ctinfo)
 {
         struct tcphdr *tcph;
-        int dir, newseq, newack;
+        int dir;
+        __be32 newseq, newack;
         struct ip_nat_seq *this_way, *other_way;        
 
         dir = CTINFO2DIR(ctinfo);
@@ -388,17 +387,15 @@ ip_nat_seq_adjust(struct sk_buff **pskb,
 
         tcph = (void *)(*pskb)->data + (*pskb)->nh.iph->ihl*4;
         if (after(ntohl(tcph->seq), this_way->correction_pos))
-                newseq = ntohl(tcph->seq) + this_way->offset_after;
+                newseq = htonl(ntohl(tcph->seq) + this_way->offset_after);
         else
-                newseq = ntohl(tcph->seq) + this_way->offset_before;
-        newseq = htonl(newseq);
+                newseq = htonl(ntohl(tcph->seq) + this_way->offset_before);
 
         if (after(ntohl(tcph->ack_seq) - other_way->offset_before,
                   other_way->correction_pos))
-                newack = ntohl(tcph->ack_seq) - other_way->offset_after;
+                newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_after);
         else
-                newack = ntohl(tcph->ack_seq) - other_way->offset_before;
-        newack = htonl(newack);
+                newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_before);
 
         tcph->check = nf_proto_csum_update(*pskb, ~tcph->seq, newseq,
                                            tcph->check, 0);
diff --git a/net/ipv4/netfilter/ip_nat_helper_h323.c b/net/ipv4/netfilter/ip_nat_helper_h323.c
index 419b878fb467..4a7d34466ee2 100644
--- a/net/ipv4/netfilter/ip_nat_helper_h323.c
+++ b/net/ipv4/netfilter/ip_nat_helper_h323.c
@@ -32,13 +32,13 @@
 /****************************************************************************/
 static int set_addr(struct sk_buff **pskb,
                     unsigned char **data, int dataoff,
-                    unsigned int addroff, u_int32_t ip, u_int16_t port)
+                    unsigned int addroff, __be32 ip, u_int16_t port)
 {
         enum ip_conntrack_info ctinfo;
         struct ip_conntrack *ct = ip_conntrack_get(*pskb, &ctinfo);
         struct {
-                u_int32_t ip;
-                u_int16_t port;
+                __be32 ip;
+                __be16 port;
         } __attribute__ ((__packed__)) buf;
         struct tcphdr _tcph, *th;
 
@@ -86,7 +86,7 @@ static int set_addr(struct sk_buff **pskb,
 static int set_h225_addr(struct sk_buff **pskb,
                          unsigned char **data, int dataoff,
                          TransportAddress * addr,
-                         u_int32_t ip, u_int16_t port)
+                         __be32 ip, u_int16_t port)
 {
         return set_addr(pskb, data, dataoff, addr->ipAddress.ip, ip, port);
 }
@@ -95,7 +95,7 @@ static int set_h225_addr(struct sk_buff **pskb,
 static int set_h245_addr(struct sk_buff **pskb,
                          unsigned char **data, int dataoff,
                          H245_TransportAddress * addr,
-                         u_int32_t ip, u_int16_t port)
+                         __be32 ip, u_int16_t port)
 {
         return set_addr(pskb, data, dataoff,
                         addr->unicastAddress.iPAddress.network, ip, port);
@@ -110,7 +110,7 @@ static int set_sig_addr(struct sk_buff **pskb, struct ip_conntrack *ct,
         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
         int dir = CTINFO2DIR(ctinfo);
         int i;
-        u_int32_t ip;
+        __be32 ip;
         u_int16_t port;
 
         for (i = 0; i < count; i++) {
@@ -164,7 +164,7 @@ static int set_ras_addr(struct sk_buff **pskb, struct ip_conntrack *ct,
 {
         int dir = CTINFO2DIR(ctinfo);
         int i;
-        u_int32_t ip;
+        __be32 ip;
         u_int16_t port;
 
         for (i = 0; i < count; i++) {
@@ -433,7 +433,7 @@ static int nat_q931(struct sk_buff **pskb, struct ip_conntrack *ct,
         struct ip_ct_h323_master *info = &ct->help.ct_h323_info;
         int dir = CTINFO2DIR(ctinfo);
         u_int16_t nated_port = port;
-        u_int32_t ip;
+        __be32 ip;
 
         /* Set expectations for NAT */
         exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port;
diff --git a/net/ipv4/netfilter/ip_nat_helper_pptp.c b/net/ipv4/netfilter/ip_nat_helper_pptp.c
index 2ff578807123..329fdcd7d702 100644
--- a/net/ipv4/netfilter/ip_nat_helper_pptp.c
+++ b/net/ipv4/netfilter/ip_nat_helper_pptp.c
@@ -51,7 +51,7 @@
 
 #define IP_NAT_PPTP_VERSION "3.0"
 
-#define REQ_CID(req, off)               (*(u_int16_t *)((char *)(req) + (off)))
+#define REQ_CID(req, off)               (*(__be16 *)((char *)(req) + (off)))
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
diff --git a/net/ipv4/netfilter/ip_nat_proto_icmp.c b/net/ipv4/netfilter/ip_nat_proto_icmp.c
index ec50cc295317..3f6efc13ac74 100644
--- a/net/ipv4/netfilter/ip_nat_proto_icmp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_icmp.c
@@ -67,7 +67,7 @@ icmp_manip_pkt(struct sk_buff **pskb,
 
         hdr = (struct icmphdr *)((*pskb)->data + hdroff);
         hdr->checksum = nf_proto_csum_update(*pskb,
-                                             hdr->un.echo.id ^ 0xFFFF,
+                                             hdr->un.echo.id ^ htons(0xFFFF),
                                              tuple->src.u.icmp.id,
                                              hdr->checksum, 0);
         hdr->un.echo.id = tuple->src.u.icmp.id;
diff --git a/net/ipv4/netfilter/ip_nat_proto_tcp.c b/net/ipv4/netfilter/ip_nat_proto_tcp.c
index 72a6307bd2db..12deb13b93b1 100644
--- a/net/ipv4/netfilter/ip_nat_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_tcp.c
@@ -24,7 +24,7 @@ tcp_in_range(const struct ip_conntrack_tuple *tuple,
              const union ip_conntrack_manip_proto *min,
              const union ip_conntrack_manip_proto *max)
 {
-        u_int16_t port;
+        __be16 port;
 
         if (maniptype == IP_NAT_MANIP_SRC)
                 port = tuple->src.u.tcp.port;
@@ -42,7 +42,7 @@ tcp_unique_tuple(struct ip_conntrack_tuple *tuple,
                  const struct ip_conntrack *conntrack)
 {
         static u_int16_t port;
-        u_int16_t *portptr;
+        __be16 *portptr;
         unsigned int range_size, min, i;
 
         if (maniptype == IP_NAT_MANIP_SRC)
@@ -93,8 +93,8 @@ tcp_manip_pkt(struct sk_buff **pskb,
         struct iphdr *iph = (struct iphdr *)((*pskb)->data + iphdroff);
         struct tcphdr *hdr;
         unsigned int hdroff = iphdroff + iph->ihl*4;
-        u32 oldip, newip;
-        u16 *portptr, newport, oldport;
+        __be32 oldip, newip;
+        __be16 *portptr, newport, oldport;
         int hdrsize = 8; /* TCP connection tracking guarantees this much */
 
         /* this could be a inner header returned in icmp packet; in such
@@ -130,7 +130,7 @@ tcp_manip_pkt(struct sk_buff **pskb,
                 return 1;
 
         hdr->check = nf_proto_csum_update(*pskb, ~oldip, newip, hdr->check, 1);
-        hdr->check = nf_proto_csum_update(*pskb, oldport ^ 0xFFFF, newport,
+        hdr->check = nf_proto_csum_update(*pskb, oldport ^ htons(0xFFFF), newport,
                                           hdr->check, 0);
         return 1;
 }
diff --git a/net/ipv4/netfilter/ip_nat_proto_udp.c b/net/ipv4/netfilter/ip_nat_proto_udp.c
index 5da196ae758c..4bbec7730d18 100644
--- a/net/ipv4/netfilter/ip_nat_proto_udp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_udp.c
@@ -24,7 +24,7 @@ udp_in_range(const struct ip_conntrack_tuple *tuple,
              const union ip_conntrack_manip_proto *min,
              const union ip_conntrack_manip_proto *max)
 {
-        u_int16_t port;
+        __be16 port;
 
         if (maniptype == IP_NAT_MANIP_SRC)
                 port = tuple->src.u.udp.port;
@@ -42,7 +42,7 @@ udp_unique_tuple(struct ip_conntrack_tuple *tuple,
                  const struct ip_conntrack *conntrack)
 {
         static u_int16_t port;
-        u_int16_t *portptr;
+        __be16 *portptr;
         unsigned int range_size, min, i;
 
         if (maniptype == IP_NAT_MANIP_SRC)
@@ -91,8 +91,8 @@ udp_manip_pkt(struct sk_buff **pskb,
         struct iphdr *iph = (struct iphdr *)((*pskb)->data + iphdroff);
         struct udphdr *hdr;
         unsigned int hdroff = iphdroff + iph->ihl*4;
-        u32 oldip, newip;
-        u16 *portptr, newport;
+        __be32 oldip, newip;
+        __be16 *portptr, newport;
 
         if (!skb_make_writable(pskb, hdroff + sizeof(*hdr)))
                 return 0;
@@ -118,7 +118,7 @@ udp_manip_pkt(struct sk_buff **pskb,
                 hdr->check = nf_proto_csum_update(*pskb, ~oldip, newip,
                                                   hdr->check, 1);
                 hdr->check = nf_proto_csum_update(*pskb,
-                                                  *portptr ^ 0xFFFF, newport,
+                                                  *portptr ^ htons(0xFFFF), newport,
                                                   hdr->check, 0);
                 if (!hdr->check)
                         hdr->check = -1;
diff --git a/net/ipv4/netfilter/ip_nat_rule.c b/net/ipv4/netfilter/ip_nat_rule.c
index 7b703839aa58..a176aa3031e0 100644
--- a/net/ipv4/netfilter/ip_nat_rule.c
+++ b/net/ipv4/netfilter/ip_nat_rule.c
@@ -119,7 +119,7 @@ static unsigned int ipt_snat_target(struct sk_buff **pskb,
 }
 
 /* Before 2.6.11 we did implicit source NAT if required. Warn about change. */
-static void warn_if_extra_mangle(u32 dstip, u32 srcip)
+static void warn_if_extra_mangle(__be32 dstip, __be32 srcip)
 {
         static int warned = 0;
         struct flowi fl = { .nl_u = { .ip4_u = { .daddr = dstip } } };
@@ -205,7 +205,7 @@ alloc_null_binding(struct ip_conntrack *conntrack,
            per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
            Use reply in case it's already been mangled (eg local packet).
         */
-        u_int32_t ip
+        __be32 ip
                 = (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC
                    ? conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip
                    : conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip);
@@ -222,7 +222,7 @@ alloc_null_binding_confirmed(struct ip_conntrack *conntrack,
                              struct ip_nat_info *info,
                              unsigned int hooknum)
 {
-        u_int32_t ip
+        __be32 ip
                 = (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC
                    ? conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.dst.ip
                    : conntrack->tuplehash[IP_CT_DIR_REPLY].tuple.src.ip);
diff --git a/net/ipv4/netfilter/ip_nat_sip.c b/net/ipv4/netfilter/ip_nat_sip.c
index 6ffba63adca2..71fc2730a007 100644
--- a/net/ipv4/netfilter/ip_nat_sip.c
+++ b/net/ipv4/netfilter/ip_nat_sip.c
@@ -60,8 +60,8 @@ static unsigned int ip_nat_sip(struct sk_buff **pskb,
         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
         char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
         unsigned int bufflen, dataoff;
-        u_int32_t ip;
-        u_int16_t port;
+        __be32 ip;
+        __be16 port;
 
         dataoff = (*pskb)->nh.iph->ihl*4 + sizeof(struct udphdr);
 
@@ -159,7 +159,7 @@ static int mangle_content_len(struct sk_buff **pskb,
 static unsigned int mangle_sdp(struct sk_buff **pskb,
                                enum ip_conntrack_info ctinfo,
                                struct ip_conntrack *ct,
-                               u_int32_t newip, u_int16_t port,
+                               __be32 newip, u_int16_t port,
                                const char *dptr)
 {
         char buffer[sizeof("nnn.nnn.nnn.nnn")];
@@ -195,7 +195,7 @@ static unsigned int ip_nat_sdp(struct sk_buff **pskb,
 {
         struct ip_conntrack *ct = exp->master;
         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-        u_int32_t newip;
+        __be32 newip;
         u_int16_t port;
 
         DEBUGP("ip_nat_sdp():\n");
diff --git a/net/ipv4/netfilter/ip_nat_snmp_basic.c b/net/ipv4/netfilter/ip_nat_snmp_basic.c
index 18b7fbdccb61..168f45fa1898 100644
--- a/net/ipv4/netfilter/ip_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/ip_nat_snmp_basic.c
@@ -1211,7 +1211,7 @@ static int snmp_translate(struct ip_conntrack *ct,
                           struct sk_buff **pskb)
 {
         struct iphdr *iph = (*pskb)->nh.iph;
-        struct udphdr *udph = (struct udphdr *)((u_int32_t *)iph + iph->ihl);
+        struct udphdr *udph = (struct udphdr *)((__be32 *)iph + iph->ihl);
         u_int16_t udplen = ntohs(udph->len);
         u_int16_t paylen = udplen - sizeof(struct udphdr);
         int dir = CTINFO2DIR(ctinfo);
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index 9c577db62047..d85d2de50449 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -191,7 +191,7 @@ ip_nat_in(unsigned int hooknum,
           int (*okfn)(struct sk_buff *))
 {
         unsigned int ret;
-        u_int32_t daddr = (*pskb)->nh.iph->daddr;
+        __be32 daddr = (*pskb)->nh.iph->daddr;
 
         ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
         if (ret != NF_DROP && ret != NF_STOLEN
@@ -265,7 +265,8 @@ ip_nat_local_fn(unsigned int hooknum,
                        ct->tuplehash[!dir].tuple.src.u.all
 #endif
                     )
-                        return ip_route_me_harder(pskb) == 0 ? ret : NF_DROP;
+                        if (ip_route_me_harder(pskb, RTN_UNSPEC))
+                                ret = NF_DROP;
         }
         return ret;
 }
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 78a44b01c035..4b90927619b8 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1932,6 +1932,9 @@ compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 {
         int ret;
 
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
         switch (cmd) {
         case IPT_SO_GET_INFO:
                 ret = get_info(user, len, 1);
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 41589665fc5d..7a29d6e7baa7 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -52,7 +52,7 @@ struct clusterip_config {
         atomic_t entries;                       /* number of entries/rules
                                                  * referencing us */
 
-        u_int32_t clusterip;                    /* the IP address */
+        __be32 clusterip;                       /* the IP address */
         u_int8_t clustermac[ETH_ALEN];          /* the MAC address */
         struct net_device *dev;                 /* device */
         u_int16_t num_total_nodes;              /* total number of nodes */
@@ -119,7 +119,7 @@ clusterip_config_entry_put(struct clusterip_config *c)
 }
 
 static struct clusterip_config *
-__clusterip_config_find(u_int32_t clusterip)
+__clusterip_config_find(__be32 clusterip)
 {
         struct list_head *pos;
 
@@ -136,7 +136,7 @@ __clusterip_config_find(u_int32_t clusterip)
 }
 
 static inline struct clusterip_config *
-clusterip_config_find_get(u_int32_t clusterip, int entry)
+clusterip_config_find_get(__be32 clusterip, int entry)
 {
         struct clusterip_config *c;
 
@@ -166,7 +166,7 @@ clusterip_config_init_nodelist(struct clusterip_config *c,
 }
 
 static struct clusterip_config *
-clusterip_config_init(struct ipt_clusterip_tgt_info *i, u_int32_t ip,
+clusterip_config_init(struct ipt_clusterip_tgt_info *i, __be32 ip,
                         struct net_device *dev)
 {
         struct clusterip_config *c;
@@ -387,7 +387,7 @@ checkentry(const char *tablename,
                 return 0;
 
         }
-        if (e->ip.dmsk.s_addr != 0xffffffff
+        if (e->ip.dmsk.s_addr != htonl(0xffffffff)
             || e->ip.dst.s_addr == 0) {
                 printk(KERN_ERR "CLUSTERIP: Please specify destination IP\n");
                 return 0;
@@ -476,9 +476,9 @@ static struct ipt_target clusterip_tgt = {
 /* hardcoded for 48bit ethernet and 32bit ipv4 addresses */
 struct arp_payload {
         u_int8_t src_hw[ETH_ALEN];
-        u_int32_t src_ip;
+        __be32 src_ip;
         u_int8_t dst_hw[ETH_ALEN];
-        u_int32_t dst_ip;
+        __be32 dst_ip;
 } __attribute__ ((packed));
 
 #ifdef CLUSTERIP_DEBUG
diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
index 23f9c7ebe7eb..1aa4517fbcdb 100644
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ b/net/ipv4/netfilter/ipt_ECN.c
@@ -37,8 +37,8 @@ set_ect_ip(struct sk_buff **pskb, const struct ipt_ECN_info *einfo)
                 oldtos = iph->tos;
                 iph->tos &= ~IPT_ECN_IP_MASK;
                 iph->tos |= (einfo->ip_ect & IPT_ECN_IP_MASK);
-                iph->check = nf_csum_update(oldtos ^ 0xFFFF, iph->tos,
-                                            iph->check);
+                iph->check = nf_csum_update(htons(oldtos) ^ htons(0xFFFF),
+                                            htons(iph->tos), iph->check);
         } 
         return 1;
 }
@@ -48,7 +48,7 @@ static inline int
 set_ect_tcp(struct sk_buff **pskb, const struct ipt_ECN_info *einfo)
 {
         struct tcphdr _tcph, *tcph;
-        u_int16_t oldval;
+        __be16 oldval;
 
         /* Not enought header? */
         tcph = skb_header_pointer(*pskb, (*pskb)->nh.iph->ihl*4,
@@ -66,15 +66,15 @@ set_ect_tcp(struct sk_buff **pskb, const struct ipt_ECN_info *einfo)
                 return 0;
         tcph = (void *)(*pskb)->nh.iph + (*pskb)->nh.iph->ihl*4;
 
-        oldval = ((u_int16_t *)tcph)[6];
+        oldval = ((__be16 *)tcph)[6];
         if (einfo->operation & IPT_ECN_OP_SET_ECE)
                 tcph->ece = einfo->proto.tcp.ece;
         if (einfo->operation & IPT_ECN_OP_SET_CWR)
                 tcph->cwr = einfo->proto.tcp.cwr;
 
         tcph->check = nf_proto_csum_update((*pskb),
-                                           oldval ^ 0xFFFF,
-                                           ((u_int16_t *)tcph)[6],
+                                           oldval ^ htons(0xFFFF),
+                                           ((__be16 *)tcph)[6],
                                            tcph->check, 0);
         return 1;
 }
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index bc65168a3437..3dbfcfac8a84 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -70,7 +70,7 @@ masquerade_target(struct sk_buff **pskb,
         const struct ip_nat_multi_range_compat *mr;
         struct ip_nat_range newrange;
         struct rtable *rt;
-        u_int32_t newsrc;
+        __be32 newsrc;
 
         IP_NF_ASSERT(hooknum == NF_IP_POST_ROUTING);
 
diff --git a/net/ipv4/netfilter/ipt_NETMAP.c b/net/ipv4/netfilter/ipt_NETMAP.c
index beb2914225ff..58a88f227108 100644
--- a/net/ipv4/netfilter/ipt_NETMAP.c
+++ b/net/ipv4/netfilter/ipt_NETMAP.c
@@ -58,7 +58,7 @@ target(struct sk_buff **pskb,
 {
         struct ip_conntrack *ct;
         enum ip_conntrack_info ctinfo;
-        u_int32_t new_ip, netmask;
+        __be32 new_ip, netmask;
         const struct ip_nat_multi_range_compat *mr = targinfo;
         struct ip_nat_range newrange;
 
diff --git a/net/ipv4/netfilter/ipt_REDIRECT.c b/net/ipv4/netfilter/ipt_REDIRECT.c
index f03d43671c6d..c0dcfe9d610c 100644
--- a/net/ipv4/netfilter/ipt_REDIRECT.c
+++ b/net/ipv4/netfilter/ipt_REDIRECT.c
@@ -61,7 +61,7 @@ redirect_target(struct sk_buff **pskb,
 {
         struct ip_conntrack *ct;
         enum ip_conntrack_info ctinfo;
-        u_int32_t newdst;
+        __be32 newdst;
         const struct ip_nat_multi_range_compat *mr = targinfo;
         struct ip_nat_range newrange;
 
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index b81821edd893..ad0312d0e4fd 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -38,76 +38,16 @@ MODULE_DESCRIPTION("iptables REJECT target module");
 #define DEBUGP(format, args...)
 #endif
 
-static inline struct rtable *route_reverse(struct sk_buff *skb, 
-                                           struct tcphdr *tcph, int hook)
-{
-        struct iphdr *iph = skb->nh.iph;
-        struct dst_entry *odst;
-        struct flowi fl = {};
-        struct rtable *rt;
-
-        /* We don't require ip forwarding to be enabled to be able to
-         * send a RST reply for bridged traffic. */
-        if (hook != NF_IP_FORWARD
-#ifdef CONFIG_BRIDGE_NETFILTER
-            || (skb->nf_bridge && skb->nf_bridge->mask & BRNF_BRIDGED)
-#endif
-           ) {
-                fl.nl_u.ip4_u.daddr = iph->saddr;
-                if (hook == NF_IP_LOCAL_IN)
-                        fl.nl_u.ip4_u.saddr = iph->daddr;
-                fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
-
-                if (ip_route_output_key(&rt, &fl) != 0)
-                        return NULL;
-        } else {
-                /* non-local src, find valid iif to satisfy
-                 * rp-filter when calling ip_route_input. */
-                fl.nl_u.ip4_u.daddr = iph->daddr;
-                if (ip_route_output_key(&rt, &fl) != 0)
-                        return NULL;
-
-                odst = skb->dst;
-                if (ip_route_input(skb, iph->saddr, iph->daddr,
-                                   RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
-                        dst_release(&rt->u.dst);
-                        return NULL;
-                }
-                dst_release(&rt->u.dst);
-                rt = (struct rtable *)skb->dst;
-                skb->dst = odst;
-
-                fl.nl_u.ip4_u.daddr = iph->saddr;
-                fl.nl_u.ip4_u.saddr = iph->daddr;
-                fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
-        }
-
-        if (rt->u.dst.error) {
-                dst_release(&rt->u.dst);
-                return NULL;
-        }
-
-        fl.proto = IPPROTO_TCP;
-        fl.fl_ip_sport = tcph->dest;
-        fl.fl_ip_dport = tcph->source;
-        security_skb_classify_flow(skb, &fl);
-
-        xfrm_lookup((struct dst_entry **)&rt, &fl, NULL, 0);
-
-        return rt;
-}
-
 /* Send RST reply */
 static void send_reset(struct sk_buff *oldskb, int hook)
 {
         struct sk_buff *nskb;
         struct iphdr *iph = oldskb->nh.iph;
         struct tcphdr _otcph, *oth, *tcph;
-        struct rtable *rt;
-        u_int16_t tmp_port;
-        u_int32_t tmp_addr;
+        __be16 tmp_port;
+        __be32 tmp_addr;
         int needs_ack;
-        int hh_len;
+        unsigned int addr_type;
 
         /* IP header checks: fragment. */
         if (oldskb->nh.iph->frag_off & htons(IP_OFFSET))
@@ -126,23 +66,13 @@ static void send_reset(struct sk_buff *oldskb, int hook)
         if (nf_ip_checksum(oldskb, hook, iph->ihl * 4, IPPROTO_TCP))
                 return;
 
-        if ((rt = route_reverse(oldskb, oth, hook)) == NULL)
-                return;
-
-        hh_len = LL_RESERVED_SPACE(rt->u.dst.dev);
-
         /* We need a linear, writeable skb.  We also need to expand
            headroom in case hh_len of incoming interface < hh_len of
            outgoing interface */
-        nskb = skb_copy_expand(oldskb, hh_len, skb_tailroom(oldskb),
+        nskb = skb_copy_expand(oldskb, LL_MAX_HEADER, skb_tailroom(oldskb),
                                GFP_ATOMIC);
-        if (!nskb) {
-                dst_release(&rt->u.dst);
+        if (!nskb)
                 return;
-        }
-
-        dst_release(nskb->dst);
-        nskb->dst = &rt->u.dst;
 
         /* This packet will not be the same as the other: clear nf fields */
         nf_reset(nskb);
@@ -184,6 +114,21 @@ static void send_reset(struct sk_buff *oldskb, int hook)
         tcph->window = 0;
         tcph->urg_ptr = 0;
 
+        /* Set DF, id = 0 */
+        nskb->nh.iph->frag_off = htons(IP_DF);
+        nskb->nh.iph->id = 0;
+
+        addr_type = RTN_UNSPEC;
+        if (hook != NF_IP_FORWARD
+#ifdef CONFIG_BRIDGE_NETFILTER
+            || (nskb->nf_bridge && nskb->nf_bridge->mask & BRNF_BRIDGED)
+#endif
+           )
+                addr_type = RTN_LOCAL;
+
+        if (ip_route_me_harder(&nskb, addr_type))
+                goto free_nskb;
+
         /* Adjust TCP checksum */
         nskb->ip_summed = CHECKSUM_NONE;
         tcph->check = 0;
@@ -192,12 +137,8 @@ static void send_reset(struct sk_buff *oldskb, int hook)
                                    nskb->nh.iph->daddr,
                                    csum_partial((char *)tcph,
                                                 sizeof(struct tcphdr), 0));
-
-        /* Adjust IP TTL, DF */
+        /* Adjust IP TTL */
         nskb->nh.iph->ttl = dst_metric(nskb->dst, RTAX_HOPLIMIT);
-        /* Set DF, id = 0 */
-        nskb->nh.iph->frag_off = htons(IP_DF);
-        nskb->nh.iph->id = 0;
 
         /* Adjust IP checksum */
         nskb->nh.iph->check = 0;
diff --git a/net/ipv4/netfilter/ipt_SAME.c b/net/ipv4/netfilter/ipt_SAME.c
index efbcb1198832..b38b13328d73 100644
--- a/net/ipv4/netfilter/ipt_SAME.c
+++ b/net/ipv4/netfilter/ipt_SAME.c
@@ -135,7 +135,8 @@ same_target(struct sk_buff **pskb,
 {
         struct ip_conntrack *ct;
         enum ip_conntrack_info ctinfo;
-        u_int32_t tmpip, aindex, new_ip;
+        u_int32_t tmpip, aindex;
+        __be32 new_ip;
         const struct ipt_same_info *same = targinfo;
         struct ip_nat_range newrange;
         const struct ip_conntrack_tuple *t;
diff --git a/net/ipv4/netfilter/ipt_TCPMSS.c b/net/ipv4/netfilter/ipt_TCPMSS.c
index 4246c4321e5b..108b6b76311f 100644
--- a/net/ipv4/netfilter/ipt_TCPMSS.c
+++ b/net/ipv4/netfilter/ipt_TCPMSS.c
@@ -42,7 +42,8 @@ ipt_tcpmss_target(struct sk_buff **pskb,
         const struct ipt_tcpmss_info *tcpmssinfo = targinfo;
         struct tcphdr *tcph;
         struct iphdr *iph;
-        u_int16_t tcplen, newtotlen, oldval, newmss;
+        u_int16_t tcplen, newmss;
+        __be16 newtotlen, oldval;
         unsigned int i;
         u_int8_t *opt;
 
@@ -97,7 +98,7 @@ ipt_tcpmss_target(struct sk_buff **pskb,
                         opt[i+3] = (newmss & 0x00ff);
 
                         tcph->check = nf_proto_csum_update(*pskb,
-                                                           htons(oldmss)^0xFFFF,
+                                                           htons(oldmss)^htons(0xFFFF),
                                                            htons(newmss),
                                                            tcph->check, 0);
                         return IPT_CONTINUE;
@@ -126,7 +127,7 @@ ipt_tcpmss_target(struct sk_buff **pskb,
         memmove(opt + TCPOLEN_MSS, opt, tcplen - sizeof(struct tcphdr));
 
         tcph->check = nf_proto_csum_update(*pskb,
-                                           htons(tcplen) ^ 0xFFFF,
+                                           htons(tcplen) ^ htons(0xFFFF),
                                            htons(tcplen + TCPOLEN_MSS),
                                            tcph->check, 1);
         opt[0] = TCPOPT_MSS;
@@ -134,18 +135,18 @@ ipt_tcpmss_target(struct sk_buff **pskb,
         opt[2] = (newmss & 0xff00) >> 8;
         opt[3] = (newmss & 0x00ff);
 
-        tcph->check = nf_proto_csum_update(*pskb, ~0, *((u_int32_t *)opt),
+        tcph->check = nf_proto_csum_update(*pskb, htonl(~0), *((__be32 *)opt),
                                            tcph->check, 0);
 
-        oldval = ((u_int16_t *)tcph)[6];
+        oldval = ((__be16 *)tcph)[6];
         tcph->doff += TCPOLEN_MSS/4;
         tcph->check = nf_proto_csum_update(*pskb,
-                                           oldval ^ 0xFFFF,
-                                           ((u_int16_t *)tcph)[6],
+                                           oldval ^ htons(0xFFFF),
+                                           ((__be16 *)tcph)[6],
                                            tcph->check, 0);
 
         newtotlen = htons(ntohs(iph->tot_len) + TCPOLEN_MSS);
-        iph->check = nf_csum_update(iph->tot_len ^ 0xFFFF,
+        iph->check = nf_csum_update(iph->tot_len ^ htons(0xFFFF),
                                     newtotlen, iph->check);
         iph->tot_len = newtotlen;
         return IPT_CONTINUE;
diff --git a/net/ipv4/netfilter/ipt_TOS.c b/net/ipv4/netfilter/ipt_TOS.c
index 471a4c438b0a..83b80b3a5d2f 100644
--- a/net/ipv4/netfilter/ipt_TOS.c
+++ b/net/ipv4/netfilter/ipt_TOS.c
@@ -38,8 +38,8 @@ target(struct sk_buff **pskb,
                 iph = (*pskb)->nh.iph;
                 oldtos = iph->tos;
                 iph->tos = (iph->tos & IPTOS_PREC_MASK) | tosinfo->tos;
-                iph->check = nf_csum_update(oldtos ^ 0xFFFF, iph->tos,
-                                            iph->check);
+                iph->check = nf_csum_update(htons(oldtos) ^ htons(0xFFFF),
+                                            htons(iph->tos), iph->check);
         }
         return IPT_CONTINUE;
 }
diff --git a/net/ipv4/netfilter/ipt_TTL.c b/net/ipv4/netfilter/ipt_TTL.c
index 96e79cc6d0f2..ac9517d62af0 100644
--- a/net/ipv4/netfilter/ipt_TTL.c
+++ b/net/ipv4/netfilter/ipt_TTL.c
@@ -54,8 +54,8 @@ ipt_ttl_target(struct sk_buff **pskb,
         }
 
         if (new_ttl != iph->ttl) {
-                iph->check = nf_csum_update(ntohs((iph->ttl << 8)) ^ 0xFFFF,
-                                            ntohs(new_ttl << 8),
+                iph->check = nf_csum_update(htons((iph->ttl << 8)) ^ htons(0xFFFF),
+                                            htons(new_ttl << 8),
                                             iph->check);
                 iph->ttl = new_ttl;
         }
diff --git a/net/ipv4/netfilter/ipt_addrtype.c b/net/ipv4/netfilter/ipt_addrtype.c
index 893dae210b04..7b60eb74788b 100644
--- a/net/ipv4/netfilter/ipt_addrtype.c
+++ b/net/ipv4/netfilter/ipt_addrtype.c
@@ -22,7 +22,7 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
 MODULE_DESCRIPTION("iptables addrtype match");
 
-static inline int match_type(u_int32_t addr, u_int16_t mask)
+static inline int match_type(__be32 addr, u_int16_t mask)
 {
         return !!(mask & (1 << inet_addr_type(addr)));
 }
diff --git a/net/ipv4/netfilter/ipt_hashlimit.c b/net/ipv4/netfilter/ipt_hashlimit.c
index 4f73a61aa3dd..33ccdbf8e794 100644
--- a/net/ipv4/netfilter/ipt_hashlimit.c
+++ b/net/ipv4/netfilter/ipt_hashlimit.c
@@ -50,11 +50,11 @@ static struct file_operations dl_file_ops;
 /* hash table crap */
 
 struct dsthash_dst {
-        u_int32_t src_ip;
-        u_int32_t dst_ip;
+        __be32 src_ip;
+        __be32 dst_ip;
         /* ports have to be consecutive !!! */
-        u_int16_t src_port;
-        u_int16_t dst_port;
+        __be16 src_port;
+        __be16 dst_port;
 };
 
 struct dsthash_ent {
@@ -106,8 +106,10 @@ static inline int dst_cmp(const struct dsthash_ent *ent, struct dsthash_dst *b)
 static inline u_int32_t
 hash_dst(const struct ipt_hashlimit_htable *ht, const struct dsthash_dst *dst)
 {
-        return (jhash_3words(dst->dst_ip, (dst->dst_port<<16 | dst->src_port), 
-                             dst->src_ip, ht->rnd) % ht->cfg.size);
+        return (jhash_3words((__force u32)dst->dst_ip,
+                            ((__force u32)dst->dst_port<<16 |
+                             (__force u32)dst->src_port),
+                             (__force u32)dst->src_ip, ht->rnd) % ht->cfg.size);
 }
 
 static inline struct dsthash_ent *
@@ -406,7 +408,7 @@ hashlimit_match(const struct sk_buff *skb,
                 dst.src_ip = skb->nh.iph->saddr;
         if (hinfo->cfg.mode & IPT_HASHLIMIT_HASH_DPT
             ||hinfo->cfg.mode & IPT_HASHLIMIT_HASH_SPT) {
-                u_int16_t _ports[2], *ports;
+                __be16 _ports[2], *ports;
 
                 switch (skb->nh.iph->protocol) {
                 case IPPROTO_TCP:
diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index 32ae8d7ac506..126db44e71a8 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -50,11 +50,10 @@ MODULE_PARM_DESC(ip_list_perms, "permissions on /proc/net/ipt_recent/* files");
 MODULE_PARM_DESC(ip_list_uid,"owner of /proc/net/ipt_recent/* files");
 MODULE_PARM_DESC(ip_list_gid,"owning group of /proc/net/ipt_recent/* files");
 
-
 struct recent_entry {
         struct list_head        list;
         struct list_head        lru_list;
-        u_int32_t               addr;
+        __be32                  addr;
         u_int8_t                ttl;
         u_int8_t                index;
         u_int16_t               nstamps;
@@ -85,17 +84,17 @@ static struct file_operations	recent_fops;
 static u_int32_t hash_rnd;
 static int hash_rnd_initted;
 
-static unsigned int recent_entry_hash(u_int32_t addr)
+static unsigned int recent_entry_hash(__be32 addr)
 {
         if (!hash_rnd_initted) {
                 get_random_bytes(&hash_rnd, 4);
                 hash_rnd_initted = 1;
         }
-        return jhash_1word(addr, hash_rnd) & (ip_list_hash_size - 1);
+        return jhash_1word((__force u32)addr, hash_rnd) & (ip_list_hash_size - 1);
 }
 
 static struct recent_entry *
-recent_entry_lookup(const struct recent_table *table, u_int32_t addr, u_int8_t ttl)
+recent_entry_lookup(const struct recent_table *table, __be32 addr, u_int8_t ttl)
 {
         struct recent_entry *e;
         unsigned int h;
@@ -116,7 +115,7 @@ static void recent_entry_remove(struct recent_table *t, struct recent_entry *e)
 }
 
 static struct recent_entry *
-recent_entry_init(struct recent_table *t, u_int32_t addr, u_int8_t ttl)
+recent_entry_init(struct recent_table *t, __be32 addr, u_int8_t ttl)
 {
         struct recent_entry *e;
 
@@ -178,7 +177,7 @@ ipt_recent_match(const struct sk_buff *skb,
         const struct ipt_recent_info *info = matchinfo;
         struct recent_table *t;
         struct recent_entry *e;
-        u_int32_t addr;
+        __be32 addr;
         u_int8_t ttl;
         int ret = info->invert;
 
@@ -406,7 +405,7 @@ static ssize_t recent_proc_write(struct file *file, const char __user *input,
         struct recent_table *t = pde->data;
         struct recent_entry *e;
         char buf[sizeof("+255.255.255.255")], *c = buf;
-        u_int32_t addr;
+        __be32 addr;
         int add;
 
         if (size > sizeof(buf))
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 79336cb42527..b91f3582359b 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -131,7 +131,7 @@ ipt_local_hook(unsigned int hook,
 {
         unsigned int ret;
         u_int8_t tos;
-        u_int32_t saddr, daddr;
+        __be32 saddr, daddr;
         unsigned long nfmark;
 
         /* root is playing with raw sockets. */
@@ -157,7 +157,8 @@ ipt_local_hook(unsigned int hook,
                 || (*pskb)->nfmark != nfmark
 #endif
                 || (*pskb)->nh.iph->tos != tos))
-                return ip_route_me_harder(pskb) == 0 ? ret : NF_DROP;
+                if (ip_route_me_harder(pskb, RTN_UNSPEC))
+                        ret = NF_DROP;
 
         return ret;
 }
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 0e935b4c8741..b430cf2a4f66 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -381,8 +381,8 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         struct ipcm_cookie ipc;
         struct rtable *rt = NULL;
         int free = 0;
-        u32 daddr;
-        u32 saddr;
+        __be32 daddr;
+        __be32 saddr;
         u8  tos;
         int err;
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 20ffe8e88c0f..925ee4dfc32c 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -261,6 +261,10 @@ static unsigned int rt_hash_code(u32 daddr, u32 saddr)
                 & rt_hash_mask);
 }
 
+#define rt_hash(daddr, saddr, idx) \
+        rt_hash_code((__force u32)(__be32)(daddr),\
+                     (__force u32)(__be32)(saddr) ^ ((idx) << 5))
+
 #ifdef CONFIG_PROC_FS
 struct rt_cache_iter_state {
         int bucket;
@@ -562,9 +566,15 @@ static inline u32 rt_score(struct rtable *rt)
 
 static inline int compare_keys(struct flowi *fl1, struct flowi *fl2)
 {
-        return memcmp(&fl1->nl_u.ip4_u, &fl2->nl_u.ip4_u, sizeof(fl1->nl_u.ip4_u)) == 0 &&
-               fl1->oif     == fl2->oif &&
-               fl1->iif     == fl2->iif;
+        return ((fl1->nl_u.ip4_u.daddr ^ fl2->nl_u.ip4_u.daddr) |
+                (fl1->nl_u.ip4_u.saddr ^ fl2->nl_u.ip4_u.saddr) |
+#ifdef CONFIG_IP_ROUTE_FWMARK
+                (fl1->nl_u.ip4_u.fwmark ^ fl2->nl_u.ip4_u.fwmark) |
+#endif
+                (*(u16 *)&fl1->nl_u.ip4_u.tos ^
+                 *(u16 *)&fl2->nl_u.ip4_u.tos) |
+                (fl1->oif ^ fl2->oif) |
+                (fl1->iif ^ fl2->iif)) == 0;
 }
 
 #ifdef CONFIG_IP_ROUTE_MULTIPATH_CACHED
@@ -1074,7 +1084,7 @@ static void ip_select_fb_ident(struct iphdr *iph)
         u32 salt;
 
         spin_lock_bh(&ip_fb_id_lock);
-        salt = secure_ip_id(ip_fallback_id ^ iph->daddr);
+        salt = secure_ip_id((__force __be32)ip_fallback_id ^ iph->daddr);
         iph->id = htons(salt & 0xFFFF);
         ip_fallback_id = salt;
         spin_unlock_bh(&ip_fb_id_lock);
@@ -1118,13 +1128,13 @@ static void rt_del(unsigned hash, struct rtable *rt)
         spin_unlock_bh(rt_hash_lock_addr(hash));
 }
 
-void ip_rt_redirect(u32 old_gw, u32 daddr, u32 new_gw,
-                    u32 saddr, struct net_device *dev)
+void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
+                    __be32 saddr, struct net_device *dev)
 {
         int i, k;
         struct in_device *in_dev = in_dev_get(dev);
         struct rtable *rth, **rthp;
-        u32  skeys[2] = { saddr, 0 };
+        __be32  skeys[2] = { saddr, 0 };
         int  ikeys[2] = { dev->ifindex, 0 };
         struct netevent_redirect netevent;
 
@@ -1147,8 +1157,7 @@ void ip_rt_redirect(u32 old_gw, u32 daddr, u32 new_gw,
 
         for (i = 0; i < 2; i++) {
                 for (k = 0; k < 2; k++) {
-                        unsigned hash = rt_hash_code(daddr,
-                                                     skeys[i] ^ (ikeys[k] << 5));
+                        unsigned hash = rt_hash(daddr, skeys[i], ikeys[k]);
 
                         rthp=&rt_hash_table[hash].chain;
 
@@ -1260,9 +1269,8 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
                         ret = NULL;
                 } else if ((rt->rt_flags & RTCF_REDIRECTED) ||
                            rt->u.dst.expires) {
-                        unsigned hash = rt_hash_code(rt->fl.fl4_dst,
-                                                     rt->fl.fl4_src ^
-                                                        (rt->fl.oif << 5));
+                        unsigned hash = rt_hash(rt->fl.fl4_dst, rt->fl.fl4_src,
+                                                rt->fl.oif);
 #if RT_CACHE_DEBUG >= 1
                         printk(KERN_DEBUG "ip_rt_advice: redirect to "
                                           "%u.%u.%u.%u/%02x dropped\n",
@@ -1397,15 +1405,15 @@ unsigned short ip_rt_frag_needed(struct iphdr *iph, unsigned short new_mtu)
         int i;
         unsigned short old_mtu = ntohs(iph->tot_len);
         struct rtable *rth;
-        u32  skeys[2] = { iph->saddr, 0, };
-        u32  daddr = iph->daddr;
+        __be32  skeys[2] = { iph->saddr, 0, };
+        __be32  daddr = iph->daddr;
         unsigned short est_mtu = 0;
 
         if (ipv4_config.no_pmtu_disc)
                 return 0;
 
         for (i = 0; i < 2; i++) {
-                unsigned hash = rt_hash_code(daddr, skeys[i]);
+                unsigned hash = rt_hash(daddr, skeys[i], 0);
 
                 rcu_read_lock();
                 for (rth = rcu_dereference(rt_hash_table[hash].chain); rth;
@@ -1530,7 +1538,7 @@ static int ip_rt_bug(struct sk_buff *skb)
 
 void ip_rt_get_source(u8 *addr, struct rtable *rt)
 {
-        u32 src;
+        __be32 src;
         struct fib_result res;
 
         if (rt->fl.iif == 0)
@@ -1596,12 +1604,12 @@ static void rt_set_nexthop(struct rtable *rt, struct fib_result *res, u32 itag)
         rt->rt_type = res->type;
 }
 
-static int ip_route_input_mc(struct sk_buff *skb, u32 daddr, u32 saddr,
+static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                                 u8 tos, struct net_device *dev, int our)
 {
         unsigned hash;
         struct rtable *rth;
-        u32 spec_dst;
+        __be32 spec_dst;
         struct in_device *in_dev = in_dev_get(dev);
         u32 itag = 0;
 
@@ -1665,7 +1673,7 @@ static int ip_route_input_mc(struct sk_buff *skb, u32 daddr, u32 saddr,
         RT_CACHE_STAT_INC(in_slow_mc);
 
         in_dev_put(in_dev);
-        hash = rt_hash_code(daddr, saddr ^ (dev->ifindex << 5));
+        hash = rt_hash(daddr, saddr, dev->ifindex);
         return rt_intern_hash(hash, rth, (struct rtable**) &skb->dst);
 
 e_nobufs:
@@ -1681,8 +1689,8 @@ e_inval:
 static void ip_handle_martian_source(struct net_device *dev,
                                      struct in_device *in_dev,
                                      struct sk_buff *skb,
-                                     u32 daddr,
-                                     u32 saddr) 
+                                     __be32 daddr,
+                                     __be32 saddr)
 {
         RT_CACHE_STAT_INC(in_martian_src);
 #ifdef CONFIG_IP_ROUTE_VERBOSE
@@ -1712,7 +1720,7 @@ static void ip_handle_martian_source(struct net_device *dev,
 static inline int __mkroute_input(struct sk_buff *skb, 
                                   struct fib_result* res, 
                                   struct in_device *in_dev, 
-                                  u32 daddr, u32 saddr, u32 tos, 
+                                  __be32 daddr, __be32 saddr, u32 tos,
                                   struct rtable **result) 
 {
 
@@ -1720,7 +1728,8 @@ static inline int __mkroute_input(struct sk_buff *skb,
         int err;
         struct in_device *out_dev;
         unsigned flags = 0;
-        u32 spec_dst, itag;
+        __be32 spec_dst;
+        u32 itag;
 
         /* get a working reference to the output device */
         out_dev = in_dev_get(FIB_RES_DEV(*res));
@@ -1813,7 +1822,7 @@ static inline int ip_mkroute_input_def(struct sk_buff *skb,
                                        struct fib_result* res, 
                                        const struct flowi *fl,
                                        struct in_device *in_dev,
-                                       u32 daddr, u32 saddr, u32 tos)
+                                       __be32 daddr, __be32 saddr, u32 tos)
 {
         struct rtable* rth = NULL;
         int err;
@@ -1830,7 +1839,7 @@ static inline int ip_mkroute_input_def(struct sk_buff *skb,
                 return err;
 
         /* put it into the cache */
-        hash = rt_hash_code(daddr, saddr ^ (fl->iif << 5));
+        hash = rt_hash(daddr, saddr, fl->iif);
         return rt_intern_hash(hash, rth, (struct rtable**)&skb->dst);   
 }
 
@@ -1838,7 +1847,7 @@ static inline int ip_mkroute_input(struct sk_buff *skb,
                                    struct fib_result* res, 
                                    const struct flowi *fl,
                                    struct in_device *in_dev,
-                                   u32 daddr, u32 saddr, u32 tos)
+                                   __be32 daddr, __be32 saddr, u32 tos)
 {
 #ifdef CONFIG_IP_ROUTE_MULTIPATH_CACHED
         struct rtable* rth = NULL, *rtres;
@@ -1871,7 +1880,7 @@ static inline int ip_mkroute_input(struct sk_buff *skb,
                         return err;
 
                 /* put it into the cache */
-                hash = rt_hash_code(daddr, saddr ^ (fl->iif << 5));
+                hash = rt_hash(daddr, saddr, fl->iif);
                 err = rt_intern_hash(hash, rth, &rtres);
                 if (err)
                         return err;
@@ -1901,7 +1910,7 @@ static inline int ip_mkroute_input(struct sk_buff *skb,
  *      2. IP spoofing attempts are filtered with 100% of guarantee.
  */
 
-static int ip_route_input_slow(struct sk_buff *skb, u32 daddr, u32 saddr,
+static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                                u8 tos, struct net_device *dev)
 {
         struct fib_result res;
@@ -1920,7 +1929,7 @@ static int ip_route_input_slow(struct sk_buff *skb, u32 daddr, u32 saddr,
         u32             itag = 0;
         struct rtable * rth;
         unsigned        hash;
-        u32             spec_dst;
+        __be32          spec_dst;
         int             err = -EINVAL;
         int             free_res = 0;
 
@@ -1936,7 +1945,7 @@ static int ip_route_input_slow(struct sk_buff *skb, u32 daddr, u32 saddr,
         if (MULTICAST(saddr) || BADCLASS(saddr) || LOOPBACK(saddr))
                 goto martian_source;
 
-        if (daddr == 0xFFFFFFFF || (saddr == 0 && daddr == 0))
+        if (daddr == htonl(0xFFFFFFFF) || (saddr == 0 && daddr == 0))
                 goto brd_input;
 
         /* Accept zero addresses only to limited broadcast;
@@ -2048,7 +2057,7 @@ local_input:
                 rth->rt_flags   &= ~RTCF_LOCAL;
         }
         rth->rt_type    = res.type;
-        hash = rt_hash_code(daddr, saddr ^ (fl.iif << 5));
+        hash = rt_hash(daddr, saddr, fl.iif);
         err = rt_intern_hash(hash, rth, (struct rtable**)&skb->dst);
         goto done;
 
@@ -2087,7 +2096,7 @@ martian_source:
         goto e_inval;
 }
 
-int ip_route_input(struct sk_buff *skb, u32 daddr, u32 saddr,
+int ip_route_input(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                    u8 tos, struct net_device *dev)
 {
         struct rtable * rth;
@@ -2095,7 +2104,7 @@ int ip_route_input(struct sk_buff *skb, u32 daddr, u32 saddr,
         int iif = dev->ifindex;
 
         tos &= IPTOS_RT_MASK;
-        hash = rt_hash_code(daddr, saddr ^ (iif << 5));
+        hash = rt_hash(daddr, saddr, iif);
 
         rcu_read_lock();
         for (rth = rcu_dereference(rt_hash_table[hash].chain); rth;
@@ -2169,7 +2178,7 @@ static inline int __mkroute_output(struct rtable **result,
         if (LOOPBACK(fl->fl4_src) && !(dev_out->flags&IFF_LOOPBACK))
                 return -EINVAL;
 
-        if (fl->fl4_dst == 0xFFFFFFFF)
+        if (fl->fl4_dst == htonl(0xFFFFFFFF))
                 res->type = RTN_BROADCAST;
         else if (MULTICAST(fl->fl4_dst))
                 res->type = RTN_MULTICAST;
@@ -2293,8 +2302,7 @@ static inline int ip_mkroute_output_def(struct rtable **rp,
         int err = __mkroute_output(&rth, res, fl, oldflp, dev_out, flags);
         unsigned hash;
         if (err == 0) {
-                hash = rt_hash_code(oldflp->fl4_dst, 
-                                    oldflp->fl4_src ^ (oldflp->oif << 5));
+                hash = rt_hash(oldflp->fl4_dst, oldflp->fl4_src, oldflp->oif);
                 err = rt_intern_hash(hash, rth, rp);
         }
         
@@ -2336,9 +2344,8 @@ static inline int ip_mkroute_output(struct rtable** rp,
                         if (err != 0)
                                 goto cleanup;
 
-                        hash = rt_hash_code(oldflp->fl4_dst, 
-                                            oldflp->fl4_src ^
-                                            (oldflp->oif << 5));
+                        hash = rt_hash(oldflp->fl4_dst, oldflp->fl4_src,
+                                        oldflp->oif);
                         err = rt_intern_hash(hash, rth, rp);
 
                         /* forward hop information to multipath impl. */
@@ -2417,7 +2424,7 @@ static int ip_route_output_slow(struct rtable **rp, const struct flowi *oldflp)
                  */
 
                 if (oldflp->oif == 0
-                    && (MULTICAST(oldflp->fl4_dst) || oldflp->fl4_dst == 0xFFFFFFFF)) {
+                    && (MULTICAST(oldflp->fl4_dst) || oldflp->fl4_dst == htonl(0xFFFFFFFF))) {
                         /* Special hack: user can direct multicasts
                            and limited broadcast via necessary interface
                            without fiddling with IP_MULTICAST_IF or IP_PKTINFO.
@@ -2454,7 +2461,7 @@ static int ip_route_output_slow(struct rtable **rp, const struct flowi *oldflp)
                         goto out;       /* Wrong error code */
                 }
 
-                if (LOCAL_MCAST(oldflp->fl4_dst) || oldflp->fl4_dst == 0xFFFFFFFF) {
+                if (LOCAL_MCAST(oldflp->fl4_dst) || oldflp->fl4_dst == htonl(0xFFFFFFFF)) {
                         if (!fl.fl4_src)
                                 fl.fl4_src = inet_select_addr(dev_out, 0,
                                                               RT_SCOPE_LINK);
@@ -2567,7 +2574,7 @@ int __ip_route_output_key(struct rtable **rp, const struct flowi *flp)
         unsigned hash;
         struct rtable *rth;
 
-        hash = rt_hash_code(flp->fl4_dst, flp->fl4_src ^ (flp->oif << 5));
+        hash = rt_hash(flp->fl4_dst, flp->fl4_src, flp->oif);
 
         rcu_read_lock_bh();
         for (rth = rcu_dereference(rt_hash_table[hash].chain); rth;
@@ -2660,11 +2667,11 @@ static int rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
         if (rt->rt_flags & RTCF_NOTIFY)
                 r->rtm_flags |= RTM_F_NOTIFY;
 
-        NLA_PUT_U32(skb, RTA_DST, rt->rt_dst);
+        NLA_PUT_BE32(skb, RTA_DST, rt->rt_dst);
 
         if (rt->fl.fl4_src) {
                 r->rtm_src_len = 32;
-                NLA_PUT_U32(skb, RTA_SRC, rt->fl.fl4_src);
+                NLA_PUT_BE32(skb, RTA_SRC, rt->fl.fl4_src);
         }
         if (rt->u.dst.dev)
                 NLA_PUT_U32(skb, RTA_OIF, rt->u.dst.dev->ifindex);
@@ -2677,12 +2684,12 @@ static int rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
                 NLA_PUT_U32(skb, RTA_MP_ALGO, rt->rt_multipath_alg);
 #endif
         if (rt->fl.iif)
-                NLA_PUT_U32(skb, RTA_PREFSRC, rt->rt_spec_dst);
+                NLA_PUT_BE32(skb, RTA_PREFSRC, rt->rt_spec_dst);
         else if (rt->rt_src != rt->fl.fl4_src)
-                NLA_PUT_U32(skb, RTA_PREFSRC, rt->rt_src);
+                NLA_PUT_BE32(skb, RTA_PREFSRC, rt->rt_src);
 
         if (rt->rt_dst != rt->rt_gateway)
-                NLA_PUT_U32(skb, RTA_GATEWAY, rt->rt_gateway);
+                NLA_PUT_BE32(skb, RTA_GATEWAY, rt->rt_gateway);
 
         if (rtnetlink_put_metrics(skb, rt->u.dst.metrics) < 0)
                 goto nla_put_failure;
@@ -2706,7 +2713,7 @@ static int rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
 
         if (rt->fl.iif) {
 #ifdef CONFIG_IP_MROUTE
-                u32 dst = rt->rt_dst;
+                __be32 dst = rt->rt_dst;
 
                 if (MULTICAST(dst) && !LOCAL_MCAST(dst) &&
                     ipv4_devconf.mc_forwarding) {
@@ -2740,7 +2747,9 @@ int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void *arg)
         struct rtmsg *rtm;
         struct nlattr *tb[RTA_MAX+1];
         struct rtable *rt = NULL;
-        u32 dst, src, iif;
+        __be32 dst = 0;
+        __be32 src = 0;
+        u32 iif;
         int err;
         struct sk_buff *skb;
 
@@ -2765,8 +2774,8 @@ int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void *arg)
         skb->nh.iph->protocol = IPPROTO_ICMP;
         skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr));
 
-        src = tb[RTA_SRC] ? nla_get_u32(tb[RTA_SRC]) : 0;
-        dst = tb[RTA_DST] ? nla_get_u32(tb[RTA_DST]) : 0;
+        src = tb[RTA_SRC] ? nla_get_be32(tb[RTA_SRC]) : 0;
+        dst = tb[RTA_DST] ? nla_get_be32(tb[RTA_DST]) : 0;
         iif = tb[RTA_IIF] ? nla_get_u32(tb[RTA_IIF]) : 0;
 
         if (iif) {
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index b3def0df14fb..cf06accbe687 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -935,7 +935,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         unsigned char *ptr = ack_skb->h.raw + TCP_SKB_CB(ack_skb)->sacked;
-        struct tcp_sack_block *sp = (struct tcp_sack_block *)(ptr+2);
+        struct tcp_sack_block_wire *sp = (struct tcp_sack_block_wire *)(ptr+2);
         int num_sacks = (ptr[1] - TCPOLEN_SACK_BASE)>>3;
         int reord = tp->packets_out;
         int prior_fackets;
@@ -2239,13 +2239,12 @@ static int tcp_tso_acked(struct sock *sk, struct sk_buff *skb,
         return acked;
 }
 
-static u32 tcp_usrtt(const struct sk_buff *skb)
+static u32 tcp_usrtt(struct timeval *tv)
 {
-        struct timeval tv, now;
+        struct timeval now;
 
         do_gettimeofday(&now);
-        skb_get_timestamp(skb, &tv);
-        return (now.tv_sec - tv.tv_sec) * 1000000 + (now.tv_usec - tv.tv_usec);
+        return (now.tv_sec - tv->tv_sec) * 1000000 + (now.tv_usec - tv->tv_usec);
 }
 
 /* Remove acknowledged frames from the retransmission queue. */
@@ -2260,6 +2259,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
         u32 pkts_acked = 0;
         void (*rtt_sample)(struct sock *sk, u32 usrtt)
                 = icsk->icsk_ca_ops->rtt_sample;
+        struct timeval tv = { .tv_sec = 0, .tv_usec = 0 };
 
         while ((skb = skb_peek(&sk->sk_write_queue)) &&
                skb != sk->sk_send_head) {
@@ -2308,8 +2308,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
                                 seq_rtt = -1;
                         } else if (seq_rtt < 0) {
                                 seq_rtt = now - scb->when;
-                                if (rtt_sample)
-                                        (*rtt_sample)(sk, tcp_usrtt(skb));
+                                skb_get_timestamp(skb, &tv);
                         }
                         if (sacked & TCPCB_SACKED_ACKED)
                                 tp->sacked_out -= tcp_skb_pcount(skb);
@@ -2322,8 +2321,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
                         }
                 } else if (seq_rtt < 0) {
                         seq_rtt = now - scb->when;
-                        if (rtt_sample)
-                                (*rtt_sample)(sk, tcp_usrtt(skb));
+                        skb_get_timestamp(skb, &tv);
                 }
                 tcp_dec_pcount_approx(&tp->fackets_out, skb);
                 tcp_packets_out_dec(tp, skb);
@@ -2335,6 +2333,8 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
         if (acked&FLAG_ACKED) {
                 tcp_ack_update_rtt(sk, acked, seq_rtt);
                 tcp_ack_packets_out(sk, tp);
+                if (rtt_sample && !(acked & FLAG_RETRANS_DATA_ACKED))
+                        (*rtt_sample)(sk, tcp_usrtt(&tv));
 
                 if (icsk->icsk_ca_ops->pkts_acked)
                         icsk->icsk_ca_ops->pkts_acked(sk, pkts_acked);
@@ -2629,7 +2629,7 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                 switch(opcode) {
                                 case TCPOPT_MSS:
                                         if(opsize==TCPOLEN_MSS && th->syn && !estab) {
-                                                u16 in_mss = ntohs(get_unaligned((__u16 *)ptr));
+                                                u16 in_mss = ntohs(get_unaligned((__be16 *)ptr));
                                                 if (in_mss) {
                                                         if (opt_rx->user_mss && opt_rx->user_mss < in_mss)
                                                                 in_mss = opt_rx->user_mss;
@@ -2657,8 +2657,8 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                                 if ((estab && opt_rx->tstamp_ok) ||
                                                     (!estab && sysctl_tcp_timestamps)) {
                                                         opt_rx->saw_tstamp = 1;
-                                                        opt_rx->rcv_tsval = ntohl(get_unaligned((__u32 *)ptr));
-                                                        opt_rx->rcv_tsecr = ntohl(get_unaligned((__u32 *)(ptr+4)));
+                                                        opt_rx->rcv_tsval = ntohl(get_unaligned((__be32 *)ptr));
+                                                        opt_rx->rcv_tsecr = ntohl(get_unaligned((__be32 *)(ptr+4)));
                                                 }
                                         }
                                         break;
@@ -2695,8 +2695,8 @@ static int tcp_fast_parse_options(struct sk_buff *skb, struct tcphdr *th,
                 return 0;
         } else if (tp->rx_opt.tstamp_ok &&
                    th->doff == (sizeof(struct tcphdr)>>2)+(TCPOLEN_TSTAMP_ALIGNED>>2)) {
-                __u32 *ptr = (__u32 *)(th + 1);
-                if (*ptr == ntohl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16)
+                __be32 *ptr = (__be32 *)(th + 1);
+                if (*ptr == htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16)
                                   | (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP)) {
                         tp->rx_opt.saw_tstamp = 1;
                         ++ptr;
@@ -3911,10 +3911,10 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
 
                 /* Check timestamp */
                 if (tcp_header_len == sizeof(struct tcphdr) + TCPOLEN_TSTAMP_ALIGNED) {
-                        __u32 *ptr = (__u32 *)(th + 1);
+                        __be32 *ptr = (__be32 *)(th + 1);
 
                         /* No? Slow path! */
-                        if (*ptr != ntohl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16)
+                        if (*ptr != htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16)
                                           | (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP))
                                 goto slow_path;
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 39b179856082..22ef8bd26620 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -159,7 +159,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         struct tcp_sock *tp = tcp_sk(sk);
         struct sockaddr_in *usin = (struct sockaddr_in *)uaddr;
         struct rtable *rt;
-        u32 daddr, nexthop;
+        __be32 daddr, nexthop;
         int tmp;
         int err;
 
@@ -355,7 +355,7 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
                 return;
         }
         if (sk->sk_state == TCP_TIME_WAIT) {
-                inet_twsk_put((struct inet_timewait_sock *)sk);
+                inet_twsk_put(inet_twsk(sk));
                 return;
         }
 
@@ -373,7 +373,7 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
         seq = ntohl(th->seq);
         if (sk->sk_state != TCP_LISTEN &&
             !between(seq, tp->snd_una, tp->snd_nxt)) {
-                NET_INC_STATS(LINUX_MIB_OUTOFWINDOWICMPS);
+                NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
                 goto out;
         }
 
@@ -578,7 +578,7 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
         struct tcphdr *th = skb->h.th;
         struct {
                 struct tcphdr th;
-                u32 tsopt[3];
+                u32 tsopt[TCPOLEN_TSTAMP_ALIGNED >> 2];
         } rep;
         struct ip_reply_arg arg;
 
@@ -734,8 +734,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         struct inet_request_sock *ireq;
         struct tcp_options_received tmp_opt;
         struct request_sock *req;
-        __u32 saddr = skb->nh.iph->saddr;
-        __u32 daddr = skb->nh.iph->daddr;
+        __be32 saddr = skb->nh.iph->saddr;
+        __be32 daddr = skb->nh.iph->daddr;
         __u32 isn = TCP_SKB_CB(skb)->when;
         struct dst_entry *dst = NULL;
 #ifdef CONFIG_SYN_COOKIES
@@ -960,7 +960,7 @@ static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
                         bh_lock_sock(nsk);
                         return nsk;
                 }
-                inet_twsk_put((struct inet_timewait_sock *)nsk);
+                inet_twsk_put(inet_twsk(nsk));
                 return NULL;
         }
 
@@ -1154,26 +1154,24 @@ discard_and_relse:
 
 do_time_wait:
         if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                inet_twsk_put((struct inet_timewait_sock *) sk);
+                inet_twsk_put(inet_twsk(sk));
                 goto discard_it;
         }
 
         if (skb->len < (th->doff << 2) || tcp_checksum_complete(skb)) {
                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
-                inet_twsk_put((struct inet_timewait_sock *) sk);
+                inet_twsk_put(inet_twsk(sk));
                 goto discard_it;
         }
-        switch (tcp_timewait_state_process((struct inet_timewait_sock *)sk,
-                                           skb, th)) {
+        switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
         case TCP_TW_SYN: {
                 struct sock *sk2 = inet_lookup_listener(&tcp_hashinfo,
                                                         skb->nh.iph->daddr,
                                                         th->dest,
                                                         inet_iif(skb));
                 if (sk2) {
-                        inet_twsk_deschedule((struct inet_timewait_sock *)sk,
-                                             &tcp_death_row);
-                        inet_twsk_put((struct inet_timewait_sock *)sk);
+                        inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row);
+                        inet_twsk_put(inet_twsk(sk));
                         sk = sk2;
                         goto process;
                 }
@@ -1763,7 +1761,7 @@ static void get_tcp4_sock(struct sock *sp, char *tmpbuf, int i)
 
 static void get_timewait4_sock(struct inet_timewait_sock *tw, char *tmpbuf, int i)
 {
-        unsigned int dest, src;
+        __be32 dest, src;
         __u16 destp, srcp;
         int ttd = tw->tw_ttd - jiffies;
 
diff --git a/net/ipv4/tcp_lp.c b/net/ipv4/tcp_lp.c
index 308fb7e071c5..f0ebaf0e21cb 100644
--- a/net/ipv4/tcp_lp.c
+++ b/net/ipv4/tcp_lp.c
@@ -31,8 +31,6 @@
  *   Hung Hing Lun, Mike <hlhung3i@gmail.com>
  * SourceForge project page:
  *   http://tcp-lp-mod.sourceforge.net/
- *
- * Version: $Id: tcp_lp.c,v 1.24 2006/09/05 20:22:53 hswong3i Exp $
  */
 
 #include <linux/module.h>
@@ -164,7 +162,7 @@ static u32 tcp_lp_remote_hz_estimator(struct sock *sk)
 
  out:
         /* record time for successful remote HZ calc */
-        if (rhz > 0)
+        if ((rhz >> 6) > 0)
                 lp->flag |= LP_VALID_RHZ;
         else
                 lp->flag &= ~LP_VALID_RHZ;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 061edfae0c29..ca406157724c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -269,14 +269,14 @@ static u16 tcp_select_window(struct sock *sk)
         return new_win;
 }
 
-static void tcp_build_and_update_options(__u32 *ptr, struct tcp_sock *tp,
+static void tcp_build_and_update_options(__be32 *ptr, struct tcp_sock *tp,
                                          __u32 tstamp)
 {
         if (tp->rx_opt.tstamp_ok) {
-                *ptr++ = __constant_htonl((TCPOPT_NOP << 24) |
-                                          (TCPOPT_NOP << 16) |
-                                          (TCPOPT_TIMESTAMP << 8) |
-                                          TCPOLEN_TIMESTAMP);
+                *ptr++ = htonl((TCPOPT_NOP << 24) |
+                               (TCPOPT_NOP << 16) |
+                               (TCPOPT_TIMESTAMP << 8) |
+                               TCPOLEN_TIMESTAMP);
                 *ptr++ = htonl(tstamp);
                 *ptr++ = htonl(tp->rx_opt.ts_recent);
         }
@@ -305,7 +305,7 @@ static void tcp_build_and_update_options(__u32 *ptr, struct tcp_sock *tp,
  * MAX_SYN_SIZE to match the new maximum number of options that you
  * can generate.
  */
-static void tcp_syn_build_options(__u32 *ptr, int mss, int ts, int sack,
+static void tcp_syn_build_options(__be32 *ptr, int mss, int ts, int sack,
                                   int offer_wscale, int wscale, __u32 tstamp,
                                   __u32 ts_recent)
 {
@@ -325,18 +325,27 @@ static void tcp_syn_build_options(__u32 *ptr, int mss, int ts, int sack,
         *ptr++ = htonl((TCPOPT_MSS << 24) | (TCPOLEN_MSS << 16) | mss);
         if (ts) {
                 if(sack)
-                        *ptr++ = __constant_htonl((TCPOPT_SACK_PERM << 24) | (TCPOLEN_SACK_PERM << 16) |
-                                                  (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
+                        *ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
+                                       (TCPOLEN_SACK_PERM << 16) |
+                                       (TCPOPT_TIMESTAMP << 8) |
+                                       TCPOLEN_TIMESTAMP);
                 else
-                        *ptr++ = __constant_htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
-                                                  (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
+                        *ptr++ = htonl((TCPOPT_NOP << 24) |
+                                       (TCPOPT_NOP << 16) |
+                                       (TCPOPT_TIMESTAMP << 8) |
+                                       TCPOLEN_TIMESTAMP);
                 *ptr++ = htonl(tstamp);         /* TSVAL */
                 *ptr++ = htonl(ts_recent);      /* TSECR */
         } else if(sack)
-                *ptr++ = __constant_htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
-                                          (TCPOPT_SACK_PERM << 8) | TCPOLEN_SACK_PERM);
+                *ptr++ = htonl((TCPOPT_NOP << 24) |
+                               (TCPOPT_NOP << 16) |
+                               (TCPOPT_SACK_PERM << 8) |
+                               TCPOLEN_SACK_PERM);
         if (offer_wscale)
-                *ptr++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_WINDOW << 16) | (TCPOLEN_WINDOW << 8) | (wscale));
+                *ptr++ = htonl((TCPOPT_NOP << 24) |
+                               (TCPOPT_WINDOW << 16) |
+                               (TCPOLEN_WINDOW << 8) |
+                               (wscale));
 }
 
 /* This routine actually transmits TCP packets queued in by
@@ -424,7 +433,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         th->dest                = inet->dport;
         th->seq                 = htonl(tcb->seq);
         th->ack_seq             = htonl(tp->rcv_nxt);
-        *(((__u16 *)th) + 6)    = htons(((tcp_header_size >> 2) << 12) |
+        *(((__be16 *)th) + 6)   = htons(((tcp_header_size >> 2) << 12) |
                                         tcb->flags);
 
         if (unlikely(tcb->flags & TCPCB_FLAG_SYN)) {
@@ -445,7 +454,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         }
 
         if (unlikely(tcb->flags & TCPCB_FLAG_SYN)) {
-                tcp_syn_build_options((__u32 *)(th + 1),
+                tcp_syn_build_options((__be32 *)(th + 1),
                                       tcp_advertise_mss(sk),
                                       (sysctl_flags & SYSCTL_FLAG_TSTAMPS),
                                       (sysctl_flags & SYSCTL_FLAG_SACK),
@@ -454,7 +463,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
                                       tcb->when,
                                       tp->rx_opt.ts_recent);
         } else {
-                tcp_build_and_update_options((__u32 *)(th + 1),
+                tcp_build_and_update_options((__be32 *)(th + 1),
                                              tp, tcb->when);
                 TCP_ECN_send(sk, tp, skb, tcp_header_size);
         }
@@ -1087,10 +1096,14 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
         u32 send_win, cong_win, limit, in_flight;
 
         if (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN)
-                return 0;
+                goto send_now;
 
         if (icsk->icsk_ca_state != TCP_CA_Open)
-                return 0;
+                goto send_now;
+
+        /* Defer for less than two clock ticks. */
+        if (!tp->tso_deferred && ((jiffies<<1)>>1) - (tp->tso_deferred>>1) > 1)
+                goto send_now;
 
         in_flight = tcp_packets_in_flight(tp);
 
@@ -1106,7 +1119,7 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
 
         /* If a full-sized TSO skb can be sent, do it. */
         if (limit >= 65536)
-                return 0;
+                goto send_now;
 
         if (sysctl_tcp_tso_win_divisor) {
                 u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
@@ -1116,7 +1129,7 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
                  */
                 chunk /= sysctl_tcp_tso_win_divisor;
                 if (limit >= chunk)
-                        return 0;
+                        goto send_now;
         } else {
                 /* Different approach, try not to defer past a single
                  * ACK.  Receiver should ACK every other full sized
@@ -1124,11 +1137,17 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
                  * then send now.
                  */
                 if (limit > tcp_max_burst(tp) * tp->mss_cache)
-                        return 0;
+                        goto send_now;
         }
 
         /* Ok, it looks like it is advisable to defer.  */
+        tp->tso_deferred = 1 | (jiffies<<1);
+
         return 1;
+
+send_now:
+        tp->tso_deferred = 0;
+        return 0;
 }
 
 /* Create a new MTU probe if we are ready.
@@ -2070,7 +2089,7 @@ struct sk_buff * tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         th->window = htons(req->rcv_wnd);
 
         TCP_SKB_CB(skb)->when = tcp_time_stamp;
-        tcp_syn_build_options((__u32 *)(th + 1), dst_metric(dst, RTAX_ADVMSS), ireq->tstamp_ok,
+        tcp_syn_build_options((__be32 *)(th + 1), dst_metric(dst, RTAX_ADVMSS), ireq->tstamp_ok,
                               ireq->sack_ok, ireq->wscale_ok, ireq->rcv_wscale,
                               TCP_SKB_CB(skb)->when,
                               req->ts_recent);
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index dab37d2f65fc..4be336f17883 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -99,8 +99,10 @@ static int jtcp_sendmsg(struct kiocb *iocb, struct sock *sk,
 }
 
 static struct jprobe tcp_send_probe = {
-        .kp = { .addr = (kprobe_opcode_t *) &tcp_sendmsg, },
-        .entry = (kprobe_opcode_t *) &jtcp_sendmsg,
+        .kp = {
+                .symbol_name    = "tcp_sendmsg",
+        },
+        .entry  = JPROBE_ENTRY(jtcp_sendmsg),
 };
 
 
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 77e265d7bb8f..865d75214a9a 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -243,8 +243,8 @@ static void udp_v4_unhash(struct sock *sk)
 /* UDP is nearly always wildcards out the wazoo, it makes no sense to try
  * harder than this. -DaveM
  */
-static struct sock *udp_v4_lookup_longway(u32 saddr, u16 sport,
-                                          u32 daddr, u16 dport, int dif)
+static struct sock *udp_v4_lookup_longway(__be32 saddr, __be16 sport,
+                                          __be32 daddr, __be16 dport, int dif)
 {
         struct sock *sk, *result = NULL;
         struct hlist_node *node;
@@ -288,8 +288,8 @@ static struct sock *udp_v4_lookup_longway(u32 saddr, u16 sport,
         return result;
 }
 
-static __inline__ struct sock *udp_v4_lookup(u32 saddr, u16 sport,
-                                             u32 daddr, u16 dport, int dif)
+static __inline__ struct sock *udp_v4_lookup(__be32 saddr, __be16 sport,
+                                             __be32 daddr, __be16 dport, int dif)
 {
         struct sock *sk;
 
@@ -302,8 +302,8 @@ static __inline__ struct sock *udp_v4_lookup(u32 saddr, u16 sport,
 }
 
 static inline struct sock *udp_v4_mcast_next(struct sock *sk,
-                                             u16 loc_port, u32 loc_addr,
-                                             u16 rmt_port, u32 rmt_addr,
+                                             __be16 loc_port, __be32 loc_addr,
+                                             __be16 rmt_port, __be32 rmt_addr,
                                              int dif)
 {
         struct hlist_node *node;
@@ -498,7 +498,7 @@ out:
 }
 
 
-static unsigned short udp_check(struct udphdr *uh, int len, unsigned long saddr, unsigned long daddr, unsigned long base)
+static unsigned short udp_check(struct udphdr *uh, int len, __be32 saddr, __be32 daddr, unsigned long base)
 {
         return(csum_tcpudp_magic(saddr, daddr, len, IPPROTO_UDP, base));
 }
@@ -513,8 +513,8 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         struct rtable *rt = NULL;
         int free = 0;
         int connected = 0;
-        u32 daddr, faddr, saddr;
-        u16 dport;
+        __be32 daddr, faddr, saddr;
+        __be16 dport;
         u8  tos;
         int err;
         int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
@@ -675,6 +675,8 @@ do_append_data:
                 udp_flush_pending_frames(sk);
         else if (!corkreq)
                 err = udp_push_pending_frames(sk, up);
+        else if (unlikely(skb_queue_empty(&sk->sk_write_queue)))
+                up->pending = 0;
         release_sock(sk);
 
 out:
@@ -931,7 +933,7 @@ static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
         int iphlen, len;
   
         __u8 *udpdata = (__u8 *)uh + sizeof(struct udphdr);
-        __u32 *udpdata32 = (__u32 *)udpdata;
+        __be32 *udpdata32 = (__be32 *)udpdata;
         __u16 encap_type = up->encap_type;
 
         /* if we're overly short, let UDP handle it */
@@ -1080,7 +1082,7 @@ static int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
  *      so we don't need to lock the hashes.
  */
 static int udp_v4_mcast_deliver(struct sk_buff *skb, struct udphdr *uh,
-                                 u32 saddr, u32 daddr)
+                                 __be32 saddr, __be32 daddr)
 {
         struct sock *sk;
         int dif;
@@ -1121,7 +1123,7 @@ static int udp_v4_mcast_deliver(struct sk_buff *skb, struct udphdr *uh,
  * including udp header and folding it to skb->csum.
  */
 static void udp_checksum_init(struct sk_buff *skb, struct udphdr *uh,
-                             unsigned short ulen, u32 saddr, u32 daddr)
+                             unsigned short ulen, __be32 saddr, __be32 daddr)
 {
         if (uh->check == 0) {
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1146,8 +1148,8 @@ int udp_rcv(struct sk_buff *skb)
         struct udphdr *uh;
         unsigned short ulen;
         struct rtable *rt = (struct rtable*)skb->dst;
-        u32 saddr = skb->nh.iph->saddr;
-        u32 daddr = skb->nh.iph->daddr;
+        __be32 saddr = skb->nh.iph->saddr;
+        __be32 daddr = skb->nh.iph->daddr;
         int len = skb->len;
 
         /*
@@ -1563,8 +1565,8 @@ void udp_proc_unregister(struct udp_seq_afinfo *afinfo)
 static void udp4_format_sock(struct sock *sp, char *tmpbuf, int bucket)
 {
         struct inet_sock *inet = inet_sk(sp);
-        unsigned int dest = inet->daddr;
-        unsigned int src  = inet->rcv_saddr;
+        __be32 dest = inet->daddr;
+        __be32 src  = inet->rcv_saddr;
         __u16 destp       = ntohs(inet->dport);
         __u16 srcp        = ntohs(inet->sport);
 
diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index 040e8475f295..8655d038364c 100644
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -23,7 +23,7 @@ int xfrm4_rcv(struct sk_buff *skb)
 
 EXPORT_SYMBOL(xfrm4_rcv);
 
-static int xfrm4_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq)
+static int xfrm4_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq)
 {
         switch (nexthdr) {
         case IPPROTO_IPIP:
@@ -55,7 +55,7 @@ drop:
 int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
 {
         int err;
-        u32 spi, seq;
+        __be32 spi, seq;
         struct xfrm_state *xfrm_vec[XFRM_MAX_DEPTH];
         struct xfrm_state *x;
         int xfrm_nr = 0;
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
new file mode 100644
index 000000000000..89cf59ea7bbe
--- /dev/null
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -0,0 +1,139 @@
+/*
+ * xfrm4_mode_beet.c - BEET mode encapsulation for IPv4.
+ *
+ * Copyright (c) 2006 Diego Beltrami <diego.beltrami@gmail.com>
+ *                    Miika Komu     <miika@iki.fi>
+ *                    Herbert Xu     <herbert@gondor.apana.org.au>
+ *                    Abhinav Pathak <abhinav.pathak@hiit.fi>
+ *                    Jeff Ahrenholz <ahrenholz@gmail.com>
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/stringify.h>
+#include <net/dst.h>
+#include <net/ip.h>
+#include <net/xfrm.h>
+
+/* Add encapsulation header.
+ *
+ * The top IP header will be constructed per draft-nikander-esp-beet-mode-06.txt.
+ * The following fields in it shall be filled in by x->type->output:
+ *      tot_len
+ *      check
+ *
+ * On exit, skb->h will be set to the start of the payload to be processed
+ * by x->type->output and skb->nh will be set to the top IP header.
+ */
+static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
+{
+        struct iphdr *iph, *top_iph = NULL;
+        int hdrlen, optlen;
+
+        iph = skb->nh.iph;
+        skb->h.ipiph = iph;
+
+        hdrlen = 0;
+        optlen = iph->ihl * 4 - sizeof(*iph);
+        if (unlikely(optlen))
+                hdrlen += IPV4_BEET_PHMAXLEN - (optlen & 4);
+
+        skb->nh.raw = skb_push(skb, x->props.header_len + hdrlen);
+        top_iph = skb->nh.iph;
+        hdrlen = iph->ihl * 4 - optlen;
+        skb->h.raw += hdrlen;
+
+        memmove(top_iph, iph, hdrlen);
+        if (unlikely(optlen)) {
+                struct ip_beet_phdr *ph;
+
+                BUG_ON(optlen < 0);
+
+                ph = (struct ip_beet_phdr *)skb->h.raw;
+                ph->padlen = 4 - (optlen & 4);
+                ph->hdrlen = (optlen + ph->padlen + sizeof(*ph)) / 8;
+                ph->nexthdr = top_iph->protocol;
+
+                top_iph->protocol = IPPROTO_BEETPH;
+                top_iph->ihl = sizeof(struct iphdr) / 4;
+        }
+
+        top_iph->saddr = x->props.saddr.a4;
+        top_iph->daddr = x->id.daddr.a4;
+
+        return 0;
+}
+
+static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb)
+{
+        struct iphdr *iph = skb->nh.iph;
+        int phlen = 0;
+        int optlen = 0;
+        __u8 ph_nexthdr = 0, protocol = 0;
+        int err = -EINVAL;
+
+        protocol = iph->protocol;
+
+        if (unlikely(iph->protocol == IPPROTO_BEETPH)) {
+                struct ip_beet_phdr *ph = (struct ip_beet_phdr*)(iph + 1);
+
+                if (!pskb_may_pull(skb, sizeof(*ph)))
+                        goto out;
+
+                phlen = ph->hdrlen * 8;
+                optlen = phlen - ph->padlen - sizeof(*ph);
+                if (optlen < 0 || optlen & 3 || optlen > 250)
+                        goto out;
+
+                if (!pskb_may_pull(skb, phlen))
+                        goto out;
+
+                ph_nexthdr = ph->nexthdr;
+        }
+
+        skb_push(skb, sizeof(*iph) - phlen + optlen);
+        memmove(skb->data, skb->nh.raw, sizeof(*iph));
+        skb->nh.raw = skb->data;
+
+        iph = skb->nh.iph;
+        iph->ihl = (sizeof(*iph) + optlen) / 4;
+        iph->tot_len = htons(skb->len);
+        iph->daddr = x->sel.daddr.a4;
+        iph->saddr = x->sel.saddr.a4;
+        if (ph_nexthdr)
+                iph->protocol = ph_nexthdr;
+        else
+                iph->protocol = protocol;
+        iph->check = 0;
+        iph->check = ip_fast_csum(skb->nh.raw, iph->ihl);
+        err = 0;
+out:
+        return err;
+}
+
+static struct xfrm_mode xfrm4_beet_mode = {
+        .input = xfrm4_beet_input,
+        .output = xfrm4_beet_output,
+        .owner = THIS_MODULE,
+        .encap = XFRM_MODE_BEET,
+};
+
+static int __init xfrm4_beet_init(void)
+{
+        return xfrm_register_mode(&xfrm4_beet_mode, AF_INET);
+}
+
+static void __exit xfrm4_beet_exit(void)
+{
+        int err;
+
+        err = xfrm_unregister_mode(&xfrm4_beet_mode, AF_INET);
+        BUG_ON(err);
+}
+
+module_init(xfrm4_beet_init);
+module_exit(xfrm4_beet_exit);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_XFRM_MODE(AF_INET, XFRM_MODE_BEET);
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index eabcd27b1767..1bed0cdf53e3 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -52,7 +52,7 @@ __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
                     xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
                     xdst->u.rt.fl.fl4_src == fl->fl4_src &&
                     xdst->u.rt.fl.fl4_tos == fl->fl4_tos &&
-                    xfrm_bundle_ok(xdst, fl, AF_INET, 0)) {
+                    xfrm_bundle_ok(policy, xdst, fl, AF_INET, 0)) {
                         dst_clone(dst);
                         break;
                 }
@@ -221,7 +221,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl)
 
                 case IPPROTO_ESP:
                         if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
-                                u32 *ehdr = (u32 *)xprth;
+                                __be32 *ehdr = (__be32 *)xprth;
 
                                 fl->fl_ipsec_spi = ehdr[0];
                         }
@@ -229,7 +229,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl)
 
                 case IPPROTO_AH:
                         if (pskb_may_pull(skb, xprth + 8 - skb->data)) {
-                                u32 *ah_hdr = (u32*)xprth;
+                                __be32 *ah_hdr = (__be32*)xprth;
 
                                 fl->fl_ipsec_spi = ah_hdr[1];
                         }
@@ -237,7 +237,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl)
 
                 case IPPROTO_COMP:
                         if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
-                                u16 *ipcomp_hdr = (u16 *)xprth;
+                                __be16 *ipcomp_hdr = (__be16 *)xprth;
 
                                 fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
                         }
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index fe2034494d08..3cc3df0c6ece 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -29,9 +29,9 @@ __xfrm4_init_tempsel(struct xfrm_state *x, struct flowi *fl,
         x->sel.daddr.a4 = fl->fl4_dst;
         x->sel.saddr.a4 = fl->fl4_src;
         x->sel.dport = xfrm_flowi_dport(fl);
-        x->sel.dport_mask = ~0;
+        x->sel.dport_mask = htons(0xffff);
         x->sel.sport = xfrm_flowi_sport(fl);
-        x->sel.sport_mask = ~0;
+        x->sel.sport_mask = htons(0xffff);
         x->sel.prefixlen_d = 32;
         x->sel.prefixlen_s = 32;
         x->sel.proto = fl->proto;
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index a2d211da2aba..6e48f52e197c 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -136,6 +136,16 @@ config INET6_XFRM_MODE_TUNNEL
 
           If unsure, say Y.
 
+config INET6_XFRM_MODE_BEET
+        tristate "IPv6: IPsec BEET mode"
+        depends on IPV6
+        default IPV6
+        select XFRM
+        ---help---
+          Support for IPsec BEET mode.
+
+          If unsure, say Y.
+
 config INET6_XFRM_MODE_ROUTEOPTIMIZATION
         tristate "IPv6: MIPv6 route optimization mode (EXPERIMENTAL)"
         depends on IPV6 && EXPERIMENTAL
@@ -143,6 +153,19 @@ config INET6_XFRM_MODE_ROUTEOPTIMIZATION
         ---help---
           Support for MIPv6 route optimization mode.
 
+config IPV6_SIT
+        tristate "IPv6: IPv6-in-IPv4 tunnel (SIT driver)"
+        depends on IPV6
+        default y
+        ---help---
+          Tunneling means encapsulating data of one protocol type within
+          another protocol and sending it over a channel that understands the
+          encapsulating protocol. This driver implements encapsulation of IPv6
+          into IPv4 packets. This is useful if you want to connect two IPv6
+          networks over an IPv4-only path.
+
+          Saying M here will produce a module called sit.ko. If unsure, say Y.
+
 config IPV6_TUNNEL
         tristate "IPv6: IPv6-in-IPv6 tunnel"
         select INET6_TUNNEL
@@ -152,9 +175,16 @@ config IPV6_TUNNEL
 
           If unsure, say N.
 
+config IPV6_MULTIPLE_TABLES
+        bool "IPv6: Multiple Routing Tables"
+        depends on IPV6 && EXPERIMENTAL
+        select FIB_RULES
+        ---help---
+          Support multiple routing tables.
+
 config IPV6_SUBTREES
         bool "IPv6: source address based routing"
-        depends on IPV6 && EXPERIMENTAL
+        depends on IPV6_MULTIPLE_TABLES
         ---help---
           Enable routing by source address or prefix.
 
@@ -166,13 +196,6 @@ config IPV6_SUBTREES
 
           If unsure, say N.
 
-config IPV6_MULTIPLE_TABLES
-        bool "IPv6: Multiple Routing Tables"
-        depends on IPV6 && EXPERIMENTAL
-        select FIB_RULES
-        ---help---
-          Support multiple routing tables.
-
 config IPV6_ROUTE_FWMARK
         bool "IPv6: use netfilter MARK value as routing key"
         depends on IPV6_MULTIPLE_TABLES && NETFILTER
diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile
index 0213c6612b58..addcc011bc01 100644
--- a/net/ipv6/Makefile
+++ b/net/ipv6/Makefile
@@ -4,7 +4,7 @@
 
 obj-$(CONFIG_IPV6) += ipv6.o
 
-ipv6-objs :=    af_inet6.o anycast.o ip6_output.o ip6_input.o addrconf.o sit.o \
+ipv6-objs :=    af_inet6.o anycast.o ip6_output.o ip6_input.o addrconf.o \
                 route.o ip6_fib.o ipv6_sockglue.o ndisc.o udp.o raw.o \
                 protocol.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
                 exthdrs.o sysctl_net_ipv6.o datagram.o proc.o \
@@ -26,8 +26,10 @@ obj-$(CONFIG_INET6_TUNNEL) += tunnel6.o
 obj-$(CONFIG_INET6_XFRM_MODE_TRANSPORT) += xfrm6_mode_transport.o
 obj-$(CONFIG_INET6_XFRM_MODE_TUNNEL) += xfrm6_mode_tunnel.o
 obj-$(CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION) += xfrm6_mode_ro.o
+obj-$(CONFIG_INET6_XFRM_MODE_BEET) += xfrm6_mode_beet.o
 obj-$(CONFIG_NETFILTER) += netfilter/
 
+obj-$(CONFIG_IPV6_SIT) += sit.o
 obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.o
 
 obj-y += exthdrs_core.o
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c18676352397..b312a5f7a759 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -396,8 +396,10 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
         ndev->regen_timer.data = (unsigned long) ndev;
         if ((dev->flags&IFF_LOOPBACK) ||
             dev->type == ARPHRD_TUNNEL ||
-            dev->type == ARPHRD_NONE ||
-            dev->type == ARPHRD_SIT) {
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
+            dev->type == ARPHRD_SIT ||
+#endif
+            dev->type == ARPHRD_NONE) {
                 printk(KERN_INFO
                        "%s: Disabled Privacy Extensions\n",
                        dev->name);
@@ -1258,8 +1260,8 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
 {
         const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
         const struct in6_addr *sk2_rcv_saddr6 = inet6_rcv_saddr(sk2);
-        u32 sk_rcv_saddr = inet_sk(sk)->rcv_saddr;
-        u32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
+        __be32 sk_rcv_saddr = inet_sk(sk)->rcv_saddr;
+        __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
         int sk_ipv6only = ipv6_only_sock(sk);
         int sk2_ipv6only = inet_v6_ipv6only(sk2);
         int addr_type = ipv6_addr_type(sk_rcv_saddr6);
@@ -1546,8 +1548,10 @@ addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
            This thing is done here expecting that the whole
            class of non-broadcast devices need not cloning.
          */
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
         if (dev->type == ARPHRD_SIT && (dev->flags & IFF_POINTOPOINT))
                 cfg.fc_flags |= RTF_NONEXTHOP;
+#endif
 
         ip6_route_add(&cfg);
 }
@@ -1569,6 +1573,7 @@ static void addrconf_add_mroute(struct net_device *dev)
         ip6_route_add(&cfg);
 }
 
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
 static void sit_route_add(struct net_device *dev)
 {
         struct fib6_config cfg = {
@@ -1582,6 +1587,7 @@ static void sit_route_add(struct net_device *dev)
         /* prefix length - 96 bits "::d.d.d.d" */
         ip6_route_add(&cfg);
 }
+#endif
 
 static void addrconf_add_lroute(struct net_device *dev)
 {
@@ -1852,6 +1858,7 @@ int addrconf_set_dstaddr(void __user *arg)
         if (dev == NULL)
                 goto err_exit;
 
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
         if (dev->type == ARPHRD_SIT) {
                 struct ifreq ifr;
                 mm_segment_t    oldfs;
@@ -1881,6 +1888,7 @@ int addrconf_set_dstaddr(void __user *arg)
                         err = dev_open(dev);
                 }
         }
+#endif
 
 err_exit:
         rtnl_unlock();
@@ -2010,6 +2018,7 @@ int addrconf_del_ifaddr(void __user *arg)
         return err;
 }
 
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
 static void sit_add_v4_addrs(struct inet6_dev *idev)
 {
         struct inet6_ifaddr * ifp;
@@ -2078,6 +2087,7 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
                 }
         }
 }
+#endif
 
 static void init_loopback(struct net_device *dev)
 {
@@ -2141,6 +2151,7 @@ static void addrconf_dev_config(struct net_device *dev)
                 addrconf_add_linklocal(idev, &addr);
 }
 
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
 static void addrconf_sit_config(struct net_device *dev)
 {
         struct inet6_dev *idev;
@@ -2166,6 +2177,7 @@ static void addrconf_sit_config(struct net_device *dev)
         } else
                 sit_route_add(dev);
 }
+#endif
 
 static inline int
 ipv6_inherit_linklocal(struct inet6_dev *idev, struct net_device *link_dev)
@@ -2260,9 +2272,11 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                 }
 
                 switch(dev->type) {
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
                 case ARPHRD_SIT:
                         addrconf_sit_config(dev);
                         break;
+#endif
                 case ARPHRD_TUNNEL6:
                         addrconf_ip6_tnl_config(dev);
                         break;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index bf6e8aff19d4..858cae29581c 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -246,7 +246,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct sock *sk = sock->sk;
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
-        __u32 v4addr = 0;
+        __be32 v4addr = 0;
         unsigned short snum;
         int addr_type = 0;
         int err = 0;
@@ -850,7 +850,6 @@ static int __init inet6_init(void)
         err = addrconf_init();
         if (err)
                 goto addrconf_fail;
-        sit_init();
 
         /* Init v6 extension headers. */
         ipv6_rthdr_init();
@@ -927,7 +926,6 @@ static void __exit inet6_exit(void)
         mip6_fini();
 #endif
         /* Cleanup code parts. */
-        sit_cleanup();
         ip6_flowlabel_cleanup();
         addrconf_cleanup();
         ip6_route_cleanup();
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 34f5bfaddfc2..1896ecb52899 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -13,7 +13,6 @@
  *      Ville Nuorvala          <vnuorval@tcs.hut.fi>
  */
 
-#include <linux/config.h>
 #include <linux/netdevice.h>
 
 #include <net/fib_rules.h>
@@ -118,12 +117,15 @@ static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 {
         struct fib6_rule *r = (struct fib6_rule *) rule;
 
-        if (!ipv6_prefix_equal(&fl->fl6_dst, &r->dst.addr, r->dst.plen))
+        if (r->dst.plen &&
+            !ipv6_prefix_equal(&fl->fl6_dst, &r->dst.addr, r->dst.plen))
                 return 0;
 
-        if ((flags & RT6_LOOKUP_F_HAS_SADDR) &&
-            !ipv6_prefix_equal(&fl->fl6_src, &r->src.addr, r->src.plen))
-                return 0;
+        if (r->src.plen) {
+                if (!(flags & RT6_LOOKUP_F_HAS_SADDR) ||
+                    !ipv6_prefix_equal(&fl->fl6_src, &r->src.addr, r->src.plen))
+                        return 0;
+        }
 
         if (r->tclass && r->tclass != ((ntohl(fl->fl6_flowlabel) >> 20) & 0xff))
                 return 0;
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index d2f3fc990bfa..8accd1fbeeda 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -64,7 +64,7 @@ struct sock *__inet6_lookup_established(struct inet_hashinfo *hashinfo,
 {
         struct sock *sk;
         const struct hlist_node *node;
-        const __u32 ports = INET_COMBINED_PORTS(sport, hnum);
+        const __portpair ports = INET_COMBINED_PORTS(sport, hnum);
         /* Optimize here for direct hit, only listening connections can
          * have wildcards anyways.
          */
@@ -82,7 +82,7 @@ struct sock *__inet6_lookup_established(struct inet_hashinfo *hashinfo,
         sk_for_each(sk, node, &(head + hashinfo->ehash_size)->chain) {
                 const struct inet_timewait_sock *tw = inet_twsk(sk);
 
-                if(*((__u32 *)&(tw->tw_dport))  == ports        &&
+                if(*((__portpair *)&(tw->tw_dport))     == ports        &&
                    sk->sk_family                == PF_INET6) {
                         const struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
 
@@ -171,7 +171,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         const struct in6_addr *daddr = &np->rcv_saddr;
         const struct in6_addr *saddr = &np->daddr;
         const int dif = sk->sk_bound_dev_if;
-        const u32 ports = INET_COMBINED_PORTS(inet->dport, lport);
+        const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
         const unsigned int hash = inet6_ehashfn(daddr, inet->num, saddr,
                                                 inet->dport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
@@ -188,7 +188,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
 
                 tw = inet_twsk(sk2);
 
-                if(*((__u32 *)&(tw->tw_dport)) == ports          &&
+                if(*((__portpair *)&(tw->tw_dport)) == ports             &&
                    sk2->sk_family              == PF_INET6       &&
                    ipv6_addr_equal(&tw6->tw_v6_daddr, saddr)     &&
                    ipv6_addr_equal(&tw6->tw_v6_rcv_saddr, daddr) &&
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index ad9c6e824e62..71f59f18ede8 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -178,7 +178,7 @@ out_ok:
 static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                                 int type, int code, int offset, __u32 info)
 {
-        u32 spi;
+        __be32 spi;
         struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
         struct ipv6_comp_hdr *ipcomph = (struct ipv6_comp_hdr*)(skb->data+offset);
         struct xfrm_state *x;
@@ -199,6 +199,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
 {
         struct xfrm_state *t = NULL;
+        u8 mode = XFRM_MODE_TUNNEL;
 
         t = xfrm_state_alloc();
         if (!t)
@@ -212,7 +213,9 @@ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
         memcpy(t->id.daddr.a6, x->id.daddr.a6, sizeof(struct in6_addr));
         memcpy(&t->sel, &x->sel, sizeof(t->sel));
         t->props.family = AF_INET6;
-        t->props.mode = XFRM_MODE_TUNNEL;
+        if (x->props.mode == XFRM_MODE_BEET)
+                mode = x->props.mode;
+        t->props.mode = mode;
         memcpy(t->props.saddr.a6, x->props.saddr.a6, sizeof(struct in6_addr));
 
         if (xfrm_init_state(t))
@@ -234,7 +237,7 @@ static int ipcomp6_tunnel_attach(struct xfrm_state *x)
 {
         int err = 0;
         struct xfrm_state *t = NULL;
-        u32 spi;
+        __be32 spi;
 
         spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&x->props.saddr);
         if (spi)
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 4f3bb7fcc8b5..de6b91981b30 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -123,6 +123,9 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features)
         struct ipv6hdr *ipv6h;
         struct inet6_protocol *ops;
 
+        if (!(features & NETIF_F_HW_CSUM))
+                features &= ~NETIF_F_SG;
+
         if (unlikely(skb_shinfo(skb)->gso_type &
                      ~(SKB_GSO_UDP |
                        SKB_GSO_DODGY |
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 99d116caecda..7ccdc8fc5a31 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -22,7 +22,6 @@
  *      Masahide NAKAMURA @USAGI
  */
 
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/time.h>
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 0304b5fe8d6a..41a8a5f06602 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -967,8 +967,6 @@ static void ndisc_recv_na(struct sk_buff *skb)
                     ipv6_devconf.forwarding && ipv6_devconf.proxy_ndp &&
                     pneigh_lookup(&nd_tbl, &msg->target, dev, 0)) {
                         /* XXX: idev->cnf.prixy_ndp */
-                        WARN_ON(skb->dst != NULL &&
-                                ((struct rt6_info *)skb->dst)->rt6i_idev);
                         goto out;
                 }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d6b4b4f48d18..c953466b7afd 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -141,6 +141,10 @@ struct rt6_info ip6_null_entry = {
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 
+static int ip6_pkt_prohibit(struct sk_buff *skb);
+static int ip6_pkt_prohibit_out(struct sk_buff *skb);
+static int ip6_pkt_blk_hole(struct sk_buff *skb);
+
 struct rt6_info ip6_prohibit_entry = {
         .u = {
                 .dst = {
@@ -150,8 +154,8 @@ struct rt6_info ip6_prohibit_entry = {
                         .obsolete       = -1,
                         .error          = -EACCES,
                         .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
-                        .input          = ip6_pkt_discard,
-                        .output         = ip6_pkt_discard_out,
+                        .input          = ip6_pkt_prohibit,
+                        .output         = ip6_pkt_prohibit_out,
                         .ops            = &ip6_dst_ops,
                         .path           = (struct dst_entry*)&ip6_prohibit_entry,
                 }
@@ -170,8 +174,8 @@ struct rt6_info ip6_blk_hole_entry = {
                         .obsolete       = -1,
                         .error          = -EINVAL,
                         .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
-                        .input          = ip6_pkt_discard,
-                        .output         = ip6_pkt_discard_out,
+                        .input          = ip6_pkt_blk_hole,
+                        .output         = ip6_pkt_blk_hole,
                         .ops            = &ip6_dst_ops,
                         .path           = (struct dst_entry*)&ip6_blk_hole_entry,
                 }
@@ -484,7 +488,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
 do { \
         if (rt == &ip6_null_entry) { \
                 struct fib6_node *pn; \
-                while (fn) { \
+                while (1) { \
                         if (fn->fn_flags & RTN_TL_ROOT) \
                                 goto out; \
                         pn = fn->parent; \
@@ -529,13 +533,17 @@ struct rt6_info *rt6_lookup(struct in6_addr *daddr, struct in6_addr *saddr,
                 .nl_u = {
                         .ip6_u = {
                                 .daddr = *daddr,
-                                /* TODO: saddr */
                         },
                 },
         };
         struct dst_entry *dst;
         int flags = strict ? RT6_LOOKUP_F_IFACE : 0;
 
+        if (saddr) {
+                memcpy(&fl.fl6_src, saddr, sizeof(*saddr));
+                flags |= RT6_LOOKUP_F_HAS_SADDR;
+        }
+
         dst = fib6_rule_lookup(&fl, flags, ip6_pol_route_lookup);
         if (dst->error == 0)
                 return (struct rt6_info *) dst;
@@ -614,8 +622,6 @@ static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort, struct in6_addr *d
                 ipv6_addr_copy(&rt->rt6i_dst.addr, daddr);
                 rt->rt6i_dst.plen = 128;
                 rt->rt6i_flags |= RTF_CACHE;
-                if (rt->rt6i_flags & RTF_REJECT)
-                        rt->u.dst.error = ort->u.dst.error;
                 rt->u.dst.flags |= DST_HOST;
                 rt->rt6i_nexthop = neigh_clone(ort->rt6i_nexthop);
         }
@@ -697,6 +703,7 @@ out2:
 void ip6_route_input(struct sk_buff *skb)
 {
         struct ipv6hdr *iph = skb->nh.ipv6h;
+        int flags = RT6_LOOKUP_F_HAS_SADDR;
         struct flowi fl = {
                 .iif = skb->dev->ifindex,
                 .nl_u = {
@@ -711,7 +718,9 @@ void ip6_route_input(struct sk_buff *skb)
                 },
                 .proto = iph->nexthdr,
         };
-        int flags = rt6_need_strict(&iph->daddr) ? RT6_LOOKUP_F_IFACE : 0;
+
+        if (rt6_need_strict(&iph->daddr))
+                flags |= RT6_LOOKUP_F_IFACE;
 
         skb->dst = fib6_rule_lookup(&fl, flags, ip6_pol_route_input);
 }
@@ -794,6 +803,9 @@ struct dst_entry * ip6_route_output(struct sock *sk, struct flowi *fl)
         if (rt6_need_strict(&fl->fl6_dst))
                 flags |= RT6_LOOKUP_F_IFACE;
 
+        if (!ipv6_addr_any(&fl->fl6_src))
+                flags |= RT6_LOOKUP_F_HAS_SADDR;
+
         return fib6_rule_lookup(fl, flags, ip6_pol_route_output);
 }
 
@@ -1345,6 +1357,7 @@ static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
                                            struct in6_addr *gateway,
                                            struct net_device *dev)
 {
+        int flags = RT6_LOOKUP_F_HAS_SADDR;
         struct ip6rd_flowi rdfl = {
                 .fl = {
                         .oif = dev->ifindex,
@@ -1357,7 +1370,9 @@ static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
                 },
                 .gateway = *gateway,
         };
-        int flags = rt6_need_strict(dest) ? RT6_LOOKUP_F_IFACE : 0;
+
+        if (rt6_need_strict(dest))
+                flags |= RT6_LOOKUP_F_IFACE;
 
         return (struct rt6_info *)fib6_rule_lookup((struct flowi *)&rdfl, flags, __ip6_route_redirect);
 }
@@ -1527,6 +1542,7 @@ static struct rt6_info * ip6_rt_copy(struct rt6_info *ort)
                 rt->u.dst.output = ort->u.dst.output;
 
                 memcpy(rt->u.dst.metrics, ort->u.dst.metrics, RTAX_MAX*sizeof(u32));
+                rt->u.dst.error = ort->u.dst.error;
                 rt->u.dst.dev = ort->u.dst.dev;
                 if (rt->u.dst.dev)
                         dev_hold(rt->u.dst.dev);
@@ -1730,24 +1746,50 @@ int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
  *      Drop the packet on the floor
  */
 
-static int ip6_pkt_discard(struct sk_buff *skb)
+static inline int ip6_pkt_drop(struct sk_buff *skb, int code)
 {
         int type = ipv6_addr_type(&skb->nh.ipv6h->daddr);
         if (type == IPV6_ADDR_ANY || type == IPV6_ADDR_RESERVED)
                 IP6_INC_STATS(IPSTATS_MIB_INADDRERRORS);
 
         IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
-        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_NOROUTE, 0, skb->dev);
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, code, 0, skb->dev);
         kfree_skb(skb);
         return 0;
 }
 
+static int ip6_pkt_discard(struct sk_buff *skb)
+{
+        return ip6_pkt_drop(skb, ICMPV6_NOROUTE);
+}
+
 static int ip6_pkt_discard_out(struct sk_buff *skb)
 {
         skb->dev = skb->dst->dev;
         return ip6_pkt_discard(skb);
 }
 
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+
+static int ip6_pkt_prohibit(struct sk_buff *skb)
+{
+        return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED);
+}
+
+static int ip6_pkt_prohibit_out(struct sk_buff *skb)
+{
+        skb->dev = skb->dst->dev;
+        return ip6_pkt_prohibit(skb);
+}
+
+static int ip6_pkt_blk_hole(struct sk_buff *skb)
+{
+        kfree_skb(skb);
+        return 0;
+}
+
+#endif
+
 /*
  *      Allocate a dst for local (unicast / anycast) address.
  */
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 836eecd7e62b..b481a4d780c2 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -850,3 +850,7 @@ int __init sit_init(void)
         inet_del_protocol(&sit_protocol, IPPROTO_IPV6);
         goto out;
 }
+
+module_init(sit_init);
+module_exit(sit_cleanup);
+MODULE_LICENSE("GPL");
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 2546fc9f0a78..4c2a7c0cafef 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -329,7 +329,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         }
 
         if (sk->sk_state == TCP_TIME_WAIT) {
-                inet_twsk_put((struct inet_timewait_sock *)sk);
+                inet_twsk_put(inet_twsk(sk));
                 return;
         }
 
@@ -653,7 +653,7 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
         int tot_len = sizeof(struct tcphdr);
 
         if (ts)
-                tot_len += 3*4;
+                tot_len += TCPOLEN_TSTAMP_ALIGNED;
 
         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
                          GFP_ATOMIC);
@@ -749,7 +749,7 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
                         bh_lock_sock(nsk);
                         return nsk;
                 }
-                inet_twsk_put((struct inet_timewait_sock *)nsk);
+                inet_twsk_put(inet_twsk(nsk));
                 return NULL;
         }
 
@@ -1237,7 +1237,7 @@ process:
 
         skb->dev = NULL;
 
-        bh_lock_sock(sk);
+        bh_lock_sock_nested(sk);
         ret = 0;
         if (!sock_owned_by_user(sk)) {
 #ifdef CONFIG_NET_DMA
@@ -1283,18 +1283,17 @@ discard_and_relse:
 
 do_time_wait:
         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                inet_twsk_put((struct inet_timewait_sock *)sk);
+                inet_twsk_put(inet_twsk(sk));
                 goto discard_it;
         }
 
         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
-                inet_twsk_put((struct inet_timewait_sock *)sk);
+                inet_twsk_put(inet_twsk(sk));
                 goto discard_it;
         }
 
-        switch (tcp_timewait_state_process((struct inet_timewait_sock *)sk,
-                                           skb, th)) {
+        switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
         case TCP_TW_SYN:
         {
                 struct sock *sk2;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 9662561701d1..e0c3934a7e4b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -546,7 +546,7 @@ static int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         struct in6_addr *daddr, *final_p = NULL, final;
         struct ipv6_txoptions *opt = NULL;
         struct ip6_flowlabel *flowlabel = NULL;
-        struct flowi *fl = &inet->cork.fl;
+        struct flowi fl;
         struct dst_entry *dst;
         int addr_len = msg->msg_namelen;
         int ulen = len;
@@ -626,19 +626,19 @@ do_udp_sendmsg:
         }
         ulen += sizeof(struct udphdr);
 
-        memset(fl, 0, sizeof(*fl));
+        memset(&fl, 0, sizeof(fl));
 
         if (sin6) {
                 if (sin6->sin6_port == 0)
                         return -EINVAL;
 
-                fl->fl_ip_dport = sin6->sin6_port;
+                fl.fl_ip_dport = sin6->sin6_port;
                 daddr = &sin6->sin6_addr;
 
                 if (np->sndflow) {
-                        fl->fl6_flowlabel = sin6->sin6_flowinfo&IPV6_FLOWINFO_MASK;
-                        if (fl->fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
-                                flowlabel = fl6_sock_lookup(sk, fl->fl6_flowlabel);
+                        fl.fl6_flowlabel = sin6->sin6_flowinfo&IPV6_FLOWINFO_MASK;
+                        if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
+                                flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
                                 if (flowlabel == NULL)
                                         return -EINVAL;
                                 daddr = &flowlabel->dst;
@@ -656,32 +656,32 @@ do_udp_sendmsg:
                 if (addr_len >= sizeof(struct sockaddr_in6) &&
                     sin6->sin6_scope_id &&
                     ipv6_addr_type(daddr)&IPV6_ADDR_LINKLOCAL)
-                        fl->oif = sin6->sin6_scope_id;
+                        fl.oif = sin6->sin6_scope_id;
         } else {
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -EDESTADDRREQ;
 
-                fl->fl_ip_dport = inet->dport;
+                fl.fl_ip_dport = inet->dport;
                 daddr = &np->daddr;
-                fl->fl6_flowlabel = np->flow_label;
+                fl.fl6_flowlabel = np->flow_label;
                 connected = 1;
         }
 
-        if (!fl->oif)
-                fl->oif = sk->sk_bound_dev_if;
+        if (!fl.oif)
+                fl.oif = sk->sk_bound_dev_if;
 
         if (msg->msg_controllen) {
                 opt = &opt_space;
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(*opt);
 
-                err = datagram_send_ctl(msg, fl, opt, &hlimit, &tclass);
+                err = datagram_send_ctl(msg, &fl, opt, &hlimit, &tclass);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
                 }
-                if ((fl->fl6_flowlabel&IPV6_FLOWLABEL_MASK) && !flowlabel) {
-                        flowlabel = fl6_sock_lookup(sk, fl->fl6_flowlabel);
+                if ((fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) && !flowlabel) {
+                        flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
                         if (flowlabel == NULL)
                                 return -EINVAL;
                 }
@@ -695,39 +695,39 @@ do_udp_sendmsg:
                 opt = fl6_merge_options(&opt_space, flowlabel, opt);
         opt = ipv6_fixup_options(&opt_space, opt);
 
-        fl->proto = IPPROTO_UDP;
-        ipv6_addr_copy(&fl->fl6_dst, daddr);
-        if (ipv6_addr_any(&fl->fl6_src) && !ipv6_addr_any(&np->saddr))
-                ipv6_addr_copy(&fl->fl6_src, &np->saddr);
-        fl->fl_ip_sport = inet->sport;
+        fl.proto = IPPROTO_UDP;
+        ipv6_addr_copy(&fl.fl6_dst, daddr);
+        if (ipv6_addr_any(&fl.fl6_src) && !ipv6_addr_any(&np->saddr))
+                ipv6_addr_copy(&fl.fl6_src, &np->saddr);
+        fl.fl_ip_sport = inet->sport;
         
         /* merge ip6_build_xmit from ip6_output */
         if (opt && opt->srcrt) {
                 struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
-                ipv6_addr_copy(&final, &fl->fl6_dst);
-                ipv6_addr_copy(&fl->fl6_dst, rt0->addr);
+                ipv6_addr_copy(&final, &fl.fl6_dst);
+                ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
                 final_p = &final;
                 connected = 0;
         }
 
-        if (!fl->oif && ipv6_addr_is_multicast(&fl->fl6_dst)) {
-                fl->oif = np->mcast_oif;
+        if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst)) {
+                fl.oif = np->mcast_oif;
                 connected = 0;
         }
 
-        security_sk_classify_flow(sk, fl);
+        security_sk_classify_flow(sk, &fl);
 
-        err = ip6_sk_dst_lookup(sk, &dst, fl);
+        err = ip6_sk_dst_lookup(sk, &dst, &fl);
         if (err)
                 goto out;
         if (final_p)
-                ipv6_addr_copy(&fl->fl6_dst, final_p);
+                ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-        if ((err = xfrm_lookup(&dst, fl, sk, 0)) < 0)
+        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
                 goto out;
 
         if (hlimit < 0) {
-                if (ipv6_addr_is_multicast(&fl->fl6_dst))
+                if (ipv6_addr_is_multicast(&fl.fl6_dst))
                         hlimit = np->mcast_hops;
                 else
                         hlimit = np->hop_limit;
@@ -763,21 +763,23 @@ back_from_confirm:
 do_append_data:
         up->len += ulen;
         err = ip6_append_data(sk, ip_generic_getfrag, msg->msg_iov, ulen,
-                sizeof(struct udphdr), hlimit, tclass, opt, fl,
+                sizeof(struct udphdr), hlimit, tclass, opt, &fl,
                 (struct rt6_info*)dst,
                 corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags);
         if (err)
                 udp_v6_flush_pending_frames(sk);
         else if (!corkreq)
                 err = udp_v6_push_pending_frames(sk, up);
+        else if (unlikely(skb_queue_empty(&sk->sk_write_queue)))
+                up->pending = 0;
 
         if (dst) {
                 if (connected) {
                         ip6_dst_store(sk, dst,
-                                      ipv6_addr_equal(&fl->fl6_dst, &np->daddr) ?
+                                      ipv6_addr_equal(&fl.fl6_dst, &np->daddr) ?
                                       &np->daddr : NULL,
 #ifdef CONFIG_IPV6_SUBTREES
-                                      ipv6_addr_equal(&fl->fl6_src, &np->saddr) ?
+                                      ipv6_addr_equal(&fl.fl6_src, &np->saddr) ?
                                       &np->saddr :
 #endif
                                       NULL);
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index a40a05789013..5c8b7a568800 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -16,10 +16,10 @@
 #include <net/ipv6.h>
 #include <net/xfrm.h>
 
-int xfrm6_rcv_spi(struct sk_buff *skb, u32 spi)
+int xfrm6_rcv_spi(struct sk_buff *skb, __be32 spi)
 {
         int err;
-        u32 seq;
+        __be32 seq;
         struct xfrm_state *xfrm_vec[XFRM_MAX_DEPTH];
         struct xfrm_state *x;
         int xfrm_nr = 0;
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
new file mode 100644
index 000000000000..edcfffa9e87b
--- /dev/null
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -0,0 +1,107 @@
+/*
+ * xfrm6_mode_beet.c - BEET mode encapsulation for IPv6.
+ *
+ * Copyright (c) 2006 Diego Beltrami <diego.beltrami@gmail.com>
+ *                    Miika Komu     <miika@iki.fi>
+ *                    Herbert Xu     <herbert@gondor.apana.org.au>
+ *                    Abhinav Pathak <abhinav.pathak@hiit.fi>
+ *                    Jeff Ahrenholz <ahrenholz@gmail.com>
+ */
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/stringify.h>
+#include <net/dsfield.h>
+#include <net/dst.h>
+#include <net/inet_ecn.h>
+#include <net/ipv6.h>
+#include <net/xfrm.h>
+
+/* Add encapsulation header.
+ *
+ * The top IP header will be constructed per draft-nikander-esp-beet-mode-06.txt.
+ * The following fields in it shall be filled in by x->type->output:
+ *      payload_len
+ *
+ * On exit, skb->h will be set to the start of the encapsulation header to be
+ * filled in by x->type->output and skb->nh will be set to the nextheader field
+ * of the extension header directly preceding the encapsulation header, or in
+ * its absence, that of the top IP header.  The value of skb->data will always
+ * point to the top IP header.
+ */
+static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
+{
+        struct ipv6hdr *iph, *top_iph;
+        u8 *prevhdr;
+        int hdr_len;
+
+        skb_push(skb, x->props.header_len);
+        iph = skb->nh.ipv6h;
+
+        hdr_len = ip6_find_1stfragopt(skb, &prevhdr);
+        skb->nh.raw = prevhdr - x->props.header_len;
+        skb->h.raw = skb->data + hdr_len;
+        memmove(skb->data, iph, hdr_len);
+
+        skb->nh.raw = skb->data;
+        top_iph = skb->nh.ipv6h;
+        skb->nh.raw = &top_iph->nexthdr;
+        skb->h.ipv6h = top_iph + 1;
+
+        ipv6_addr_copy(&top_iph->saddr, (struct in6_addr *)&x->props.saddr);
+        ipv6_addr_copy(&top_iph->daddr, (struct in6_addr *)&x->id.daddr);
+
+        return 0;
+}
+
+static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
+{
+        struct ipv6hdr *ip6h;
+        int size = sizeof(struct ipv6hdr);
+        int err = -EINVAL;
+
+        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
+                goto out;
+
+        skb_push(skb, size);
+        memmove(skb->data, skb->nh.raw, size);
+        skb->nh.raw = skb->data;
+
+        skb->mac.raw = memmove(skb->data - skb->mac_len,
+                               skb->mac.raw, skb->mac_len);
+
+        ip6h = skb->nh.ipv6h;
+        ip6h->payload_len = htons(skb->len - size);
+        ipv6_addr_copy(&ip6h->daddr, (struct in6_addr *) &x->sel.daddr.a6);
+        ipv6_addr_copy(&ip6h->saddr, (struct in6_addr *) &x->sel.saddr.a6);
+        err = 0;
+out:
+        return err;
+}
+
+static struct xfrm_mode xfrm6_beet_mode = {
+        .input = xfrm6_beet_input,
+        .output = xfrm6_beet_output,
+        .owner = THIS_MODULE,
+        .encap = XFRM_MODE_BEET,
+};
+
+static int __init xfrm6_beet_init(void)
+{
+        return xfrm_register_mode(&xfrm6_beet_mode, AF_INET6);
+}
+
+static void __exit xfrm6_beet_exit(void)
+{
+        int err;
+
+        err = xfrm_unregister_mode(&xfrm6_beet_mode, AF_INET6);
+        BUG_ON(err);
+}
+
+module_init(xfrm6_beet_init);
+module_exit(xfrm6_beet_exit);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_XFRM_MODE(AF_INET6, XFRM_MODE_BEET);
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 6a252e2134d1..d400f8fae129 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -25,12 +25,14 @@
 static struct dst_ops xfrm6_dst_ops;
 static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
 
-static int xfrm6_dst_lookup(struct xfrm_dst **dst, struct flowi *fl)
+static int xfrm6_dst_lookup(struct xfrm_dst **xdst, struct flowi *fl)
 {
-        int err = 0;
-        *dst = (struct xfrm_dst*)ip6_route_output(NULL, fl);
-        if (!*dst)
-                err = -ENETUNREACH;
+        struct dst_entry *dst = ip6_route_output(NULL, fl);
+        int err = dst->error;
+        if (!err)
+                *xdst = (struct xfrm_dst *) dst;
+        else
+                dst_release(dst);
         return err;
 }
 
@@ -73,7 +75,7 @@ __xfrm6_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
                                  xdst->u.rt6.rt6i_src.plen);
                 if (ipv6_addr_equal(&xdst->u.rt6.rt6i_dst.addr, &fl_dst_prefix) &&
                     ipv6_addr_equal(&xdst->u.rt6.rt6i_src.addr, &fl_src_prefix) &&
-                    xfrm_bundle_ok(xdst, fl, AF_INET6,
+                    xfrm_bundle_ok(policy, xdst, fl, AF_INET6,
                                    (xdst->u.rt6.rt6i_dst.plen != 128 ||
                                     xdst->u.rt6.rt6i_src.plen != 128))) {
                         dst_clone(dst);
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index 711bfafb2472..9ddaa9d41539 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -29,9 +29,9 @@ __xfrm6_init_tempsel(struct xfrm_state *x, struct flowi *fl,
         ipv6_addr_copy((struct in6_addr *)&x->sel.daddr, &fl->fl6_dst);
         ipv6_addr_copy((struct in6_addr *)&x->sel.saddr, &fl->fl6_src);
         x->sel.dport = xfrm_flowi_dport(fl);
-        x->sel.dport_mask = ~0;
+        x->sel.dport_mask = htons(0xffff);
         x->sel.sport = xfrm_flowi_sport(fl);
-        x->sel.sport_mask = ~0;
+        x->sel.sport_mask = htons(0xffff);
         x->sel.prefixlen_d = 128;
         x->sel.prefixlen_s = 128;
         x->sel.proto = fl->proto;
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 59685ee8f700..7af227bb1551 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -258,7 +258,7 @@ static int xfrm6_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_tunnel_rcv(struct sk_buff *skb)
 {
         struct ipv6hdr *iph = skb->nh.ipv6h;
-        u32 spi;
+        __be32 spi;
 
         spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&iph->saddr);
         return xfrm6_rcv_spi(skb, spi);
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 17699eeb64d7..7e1aea89ef05 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -132,13 +132,14 @@ static void irda_disconnect_indication(void *instance, void *sap,
 
         /* Prevent race conditions with irda_release() and irda_shutdown() */
         if (!sock_flag(sk, SOCK_DEAD) && sk->sk_state != TCP_CLOSE) {
+                lock_sock(sk);
                 sk->sk_state     = TCP_CLOSE;
                 sk->sk_err       = ECONNRESET;
                 sk->sk_shutdown |= SEND_SHUTDOWN;
 
                 sk->sk_state_change(sk);
-                /* Uh-oh... Should use sock_orphan ? */
-                sock_set_flag(sk, SOCK_DEAD);
+                sock_orphan(sk);
+                release_sock(sk);
 
                 /* Close our TSAP.
                  * If we leave it open, IrLMP put it back into the list of
@@ -308,7 +309,8 @@ static void irda_connect_response(struct irda_sock *self)
 
         IRDA_ASSERT(self != NULL, return;);
 
-        skb = alloc_skb(64, GFP_ATOMIC);
+        skb = alloc_skb(TTP_MAX_HEADER + TTP_SAR_HEADER,
+                        GFP_ATOMIC);
         if (skb == NULL) {
                 IRDA_DEBUG(0, "%s() Unable to allocate sk_buff!\n",
                            __FUNCTION__);
@@ -1212,6 +1214,7 @@ static int irda_release(struct socket *sock)
         if (sk == NULL)
                 return 0;
 
+        lock_sock(sk);
         sk->sk_state       = TCP_CLOSE;
         sk->sk_shutdown   |= SEND_SHUTDOWN;
         sk->sk_state_change(sk);
@@ -1221,6 +1224,7 @@ static int irda_release(struct socket *sock)
 
         sock_orphan(sk);
         sock->sk   = NULL;
+        release_sock(sk);
 
         /* Purge queues (see sock_init_data()) */
         skb_queue_purge(&sk->sk_receive_queue);
@@ -1353,6 +1357,7 @@ static int irda_recvmsg_dgram(struct kiocb *iocb, struct socket *sock,
         IRDA_DEBUG(4, "%s()\n", __FUNCTION__);
 
         IRDA_ASSERT(self != NULL, return -1;);
+        IRDA_ASSERT(!sock_error(sk), return -1;);
 
         skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                 flags & MSG_DONTWAIT, &err);
@@ -1405,6 +1410,7 @@ static int irda_recvmsg_stream(struct kiocb *iocb, struct socket *sock,
         IRDA_DEBUG(3, "%s()\n", __FUNCTION__);
 
         IRDA_ASSERT(self != NULL, return -1;);
+        IRDA_ASSERT(!sock_error(sk), return -1;);
 
         if (sock->flags & __SO_ACCEPTCON)
                 return(-EINVAL);
diff --git a/net/irda/ircomm/ircomm_lmp.c b/net/irda/ircomm/ircomm_lmp.c
index 959874b6451f..c8e0d89ee11f 100644
--- a/net/irda/ircomm/ircomm_lmp.c
+++ b/net/irda/ircomm/ircomm_lmp.c
@@ -81,7 +81,7 @@ static int ircomm_lmp_connect_response(struct ircomm_cb *self,
         
         /* Any userdata supplied? */
         if (userdata == NULL) {
-                tx_skb = alloc_skb(64, GFP_ATOMIC);
+                tx_skb = alloc_skb(LMP_MAX_HEADER, GFP_ATOMIC);
                 if (!tx_skb)
                         return -ENOMEM;
 
@@ -115,7 +115,7 @@ static int ircomm_lmp_disconnect_request(struct ircomm_cb *self,
         IRDA_DEBUG(0, "%s()\n", __FUNCTION__ );
 
         if (!userdata) {
-                tx_skb = alloc_skb(64, GFP_ATOMIC);
+                tx_skb = alloc_skb(LMP_MAX_HEADER, GFP_ATOMIC);
                 if (!tx_skb)
                         return -ENOMEM;
                 
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index 3bcdb467efc5..d50a02030ad7 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -79,7 +79,7 @@ static struct tty_driver *driver;
 
 hashbin_t *ircomm_tty = NULL;
 
-static struct tty_operations ops = {
+static const struct tty_operations ops = {
         .open            = ircomm_tty_open,
         .close           = ircomm_tty_close,
         .write           = ircomm_tty_write,
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index 61128aa05b40..415cf4eec23b 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -345,10 +345,11 @@ static void iriap_disconnect_request(struct iriap_cb *self)
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == IAS_MAGIC, return;);
 
-        tx_skb = alloc_skb(64, GFP_ATOMIC);
+        tx_skb = alloc_skb(LMP_MAX_HEADER, GFP_ATOMIC);
         if (tx_skb == NULL) {
-                IRDA_DEBUG(0, "%s(), Could not allocate an sk_buff of length %d\n", 
-                        __FUNCTION__, 64);
+                IRDA_DEBUG(0,
+                           "%s(), Could not allocate an sk_buff of length %d\n",
+                           __FUNCTION__, LMP_MAX_HEADER);
                 return;
         }
 
@@ -701,7 +702,7 @@ void iriap_send_ack(struct iriap_cb *self)
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == IAS_MAGIC, return;);
 
-        tx_skb = alloc_skb(64, GFP_ATOMIC);
+        tx_skb = alloc_skb(LMP_MAX_HEADER + 1, GFP_ATOMIC);
         if (!tx_skb)
                 return;
 
diff --git a/net/irda/iriap_event.c b/net/irda/iriap_event.c
index da17395df05a..99b18dc7a0b7 100644
--- a/net/irda/iriap_event.c
+++ b/net/irda/iriap_event.c
@@ -365,7 +365,7 @@ static void state_r_disconnect(struct iriap_cb *self, IRIAP_EVENT event,
 
         switch (event) {
         case IAP_LM_CONNECT_INDICATION:
-                tx_skb = alloc_skb(64, GFP_ATOMIC);
+                tx_skb = alloc_skb(LMP_MAX_HEADER, GFP_ATOMIC);
                 if (tx_skb == NULL) {
                         IRDA_WARNING("%s: unable to malloc!\n", __FUNCTION__);
                         return;
diff --git a/net/irda/irias_object.c b/net/irda/irias_object.c
index a154b1d71c0f..56292ab7d652 100644
--- a/net/irda/irias_object.c
+++ b/net/irda/irias_object.c
@@ -43,7 +43,7 @@ struct ias_value irias_missing = { IAS_MISSING, 0, 0, 0, {0}};
  *
  * Faster, check boundary... Jean II
  */
-static char *strndup(char *str, int max)
+static char *strndup(char *str, size_t max)
 {
         char *new_str;
         int len;
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index 7dd0a2fe1d20..9b962f247714 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -636,7 +636,8 @@ void irlan_get_provider_info(struct irlan_cb *self)
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);
 
-        skb = alloc_skb(64, GFP_ATOMIC);
+        skb = alloc_skb(IRLAN_MAX_HEADER + IRLAN_CMD_HEADER,
+                        GFP_ATOMIC);
         if (!skb)
                 return;
 
@@ -668,7 +669,10 @@ void irlan_open_data_channel(struct irlan_cb *self)
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);
         
-        skb = alloc_skb(64, GFP_ATOMIC);
+        skb = alloc_skb(IRLAN_MAX_HEADER + IRLAN_CMD_HEADER +
+                        IRLAN_STRING_PARAMETER_LEN("MEDIA", "802.3") +
+                        IRLAN_STRING_PARAMETER_LEN("ACCESS_TYPE", "DIRECT"),
+                        GFP_ATOMIC);
         if (!skb)
                 return;
 
@@ -704,7 +708,9 @@ void irlan_close_data_channel(struct irlan_cb *self)
         if (self->client.tsap_ctrl == NULL)
                 return;
 
-        skb = alloc_skb(64, GFP_ATOMIC);
+        skb = alloc_skb(IRLAN_MAX_HEADER + IRLAN_CMD_HEADER +
+                        IRLAN_BYTE_PARAMETER_LEN("DATA_CHAN"),
+                        GFP_ATOMIC);
         if (!skb)
                 return;
 
@@ -715,7 +721,7 @@ void irlan_close_data_channel(struct irlan_cb *self)
         
         /* Build frame */
         frame[0] = CMD_CLOSE_DATA_CHAN;
-        frame[1] = 0x01; /* Two parameters */
+        frame[1] = 0x01; /* One parameter */
 
         irlan_insert_byte_param(skb, "DATA_CHAN", self->dtsap_sel_data);
 
@@ -739,7 +745,11 @@ static void irlan_open_unicast_addr(struct irlan_cb *self)
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);       
         
-        skb = alloc_skb(128, GFP_ATOMIC);
+        skb = alloc_skb(IRLAN_MAX_HEADER + IRLAN_CMD_HEADER +
+                        IRLAN_BYTE_PARAMETER_LEN("DATA_CHAN") +
+                        IRLAN_STRING_PARAMETER_LEN("FILTER_TYPE", "DIRECTED") +
+                        IRLAN_STRING_PARAMETER_LEN("FILTER_MODE", "FILTER"),
+                        GFP_ATOMIC);
         if (!skb)
                 return;
 
@@ -777,7 +787,12 @@ void irlan_set_broadcast_filter(struct irlan_cb *self, int status)
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);
         
-        skb = alloc_skb(128, GFP_ATOMIC);
+        skb = alloc_skb(IRLAN_MAX_HEADER + IRLAN_CMD_HEADER +
+                        IRLAN_BYTE_PARAMETER_LEN("DATA_CHAN") +
+                        IRLAN_STRING_PARAMETER_LEN("FILTER_TYPE", "BROADCAST") +
+                        /* We may waste one byte here...*/
+                        IRLAN_STRING_PARAMETER_LEN("FILTER_MODE", "FILTER"),
+                        GFP_ATOMIC);
         if (!skb)
                 return;
 
@@ -816,7 +831,12 @@ void irlan_set_multicast_filter(struct irlan_cb *self, int status)
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);
 
-        skb = alloc_skb(128, GFP_ATOMIC);
+        skb = alloc_skb(IRLAN_MAX_HEADER + IRLAN_CMD_HEADER +
+                        IRLAN_BYTE_PARAMETER_LEN("DATA_CHAN") +
+                        IRLAN_STRING_PARAMETER_LEN("FILTER_TYPE", "MULTICAST") +
+                        /* We may waste one byte here...*/
+                        IRLAN_STRING_PARAMETER_LEN("FILTER_MODE", "NONE"),
+                        GFP_ATOMIC);
         if (!skb)
                 return;
         
@@ -856,7 +876,12 @@ static void irlan_get_unicast_addr(struct irlan_cb *self)
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);
         
-        skb = alloc_skb(128, GFP_ATOMIC);
+        skb = alloc_skb(IRLAN_MAX_HEADER + IRLAN_CMD_HEADER +
+                        IRLAN_BYTE_PARAMETER_LEN("DATA_CHAN") +
+                        IRLAN_STRING_PARAMETER_LEN("FILTER_TYPE", "DIRECTED") +
+                        IRLAN_STRING_PARAMETER_LEN("FILTER_OPERATION",
+                                                   "DYNAMIC"),
+                        GFP_ATOMIC);
         if (!skb)
                 return;
 
@@ -891,7 +916,10 @@ void irlan_get_media_char(struct irlan_cb *self)
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);
         
-        skb = alloc_skb(64, GFP_ATOMIC);
+        skb = alloc_skb(IRLAN_MAX_HEADER + IRLAN_CMD_HEADER +
+                        IRLAN_STRING_PARAMETER_LEN("MEDIA", "802.3"),
+                        GFP_ATOMIC);
+
         if (!skb)
                 return;
 
diff --git a/net/irda/irlan/irlan_provider.c b/net/irda/irlan/irlan_provider.c
index 9c0df86044d7..58efde919667 100644
--- a/net/irda/irlan/irlan_provider.c
+++ b/net/irda/irlan/irlan_provider.c
@@ -296,7 +296,14 @@ void irlan_provider_send_reply(struct irlan_cb *self, int command,
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == IRLAN_MAGIC, return;);
 
-        skb = alloc_skb(128, GFP_ATOMIC);
+        skb = alloc_skb(IRLAN_MAX_HEADER + IRLAN_CMD_HEADER +
+                        /* Bigger param length comes from CMD_GET_MEDIA_CHAR */
+                        IRLAN_STRING_PARAMETER_LEN("FILTER_TYPE", "DIRECTED") +
+                        IRLAN_STRING_PARAMETER_LEN("FILTER_TYPE", "BORADCAST") +
+                        IRLAN_STRING_PARAMETER_LEN("FILTER_TYPE", "MULTICAST") +
+                        IRLAN_STRING_PARAMETER_LEN("ACCESS_TYPE", "HOSTED"),
+                        GFP_ATOMIC);
+
         if (!skb)
                 return;
 
@@ -354,8 +361,7 @@ void irlan_provider_send_reply(struct irlan_cb *self, int command,
                 } else
                         skb->data[1] = 0x02; /* 2 parameters */
                 irlan_insert_byte_param(skb, "DATA_CHAN", self->stsap_sel_data);
-                irlan_insert_array_param(skb, "RECONNECT_KEY", "LINUX RULES!",
-                                         12);
+                irlan_insert_string_param(skb, "RECONNECT_KEY", "LINUX RULES!");
                 break;
         case CMD_FILTER_OPERATION:
                 irlan_filter_request(self, skb);
diff --git a/net/irda/irlap_frame.c b/net/irda/irlap_frame.c
index ccb983bf0f4a..dba349c832d0 100644
--- a/net/irda/irlap_frame.c
+++ b/net/irda/irlap_frame.c
@@ -117,7 +117,9 @@ void irlap_send_snrm_frame(struct irlap_cb *self, struct qos_info *qos)
         IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
 
         /* Allocate frame */
-        tx_skb = alloc_skb(64, GFP_ATOMIC);
+        tx_skb = alloc_skb(sizeof(struct snrm_frame) +
+                           IRLAP_NEGOCIATION_PARAMS_LEN,
+                           GFP_ATOMIC);
         if (!tx_skb)
                 return;
 
@@ -136,7 +138,7 @@ void irlap_send_snrm_frame(struct irlap_cb *self, struct qos_info *qos)
          *  If we are establishing a connection then insert QoS paramerters
          */
         if (qos) {
-                skb_put(tx_skb, 9); /* 21 left */
+                skb_put(tx_skb, 9); /* 25 left */
                 frame->saddr = cpu_to_le32(self->saddr);
                 frame->daddr = cpu_to_le32(self->daddr);
 
@@ -210,7 +212,9 @@ void irlap_send_ua_response_frame(struct irlap_cb *self, struct qos_info *qos)
         IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
 
         /* Allocate frame */
-        tx_skb = alloc_skb(64, GFP_ATOMIC);
+        tx_skb = alloc_skb(sizeof(struct ua_frame) +
+                           IRLAP_NEGOCIATION_PARAMS_LEN,
+                           GFP_ATOMIC);
         if (!tx_skb)
                 return;
 
@@ -245,23 +249,23 @@ void irlap_send_ua_response_frame(struct irlap_cb *self, struct qos_info *qos)
 void irlap_send_dm_frame( struct irlap_cb *self)
 {
         struct sk_buff *tx_skb = NULL;
-        __u8 *frame;
+        struct dm_frame *frame;
 
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
 
-        tx_skb = alloc_skb(32, GFP_ATOMIC);
+        tx_skb = alloc_skb(sizeof(struct dm_frame), GFP_ATOMIC);
         if (!tx_skb)
                 return;
 
-        frame = skb_put(tx_skb, 2);
+        frame = (struct dm_frame *)skb_put(tx_skb, 2);
 
         if (self->state == LAP_NDM)
-                frame[0] = CBROADCAST;
+                frame->caddr = CBROADCAST;
         else
-                frame[0] = self->caddr;
+                frame->caddr = self->caddr;
 
-        frame[1] = DM_RSP | PF_BIT;
+        frame->control = DM_RSP | PF_BIT;
 
         irlap_queue_xmit(self, tx_skb);
 }
@@ -275,21 +279,21 @@ void irlap_send_dm_frame( struct irlap_cb *self)
 void irlap_send_disc_frame(struct irlap_cb *self)
 {
         struct sk_buff *tx_skb = NULL;
-        __u8 *frame;
+        struct disc_frame *frame;
 
         IRDA_DEBUG(3, "%s()\n", __FUNCTION__);
 
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
 
-        tx_skb = alloc_skb(16, GFP_ATOMIC);
+        tx_skb = alloc_skb(sizeof(struct disc_frame), GFP_ATOMIC);
         if (!tx_skb)
                 return;
 
-        frame = skb_put(tx_skb, 2);
+        frame = (struct disc_frame *)skb_put(tx_skb, 2);
 
-        frame[0] = self->caddr | CMD_FRAME;
-        frame[1] = DISC_CMD | PF_BIT;
+        frame->caddr = self->caddr | CMD_FRAME;
+        frame->control = DISC_CMD | PF_BIT;
 
         irlap_queue_xmit(self, tx_skb);
 }
@@ -315,7 +319,8 @@ void irlap_send_discovery_xid_frame(struct irlap_cb *self, int S, __u8 s,
         IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
         IRDA_ASSERT(discovery != NULL, return;);
 
-        tx_skb = alloc_skb(64, GFP_ATOMIC);
+        tx_skb = alloc_skb(sizeof(struct xid_frame) + IRLAP_DISCOVERY_INFO_LEN,
+                           GFP_ATOMIC);
         if (!tx_skb)
                 return;
 
@@ -573,18 +578,18 @@ static void irlap_recv_discovery_xid_cmd(struct irlap_cb *self,
 void irlap_send_rr_frame(struct irlap_cb *self, int command)
 {
         struct sk_buff *tx_skb;
-        __u8 *frame;
+        struct rr_frame *frame;
 
-        tx_skb = alloc_skb(16, GFP_ATOMIC);
+        tx_skb = alloc_skb(sizeof(struct rr_frame), GFP_ATOMIC);
         if (!tx_skb)
                 return;
 
-        frame = skb_put(tx_skb, 2);
+        frame = (struct rr_frame *)skb_put(tx_skb, 2);
 
-        frame[0] = self->caddr;
-        frame[0] |= (command) ? CMD_FRAME : 0;
+        frame->caddr = self->caddr;
+        frame->caddr |= (command) ? CMD_FRAME : 0;
 
-        frame[1] = RR | PF_BIT | (self->vr << 5);
+        frame->control = RR | PF_BIT | (self->vr << 5);
 
         irlap_queue_xmit(self, tx_skb);
 }
@@ -598,16 +603,16 @@ void irlap_send_rr_frame(struct irlap_cb *self, int command)
 void irlap_send_rd_frame(struct irlap_cb *self)
 {
         struct sk_buff *tx_skb;
-        __u8 *frame;
+        struct rd_frame *frame;
 
-        tx_skb = alloc_skb(16, GFP_ATOMIC);
+        tx_skb = alloc_skb(sizeof(struct rd_frame), GFP_ATOMIC);
         if (!tx_skb)
                 return;
 
-        frame = skb_put(tx_skb, 2);
+        frame = (struct rd_frame *)skb_put(tx_skb, 2);
 
-        frame[0] = self->caddr;
-        frame[1] = RD_RSP | PF_BIT;
+        frame->caddr = self->caddr;
+        frame->caddr = RD_RSP | PF_BIT;
 
         irlap_queue_xmit(self, tx_skb);
 }
@@ -1214,7 +1219,7 @@ void irlap_send_test_frame(struct irlap_cb *self, __u8 caddr, __u32 daddr,
         struct test_frame *frame;
         __u8 *info;
 
-        tx_skb = alloc_skb(cmd->len+sizeof(struct test_frame), GFP_ATOMIC);
+        tx_skb = alloc_skb(cmd->len + sizeof(struct test_frame), GFP_ATOMIC);
         if (!tx_skb)
                 return;
 
diff --git a/net/irda/irlmp.c b/net/irda/irlmp.c
index c440913dee14..5073261b9d0c 100644
--- a/net/irda/irlmp.c
+++ b/net/irda/irlmp.c
@@ -392,7 +392,7 @@ int irlmp_connect_request(struct lsap_cb *self, __u8 dlsap_sel,
 
         /* Any userdata? */
         if (tx_skb == NULL) {
-                tx_skb = alloc_skb(64, GFP_ATOMIC);
+                tx_skb = alloc_skb(LMP_MAX_HEADER, GFP_ATOMIC);
                 if (!tx_skb)
                         return -ENOMEM;
 
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index 42acf1cde737..3c2e70b77df1 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -804,12 +804,12 @@ static inline void irttp_give_credit(struct tsap_cb *self)
                    self->send_credit, self->avail_credit, self->remote_credit);
 
         /* Give credit to peer */
-        tx_skb = alloc_skb(64, GFP_ATOMIC);
+        tx_skb = alloc_skb(TTP_MAX_HEADER, GFP_ATOMIC);
         if (!tx_skb)
                 return;
 
         /* Reserve space for LMP, and LAP header */
-        skb_reserve(tx_skb, self->max_header_size);
+        skb_reserve(tx_skb, LMP_MAX_HEADER);
 
         /*
          *  Since we can transmit and receive frames concurrently,
@@ -1093,7 +1093,8 @@ int irttp_connect_request(struct tsap_cb *self, __u8 dtsap_sel,
 
         /* Any userdata supplied? */
         if (userdata == NULL) {
-                tx_skb = alloc_skb(64, GFP_ATOMIC);
+                tx_skb = alloc_skb(TTP_MAX_HEADER + TTP_SAR_HEADER,
+                                   GFP_ATOMIC);
                 if (!tx_skb)
                         return -ENOMEM;
 
@@ -1341,7 +1342,8 @@ int irttp_connect_response(struct tsap_cb *self, __u32 max_sdu_size,
 
         /* Any userdata supplied? */
         if (userdata == NULL) {
-                tx_skb = alloc_skb(64, GFP_ATOMIC);
+                tx_skb = alloc_skb(TTP_MAX_HEADER + TTP_SAR_HEADER,
+                                   GFP_ATOMIC);
                 if (!tx_skb)
                         return -ENOMEM;
 
@@ -1540,14 +1542,14 @@ int irttp_disconnect_request(struct tsap_cb *self, struct sk_buff *userdata,
 
         if (!userdata) {
                 struct sk_buff *tx_skb;
-                tx_skb = alloc_skb(64, GFP_ATOMIC);
+                tx_skb = alloc_skb(LMP_MAX_HEADER, GFP_ATOMIC);
                 if (!tx_skb)
                         return -ENOMEM;
 
                 /*
                  *  Reserve space for MUX and LAP header
                  */
-                skb_reserve(tx_skb, TTP_MAX_HEADER);
+                skb_reserve(tx_skb, LMP_MAX_HEADER);
 
                 userdata = tx_skb;
         }
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 83b443ddc72f..20ff7cca1d07 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2140,7 +2140,7 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
         xp->selector.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
         xp->selector.sport = ((struct sockaddr_in *)(sa+1))->sin_port;
         if (xp->selector.sport)
-                xp->selector.sport_mask = ~0;
+                xp->selector.sport_mask = htons(0xffff);
 
         sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1], 
         pfkey_sadb_addr2xfrm_addr(sa, &xp->selector.daddr);
@@ -2153,7 +2153,7 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
 
         xp->selector.dport = ((struct sockaddr_in *)(sa+1))->sin_port;
         if (xp->selector.dport)
-                xp->selector.dport_mask = ~0;
+                xp->selector.dport_mask = htons(0xffff);
 
         sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1];
         if (sec_ctx != NULL) {
@@ -2243,7 +2243,7 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
         sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
         sel.sport = ((struct sockaddr_in *)(sa+1))->sin_port;
         if (sel.sport)
-                sel.sport_mask = ~0;
+                sel.sport_mask = htons(0xffff);
 
         sa = ext_hdrs[SADB_EXT_ADDRESS_DST-1], 
         pfkey_sadb_addr2xfrm_addr(sa, &sel.daddr);
@@ -2251,7 +2251,7 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
         sel.proto = pfkey_proto_to_xfrm(sa->sadb_address_proto);
         sel.dport = ((struct sockaddr_in *)(sa+1))->sin_port;
         if (sel.dport)
-                sel.dport_mask = ~0;
+                sel.dport_mask = htons(0xffff);
 
         sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1];
         memset(&tmp, 0, sizeof(struct xfrm_policy));
@@ -2928,11 +2928,6 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
                 if (*dir)
                         goto out;
         }
-        else {
-                *dir = security_xfrm_sock_policy_alloc(xp, sk);
-                if (*dir)
-                        goto out;
-        }
 
         *dir = pol->sadb_x_policy_dir-1;
         return xp;
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 0a28d2c5c44f..f619c6527266 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -209,7 +209,9 @@ config NETFILTER_XT_TARGET_SECMARK
 
 config NETFILTER_XT_TARGET_CONNSECMARK
         tristate '"CONNSECMARK" target support'
-        depends on NETFILTER_XTABLES && (NF_CONNTRACK_SECMARK || IP_NF_CONNTRACK_SECMARK)
+        depends on NETFILTER_XTABLES && \
+                   ((NF_CONNTRACK && NF_CONNTRACK_SECMARK) || \
+                    (IP_NF_CONNTRACK && IP_NF_CONNTRACK_SECMARK))
         help
           The CONNSECMARK target copies security markings from packets
           to connections, and restores security markings from connections
@@ -365,7 +367,7 @@ config NETFILTER_XT_MATCH_MULTIPORT
 
 config NETFILTER_XT_MATCH_PHYSDEV
         tristate '"physdev" match support'
-        depends on NETFILTER_XTABLES && BRIDGE_NETFILTER
+        depends on NETFILTER_XTABLES && BRIDGE && BRIDGE_NETFILTER
         help
           Physdev packet matching matches against the physical bridge ports
           the IP packet arrived on or will leave by.
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 1721f7c78c77..bd0156a28ecd 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -47,13 +47,6 @@ MODULE_LICENSE("GPL");
 
 static char __initdata version[] = "0.93";
 
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
-
 static inline int
 ctnetlink_dump_tuples_proto(struct sk_buff *skb, 
                             const struct nf_conntrack_tuple *tuple,
@@ -410,7 +403,6 @@ static int ctnetlink_done(struct netlink_callback *cb)
 {
         if (cb->args[1])
                 nf_ct_put((struct nf_conn *)cb->args[1]);
-        DEBUGP("entered %s\n", __FUNCTION__);
         return 0;
 }
 
@@ -425,9 +417,6 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
         u_int8_t l3proto = nfmsg->nfgen_family;
 
-        DEBUGP("entered %s, last bucket=%lu id=%u\n", __FUNCTION__, 
-                        cb->args[0], *id);
-
         read_lock_bh(&nf_conntrack_lock);
         last = (struct nf_conn *)cb->args[1];
         for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
@@ -471,7 +460,6 @@ out:
         if (last)
                 nf_ct_put(last);
 
-        DEBUGP("leaving, last bucket=%lu id=%u\n", cb->args[0], *id);
         return skb->len;
 }
 
@@ -482,8 +470,6 @@ ctnetlink_parse_tuple_ip(struct nfattr *attr, struct nf_conntrack_tuple *tuple)
         struct nf_conntrack_l3proto *l3proto;
         int ret = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_IP_MAX, attr);
 
         l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
@@ -493,8 +479,6 @@ ctnetlink_parse_tuple_ip(struct nfattr *attr, struct nf_conntrack_tuple *tuple)
 
         nf_ct_l3proto_put(l3proto);
 
-        DEBUGP("leaving\n");
-
         return ret;
 }
 
@@ -510,8 +494,6 @@ ctnetlink_parse_tuple_proto(struct nfattr *attr,
         struct nf_conntrack_protocol *proto;
         int ret = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_PROTO_MAX, attr);
 
         if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
@@ -538,8 +520,6 @@ ctnetlink_parse_tuple(struct nfattr *cda[], struct nf_conntrack_tuple *tuple,
         struct nfattr *tb[CTA_TUPLE_MAX];
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         memset(tuple, 0, sizeof(*tuple));
 
         nfattr_parse_nested(tb, CTA_TUPLE_MAX, cda[type-1]);
@@ -566,10 +546,6 @@ ctnetlink_parse_tuple(struct nfattr *cda[], struct nf_conntrack_tuple *tuple,
         else
                 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
 
-        NF_CT_DUMP_TUPLE(tuple);
-
-        DEBUGP("leaving\n");
-
         return 0;
 }
 
@@ -586,8 +562,6 @@ static int ctnetlink_parse_nat_proto(struct nfattr *attr,
         struct nfattr *tb[CTA_PROTONAT_MAX];
         struct ip_nat_protocol *npt;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_PROTONAT_MAX, attr);
 
         if (nfattr_bad_size(tb, CTA_PROTONAT_MAX, cta_min_protonat))
@@ -606,7 +580,6 @@ static int ctnetlink_parse_nat_proto(struct nfattr *attr,
 
         ip_nat_proto_put(npt);
 
-        DEBUGP("leaving\n");
         return 0;
 }
 
@@ -622,8 +595,6 @@ ctnetlink_parse_nat(struct nfattr *nat,
         struct nfattr *tb[CTA_NAT_MAX];
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         memset(range, 0, sizeof(*range));
         
         nfattr_parse_nested(tb, CTA_NAT_MAX, nat);
@@ -649,7 +620,6 @@ ctnetlink_parse_nat(struct nfattr *nat,
         if (err < 0)
                 return err;
 
-        DEBUGP("leaving\n");
         return 0;
 }
 #endif
@@ -659,8 +629,6 @@ ctnetlink_parse_help(struct nfattr *attr, char **helper_name)
 {
         struct nfattr *tb[CTA_HELP_MAX];
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_HELP_MAX, attr);
 
         if (!tb[CTA_HELP_NAME-1])
@@ -690,8 +658,6 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
         u_int8_t u3 = nfmsg->nfgen_family;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nfattr_bad_size(cda, CTA_MAX, cta_min))
                 return -EINVAL;
 
@@ -709,10 +675,8 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 return err;
 
         h = nf_conntrack_find_get(&tuple, NULL);
-        if (!h) {
-                DEBUGP("tuple not found in conntrack hash\n");
+        if (!h)
                 return -ENOENT;
-        }
 
         ct = nf_ct_tuplehash_to_ctrack(h);
         
@@ -727,7 +691,6 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 ct->timeout.function((unsigned long)ct);
 
         nf_ct_put(ct);
-        DEBUGP("leaving\n");
 
         return 0;
 }
@@ -744,8 +707,6 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
         u_int8_t u3 = nfmsg->nfgen_family;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 u32 rlen;
 
@@ -779,11 +740,9 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 return err;
 
         h = nf_conntrack_find_get(&tuple, NULL);
-        if (!h) {
-                DEBUGP("tuple not found in conntrack hash");
+        if (!h)
                 return -ENOENT;
-        }
-        DEBUGP("tuple found\n");
+
         ct = nf_ct_tuplehash_to_ctrack(h);
 
         err = -ENOMEM;
@@ -804,7 +763,6 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
         if (err < 0)
                 goto out;
 
-        DEBUGP("leaving\n");
         return 0;
 
 free:
@@ -876,8 +834,6 @@ ctnetlink_change_helper(struct nf_conn *ct, struct nfattr *cda[])
         char *helpname;
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (!help) {
                 /* FIXME: we need to reallocate and rehash */
                 return -EBUSY;
@@ -954,8 +910,6 @@ ctnetlink_change_conntrack(struct nf_conn *ct, struct nfattr *cda[])
 {
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (cda[CTA_HELP-1]) {
                 err = ctnetlink_change_helper(ct, cda);
                 if (err < 0)
@@ -985,7 +939,6 @@ ctnetlink_change_conntrack(struct nf_conn *ct, struct nfattr *cda[])
                 ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
 #endif
 
-        DEBUGP("all done\n");
         return 0;
 }
 
@@ -997,8 +950,6 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
         struct nf_conn *ct;
         int err = -EINVAL;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         ct = nf_conntrack_alloc(otuple, rtuple);
         if (ct == NULL || IS_ERR(ct))
                 return -ENOMEM; 
@@ -1028,7 +979,6 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
         add_timer(&ct->timeout);
         nf_conntrack_hash_insert(ct);
 
-        DEBUGP("conntrack with id %u inserted\n", ct->id);
         return 0;
 
 err:    
@@ -1046,8 +996,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
         u_int8_t u3 = nfmsg->nfgen_family;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nfattr_bad_size(cda, CTA_MAX, cta_min))
                 return -EINVAL;
 
@@ -1071,7 +1019,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
 
         if (h == NULL) {
                 write_unlock_bh(&nf_conntrack_lock);
-                DEBUGP("no such conntrack, create new\n");
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE)
                         err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);
@@ -1087,7 +1034,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
 
         /* We manipulate the conntrack inside the global conntrack table lock,
          * so there's no need to increase the refcount */
-        DEBUGP("conntrack found\n");
         err = -EEXIST;
         if (!(nlh->nlmsg_flags & NLM_F_EXCL))
                 err = ctnetlink_change_conntrack(nf_ct_tuplehash_to_ctrack(h), cda);
@@ -1268,8 +1214,6 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
         u_int8_t l3proto = nfmsg->nfgen_family;
 
-        DEBUGP("entered %s, last id=%llu\n", __FUNCTION__, *id);
-
         read_lock_bh(&nf_conntrack_lock);
         list_for_each_prev(i, &nf_conntrack_expect_list) {
                 exp = (struct nf_conntrack_expect *) i;
@@ -1287,8 +1231,6 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 out:    
         read_unlock_bh(&nf_conntrack_lock);
 
-        DEBUGP("leaving, last id=%llu\n", *id);
-
         return skb->len;
 }
 
@@ -1308,8 +1250,6 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
         u_int8_t u3 = nfmsg->nfgen_family;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
                 return -EINVAL;
 
@@ -1460,8 +1400,6 @@ ctnetlink_create_expect(struct nfattr *cda[], u_int8_t u3)
         struct nf_conn_help *help;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         /* caller guarantees that those three CTA_EXPECT_* exist */
         err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
         if (err < 0)
@@ -1516,8 +1454,6 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
         u_int8_t u3 = nfmsg->nfgen_family;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);   
-
         if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
                 return -EINVAL;
 
@@ -1546,8 +1482,6 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
                 err = ctnetlink_change_expect(exp, cda);
         write_unlock_bh(&nf_conntrack_lock);
 
-        DEBUGP("leaving\n");
-        
         return err;
 }
 
diff --git a/net/netfilter/xt_NFQUEUE.c b/net/netfilter/xt_NFQUEUE.c
index db9b896e57c8..39e117502bd7 100644
--- a/net/netfilter/xt_NFQUEUE.c
+++ b/net/netfilter/xt_NFQUEUE.c
@@ -68,7 +68,7 @@ static int __init xt_nfqueue_init(void)
 
 static void __exit xt_nfqueue_fini(void)
 {
-        xt_register_targets(xt_nfqueue_target, ARRAY_SIZE(xt_nfqueue_target));
+        xt_unregister_targets(xt_nfqueue_target, ARRAY_SIZE(xt_nfqueue_target));
 }
 
 module_init(xt_nfqueue_init);
diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index 92a5726ef237..a8f03057dbde 100644
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -147,7 +147,7 @@ static int __init xt_connmark_init(void)
 
 static void __exit xt_connmark_fini(void)
 {
-        xt_register_matches(xt_connmark_match, ARRAY_SIZE(xt_connmark_match));
+        xt_unregister_matches(xt_connmark_match, ARRAY_SIZE(xt_connmark_match));
 }
 
 module_init(xt_connmark_init);
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index 4125a55f469f..a6ce1d6d5c59 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -32,6 +32,7 @@
 #include <linux/socket.h>
 #include <linux/string.h>
 #include <linux/skbuff.h>
+#include <linux/audit.h>
 #include <net/sock.h>
 #include <net/netlink.h>
 #include <net/genetlink.h>
@@ -162,8 +163,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info)
         int nla_a_rem;
         int nla_b_rem;
 
-        if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
-            !info->attrs[NLBL_CIPSOV4_A_TAGLST] ||
+        if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] ||
             !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST])
                 return -EINVAL;
 
@@ -344,8 +344,7 @@ static int netlbl_cipsov4_add_pass(struct genl_info *info)
         int ret_val;
         struct cipso_v4_doi *doi_def = NULL;
 
-        if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
-            !info->attrs[NLBL_CIPSOV4_A_TAGLST])
+        if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
                 return -EINVAL;
 
         doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
@@ -381,21 +380,40 @@ static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
 
 {
         int ret_val = -EINVAL;
-        u32 map_type;
+        u32 type;
+        u32 doi;
+        const char *type_str = "(unknown)";
+        struct audit_buffer *audit_buf;
+        struct netlbl_audit audit_info;
 
-        if (!info->attrs[NLBL_CIPSOV4_A_MTYPE])
+        if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
+            !info->attrs[NLBL_CIPSOV4_A_MTYPE])
                 return -EINVAL;
 
-        map_type = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE]);
-        switch (map_type) {
+        doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
+        netlbl_netlink_auditinfo(skb, &audit_info);
+
+        type = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE]);
+        switch (type) {
         case CIPSO_V4_MAP_STD:
+                type_str = "std";
                 ret_val = netlbl_cipsov4_add_std(info);
                 break;
         case CIPSO_V4_MAP_PASS:
+                type_str = "pass";
                 ret_val = netlbl_cipsov4_add_pass(info);
                 break;
         }
 
+        audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_ADD,
+                                              &audit_info);
+        audit_log_format(audit_buf,
+                         " cipso_doi=%u cipso_type=%s res=%u",
+                         doi,
+                         type_str,
+                         ret_val == 0 ? 1 : 0);
+        audit_log_end(audit_buf);
+
         return ret_val;
 }
 
@@ -653,12 +671,27 @@ static int netlbl_cipsov4_listall(struct sk_buff *skb,
 static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
 {
         int ret_val = -EINVAL;
-        u32 doi;
+        u32 doi = 0;
+        struct audit_buffer *audit_buf;
+        struct netlbl_audit audit_info;
 
-        if (info->attrs[NLBL_CIPSOV4_A_DOI]) {
-                doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
-                ret_val = cipso_v4_doi_remove(doi, netlbl_cipsov4_doi_free);
-        }
+        if (!info->attrs[NLBL_CIPSOV4_A_DOI])
+                return -EINVAL;
+
+        doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
+        netlbl_netlink_auditinfo(skb, &audit_info);
+
+        ret_val = cipso_v4_doi_remove(doi,
+                                      &audit_info,
+                                      netlbl_cipsov4_doi_free);
+
+        audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_DEL,
+                                              &audit_info);
+        audit_log_format(audit_buf,
+                         " cipso_doi=%u res=%u",
+                         doi,
+                         ret_val == 0 ? 1 : 0);
+        audit_log_end(audit_buf);
 
         return ret_val;
 }
diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
index f56d7a8ac7b7..af4371d3b459 100644
--- a/net/netlabel/netlabel_domainhash.c
+++ b/net/netlabel/netlabel_domainhash.c
@@ -35,12 +35,14 @@
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
 #include <linux/string.h>
+#include <linux/audit.h>
 #include <net/netlabel.h>
 #include <net/cipso_ipv4.h>
 #include <asm/bug.h>
 
 #include "netlabel_mgmt.h"
 #include "netlabel_domainhash.h"
+#include "netlabel_user.h"
 
 struct netlbl_domhsh_tbl {
         struct list_head *tbl;
@@ -186,6 +188,7 @@ int netlbl_domhsh_init(u32 size)
 /**
  * netlbl_domhsh_add - Adds a entry to the domain hash table
  * @entry: the entry to add
+ * @audit_info: NetLabel audit information
  *
  * Description:
  * Adds a new entry to the domain hash table and handles any updates to the
@@ -193,10 +196,13 @@ int netlbl_domhsh_init(u32 size)
  * negative on failure.
  *
  */
-int netlbl_domhsh_add(struct netlbl_dom_map *entry)
+int netlbl_domhsh_add(struct netlbl_dom_map *entry,
+                      struct netlbl_audit *audit_info)
 {
         int ret_val;
         u32 bkt;
+        struct audit_buffer *audit_buf;
+        char *audit_domain;
 
         switch (entry->type) {
         case NETLBL_NLTYPE_UNLABELED:
@@ -236,6 +242,26 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry)
                 spin_unlock(&netlbl_domhsh_def_lock);
         } else
                 ret_val = -EINVAL;
+
+        if (entry->domain != NULL)
+                audit_domain = entry->domain;
+        else
+                audit_domain = "(default)";
+        audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_ADD, audit_info);
+        audit_log_format(audit_buf, " nlbl_domain=%s", audit_domain);
+        switch (entry->type) {
+        case NETLBL_NLTYPE_UNLABELED:
+                audit_log_format(audit_buf, " nlbl_protocol=unlbl");
+                break;
+        case NETLBL_NLTYPE_CIPSOV4:
+                audit_log_format(audit_buf,
+                                 " nlbl_protocol=cipsov4 cipso_doi=%u",
+                                 entry->type_def.cipsov4->doi);
+                break;
+        }
+        audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
+        audit_log_end(audit_buf);
+
         rcu_read_unlock();
 
         if (ret_val != 0) {
@@ -254,6 +280,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry)
 /**
  * netlbl_domhsh_add_default - Adds the default entry to the domain hash table
  * @entry: the entry to add
+ * @audit_info: NetLabel audit information
  *
  * Description:
  * Adds a new default entry to the domain hash table and handles any updates
@@ -261,14 +288,16 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry)
  * negative on failure.
  *
  */
-int netlbl_domhsh_add_default(struct netlbl_dom_map *entry)
+int netlbl_domhsh_add_default(struct netlbl_dom_map *entry,
+                              struct netlbl_audit *audit_info)
 {
-        return netlbl_domhsh_add(entry);
+        return netlbl_domhsh_add(entry, audit_info);
 }
 
 /**
  * netlbl_domhsh_remove - Removes an entry from the domain hash table
  * @domain: the domain to remove
+ * @audit_info: NetLabel audit information
  *
  * Description:
  * Removes an entry from the domain hash table and handles any updates to the
@@ -276,10 +305,12 @@ int netlbl_domhsh_add_default(struct netlbl_dom_map *entry)
  * negative on failure.
  *
  */
-int netlbl_domhsh_remove(const char *domain)
+int netlbl_domhsh_remove(const char *domain, struct netlbl_audit *audit_info)
 {
         int ret_val = -ENOENT;
         struct netlbl_dom_map *entry;
+        struct audit_buffer *audit_buf;
+        char *audit_domain;
 
         rcu_read_lock();
         if (domain != NULL)
@@ -316,6 +347,18 @@ int netlbl_domhsh_remove(const char *domain)
                         ret_val = -ENOENT;
                 spin_unlock(&netlbl_domhsh_def_lock);
         }
+
+        if (entry->domain != NULL)
+                audit_domain = entry->domain;
+        else
+                audit_domain = "(default)";
+        audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info);
+        audit_log_format(audit_buf,
+                         " nlbl_domain=%s res=%u",
+                         audit_domain,
+                         ret_val == 0 ? 1 : 0);
+        audit_log_end(audit_buf);
+
         if (ret_val == 0)
                 call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
 
@@ -326,6 +369,7 @@ remove_return:
 
 /**
  * netlbl_domhsh_remove_default - Removes the default entry from the table
+ * @audit_info: NetLabel audit information
  *
  * Description:
  * Removes/resets the default entry for the domain hash table and handles any
@@ -333,9 +377,9 @@ remove_return:
  * success, non-zero on failure.
  *
  */
-int netlbl_domhsh_remove_default(void)
+int netlbl_domhsh_remove_default(struct netlbl_audit *audit_info)
 {
-        return netlbl_domhsh_remove(NULL);
+        return netlbl_domhsh_remove(NULL, audit_info);
 }
 
 /**
diff --git a/net/netlabel/netlabel_domainhash.h b/net/netlabel/netlabel_domainhash.h
index 02af72a7877c..3689956c3436 100644
--- a/net/netlabel/netlabel_domainhash.h
+++ b/net/netlabel/netlabel_domainhash.h
@@ -57,9 +57,11 @@ struct netlbl_dom_map {
 int netlbl_domhsh_init(u32 size);
 
 /* Manipulate the domain hash table */
-int netlbl_domhsh_add(struct netlbl_dom_map *entry);
-int netlbl_domhsh_add_default(struct netlbl_dom_map *entry);
-int netlbl_domhsh_remove_default(void);
+int netlbl_domhsh_add(struct netlbl_dom_map *entry,
+                      struct netlbl_audit *audit_info);
+int netlbl_domhsh_add_default(struct netlbl_dom_map *entry,
+                              struct netlbl_audit *audit_info);
+int netlbl_domhsh_remove_default(struct netlbl_audit *audit_info);
 struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain);
 int netlbl_domhsh_walk(u32 *skip_bkt,
                      u32 *skip_chain,
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 54fb7de3c2b1..ff971103fd0c 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -200,7 +200,7 @@ void netlbl_cache_invalidate(void)
 int netlbl_cache_add(const struct sk_buff *skb,
                      const struct netlbl_lsm_secattr *secattr)
 {
-        if (secattr->cache.data == NULL)
+        if (secattr->cache == NULL)
                 return -ENOMSG;
 
         if (CIPSO_V4_OPTEXIST(skb))
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index 8626c9f678eb..53c9079ad2c3 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -87,11 +87,14 @@ static int netlbl_mgmt_add(struct sk_buff *skb, struct genl_info *info)
         struct netlbl_dom_map *entry = NULL;
         size_t tmp_size;
         u32 tmp_val;
+        struct netlbl_audit audit_info;
 
         if (!info->attrs[NLBL_MGMT_A_DOMAIN] ||
             !info->attrs[NLBL_MGMT_A_PROTOCOL])
                 goto add_failure;
 
+        netlbl_netlink_auditinfo(skb, &audit_info);
+
         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
         if (entry == NULL) {
                 ret_val = -ENOMEM;
@@ -108,7 +111,7 @@ static int netlbl_mgmt_add(struct sk_buff *skb, struct genl_info *info)
 
         switch (entry->type) {
         case NETLBL_NLTYPE_UNLABELED:
-                ret_val = netlbl_domhsh_add(entry);
+                ret_val = netlbl_domhsh_add(entry, &audit_info);
                 break;
         case NETLBL_NLTYPE_CIPSOV4:
                 if (!info->attrs[NLBL_MGMT_A_CV4DOI])
@@ -125,7 +128,7 @@ static int netlbl_mgmt_add(struct sk_buff *skb, struct genl_info *info)
                         rcu_read_unlock();
                         goto add_failure;
                 }
-                ret_val = netlbl_domhsh_add(entry);
+                ret_val = netlbl_domhsh_add(entry, &audit_info);
                 rcu_read_unlock();
                 break;
         default:
@@ -156,12 +159,15 @@ add_failure:
 static int netlbl_mgmt_remove(struct sk_buff *skb, struct genl_info *info)
 {
         char *domain;
+        struct netlbl_audit audit_info;
 
         if (!info->attrs[NLBL_MGMT_A_DOMAIN])
                 return -EINVAL;
 
+        netlbl_netlink_auditinfo(skb, &audit_info);
+
         domain = nla_data(info->attrs[NLBL_MGMT_A_DOMAIN]);
-        return netlbl_domhsh_remove(domain);
+        return netlbl_domhsh_remove(domain, &audit_info);
 }
 
 /**
@@ -264,10 +270,13 @@ static int netlbl_mgmt_adddef(struct sk_buff *skb, struct genl_info *info)
         int ret_val = -EINVAL;
         struct netlbl_dom_map *entry = NULL;
         u32 tmp_val;
+        struct netlbl_audit audit_info;
 
         if (!info->attrs[NLBL_MGMT_A_PROTOCOL])
                 goto adddef_failure;
 
+        netlbl_netlink_auditinfo(skb, &audit_info);
+
         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
         if (entry == NULL) {
                 ret_val = -ENOMEM;
@@ -277,7 +286,7 @@ static int netlbl_mgmt_adddef(struct sk_buff *skb, struct genl_info *info)
 
         switch (entry->type) {
         case NETLBL_NLTYPE_UNLABELED:
-                ret_val = netlbl_domhsh_add_default(entry);
+                ret_val = netlbl_domhsh_add_default(entry, &audit_info);
                 break;
         case NETLBL_NLTYPE_CIPSOV4:
                 if (!info->attrs[NLBL_MGMT_A_CV4DOI])
@@ -294,7 +303,7 @@ static int netlbl_mgmt_adddef(struct sk_buff *skb, struct genl_info *info)
                         rcu_read_unlock();
                         goto adddef_failure;
                 }
-                ret_val = netlbl_domhsh_add_default(entry);
+                ret_val = netlbl_domhsh_add_default(entry, &audit_info);
                 rcu_read_unlock();
                 break;
         default:
@@ -322,7 +331,11 @@ adddef_failure:
  */
 static int netlbl_mgmt_removedef(struct sk_buff *skb, struct genl_info *info)
 {
-        return netlbl_domhsh_remove_default();
+        struct netlbl_audit audit_info;
+
+        netlbl_netlink_auditinfo(skb, &audit_info);
+
+        return netlbl_domhsh_remove_default(&audit_info);
 }
 
 /**
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 440f5c4e1e2d..1833ad233b39 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -64,6 +64,34 @@ static struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = {
 };
 
 /*
+ * Helper Functions
+ */
+
+/**
+ * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag
+ * @value: desired value
+ * @audit_info: NetLabel audit information
+ *
+ * Description:
+ * Set the value of the unlabeled accept flag to @value.
+ *
+ */
+static void netlbl_unlabel_acceptflg_set(u8 value,
+                                         struct netlbl_audit *audit_info)
+{
+        struct audit_buffer *audit_buf;
+        u8 old_val;
+
+        old_val = atomic_read(&netlabel_unlabel_accept_flg);
+        atomic_set(&netlabel_unlabel_accept_flg, value);
+
+        audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW,
+                                              audit_info);
+        audit_log_format(audit_buf, " unlbl_accept=%u old=%u", value, old_val);
+        audit_log_end(audit_buf);
+}
+
+/*
  * NetLabel Command Handlers
  */
 
@@ -79,18 +107,19 @@ static struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = {
  */
 static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info)
 {
-        int ret_val = -EINVAL;
         u8 value;
+        struct netlbl_audit audit_info;
 
         if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) {
                 value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]);
                 if (value == 1 || value == 0) {
-                        atomic_set(&netlabel_unlabel_accept_flg, value);
-                        ret_val = 0;
+                        netlbl_netlink_auditinfo(skb, &audit_info);
+                        netlbl_unlabel_acceptflg_set(value, &audit_info);
+                        return 0;
                 }
         }
 
-        return ret_val;
+        return -EINVAL;
 }
 
 /**
@@ -229,16 +258,23 @@ int netlbl_unlabel_defconf(void)
 {
         int ret_val;
         struct netlbl_dom_map *entry;
+        struct netlbl_audit audit_info;
+
+        /* Only the kernel is allowed to call this function and the only time
+         * it is called is at bootup before the audit subsystem is reporting
+         * messages so don't worry to much about these values. */
+        security_task_getsecid(current, &audit_info.secid);
+        audit_info.loginuid = 0;
 
         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
         if (entry == NULL)
                 return -ENOMEM;
         entry->type = NETLBL_NLTYPE_UNLABELED;
-        ret_val = netlbl_domhsh_add_default(entry);
+        ret_val = netlbl_domhsh_add_default(entry, &audit_info);
         if (ret_val != 0)
                 return ret_val;
 
-        atomic_set(&netlabel_unlabel_accept_flg, 1);
+        netlbl_unlabel_acceptflg_set(1, &audit_info);
 
         return 0;
 }
diff --git a/net/netlabel/netlabel_user.c b/net/netlabel/netlabel_user.c
index eeb7d768d2bb..98a416381e61 100644
--- a/net/netlabel/netlabel_user.c
+++ b/net/netlabel/netlabel_user.c
@@ -32,6 +32,9 @@
 #include <linux/types.h>
 #include <linux/list.h>
 #include <linux/socket.h>
+#include <linux/audit.h>
+#include <linux/tty.h>
+#include <linux/security.h>
 #include <net/sock.h>
 #include <net/netlink.h>
 #include <net/genetlink.h>
@@ -74,3 +77,41 @@ int netlbl_netlink_init(void)
 
         return 0;
 }
+
+/*
+ * NetLabel Audit Functions
+ */
+
+/**
+ * netlbl_audit_start_common - Start an audit message
+ * @type: audit message type
+ * @audit_info: NetLabel audit information
+ *
+ * Description:
+ * Start an audit message using the type specified in @type and fill the audit
+ * message with some fields common to all NetLabel audit messages.  Returns
+ * a pointer to the audit buffer on success, NULL on failure.
+ *
+ */
+struct audit_buffer *netlbl_audit_start_common(int type,
+                                               struct netlbl_audit *audit_info)
+{
+        struct audit_context *audit_ctx = current->audit_context;
+        struct audit_buffer *audit_buf;
+        char *secctx;
+        u32 secctx_len;
+
+        audit_buf = audit_log_start(audit_ctx, GFP_ATOMIC, type);
+        if (audit_buf == NULL)
+                return NULL;
+
+        audit_log_format(audit_buf, "netlabel: auid=%u", audit_info->loginuid);
+
+        if (audit_info->secid != 0 &&
+            security_secid_to_secctx(audit_info->secid,
+                                     &secctx,
+                                     &secctx_len) == 0)
+                audit_log_format(audit_buf, " subj=%s", secctx);
+
+        return audit_buf;
+}
diff --git a/net/netlabel/netlabel_user.h b/net/netlabel/netlabel_user.h
index 3f9386b917df..47967ef32964 100644
--- a/net/netlabel/netlabel_user.h
+++ b/net/netlabel/netlabel_user.h
@@ -34,6 +34,7 @@
 #include <linux/types.h>
 #include <linux/skbuff.h>
 #include <linux/capability.h>
+#include <linux/audit.h>
 #include <net/netlink.h>
 #include <net/genetlink.h>
 #include <net/netlabel.h>
@@ -71,8 +72,25 @@ static inline void *netlbl_netlink_hdr_put(struct sk_buff *skb,
                            NETLBL_PROTO_VERSION);
 }
 
+/**
+ * netlbl_netlink_auditinfo - Fetch the audit information from a NETLINK msg
+ * @skb: the packet
+ * @audit_info: NetLabel audit information
+ */
+static inline void netlbl_netlink_auditinfo(struct sk_buff *skb,
+                                            struct netlbl_audit *audit_info)
+{
+        audit_info->secid = NETLINK_CB(skb).sid;
+        audit_info->loginuid = NETLINK_CB(skb).loginuid;
+}
+
 /* NetLabel NETLINK I/O functions */
 
 int netlbl_netlink_init(void);
 
+/* NetLabel Audit Functions */
+
+struct audit_buffer *netlbl_audit_start_common(int type,
+                                              struct netlbl_audit *audit_info);
+
 #endif
diff --git a/net/rxrpc/transport.c b/net/rxrpc/transport.c
index 465efc86fccf..94b2e2fe6fdb 100644
--- a/net/rxrpc/transport.c
+++ b/net/rxrpc/transport.c
@@ -381,11 +381,10 @@ static int rxrpc_incoming_msg(struct rxrpc_transport *trans,
 
                 /* allocate a new message record */
                 ret = -ENOMEM;
-                msg = kmalloc(sizeof(struct rxrpc_message), GFP_KERNEL);
+                msg = kmemdup(jumbomsg, sizeof(struct rxrpc_message), GFP_KERNEL);
                 if (!msg)
                         goto error;
 
-                memcpy(msg, jumbomsg, sizeof(*msg));
                 list_add_tail(&msg->link, msgq);
 
                 /* adjust the jumbo packet */
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 7e14f14058e9..37a184021647 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -401,7 +401,7 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb)
         if ((dev = dev_get_by_index(tcm->tcm_ifindex)) == NULL)
                 return skb->len;
 
-        read_lock_bh(&qdisc_tree_lock);
+        read_lock(&qdisc_tree_lock);
         if (!tcm->tcm_parent)
                 q = dev->qdisc_sleeping;
         else
@@ -458,7 +458,7 @@ errout:
         if (cl)
                 cops->put(q, cl);
 out:
-        read_unlock_bh(&qdisc_tree_lock);
+        read_unlock(&qdisc_tree_lock);
         dev_put(dev);
         return skb->len;
 }
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index 86cac49a0531..09fda68c8b39 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -194,7 +194,7 @@ static int basic_change(struct tcf_proto *tp, unsigned long base, u32 handle,
         if (handle)
                 f->handle = handle;
         else {
-                int i = 0x80000000;
+                unsigned int i = 0x80000000;
                 do {
                         if (++head->hgenerator == 0x7FFFFFFF)
                                 head->hgenerator = 1;
diff --git a/net/sched/estimator.c b/net/sched/estimator.c
deleted file mode 100644
index 0ebc98e9be2d..000000000000
--- a/net/sched/estimator.c
+++ /dev/null
@@ -1,196 +0,0 @@
-/*
- * net/sched/estimator.c        Simple rate estimator.
- *
- *              This program is free software; you can redistribute it and/or
- *              modify it under the terms of the GNU General Public License
- *              as published by the Free Software Foundation; either version
- *              2 of the License, or (at your option) any later version.
- *
- * Authors:     Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
- */
-
-#include <asm/uaccess.h>
-#include <asm/system.h>
-#include <linux/bitops.h>
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/jiffies.h>
-#include <linux/string.h>
-#include <linux/mm.h>
-#include <linux/socket.h>
-#include <linux/sockios.h>
-#include <linux/in.h>
-#include <linux/errno.h>
-#include <linux/interrupt.h>
-#include <linux/netdevice.h>
-#include <linux/skbuff.h>
-#include <linux/rtnetlink.h>
-#include <linux/init.h>
-#include <net/sock.h>
-#include <net/pkt_sched.h>
-
-/*
-   This code is NOT intended to be used for statistics collection,
-   its purpose is to provide a base for statistical multiplexing
-   for controlled load service.
-   If you need only statistics, run a user level daemon which
-   periodically reads byte counters.
-
-   Unfortunately, rate estimation is not a very easy task.
-   F.e. I did not find a simple way to estimate the current peak rate
-   and even failed to formulate the problem 8)8)
-
-   So I preferred not to built an estimator into the scheduler,
-   but run this task separately.
-   Ideally, it should be kernel thread(s), but for now it runs
-   from timers, which puts apparent top bounds on the number of rated
-   flows, has minimal overhead on small, but is enough
-   to handle controlled load service, sets of aggregates.
-
-   We measure rate over A=(1<<interval) seconds and evaluate EWMA:
-
-   avrate = avrate*(1-W) + rate*W
-
-   where W is chosen as negative power of 2: W = 2^(-ewma_log)
-
-   The resulting time constant is:
-
-   T = A/(-ln(1-W))
-
-
-   NOTES.
-
-   * The stored value for avbps is scaled by 2^5, so that maximal
-     rate is ~1Gbit, avpps is scaled by 2^10.
-
-   * Minimal interval is HZ/4=250msec (it is the greatest common divisor
-     for HZ=100 and HZ=1024 8)), maximal interval
-     is (HZ*2^EST_MAX_INTERVAL)/4 = 8sec. Shorter intervals
-     are too expensive, longer ones can be implemented
-     at user level painlessly.
- */
-
-#define EST_MAX_INTERVAL        5
-
-struct qdisc_estimator
-{
-        struct qdisc_estimator  *next;
-        struct tc_stats         *stats;
-        spinlock_t              *stats_lock;
-        unsigned                interval;
-        int                     ewma_log;
-        u64                     last_bytes;
-        u32                     last_packets;
-        u32                     avpps;
-        u32                     avbps;
-};
-
-struct qdisc_estimator_head
-{
-        struct timer_list       timer;
-        struct qdisc_estimator  *list;
-};
-
-static struct qdisc_estimator_head elist[EST_MAX_INTERVAL+1];
-
-/* Estimator array lock */
-static DEFINE_RWLOCK(est_lock);
-
-static void est_timer(unsigned long arg)
-{
-        int idx = (int)arg;
-        struct qdisc_estimator *e;
-
-        read_lock(&est_lock);
-        for (e = elist[idx].list; e; e = e->next) {
-                struct tc_stats *st = e->stats;
-                u64 nbytes;
-                u32 npackets;
-                u32 rate;
-
-                spin_lock(e->stats_lock);
-                nbytes = st->bytes;
-                npackets = st->packets;
-                rate = (nbytes - e->last_bytes)<<(7 - idx);
-                e->last_bytes = nbytes;
-                e->avbps += ((long)rate - (long)e->avbps) >> e->ewma_log;
-                st->bps = (e->avbps+0xF)>>5;
-
-                rate = (npackets - e->last_packets)<<(12 - idx);
-                e->last_packets = npackets;
-                e->avpps += ((long)rate - (long)e->avpps) >> e->ewma_log;
-                e->stats->pps = (e->avpps+0x1FF)>>10;
-                spin_unlock(e->stats_lock);
-        }
-
-        mod_timer(&elist[idx].timer, jiffies + ((HZ<<idx)/4));
-        read_unlock(&est_lock);
-}
-
-int qdisc_new_estimator(struct tc_stats *stats, spinlock_t *stats_lock, struct rtattr *opt)
-{
-        struct qdisc_estimator *est;
-        struct tc_estimator *parm = RTA_DATA(opt);
-
-        if (RTA_PAYLOAD(opt) < sizeof(*parm))
-                return -EINVAL;
-
-        if (parm->interval < -2 || parm->interval > 3)
-                return -EINVAL;
-
-        est = kzalloc(sizeof(*est), GFP_KERNEL);
-        if (est == NULL)
-                return -ENOBUFS;
-
-        est->interval = parm->interval + 2;
-        est->stats = stats;
-        est->stats_lock = stats_lock;
-        est->ewma_log = parm->ewma_log;
-        est->last_bytes = stats->bytes;
-        est->avbps = stats->bps<<5;
-        est->last_packets = stats->packets;
-        est->avpps = stats->pps<<10;
-
-        est->next = elist[est->interval].list;
-        if (est->next == NULL) {
-                init_timer(&elist[est->interval].timer);
-                elist[est->interval].timer.data = est->interval;
-                elist[est->interval].timer.expires = jiffies + ((HZ<<est->interval)/4);
-                elist[est->interval].timer.function = est_timer;
-                add_timer(&elist[est->interval].timer);
-        }
-        write_lock_bh(&est_lock);
-        elist[est->interval].list = est;
-        write_unlock_bh(&est_lock);
-        return 0;
-}
-
-void qdisc_kill_estimator(struct tc_stats *stats)
-{
-        int idx;
-        struct qdisc_estimator *est, **pest;
-
-        for (idx=0; idx <= EST_MAX_INTERVAL; idx++) {
-                int killed = 0;
-                pest = &elist[idx].list;
-                while ((est=*pest) != NULL) {
-                        if (est->stats != stats) {
-                                pest = &est->next;
-                                continue;
-                        }
-
-                        write_lock_bh(&est_lock);
-                        *pest = est->next;
-                        write_unlock_bh(&est_lock);
-
-                        kfree(est);
-                        killed++;
-                }
-                if (killed && elist[idx].list == NULL)
-                        del_timer(&elist[idx].timer);
-        }
-}
-
-EXPORT_SYMBOL(qdisc_kill_estimator);
-EXPORT_SYMBOL(qdisc_new_estimator);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index a19eff12cf78..0b6489291140 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -195,14 +195,14 @@ struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle)
 {
         struct Qdisc *q;
 
-        read_lock_bh(&qdisc_tree_lock);
+        read_lock(&qdisc_tree_lock);
         list_for_each_entry(q, &dev->qdisc_list, list) {
                 if (q->handle == handle) {
-                        read_unlock_bh(&qdisc_tree_lock);
+                        read_unlock(&qdisc_tree_lock);
                         return q;
                 }
         }
-        read_unlock_bh(&qdisc_tree_lock);
+        read_unlock(&qdisc_tree_lock);
         return NULL;
 }
 
@@ -837,7 +837,7 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
                         continue;
                 if (idx > s_idx)
                         s_q_idx = 0;
-                read_lock_bh(&qdisc_tree_lock);
+                read_lock(&qdisc_tree_lock);
                 q_idx = 0;
                 list_for_each_entry(q, &dev->qdisc_list, list) {
                         if (q_idx < s_q_idx) {
@@ -846,12 +846,12 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
                         }
                         if (tc_fill_qdisc(skb, q, q->parent, NETLINK_CB(cb->skb).pid,
                                           cb->nlh->nlmsg_seq, NLM_F_MULTI, RTM_NEWQDISC) <= 0) {
-                                read_unlock_bh(&qdisc_tree_lock);
+                                read_unlock(&qdisc_tree_lock);
                                 goto done;
                         }
                         q_idx++;
                 }
-                read_unlock_bh(&qdisc_tree_lock);
+                read_unlock(&qdisc_tree_lock);
         }
 
 done:
@@ -1074,7 +1074,7 @@ static int tc_dump_tclass(struct sk_buff *skb, struct netlink_callback *cb)
         s_t = cb->args[0];
         t = 0;
 
-        read_lock_bh(&qdisc_tree_lock);
+        read_lock(&qdisc_tree_lock);
         list_for_each_entry(q, &dev->qdisc_list, list) {
                 if (t < s_t || !q->ops->cl_ops ||
                     (tcm->tcm_parent &&
@@ -1096,7 +1096,7 @@ static int tc_dump_tclass(struct sk_buff *skb, struct netlink_callback *cb)
                         break;
                 t++;
         }
-        read_unlock_bh(&qdisc_tree_lock);
+        read_unlock(&qdisc_tree_lock);
 
         cb->args[0] = t;
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 6f9151899795..88c6a99ce53c 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -45,11 +45,10 @@
    The idea is the following:
    - enqueue, dequeue are serialized via top level device
      spinlock dev->queue_lock.
-   - tree walking is protected by read_lock_bh(qdisc_tree_lock)
+   - tree walking is protected by read_lock(qdisc_tree_lock)
      and this lock is used only in process context.
-   - updates to tree are made under rtnl semaphore or
-     from softirq context (__qdisc_destroy rcu-callback)
-     hence this lock needs local bh disabling.
+   - updates to tree are made only under rtnl semaphore,
+     hence this lock may be made without local bh disabling.
 
    qdisc_tree_lock must be grabbed BEFORE dev->queue_lock!
  */
@@ -57,14 +56,14 @@ DEFINE_RWLOCK(qdisc_tree_lock);
 
 void qdisc_lock_tree(struct net_device *dev)
 {
-        write_lock_bh(&qdisc_tree_lock);
+        write_lock(&qdisc_tree_lock);
         spin_lock_bh(&dev->queue_lock);
 }
 
 void qdisc_unlock_tree(struct net_device *dev)
 {
         spin_unlock_bh(&dev->queue_lock);
-        write_unlock_bh(&qdisc_tree_lock);
+        write_unlock(&qdisc_tree_lock);
 }
 
 /* 
@@ -483,20 +482,6 @@ void qdisc_reset(struct Qdisc *qdisc)
 static void __qdisc_destroy(struct rcu_head *head)
 {
         struct Qdisc *qdisc = container_of(head, struct Qdisc, q_rcu);
-        struct Qdisc_ops  *ops = qdisc->ops;
-
-#ifdef CONFIG_NET_ESTIMATOR
-        gen_kill_estimator(&qdisc->bstats, &qdisc->rate_est);
-#endif
-        write_lock(&qdisc_tree_lock);
-        if (ops->reset)
-                ops->reset(qdisc);
-        if (ops->destroy)
-                ops->destroy(qdisc);
-        write_unlock(&qdisc_tree_lock);
-        module_put(ops->owner);
-
-        dev_put(qdisc->dev);
         kfree((char *) qdisc - qdisc->padded);
 }
 
@@ -504,32 +489,23 @@ static void __qdisc_destroy(struct rcu_head *head)
 
 void qdisc_destroy(struct Qdisc *qdisc)
 {
-        struct list_head cql = LIST_HEAD_INIT(cql);
-        struct Qdisc *cq, *q, *n;
+        struct Qdisc_ops  *ops = qdisc->ops;
 
         if (qdisc->flags & TCQ_F_BUILTIN ||
-                !atomic_dec_and_test(&qdisc->refcnt))
+            !atomic_dec_and_test(&qdisc->refcnt))
                 return;
 
-        if (!list_empty(&qdisc->list)) {
-                if (qdisc->ops->cl_ops == NULL)
-                        list_del(&qdisc->list);
-                else
-                        list_move(&qdisc->list, &cql);
-        }
-
-        /* unlink inner qdiscs from dev->qdisc_list immediately */
-        list_for_each_entry(cq, &cql, list)
-                list_for_each_entry_safe(q, n, &qdisc->dev->qdisc_list, list)
-                        if (TC_H_MAJ(q->parent) == TC_H_MAJ(cq->handle)) {
-                                if (q->ops->cl_ops == NULL)
-                                        list_del_init(&q->list);
-                                else
-                                        list_move_tail(&q->list, &cql);
-                        }
-        list_for_each_entry_safe(cq, n, &cql, list)
-                list_del_init(&cq->list);
+        list_del(&qdisc->list);
+#ifdef CONFIG_NET_ESTIMATOR
+        gen_kill_estimator(&qdisc->bstats, &qdisc->rate_est);
+#endif
+        if (ops->reset)
+                ops->reset(qdisc);
+        if (ops->destroy)
+                ops->destroy(qdisc);
 
+        module_put(ops->owner);
+        dev_put(qdisc->dev);
         call_rcu(&qdisc->q_rcu, __qdisc_destroy);
 }
 
@@ -549,15 +525,15 @@ void dev_activate(struct net_device *dev)
                                 printk(KERN_INFO "%s: activation failed\n", dev->name);
                                 return;
                         }
-                        write_lock_bh(&qdisc_tree_lock);
+                        write_lock(&qdisc_tree_lock);
                         list_add_tail(&qdisc->list, &dev->qdisc_list);
-                        write_unlock_bh(&qdisc_tree_lock);
+                        write_unlock(&qdisc_tree_lock);
                 } else {
                         qdisc =  &noqueue_qdisc;
                 }
-                write_lock_bh(&qdisc_tree_lock);
+                write_lock(&qdisc_tree_lock);
                 dev->qdisc_sleeping = qdisc;
-                write_unlock_bh(&qdisc_tree_lock);
+                write_unlock(&qdisc_tree_lock);
         }
 
         if (!netif_carrier_ok(dev))
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index bb3ddd4784b1..9b9c555c713f 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -786,11 +786,10 @@ static long htb_do_events(struct htb_sched *q, int level)
         for (i = 0; i < 500; i++) {
                 struct htb_class *cl;
                 long diff;
-                struct rb_node *p = q->wait_pq[level].rb_node;
+                struct rb_node *p = rb_first(&q->wait_pq[level]);
+
                 if (!p)
                         return 0;
-                while (p->rb_left)
-                        p = p->rb_left;
 
                 cl = rb_entry(p, struct htb_class, pq_node);
                 if (time_after(cl->pq_key, q->jiffies)) {
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 03f65de75d88..64f630102532 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -218,12 +218,6 @@ int sctp_rcv(struct sk_buff *skb)
                 }
         }
 
-        /* SCTP seems to always need a timestamp right now (FIXME) */
-        if (skb->tstamp.off_sec == 0) {
-                __net_timestamp(skb);
-                sock_enable_timestamp(sk); 
-        }
-
         if (!xfrm_policy_check(sk, XFRM_POLICY_IN, skb, family))
                 goto discard_release;
         nf_reset(skb);
@@ -388,7 +382,7 @@ void sctp_icmp_frag_needed(struct sock *sk, struct sctp_association *asoc,
                          * pmtu discovery on this transport.
                          */
                         t->pathmtu = SCTP_DEFAULT_MINSEGMENT;
-                        t->param_flags = (t->param_flags & ~SPP_HB) |
+                        t->param_flags = (t->param_flags & ~SPP_PMTUD) |
                                 SPP_PMTUD_DISABLE;
                 } else {
                         t->pathmtu = pmtu;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 249e5033c1a8..78071c6e6cf1 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -215,17 +215,17 @@ static struct dst_entry *sctp_v6_get_dst(struct sctp_association *asoc,
         }
 
         dst = ip6_route_output(NULL, &fl);
-        if (dst) {
+        if (!dst->error) {
                 struct rt6_info *rt;
                 rt = (struct rt6_info *)dst;
                 SCTP_DEBUG_PRINTK(
                         "rt6_dst:" NIP6_FMT " rt6_src:" NIP6_FMT "\n",
                         NIP6(rt->rt6i_dst.addr), NIP6(rt->rt6i_src.addr));
-        } else {
-                SCTP_DEBUG_PRINTK("NO ROUTE\n");
+                return dst;
         }
-
-        return dst;
+        SCTP_DEBUG_PRINTK("NO ROUTE\n");
+        dst_release(dst);
+        return NULL;
 }
 
 /* Returns the number of consecutive initial bits that match in the 2 ipv6
diff --git a/net/sctp/output.c b/net/sctp/output.c
index cdc5a3936766..3ef4351dd956 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -633,7 +633,7 @@ static sctp_xmit_t sctp_packet_append_data(struct sctp_packet *packet,
                  * data will fit or delay in hopes of bundling a full
                  * sized packet.
                  */
-                if (len < asoc->pathmtu - packet->overhead) {
+                if (len < asoc->frag_point) {
                         retval = SCTP_XMIT_NAGLE_DELAY;
                         goto finish;
                 }
@@ -645,7 +645,13 @@ static sctp_xmit_t sctp_packet_append_data(struct sctp_packet *packet,
         /* Keep track of how many bytes are in flight to the receiver. */
         asoc->outqueue.outstanding_bytes += datasize;
 
-        /* Update our view of the receiver's rwnd. */
+        /* Update our view of the receiver's rwnd. Include sk_buff overhead
+         * while updating peer.rwnd so that it reduces the chances of a
+         * receiver running out of receive buffer space even when receive
+         * window is still open. This can happen when a sender is sending
+         * sending small messages.
+         */
+        datasize += sizeof(struct sk_buff);
         if (datasize < rwnd)
                 rwnd -= datasize;
         else
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 37074a39ecbb..739582415bf6 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -416,7 +416,8 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                          * (Section 7.2.4)), add the data size of those
                          * chunks to the rwnd.
                          */
-                        q->asoc->peer.rwnd += sctp_data_size(chunk);
+                        q->asoc->peer.rwnd += (sctp_data_size(chunk) +
+                                                sizeof(struct sk_buff));
                         q->outstanding_bytes -= sctp_data_size(chunk);
                         transport->flight_size -= sctp_data_size(chunk);
 
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index a356d8d310a9..7f49e769080e 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -344,7 +344,7 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
                            assoc, sk, sctp_sk(sk)->type, sk->sk_state,
                            assoc->state, hash, assoc->assoc_id,
                            assoc->sndbuf_used,
-                           (sk->sk_rcvbuf - assoc->rwnd),
+                           atomic_read(&assoc->rmem_alloc),
                            sock_i_uid(sk), sock_i_ino(sk),
                            epb->bind_addr.port,
                            assoc->peer.port);
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 7745bdea7817..507dff72c585 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1447,8 +1447,16 @@ no_hmac:
         /* Check to see if the cookie is stale.  If there is already
          * an association, there is no need to check cookie's expiration
          * for init collision case of lost COOKIE ACK.
+         * If skb has been timestamped, then use the stamp, otherwise
+         * use current time.  This introduces a small possibility that
+         * that a cookie may be considered expired, but his would only slow
+         * down the new association establishment instead of every packet.
          */
-        skb_get_timestamp(skb, &tv);
+        if (sock_flag(ep->base.sk, SOCK_TIMESTAMP))
+                skb_get_timestamp(skb, &tv);
+        else
+                do_gettimeofday(&tv);
+
         if (!asoc && tv_lt(bear_cookie->expiration, tv)) {
                 __u16 len;
                 /*
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 79c3e072cf28..9f34dec6ff8e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -821,7 +821,7 @@ out:
  * addrs is a pointer to an array of one or more socket addresses. Each
  * address is contained in its appropriate structure (i.e. struct
  * sockaddr_in or struct sockaddr_in6) the family of the address type
- * must be used to distengish the address length (note that this
+ * must be used to distinguish the address length (note that this
  * representation is termed a "packed array" of addresses). The caller
  * specifies the number of addresses in the array with addrcnt.
  *
@@ -3084,8 +3084,8 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
          */
         sp->disable_fragments = 0;
 
-        /* Turn on/off any Nagle-like algorithm.  */
-        sp->nodelay           = 1;
+        /* Enable Nagle algorithm by default.  */
+        sp->nodelay           = 0;
 
         /* Enable by default. */
         sp->v4mapped          = 1;
@@ -5362,6 +5362,20 @@ static void sctp_wfree(struct sk_buff *skb)
         sctp_association_put(asoc);
 }
 
+/* Do accounting for the receive space on the socket.
+ * Accounting for the association is done in ulpevent.c
+ * We set this as a destructor for the cloned data skbs so that
+ * accounting is done at the correct time.
+ */
+void sctp_sock_rfree(struct sk_buff *skb)
+{
+        struct sock *sk = skb->sk;
+        struct sctp_ulpevent *event = sctp_skb2event(skb);
+
+        atomic_sub(event->rmem_len, &sk->sk_rmem_alloc);
+}
+
+
 /* Helper function to wait for space in the sndbuf.  */
 static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
                                 size_t msg_len)
@@ -5634,10 +5648,10 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         sctp_skb_for_each(skb, &oldsk->sk_receive_queue, tmp) {
                 event = sctp_skb2event(skb);
                 if (event->asoc == assoc) {
-                        sock_rfree(skb);
+                        sctp_sock_rfree(skb);
                         __skb_unlink(skb, &oldsk->sk_receive_queue);
                         __skb_queue_tail(&newsk->sk_receive_queue, skb);
-                        skb_set_owner_r(skb, newsk);
+                        sctp_skb_set_owner_r(skb, newsk);
                 }
         }
 
@@ -5665,10 +5679,10 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
                 sctp_skb_for_each(skb, &oldsp->pd_lobby, tmp) {
                         event = sctp_skb2event(skb);
                         if (event->asoc == assoc) {
-                                sock_rfree(skb);
+                                sctp_sock_rfree(skb);
                                 __skb_unlink(skb, &oldsp->pd_lobby);
                                 __skb_queue_tail(queue, skb);
-                                skb_set_owner_r(skb, newsk);
+                                sctp_skb_set_owner_r(skb, newsk);
                         }
                 }
 
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index ee236784a6bb..a015283a9087 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -55,10 +55,13 @@ static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event);
 
 
 /* Initialize an ULP event from an given skb.  */
-SCTP_STATIC void sctp_ulpevent_init(struct sctp_ulpevent *event, int msg_flags)
+SCTP_STATIC void sctp_ulpevent_init(struct sctp_ulpevent *event,
+                                    int msg_flags,
+                                    unsigned int len)
 {
         memset(event, 0, sizeof(struct sctp_ulpevent));
         event->msg_flags = msg_flags;
+        event->rmem_len = len;
 }
 
 /* Create a new sctp_ulpevent.  */
@@ -73,7 +76,7 @@ SCTP_STATIC struct sctp_ulpevent *sctp_ulpevent_new(int size, int msg_flags,
                 goto fail;
 
         event = sctp_skb2event(skb);
-        sctp_ulpevent_init(event, msg_flags);
+        sctp_ulpevent_init(event, msg_flags, skb->truesize);
 
         return event;
 
@@ -101,17 +104,16 @@ static inline void sctp_ulpevent_set_owner(struct sctp_ulpevent *event,
         sctp_association_hold((struct sctp_association *)asoc);
         skb = sctp_event2skb(event);
         event->asoc = (struct sctp_association *)asoc;
-        atomic_add(skb->truesize, &event->asoc->rmem_alloc);
-        skb_set_owner_r(skb, asoc->base.sk);
+        atomic_add(event->rmem_len, &event->asoc->rmem_alloc);
+        sctp_skb_set_owner_r(skb, asoc->base.sk);
 }
 
 /* A simple destructor to give up the reference to the association. */
 static inline void sctp_ulpevent_release_owner(struct sctp_ulpevent *event)
 {
         struct sctp_association *asoc = event->asoc;
-        struct sk_buff *skb = sctp_event2skb(event);
 
-        atomic_sub(skb->truesize, &asoc->rmem_alloc);
+        atomic_sub(event->rmem_len, &asoc->rmem_alloc);
         sctp_association_put(asoc);
 }
 
@@ -372,7 +374,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_remote_error(
 
         /* Embed the event fields inside the cloned skb.  */
         event = sctp_skb2event(skb);
-        sctp_ulpevent_init(event, MSG_NOTIFICATION);
+        sctp_ulpevent_init(event, MSG_NOTIFICATION, skb->truesize);
 
         sre = (struct sctp_remote_error *)
                 skb_push(skb, sizeof(struct sctp_remote_error));
@@ -464,7 +466,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_send_failed(
 
         /* Embed the event fields inside the cloned skb.  */
         event = sctp_skb2event(skb);
-        sctp_ulpevent_init(event, MSG_NOTIFICATION);
+        sctp_ulpevent_init(event, MSG_NOTIFICATION, skb->truesize);
 
         ssf = (struct sctp_send_failed *)
                 skb_push(skb, sizeof(struct sctp_send_failed));
@@ -682,8 +684,11 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
         /* Embed the event fields inside the cloned skb.  */
         event = sctp_skb2event(skb);
 
-        /* Initialize event with flags 0.  */
-        sctp_ulpevent_init(event, 0);
+        /* Initialize event with flags 0  and correct length
+         * Since this is a clone of the original skb, only account for
+         * the data of this chunk as other chunks will be accounted separately.
+         */
+        sctp_ulpevent_init(event, 0, skb->len + sizeof(struct sk_buff));
 
         sctp_ulpevent_receive_data(event, asoc);
 
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index 575e556aeb3e..e1d144275f97 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -309,7 +309,7 @@ static struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff_head *qu
                         if (!new)
                                 return NULL;    /* try again later */
 
-                        new->sk = f_frag->sk;
+                        sctp_skb_set_owner_r(new, f_frag->sk);
 
                         skb_shinfo(new)->frag_list = pos;
                 } else
diff --git a/net/socket.c b/net/socket.c
index 1bc4167e0da8..6c9b9b326d76 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -95,10 +95,10 @@
 #include <linux/netfilter.h>
 
 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
-static ssize_t sock_aio_read(struct kiocb *iocb, char __user *buf,
-                             size_t size, loff_t pos);
-static ssize_t sock_aio_write(struct kiocb *iocb, const char __user *buf,
-                              size_t size, loff_t pos);
+static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
+                         unsigned long nr_segs, loff_t pos);
+static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
+                          unsigned long nr_segs, loff_t pos);
 static int sock_mmap(struct file *file, struct vm_area_struct *vma);
 
 static int sock_close(struct inode *inode, struct file *file);
@@ -110,10 +110,6 @@ static long compat_sock_ioctl(struct file *file,
                               unsigned int cmd, unsigned long arg);
 #endif
 static int sock_fasync(int fd, struct file *filp, int on);
-static ssize_t sock_readv(struct file *file, const struct iovec *vector,
-                          unsigned long count, loff_t *ppos);
-static ssize_t sock_writev(struct file *file, const struct iovec *vector,
-                           unsigned long count, loff_t *ppos);
 static ssize_t sock_sendpage(struct file *file, struct page *page,
                              int offset, size_t size, loff_t *ppos, int more);
 
@@ -136,8 +132,6 @@ static struct file_operations socket_file_ops = {
         .open =         sock_no_open,   /* special open code to disallow open via /proc */
         .release =      sock_close,
         .fasync =       sock_fasync,
-        .readv =        sock_readv,
-        .writev =       sock_writev,
         .sendpage =     sock_sendpage,
         .splice_write = generic_splice_sendpage,
 };
@@ -664,7 +658,6 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
 }
 
 static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
-                                         char __user *ubuf, size_t size,
                                          struct sock_iocb *siocb)
 {
         if (!is_sync_kiocb(iocb)) {
@@ -675,16 +668,13 @@ static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
         }
 
         siocb->kiocb = iocb;
-        siocb->async_iov.iov_base = ubuf;
-        siocb->async_iov.iov_len = size;
-
         iocb->private = siocb;
         return siocb;
 }
 
 static ssize_t do_sock_read(struct msghdr *msg, struct kiocb *iocb,
-                            struct file *file, struct iovec *iov,
-                            unsigned long nr_segs)
+                struct file *file, const struct iovec *iov,
+                unsigned long nr_segs)
 {
         struct socket *sock = file->private_data;
         size_t size = 0;
@@ -704,43 +694,27 @@ static ssize_t do_sock_read(struct msghdr *msg, struct kiocb *iocb,
         return __sock_recvmsg(iocb, sock, msg, size, msg->msg_flags);
 }
 
-static ssize_t sock_readv(struct file *file, const struct iovec *iov,
-                          unsigned long nr_segs, loff_t *ppos)
-{
-        struct kiocb iocb;
-        struct sock_iocb siocb;
-        struct msghdr msg;
-        int ret;
-
-        init_sync_kiocb(&iocb, NULL);
-        iocb.private = &siocb;
-
-        ret = do_sock_read(&msg, &iocb, file, (struct iovec *)iov, nr_segs);
-        if (-EIOCBQUEUED == ret)
-                ret = wait_on_sync_kiocb(&iocb);
-        return ret;
-}
-
-static ssize_t sock_aio_read(struct kiocb *iocb, char __user *ubuf,
-                             size_t count, loff_t pos)
+static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
+                                unsigned long nr_segs, loff_t pos)
 {
         struct sock_iocb siocb, *x;
 
         if (pos != 0)
                 return -ESPIPE;
-        if (count == 0)         /* Match SYS5 behaviour */
+
+        if (iocb->ki_left == 0) /* Match SYS5 behaviour */
                 return 0;
 
-        x = alloc_sock_iocb(iocb, ubuf, count, &siocb);
+
+        x = alloc_sock_iocb(iocb, &siocb);
         if (!x)
                 return -ENOMEM;
-        return do_sock_read(&x->async_msg, iocb, iocb->ki_filp,
-                            &x->async_iov, 1);
+        return do_sock_read(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
 }
 
 static ssize_t do_sock_write(struct msghdr *msg, struct kiocb *iocb,
-                             struct file *file, struct iovec *iov,
-                             unsigned long nr_segs)
+                        struct file *file, const struct iovec *iov,
+                        unsigned long nr_segs)
 {
         struct socket *sock = file->private_data;
         size_t size = 0;
@@ -762,39 +736,22 @@ static ssize_t do_sock_write(struct msghdr *msg, struct kiocb *iocb,
         return __sock_sendmsg(iocb, sock, msg, size);
 }
 
-static ssize_t sock_writev(struct file *file, const struct iovec *iov,
-                           unsigned long nr_segs, loff_t *ppos)
-{
-        struct msghdr msg;
-        struct kiocb iocb;
-        struct sock_iocb siocb;
-        int ret;
-
-        init_sync_kiocb(&iocb, NULL);
-        iocb.private = &siocb;
-
-        ret = do_sock_write(&msg, &iocb, file, (struct iovec *)iov, nr_segs);
-        if (-EIOCBQUEUED == ret)
-                ret = wait_on_sync_kiocb(&iocb);
-        return ret;
-}
-
-static ssize_t sock_aio_write(struct kiocb *iocb, const char __user *ubuf,
-                              size_t count, loff_t pos)
+static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
+                          unsigned long nr_segs, loff_t pos)
 {
         struct sock_iocb siocb, *x;
 
         if (pos != 0)
                 return -ESPIPE;
-        if (count == 0)         /* Match SYS5 behaviour */
+
+        if (iocb->ki_left == 0) /* Match SYS5 behaviour */
                 return 0;
 
-        x = alloc_sock_iocb(iocb, (void __user *)ubuf, count, &siocb);
+        x = alloc_sock_iocb(iocb, &siocb);
         if (!x)
                 return -ENOMEM;
 
-        return do_sock_write(&x->async_msg, iocb, iocb->ki_filp,
-                             &x->async_iov, 1);
+        return do_sock_write(&x->async_msg, iocb, iocb->ki_filp, iov, nr_segs);
 }
 
 /*
@@ -868,7 +825,7 @@ static long sock_ioctl(struct file *file, unsigned cmd, unsigned long arg)
                         break;
                 case FIOGETOWN:
                 case SIOCGPGRP:
-                        err = put_user(sock->file->f_owner.pid,
+                        err = put_user(f_getown(sock->file),
                                        (int __user *)argp);
                         break;
                 case SIOCGIFBR:
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 55163af3dcaf..993ff1a5d945 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -331,8 +331,8 @@ rpcauth_unbindcred(struct rpc_task *task)
         task->tk_msg.rpc_cred = NULL;
 }
 
-u32 *
-rpcauth_marshcred(struct rpc_task *task, u32 *p)
+__be32 *
+rpcauth_marshcred(struct rpc_task *task, __be32 *p)
 {
         struct rpc_cred *cred = task->tk_msg.rpc_cred;
 
@@ -342,8 +342,8 @@ rpcauth_marshcred(struct rpc_task *task, u32 *p)
         return cred->cr_ops->crmarshal(task, p);
 }
 
-u32 *
-rpcauth_checkverf(struct rpc_task *task, u32 *p)
+__be32 *
+rpcauth_checkverf(struct rpc_task *task, __be32 *p)
 {
         struct rpc_cred *cred = task->tk_msg.rpc_cred;
 
@@ -355,7 +355,7 @@ rpcauth_checkverf(struct rpc_task *task, u32 *p)
 
 int
 rpcauth_wrap_req(struct rpc_task *task, kxdrproc_t encode, void *rqstp,
-                u32 *data, void *obj)
+                __be32 *data, void *obj)
 {
         struct rpc_cred *cred = task->tk_msg.rpc_cred;
 
@@ -369,7 +369,7 @@ rpcauth_wrap_req(struct rpc_task *task, kxdrproc_t encode, void *rqstp,
 
 int
 rpcauth_unwrap_resp(struct rpc_task *task, kxdrproc_t decode, void *rqstp,
-                u32 *data, void *obj)
+                __be32 *data, void *obj)
 {
         struct rpc_cred *cred = task->tk_msg.rpc_cred;
 
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 6eed3e166ba3..b36b9463f5a4 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1,5 +1,5 @@
 /*
- * linux/net/sunrpc/auth_gss.c
+ * linux/net/sunrpc/auth_gss/auth_gss.c
  *
  * RPCSEC_GSS client authentication.
  * 
@@ -826,14 +826,14 @@ out:
 * Marshal credentials.
 * Maybe we should keep a cached credential for performance reasons.
 */
-static u32 *
-gss_marshal(struct rpc_task *task, u32 *p)
+static __be32 *
+gss_marshal(struct rpc_task *task, __be32 *p)
 {
         struct rpc_cred *cred = task->tk_msg.rpc_cred;
         struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
                                                  gc_base);
         struct gss_cl_ctx       *ctx = gss_cred_get_ctx(cred);
-        u32             *cred_len;
+        __be32          *cred_len;
         struct rpc_rqst *req = task->tk_rqstp;
         u32             maj_stat = 0;
         struct xdr_netobj mic;
@@ -894,12 +894,12 @@ gss_refresh(struct rpc_task *task)
         return 0;
 }
 
-static u32 *
-gss_validate(struct rpc_task *task, u32 *p)
+static __be32 *
+gss_validate(struct rpc_task *task, __be32 *p)
 {
         struct rpc_cred *cred = task->tk_msg.rpc_cred;
         struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
-        u32             seq;
+        __be32          seq;
         struct kvec     iov;
         struct xdr_buf  verf_buf;
         struct xdr_netobj mic;
@@ -940,13 +940,14 @@ out_bad:
 
 static inline int
 gss_wrap_req_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
-                kxdrproc_t encode, struct rpc_rqst *rqstp, u32 *p, void *obj)
+                kxdrproc_t encode, struct rpc_rqst *rqstp, __be32 *p, void *obj)
 {
         struct xdr_buf  *snd_buf = &rqstp->rq_snd_buf;
         struct xdr_buf  integ_buf;
-        u32             *integ_len = NULL;
+        __be32          *integ_len = NULL;
         struct xdr_netobj mic;
-        u32             offset, *q;
+        u32             offset;
+        __be32          *q;
         struct kvec     *iov;
         u32             maj_stat = 0;
         int             status = -EIO;
@@ -1032,13 +1033,13 @@ out:
 
 static inline int
 gss_wrap_req_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
-                kxdrproc_t encode, struct rpc_rqst *rqstp, u32 *p, void *obj)
+                kxdrproc_t encode, struct rpc_rqst *rqstp, __be32 *p, void *obj)
 {
         struct xdr_buf  *snd_buf = &rqstp->rq_snd_buf;
         u32             offset;
         u32             maj_stat;
         int             status;
-        u32             *opaque_len;
+        __be32          *opaque_len;
         struct page     **inpages;
         int             first;
         int             pad;
@@ -1095,7 +1096,7 @@ gss_wrap_req_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
 
 static int
 gss_wrap_req(struct rpc_task *task,
-             kxdrproc_t encode, void *rqstp, u32 *p, void *obj)
+             kxdrproc_t encode, void *rqstp, __be32 *p, void *obj)
 {
         struct rpc_cred *cred = task->tk_msg.rpc_cred;
         struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
@@ -1132,7 +1133,7 @@ out:
 
 static inline int
 gss_unwrap_resp_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
-                struct rpc_rqst *rqstp, u32 **p)
+                struct rpc_rqst *rqstp, __be32 **p)
 {
         struct xdr_buf  *rcv_buf = &rqstp->rq_rcv_buf;
         struct xdr_buf integ_buf;
@@ -1169,7 +1170,7 @@ gss_unwrap_resp_integ(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
 
 static inline int
 gss_unwrap_resp_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
-                struct rpc_rqst *rqstp, u32 **p)
+                struct rpc_rqst *rqstp, __be32 **p)
 {
         struct xdr_buf  *rcv_buf = &rqstp->rq_rcv_buf;
         u32 offset;
@@ -1198,13 +1199,13 @@ gss_unwrap_resp_priv(struct rpc_cred *cred, struct gss_cl_ctx *ctx,
 
 static int
 gss_unwrap_resp(struct rpc_task *task,
-                kxdrproc_t decode, void *rqstp, u32 *p, void *obj)
+                kxdrproc_t decode, void *rqstp, __be32 *p, void *obj)
 {
         struct rpc_cred *cred = task->tk_msg.rpc_cred;
         struct gss_cred *gss_cred = container_of(cred, struct gss_cred,
                         gc_base);
         struct gss_cl_ctx *ctx = gss_cred_get_ctx(cred);
-        u32             *savedp = p;
+        __be32          *savedp = p;
         struct kvec     *head = ((struct rpc_rqst *)rqstp)->rq_rcv_buf.head;
         int             savedlen = head->iov_len;
         int             status = -EIO;
diff --git a/net/sunrpc/auth_gss/gss_krb5_seal.c b/net/sunrpc/auth_gss/gss_krb5_seal.c
index 2f312164d6d5..08601ee4cd73 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seal.c
@@ -115,7 +115,7 @@ gss_get_mic_kerberos(struct gss_ctx *gss_ctx, struct xdr_buf *text,
         krb5_hdr = ptr - 2;
         msg_start = krb5_hdr + 24;
 
-        *(u16 *)(krb5_hdr + 2) = htons(ctx->signalg);
+        *(__be16 *)(krb5_hdr + 2) = htons(ctx->signalg);
         memset(krb5_hdr + 4, 0xff, 4);
 
         if (make_checksum(checksum_type, krb5_hdr, 8, text, 0, &md5cksum))
diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c
index f179415d0c38..cc45c1605f80 100644
--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
+++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
@@ -177,9 +177,9 @@ gss_wrap_kerberos(struct gss_ctx *ctx, int offset,
         msg_start = krb5_hdr + 24;
         /* XXXJBF: */ BUG_ON(buf->head[0].iov_base + offset + headlen != msg_start + blocksize);
 
-        *(u16 *)(krb5_hdr + 2) = htons(kctx->signalg);
+        *(__be16 *)(krb5_hdr + 2) = htons(kctx->signalg);
         memset(krb5_hdr + 4, 0xff, 4);
-        *(u16 *)(krb5_hdr + 4) = htons(kctx->sealalg);
+        *(__be16 *)(krb5_hdr + 4) = htons(kctx->sealalg);
 
         make_confounder(msg_start, blocksize);
 
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 94217ec9e2dd..1f0f079ffa65 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -607,7 +607,7 @@ svc_safe_getnetobj(struct kvec *argv, struct xdr_netobj *o)
 
         if (argv->iov_len < 4)
                 return -1;
-        o->len = ntohl(svc_getu32(argv));
+        o->len = svc_getnl(argv);
         l = round_up_to_quad(o->len);
         if (argv->iov_len < l)
                 return -1;
@@ -620,17 +620,17 @@ svc_safe_getnetobj(struct kvec *argv, struct xdr_netobj *o)
 static inline int
 svc_safe_putnetobj(struct kvec *resv, struct xdr_netobj *o)
 {
-        u32 *p;
+        u8 *p;
 
         if (resv->iov_len + 4 > PAGE_SIZE)
                 return -1;
-        svc_putu32(resv, htonl(o->len));
+        svc_putnl(resv, o->len);
         p = resv->iov_base + resv->iov_len;
         resv->iov_len += round_up_to_quad(o->len);
         if (resv->iov_len > PAGE_SIZE)
                 return -1;
         memcpy(p, o->data, o->len);
-        memset((u8 *)p + o->len, 0, round_up_to_quad(o->len) - o->len);
+        memset(p + o->len, 0, round_up_to_quad(o->len) - o->len);
         return 0;
 }
 
@@ -640,7 +640,7 @@ svc_safe_putnetobj(struct kvec *resv, struct xdr_netobj *o)
  */
 static int
 gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci,
-                  u32 *rpcstart, struct rpc_gss_wire_cred *gc, u32 *authp)
+                  __be32 *rpcstart, struct rpc_gss_wire_cred *gc, __be32 *authp)
 {
         struct gss_ctx          *ctx_id = rsci->mechctx;
         struct xdr_buf          rpchdr;
@@ -657,7 +657,7 @@ gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci,
         *authp = rpc_autherr_badverf;
         if (argv->iov_len < 4)
                 return SVC_DENIED;
-        flavor = ntohl(svc_getu32(argv));
+        flavor = svc_getnl(argv);
         if (flavor != RPC_AUTH_GSS)
                 return SVC_DENIED;
         if (svc_safe_getnetobj(argv, &checksum))
@@ -687,9 +687,9 @@ gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci,
 static int
 gss_write_null_verf(struct svc_rqst *rqstp)
 {
-        u32     *p;
+        __be32     *p;
 
-        svc_putu32(rqstp->rq_res.head, htonl(RPC_AUTH_NULL));
+        svc_putnl(rqstp->rq_res.head, RPC_AUTH_NULL);
         p = rqstp->rq_res.head->iov_base + rqstp->rq_res.head->iov_len;
         /* don't really need to check if head->iov_len > PAGE_SIZE ... */
         *p++ = 0;
@@ -701,14 +701,14 @@ gss_write_null_verf(struct svc_rqst *rqstp)
 static int
 gss_write_verf(struct svc_rqst *rqstp, struct gss_ctx *ctx_id, u32 seq)
 {
-        u32                     xdr_seq;
+        __be32                  xdr_seq;
         u32                     maj_stat;
         struct xdr_buf          verf_data;
         struct xdr_netobj       mic;
-        u32                     *p;
+        __be32                  *p;
         struct kvec             iov;
 
-        svc_putu32(rqstp->rq_res.head, htonl(RPC_AUTH_GSS));
+        svc_putnl(rqstp->rq_res.head, RPC_AUTH_GSS);
         xdr_seq = htonl(seq);
 
         iov.iov_base = &xdr_seq;
@@ -782,7 +782,7 @@ EXPORT_SYMBOL(svcauth_gss_register_pseudoflavor);
 static inline int
 read_u32_from_xdr_buf(struct xdr_buf *buf, int base, u32 *obj)
 {
-        u32     raw;
+        __be32  raw;
         int     status;
 
         status = read_bytes_from_xdr_buf(buf, base, &raw, sizeof(*obj));
@@ -805,7 +805,7 @@ unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
         struct xdr_netobj mic;
         struct xdr_buf integ_buf;
 
-        integ_len = ntohl(svc_getu32(&buf->head[0]));
+        integ_len = svc_getnl(&buf->head[0]);
         if (integ_len & 3)
                 goto out;
         if (integ_len > buf->len)
@@ -825,7 +825,7 @@ unwrap_integ_data(struct xdr_buf *buf, u32 seq, struct gss_ctx *ctx)
         maj_stat = gss_verify_mic(ctx, &integ_buf, &mic);
         if (maj_stat != GSS_S_COMPLETE)
                 goto out;
-        if (ntohl(svc_getu32(&buf->head[0])) != seq)
+        if (svc_getnl(&buf->head[0]) != seq)
                 goto out;
         stat = 0;
 out:
@@ -857,7 +857,7 @@ unwrap_priv_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gs
 
         rqstp->rq_sendfile_ok = 0;
 
-        priv_len = ntohl(svc_getu32(&buf->head[0]));
+        priv_len = svc_getnl(&buf->head[0]);
         if (rqstp->rq_deferred) {
                 /* Already decrypted last time through! The sequence number
                  * check at out_seq is unnecessary but harmless: */
@@ -895,7 +895,7 @@ unwrap_priv_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gs
         if (maj_stat != GSS_S_COMPLETE)
                 return -EINVAL;
 out_seq:
-        if (ntohl(svc_getu32(&buf->head[0])) != seq)
+        if (svc_getnl(&buf->head[0]) != seq)
                 return -EINVAL;
         return 0;
 }
@@ -903,9 +903,9 @@ out_seq:
 struct gss_svc_data {
         /* decoded gss client cred: */
         struct rpc_gss_wire_cred        clcred;
-        /* pointer to the beginning of the procedure-specific results,
-         * which may be encrypted/checksummed in svcauth_gss_release: */
-        u32                             *body_start;
+        /* save a pointer to the beginning of the encoded verifier,
+         * for use in encryption/checksumming in svcauth_gss_release: */
+        __be32                          *verf_start;
         struct rsc                      *rsci;
 };
 
@@ -946,7 +946,7 @@ gss_write_init_verf(struct svc_rqst *rqstp, struct rsi *rsip)
  * response here and return SVC_COMPLETE.
  */
 static int
-svcauth_gss_accept(struct svc_rqst *rqstp, u32 *authp)
+svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
 {
         struct kvec     *argv = &rqstp->rq_arg.head[0];
         struct kvec     *resv = &rqstp->rq_res.head[0];
@@ -956,8 +956,8 @@ svcauth_gss_accept(struct svc_rqst *rqstp, u32 *authp)
         struct rpc_gss_wire_cred *gc;
         struct rsc      *rsci = NULL;
         struct rsi      *rsip, rsikey;
-        u32             *rpcstart;
-        u32             *reject_stat = resv->iov_base + resv->iov_len;
+        __be32          *rpcstart;
+        __be32          *reject_stat = resv->iov_base + resv->iov_len;
         int             ret;
 
         dprintk("RPC:      svcauth_gss: argv->iov_len = %zd\n",argv->iov_len);
@@ -968,7 +968,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, u32 *authp)
         if (!svcdata)
                 goto auth_err;
         rqstp->rq_auth_data = svcdata;
-        svcdata->body_start = NULL;
+        svcdata->verf_start = NULL;
         svcdata->rsci = NULL;
         gc = &svcdata->clcred;
 
@@ -985,12 +985,12 @@ svcauth_gss_accept(struct svc_rqst *rqstp, u32 *authp)
 
         if (argv->iov_len < 5 * 4)
                 goto auth_err;
-        crlen = ntohl(svc_getu32(argv));
-        if (ntohl(svc_getu32(argv)) != RPC_GSS_VERSION)
+        crlen = svc_getnl(argv);
+        if (svc_getnl(argv) != RPC_GSS_VERSION)
                 goto auth_err;
-        gc->gc_proc = ntohl(svc_getu32(argv));
-        gc->gc_seq = ntohl(svc_getu32(argv));
-        gc->gc_svc = ntohl(svc_getu32(argv));
+        gc->gc_proc = svc_getnl(argv);
+        gc->gc_seq = svc_getnl(argv);
+        gc->gc_svc = svc_getnl(argv);
         if (svc_safe_getnetobj(argv, &gc->gc_ctx))
                 goto auth_err;
         if (crlen != round_up_to_quad(gc->gc_ctx.len) + 5 * 4)
@@ -1016,9 +1016,9 @@ svcauth_gss_accept(struct svc_rqst *rqstp, u32 *authp)
         case RPC_GSS_PROC_CONTINUE_INIT:
                 if (argv->iov_len < 2 * 4)
                         goto auth_err;
-                if (ntohl(svc_getu32(argv)) != RPC_AUTH_NULL)
+                if (svc_getnl(argv) != RPC_AUTH_NULL)
                         goto auth_err;
-                if (ntohl(svc_getu32(argv)) != 0)
+                if (svc_getnl(argv) != 0)
                         goto auth_err;
                 break;
         case RPC_GSS_PROC_DATA:
@@ -1076,14 +1076,14 @@ svcauth_gss_accept(struct svc_rqst *rqstp, u32 *authp)
                                 goto drop;
                         if (resv->iov_len + 4 > PAGE_SIZE)
                                 goto drop;
-                        svc_putu32(resv, rpc_success);
+                        svc_putnl(resv, RPC_SUCCESS);
                         if (svc_safe_putnetobj(resv, &rsip->out_handle))
                                 goto drop;
                         if (resv->iov_len + 3 * 4 > PAGE_SIZE)
                                 goto drop;
-                        svc_putu32(resv, htonl(rsip->major_status));
-                        svc_putu32(resv, htonl(rsip->minor_status));
-                        svc_putu32(resv, htonl(GSS_SEQ_WIN));
+                        svc_putnl(resv, rsip->major_status);
+                        svc_putnl(resv, rsip->minor_status);
+                        svc_putnl(resv, GSS_SEQ_WIN);
                         if (svc_safe_putnetobj(resv, &rsip->out_token))
                                 goto drop;
                         rqstp->rq_client = NULL;
@@ -1093,10 +1093,11 @@ svcauth_gss_accept(struct svc_rqst *rqstp, u32 *authp)
                 set_bit(CACHE_NEGATIVE, &rsci->h.flags);
                 if (resv->iov_len + 4 > PAGE_SIZE)
                         goto drop;
-                svc_putu32(resv, rpc_success);
+                svc_putnl(resv, RPC_SUCCESS);
                 goto complete;
         case RPC_GSS_PROC_DATA:
                 *authp = rpcsec_gsserr_ctxproblem;
+                svcdata->verf_start = resv->iov_base + resv->iov_len;
                 if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq))
                         goto auth_err;
                 rqstp->rq_cred = rsci->cred;
@@ -1110,18 +1111,16 @@ svcauth_gss_accept(struct svc_rqst *rqstp, u32 *authp)
                                         gc->gc_seq, rsci->mechctx))
                                 goto auth_err;
                         /* placeholders for length and seq. number: */
-                        svcdata->body_start = resv->iov_base + resv->iov_len;
-                        svc_putu32(resv, 0);
-                        svc_putu32(resv, 0);
+                        svc_putnl(resv, 0);
+                        svc_putnl(resv, 0);
                         break;
                 case RPC_GSS_SVC_PRIVACY:
                         if (unwrap_priv_data(rqstp, &rqstp->rq_arg,
                                         gc->gc_seq, rsci->mechctx))
                                 goto auth_err;
                         /* placeholders for length and seq. number: */
-                        svcdata->body_start = resv->iov_base + resv->iov_len;
-                        svc_putu32(resv, 0);
-                        svc_putu32(resv, 0);
+                        svc_putnl(resv, 0);
+                        svc_putnl(resv, 0);
                         break;
                 default:
                         goto auth_err;
@@ -1147,6 +1146,33 @@ out:
         return ret;
 }
 
+static __be32 *
+svcauth_gss_prepare_to_wrap(struct xdr_buf *resbuf, struct gss_svc_data *gsd)
+{
+        __be32 *p;
+        u32 verf_len;
+
+        p = gsd->verf_start;
+        gsd->verf_start = NULL;
+
+        /* If the reply stat is nonzero, don't wrap: */
+        if (*(p-1) != rpc_success)
+                return NULL;
+        /* Skip the verifier: */
+        p += 1;
+        verf_len = ntohl(*p++);
+        p += XDR_QUADLEN(verf_len);
+        /* move accept_stat to right place: */
+        memcpy(p, p + 2, 4);
+        /* Also don't wrap if the accept stat is nonzero: */
+        if (*p != rpc_success) {
+                resbuf->head[0].iov_len -= 2 * 4;
+                return NULL;
+        }
+        p++;
+        return p;
+}
+
 static inline int
 svcauth_gss_wrap_resp_integ(struct svc_rqst *rqstp)
 {
@@ -1156,21 +1182,13 @@ svcauth_gss_wrap_resp_integ(struct svc_rqst *rqstp)
         struct xdr_buf integ_buf;
         struct xdr_netobj mic;
         struct kvec *resv;
-        u32 *p;
+        __be32 *p;
         int integ_offset, integ_len;
         int stat = -EINVAL;
 
-        p = gsd->body_start;
-        gsd->body_start = NULL;
-        /* move accept_stat to right place: */
-        memcpy(p, p + 2, 4);
-        /* Don't wrap in failure case: */
-        /* Counting on not getting here if call was not even accepted! */
-        if (*p != rpc_success) {
-                resbuf->head[0].iov_len -= 2 * 4;
+        p = svcauth_gss_prepare_to_wrap(resbuf, gsd);
+        if (p == NULL)
                 goto out;
-        }
-        p++;
         integ_offset = (u8 *)(p + 1) - (u8 *)resbuf->head[0].iov_base;
         integ_len = resbuf->len - integ_offset;
         BUG_ON(integ_len % 4);
@@ -1191,7 +1209,6 @@ svcauth_gss_wrap_resp_integ(struct svc_rqst *rqstp)
                 resbuf->tail[0].iov_base = resbuf->head[0].iov_base
                                                 + resbuf->head[0].iov_len;
                 resbuf->tail[0].iov_len = 0;
-                rqstp->rq_restailpage = 0;
                 resv = &resbuf->tail[0];
         } else {
                 resv = &resbuf->tail[0];
@@ -1199,7 +1216,7 @@ svcauth_gss_wrap_resp_integ(struct svc_rqst *rqstp)
         mic.data = (u8 *)resv->iov_base + resv->iov_len + 4;
         if (gss_get_mic(gsd->rsci->mechctx, &integ_buf, &mic))
                 goto out_err;
-        svc_putu32(resv, htonl(mic.len));
+        svc_putnl(resv, mic.len);
         memset(mic.data + mic.len, 0,
                         round_up_to_quad(mic.len) - mic.len);
         resv->iov_len += XDR_QUADLEN(mic.len) << 2;
@@ -1219,28 +1236,20 @@ svcauth_gss_wrap_resp_priv(struct svc_rqst *rqstp)
         struct rpc_gss_wire_cred *gc = &gsd->clcred;
         struct xdr_buf *resbuf = &rqstp->rq_res;
         struct page **inpages = NULL;
-        u32 *p;
-        int offset, *len;
+        __be32 *p, *len;
+        int offset;
         int pad;
 
-        p = gsd->body_start;
-        gsd->body_start = NULL;
-        /* move accept_stat to right place: */
-        memcpy(p, p + 2, 4);
-        /* Don't wrap in failure case: */
-        /* Counting on not getting here if call was not even accepted! */
-        if (*p != rpc_success) {
-                resbuf->head[0].iov_len -= 2 * 4;
+        p = svcauth_gss_prepare_to_wrap(resbuf, gsd);
+        if (p == NULL)
                 return 0;
-        }
-        p++;
         len = p++;
         offset = (u8 *)p - (u8 *)resbuf->head[0].iov_base;
         *p++ = htonl(gc->gc_seq);
         inpages = resbuf->pages;
         /* XXX: Would be better to write some xdr helper functions for
          * nfs{2,3,4}xdr.c that place the data right, instead of copying: */
-        if (resbuf->tail[0].iov_base && rqstp->rq_restailpage == 0) {
+        if (resbuf->tail[0].iov_base) {
                 BUG_ON(resbuf->tail[0].iov_base >= resbuf->head[0].iov_base
                                                         + PAGE_SIZE);
                 BUG_ON(resbuf->tail[0].iov_base < resbuf->head[0].iov_base);
@@ -1258,13 +1267,12 @@ svcauth_gss_wrap_resp_priv(struct svc_rqst *rqstp)
                 resbuf->tail[0].iov_base = resbuf->head[0].iov_base
                         + resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE;
                 resbuf->tail[0].iov_len = 0;
-                rqstp->rq_restailpage = 0;
         }
         if (gss_wrap(gsd->rsci->mechctx, offset, resbuf, inpages))
                 return -ENOMEM;
         *len = htonl(resbuf->len - offset);
         pad = 3 - ((resbuf->len - offset - 1)&3);
-        p = (u32 *)(resbuf->tail[0].iov_base + resbuf->tail[0].iov_len);
+        p = (__be32 *)(resbuf->tail[0].iov_base + resbuf->tail[0].iov_len);
         memset(p, 0, pad);
         resbuf->tail[0].iov_len += pad;
         resbuf->len += pad;
@@ -1282,7 +1290,7 @@ svcauth_gss_release(struct svc_rqst *rqstp)
         if (gc->gc_proc != RPC_GSS_PROC_DATA)
                 goto out;
         /* Release can be called twice, but we only wrap once. */
-        if (gsd->body_start == NULL)
+        if (gsd->verf_start == NULL)
                 goto out;
         /* normally not set till svc_send, but we need it here: */
         /* XXX: what for?  Do we mess it up the moment we call svc_putu32
diff --git a/net/sunrpc/auth_null.c b/net/sunrpc/auth_null.c
index 2eccffa96ba1..3be257dc32b2 100644
--- a/net/sunrpc/auth_null.c
+++ b/net/sunrpc/auth_null.c
@@ -60,8 +60,8 @@ nul_match(struct auth_cred *acred, struct rpc_cred *cred, int taskflags)
 /*
  * Marshal credential.
  */
-static u32 *
-nul_marshal(struct rpc_task *task, u32 *p)
+static __be32 *
+nul_marshal(struct rpc_task *task, __be32 *p)
 {
         *p++ = htonl(RPC_AUTH_NULL);
         *p++ = 0;
@@ -81,8 +81,8 @@ nul_refresh(struct rpc_task *task)
         return 0;
 }
 
-static u32 *
-nul_validate(struct rpc_task *task, u32 *p)
+static __be32 *
+nul_validate(struct rpc_task *task, __be32 *p)
 {
         rpc_authflavor_t        flavor;
         u32                     size;
diff --git a/net/sunrpc/auth_unix.c b/net/sunrpc/auth_unix.c
index 74c7406a1054..f7f990c9afe2 100644
--- a/net/sunrpc/auth_unix.c
+++ b/net/sunrpc/auth_unix.c
@@ -137,12 +137,12 @@ unx_match(struct auth_cred *acred, struct rpc_cred *rcred, int flags)
  * Marshal credentials.
  * Maybe we should keep a cached credential for performance reasons.
  */
-static u32 *
-unx_marshal(struct rpc_task *task, u32 *p)
+static __be32 *
+unx_marshal(struct rpc_task *task, __be32 *p)
 {
         struct rpc_clnt *clnt = task->tk_client;
         struct unx_cred *cred = (struct unx_cred *) task->tk_msg.rpc_cred;
-        u32             *base, *hold;
+        __be32          *base, *hold;
         int             i;
 
         *p++ = htonl(RPC_AUTH_UNIX);
@@ -178,8 +178,8 @@ unx_refresh(struct rpc_task *task)
         return 0;
 }
 
-static u32 *
-unx_validate(struct rpc_task *task, u32 *p)
+static __be32 *
+unx_validate(struct rpc_task *task, __be32 *p)
 {
         rpc_authflavor_t        flavor;
         u32                     size;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 084a0ad5c64e..78696f2dc7d6 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -60,8 +60,8 @@ static void	call_refreshresult(struct rpc_task *task);
 static void     call_timeout(struct rpc_task *task);
 static void     call_connect(struct rpc_task *task);
 static void     call_connect_status(struct rpc_task *task);
-static u32 *    call_header(struct rpc_task *task);
-static u32 *    call_verify(struct rpc_task *task);
+static __be32 * call_header(struct rpc_task *task);
+static __be32 * call_verify(struct rpc_task *task);
 
 
 static int
@@ -161,10 +161,10 @@ static struct rpc_clnt * rpc_new_client(struct rpc_xprt *xprt, char *servname, s
         }
 
         /* save the nodename */
-        clnt->cl_nodelen = strlen(system_utsname.nodename);
+        clnt->cl_nodelen = strlen(utsname()->nodename);
         if (clnt->cl_nodelen > UNX_MAXNODENAME)
                 clnt->cl_nodelen = UNX_MAXNODENAME;
-        memcpy(clnt->cl_nodename, system_utsname.nodename, clnt->cl_nodelen);
+        memcpy(clnt->cl_nodename, utsname()->nodename, clnt->cl_nodelen);
         return clnt;
 
 out_no_auth:
@@ -782,7 +782,7 @@ call_encode(struct rpc_task *task)
         struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
         unsigned int    bufsiz;
         kxdrproc_t      encode;
-        u32             *p;
+        __be32          *p;
 
         dprintk("RPC: %4d call_encode (status %d)\n", 
                                 task->tk_pid, task->tk_status);
@@ -1100,7 +1100,7 @@ call_decode(struct rpc_task *task)
         struct rpc_clnt *clnt = task->tk_client;
         struct rpc_rqst *req = task->tk_rqstp;
         kxdrproc_t      decode = task->tk_msg.rpc_proc->p_decode;
-        u32             *p;
+        __be32          *p;
 
         dprintk("RPC: %4d call_decode (status %d)\n", 
                                 task->tk_pid, task->tk_status);
@@ -1197,12 +1197,12 @@ call_refreshresult(struct rpc_task *task)
 /*
  * Call header serialization
  */
-static u32 *
+static __be32 *
 call_header(struct rpc_task *task)
 {
         struct rpc_clnt *clnt = task->tk_client;
         struct rpc_rqst *req = task->tk_rqstp;
-        u32             *p = req->rq_svec[0].iov_base;
+        __be32          *p = req->rq_svec[0].iov_base;
 
         /* FIXME: check buffer size? */
 
@@ -1221,12 +1221,13 @@ call_header(struct rpc_task *task)
 /*
  * Reply header verification
  */
-static u32 *
+static __be32 *
 call_verify(struct rpc_task *task)
 {
         struct kvec *iov = &task->tk_rqstp->rq_rcv_buf.head[0];
         int len = task->tk_rqstp->rq_rcv_buf.len >> 2;
-        u32     *p = iov->iov_base, n;
+        __be32  *p = iov->iov_base;
+        u32 n;
         int error = -EACCES;
 
         if ((task->tk_rqstp->rq_rcv_buf.len & 3) != 0) {
@@ -1303,7 +1304,7 @@ call_verify(struct rpc_task *task)
                 printk(KERN_WARNING "call_verify: auth check failed\n");
                 goto out_garbage;               /* bad verifier, retry */
         }
-        len = p - (u32 *)iov->iov_base - 1;
+        len = p - (__be32 *)iov->iov_base - 1;
         if (len < 0)
                 goto out_overflow;
         switch ((n = ntohl(*p++))) {
@@ -1358,12 +1359,12 @@ out_overflow:
         goto out_garbage;
 }
 
-static int rpcproc_encode_null(void *rqstp, u32 *data, void *obj)
+static int rpcproc_encode_null(void *rqstp, __be32 *data, void *obj)
 {
         return 0;
 }
 
-static int rpcproc_decode_null(void *rqstp, u32 *data, void *obj)
+static int rpcproc_decode_null(void *rqstp, __be32 *data, void *obj)
 {
         return 0;
 }
diff --git a/net/sunrpc/pmap_clnt.c b/net/sunrpc/pmap_clnt.c
index c04609d3476a..e52afab413de 100644
--- a/net/sunrpc/pmap_clnt.c
+++ b/net/sunrpc/pmap_clnt.c
@@ -101,11 +101,13 @@ void rpc_getport(struct rpc_task *task)
         /* Autobind on cloned rpc clients is discouraged */
         BUG_ON(clnt->cl_parent != clnt);
 
-        if (xprt_test_and_set_binding(xprt)) {
-                task->tk_status = -EACCES;      /* tell caller to check again */
-                rpc_sleep_on(&xprt->binding, task, NULL, NULL);
-                return;
-        }
+        /* Put self on queue before sending rpcbind request, in case
+         * pmap_getport_done completes before we return from rpc_run_task */
+        rpc_sleep_on(&xprt->binding, task, NULL, NULL);
+
+        status = -EACCES;               /* tell caller to check again */
+        if (xprt_test_and_set_binding(xprt))
+                goto bailout_nofree;
 
         /* Someone else may have bound if we slept */
         status = 0;
@@ -134,8 +136,6 @@ void rpc_getport(struct rpc_task *task)
                 goto bailout;
         rpc_release_task(child);
 
-        rpc_sleep_on(&xprt->binding, task, NULL, NULL);
-
         task->tk_xprt->stat.bind_count++;
         return;
 
@@ -300,7 +300,7 @@ static struct rpc_clnt *pmap_create(char *hostname, struct sockaddr_in *srvaddr,
 /*
  * XDR encode/decode functions for PMAP
  */
-static int xdr_encode_mapping(struct rpc_rqst *req, u32 *p, struct portmap_args *map)
+static int xdr_encode_mapping(struct rpc_rqst *req, __be32 *p, struct portmap_args *map)
 {
         dprintk("RPC: xdr_encode_mapping(%u, %u, %u, %u)\n",
                 map->pm_prog, map->pm_vers, map->pm_prot, map->pm_port);
@@ -313,13 +313,13 @@ static int xdr_encode_mapping(struct rpc_rqst *req, u32 *p, struct portmap_args
         return 0;
 }
 
-static int xdr_decode_port(struct rpc_rqst *req, u32 *p, unsigned short *portp)
+static int xdr_decode_port(struct rpc_rqst *req, __be32 *p, unsigned short *portp)
 {
         *portp = (unsigned short) ntohl(*p++);
         return 0;
 }
 
-static int xdr_decode_bool(struct rpc_rqst *req, u32 *p, unsigned int *boolp)
+static int xdr_decode_bool(struct rpc_rqst *req, __be32 *p, unsigned int *boolp)
 {
         *boolp = (unsigned int) ntohl(*p++);
         return 0;
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index dfa504fe383f..9a0b41a97f90 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -488,14 +488,13 @@ rpc_get_inode(struct super_block *sb, int mode)
                 return NULL;
         inode->i_mode = mode;
         inode->i_uid = inode->i_gid = 0;
-        inode->i_blksize = PAGE_CACHE_SIZE;
         inode->i_blocks = 0;
         inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
         switch(mode & S_IFMT) {
                 case S_IFDIR:
                         inode->i_fop = &simple_dir_operations;
                         inode->i_op = &simple_dir_inode_operations;
-                        inode->i_nlink++;
+                        inc_nlink(inode);
                 default:
                         break;
         }
@@ -572,7 +571,7 @@ rpc_populate(struct dentry *parent,
                 if (private)
                         rpc_inode_setowner(inode, private);
                 if (S_ISDIR(mode))
-                        dir->i_nlink++;
+                        inc_nlink(dir);
                 d_add(dentry, inode);
         }
         mutex_unlock(&dir->i_mutex);
@@ -594,7 +593,7 @@ __rpc_mkdir(struct inode *dir, struct dentry *dentry)
                 goto out_err;
         inode->i_ino = iunique(dir->i_sb, 100);
         d_instantiate(dentry, inode);
-        dir->i_nlink++;
+        inc_nlink(dir);
         inode_dir_notify(dir, DN_CREATE);
         return 0;
 out_err:
@@ -858,7 +857,6 @@ int register_rpc_pipefs(void)
 
 void unregister_rpc_pipefs(void)
 {
-        if (kmem_cache_destroy(rpc_inode_cachep))
-                printk(KERN_WARNING "RPC: unable to free inode cache\n");
+        kmem_cache_destroy(rpc_inode_cachep);
         unregister_filesystem(&rpc_pipe_fs_type);
 }
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 6390461a9756..a1ab4eed41f4 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -1059,10 +1059,10 @@ rpc_destroy_mempool(void)
                 mempool_destroy(rpc_buffer_mempool);
         if (rpc_task_mempool)
                 mempool_destroy(rpc_task_mempool);
-        if (rpc_task_slabp && kmem_cache_destroy(rpc_task_slabp))
-                printk(KERN_INFO "rpc_task: not all structures were freed\n");
-        if (rpc_buffer_slabp && kmem_cache_destroy(rpc_buffer_slabp))
-                printk(KERN_INFO "rpc_buffers: not all structures were freed\n");
+        if (rpc_task_slabp)
+                kmem_cache_destroy(rpc_task_slabp);
+        if (rpc_buffer_slabp)
+                kmem_cache_destroy(rpc_buffer_slabp);
 }
 
 int
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index 26c0531d7e25..192dff5dabcb 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -70,6 +70,8 @@ EXPORT_SYMBOL(put_rpccred);
 /* RPC server stuff */
 EXPORT_SYMBOL(svc_create);
 EXPORT_SYMBOL(svc_create_thread);
+EXPORT_SYMBOL(svc_create_pooled);
+EXPORT_SYMBOL(svc_set_num_threads);
 EXPORT_SYMBOL(svc_exit_thread);
 EXPORT_SYMBOL(svc_destroy);
 EXPORT_SYMBOL(svc_drop);
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index b76a227dd3ad..eb44ec929ca1 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -4,6 +4,10 @@
  * High-level RPC service routines
  *
  * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
+ *
+ * Multiple threads pools and NUMAisation
+ * Copyright (c) 2006 Silicon Graphics, Inc.
+ * by Greg Banks <gnb@melbourne.sgi.com>
  */
 
 #include <linux/linkage.h>
@@ -12,6 +16,8 @@
 #include <linux/net.h>
 #include <linux/in.h>
 #include <linux/mm.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
 
 #include <linux/sunrpc/types.h>
 #include <linux/sunrpc/xdr.h>
@@ -23,14 +29,252 @@
 #define RPC_PARANOIA 1
 
 /*
+ * Mode for mapping cpus to pools.
+ */
+enum {
+        SVC_POOL_NONE = -1,     /* uninitialised, choose one of the others */
+        SVC_POOL_GLOBAL,        /* no mapping, just a single global pool
+                                 * (legacy & UP mode) */
+        SVC_POOL_PERCPU,        /* one pool per cpu */
+        SVC_POOL_PERNODE        /* one pool per numa node */
+};
+
+/*
+ * Structure for mapping cpus to pools and vice versa.
+ * Setup once during sunrpc initialisation.
+ */
+static struct svc_pool_map {
+        int mode;                       /* Note: int not enum to avoid
+                                         * warnings about "enumeration value
+                                         * not handled in switch" */
+        unsigned int npools;
+        unsigned int *pool_to;          /* maps pool id to cpu or node */
+        unsigned int *to_pool;          /* maps cpu or node to pool id */
+} svc_pool_map = {
+        .mode = SVC_POOL_NONE
+};
+
+
+/*
+ * Detect best pool mapping mode heuristically,
+ * according to the machine's topology.
+ */
+static int
+svc_pool_map_choose_mode(void)
+{
+        unsigned int node;
+
+        if (num_online_nodes() > 1) {
+                /*
+                 * Actually have multiple NUMA nodes,
+                 * so split pools on NUMA node boundaries
+                 */
+                return SVC_POOL_PERNODE;
+        }
+
+        node = any_online_node(node_online_map);
+        if (nr_cpus_node(node) > 2) {
+                /*
+                 * Non-trivial SMP, or CONFIG_NUMA on
+                 * non-NUMA hardware, e.g. with a generic
+                 * x86_64 kernel on Xeons.  In this case we
+                 * want to divide the pools on cpu boundaries.
+                 */
+                return SVC_POOL_PERCPU;
+        }
+
+        /* default: one global pool */
+        return SVC_POOL_GLOBAL;
+}
+
+/*
+ * Allocate the to_pool[] and pool_to[] arrays.
+ * Returns 0 on success or an errno.
+ */
+static int
+svc_pool_map_alloc_arrays(struct svc_pool_map *m, unsigned int maxpools)
+{
+        m->to_pool = kcalloc(maxpools, sizeof(unsigned int), GFP_KERNEL);
+        if (!m->to_pool)
+                goto fail;
+        m->pool_to = kcalloc(maxpools, sizeof(unsigned int), GFP_KERNEL);
+        if (!m->pool_to)
+                goto fail_free;
+
+        return 0;
+
+fail_free:
+        kfree(m->to_pool);
+fail:
+        return -ENOMEM;
+}
+
+/*
+ * Initialise the pool map for SVC_POOL_PERCPU mode.
+ * Returns number of pools or <0 on error.
+ */
+static int
+svc_pool_map_init_percpu(struct svc_pool_map *m)
+{
+        unsigned int maxpools = highest_possible_processor_id()+1;
+        unsigned int pidx = 0;
+        unsigned int cpu;
+        int err;
+
+        err = svc_pool_map_alloc_arrays(m, maxpools);
+        if (err)
+                return err;
+
+        for_each_online_cpu(cpu) {
+                BUG_ON(pidx > maxpools);
+                m->to_pool[cpu] = pidx;
+                m->pool_to[pidx] = cpu;
+                pidx++;
+        }
+        /* cpus brought online later all get mapped to pool0, sorry */
+
+        return pidx;
+};
+
+
+/*
+ * Initialise the pool map for SVC_POOL_PERNODE mode.
+ * Returns number of pools or <0 on error.
+ */
+static int
+svc_pool_map_init_pernode(struct svc_pool_map *m)
+{
+        unsigned int maxpools = highest_possible_node_id()+1;
+        unsigned int pidx = 0;
+        unsigned int node;
+        int err;
+
+        err = svc_pool_map_alloc_arrays(m, maxpools);
+        if (err)
+                return err;
+
+        for_each_node_with_cpus(node) {
+                /* some architectures (e.g. SN2) have cpuless nodes */
+                BUG_ON(pidx > maxpools);
+                m->to_pool[node] = pidx;
+                m->pool_to[pidx] = node;
+                pidx++;
+        }
+        /* nodes brought online later all get mapped to pool0, sorry */
+
+        return pidx;
+}
+
+
+/*
+ * Build the global map of cpus to pools and vice versa.
+ */
+static unsigned int
+svc_pool_map_init(void)
+{
+        struct svc_pool_map *m = &svc_pool_map;
+        int npools = -1;
+
+        if (m->mode != SVC_POOL_NONE)
+                return m->npools;
+
+        m->mode = svc_pool_map_choose_mode();
+
+        switch (m->mode) {
+        case SVC_POOL_PERCPU:
+                npools = svc_pool_map_init_percpu(m);
+                break;
+        case SVC_POOL_PERNODE:
+                npools = svc_pool_map_init_pernode(m);
+                break;
+        }
+
+        if (npools < 0) {
+                /* default, or memory allocation failure */
+                npools = 1;
+                m->mode = SVC_POOL_GLOBAL;
+        }
+        m->npools = npools;
+
+        return m->npools;
+}
+
+/*
+ * Set the current thread's cpus_allowed mask so that it
+ * will only run on cpus in the given pool.
+ *
+ * Returns 1 and fills in oldmask iff a cpumask was applied.
+ */
+static inline int
+svc_pool_map_set_cpumask(unsigned int pidx, cpumask_t *oldmask)
+{
+        struct svc_pool_map *m = &svc_pool_map;
+        unsigned int node; /* or cpu */
+
+        /*
+         * The caller checks for sv_nrpools > 1, which
+         * implies that we've been initialized and the
+         * map mode is not NONE.
+         */
+        BUG_ON(m->mode == SVC_POOL_NONE);
+
+        switch (m->mode)
+        {
+        default:
+                return 0;
+        case SVC_POOL_PERCPU:
+                node = m->pool_to[pidx];
+                *oldmask = current->cpus_allowed;
+                set_cpus_allowed(current, cpumask_of_cpu(node));
+                return 1;
+        case SVC_POOL_PERNODE:
+                node = m->pool_to[pidx];
+                *oldmask = current->cpus_allowed;
+                set_cpus_allowed(current, node_to_cpumask(node));
+                return 1;
+        }
+}
+
+/*
+ * Use the mapping mode to choose a pool for a given CPU.
+ * Used when enqueueing an incoming RPC.  Always returns
+ * a non-NULL pool pointer.
+ */
+struct svc_pool *
+svc_pool_for_cpu(struct svc_serv *serv, int cpu)
+{
+        struct svc_pool_map *m = &svc_pool_map;
+        unsigned int pidx = 0;
+
+        /*
+         * SVC_POOL_NONE happens in a pure client when
+         * lockd is brought up, so silently treat it the
+         * same as SVC_POOL_GLOBAL.
+         */
+
+        switch (m->mode) {
+        case SVC_POOL_PERCPU:
+                pidx = m->to_pool[cpu];
+                break;
+        case SVC_POOL_PERNODE:
+                pidx = m->to_pool[cpu_to_node(cpu)];
+                break;
+        }
+        return &serv->sv_pools[pidx % serv->sv_nrpools];
+}
+
+
+/*
  * Create an RPC service
  */
-struct svc_serv *
-svc_create(struct svc_program *prog, unsigned int bufsize)
+static struct svc_serv *
+__svc_create(struct svc_program *prog, unsigned int bufsize, int npools,
+           void (*shutdown)(struct svc_serv *serv))
 {
         struct svc_serv *serv;
         int vers;
         unsigned int xdrsize;
+        unsigned int i;
 
         if (!(serv = kzalloc(sizeof(*serv), GFP_KERNEL)))
                 return NULL;
@@ -38,7 +282,11 @@ svc_create(struct svc_program *prog, unsigned int bufsize)
         serv->sv_program   = prog;
         serv->sv_nrthreads = 1;
         serv->sv_stats     = prog->pg_stats;
-        serv->sv_bufsz     = bufsize? bufsize : 4096;
+        if (bufsize > RPCSVC_MAXPAYLOAD)
+                bufsize = RPCSVC_MAXPAYLOAD;
+        serv->sv_max_payload = bufsize? bufsize : 4096;
+        serv->sv_max_mesg  = roundup(serv->sv_max_payload + PAGE_SIZE, PAGE_SIZE);
+        serv->sv_shutdown  = shutdown;
         xdrsize = 0;
         while (prog) {
                 prog->pg_lovers = prog->pg_nvers-1;
@@ -53,20 +301,68 @@ svc_create(struct svc_program *prog, unsigned int bufsize)
                 prog = prog->pg_next;
         }
         serv->sv_xdrsize   = xdrsize;
-        INIT_LIST_HEAD(&serv->sv_threads);
-        INIT_LIST_HEAD(&serv->sv_sockets);
         INIT_LIST_HEAD(&serv->sv_tempsocks);
         INIT_LIST_HEAD(&serv->sv_permsocks);
+        init_timer(&serv->sv_temptimer);
         spin_lock_init(&serv->sv_lock);
 
+        serv->sv_nrpools = npools;
+        serv->sv_pools =
+                kcalloc(sizeof(struct svc_pool), serv->sv_nrpools,
+                        GFP_KERNEL);
+        if (!serv->sv_pools) {
+                kfree(serv);
+                return NULL;
+        }
+
+        for (i = 0; i < serv->sv_nrpools; i++) {
+                struct svc_pool *pool = &serv->sv_pools[i];
+
+                dprintk("initialising pool %u for %s\n",
+                                i, serv->sv_name);
+
+                pool->sp_id = i;
+                INIT_LIST_HEAD(&pool->sp_threads);
+                INIT_LIST_HEAD(&pool->sp_sockets);
+                INIT_LIST_HEAD(&pool->sp_all_threads);
+                spin_lock_init(&pool->sp_lock);
+        }
+
+
         /* Remove any stale portmap registrations */
         svc_register(serv, 0, 0);
 
         return serv;
 }
 
+struct svc_serv *
+svc_create(struct svc_program *prog, unsigned int bufsize,
+                void (*shutdown)(struct svc_serv *serv))
+{
+        return __svc_create(prog, bufsize, /*npools*/1, shutdown);
+}
+
+struct svc_serv *
+svc_create_pooled(struct svc_program *prog, unsigned int bufsize,
+                void (*shutdown)(struct svc_serv *serv),
+                  svc_thread_fn func, int sig, struct module *mod)
+{
+        struct svc_serv *serv;
+        unsigned int npools = svc_pool_map_init();
+
+        serv = __svc_create(prog, bufsize, npools, shutdown);
+
+        if (serv != NULL) {
+                serv->sv_function = func;
+                serv->sv_kill_signal = sig;
+                serv->sv_module = mod;
+        }
+
+        return serv;
+}
+
 /*
- * Destroy an RPC service
+ * Destroy an RPC service.  Should be called with the BKL held
  */
 void
 svc_destroy(struct svc_serv *serv)
@@ -85,12 +381,17 @@ svc_destroy(struct svc_serv *serv)
         } else
                 printk("svc_destroy: no threads for serv=%p!\n", serv);
 
+        del_timer_sync(&serv->sv_temptimer);
+
         while (!list_empty(&serv->sv_tempsocks)) {
                 svsk = list_entry(serv->sv_tempsocks.next,
                                   struct svc_sock,
                                   sk_list);
                 svc_delete_socket(svsk);
         }
+        if (serv->sv_shutdown)
+                serv->sv_shutdown(serv);
+
         while (!list_empty(&serv->sv_permsocks)) {
                 svsk = list_entry(serv->sv_permsocks.next,
                                   struct svc_sock,
@@ -102,6 +403,7 @@ svc_destroy(struct svc_serv *serv)
 
         /* Unregister service with the portmapper */
         svc_register(serv, 0, 0);
+        kfree(serv->sv_pools);
         kfree(serv);
 }
 
@@ -115,21 +417,18 @@ svc_init_buffer(struct svc_rqst *rqstp, unsigned int size)
         int pages;
         int arghi;
         
-        if (size > RPCSVC_MAXPAYLOAD)
-                size = RPCSVC_MAXPAYLOAD;
-        pages = 2 + (size+ PAGE_SIZE -1) / PAGE_SIZE;
-        rqstp->rq_argused = 0;
-        rqstp->rq_resused = 0;
+        pages = size / PAGE_SIZE + 1; /* extra page as we hold both request and reply.
+                                       * We assume one is at most one page
+                                       */
         arghi = 0;
         BUG_ON(pages > RPCSVC_MAXPAGES);
         while (pages) {
                 struct page *p = alloc_page(GFP_KERNEL);
                 if (!p)
                         break;
-                rqstp->rq_argpages[arghi++] = p;
+                rqstp->rq_pages[arghi++] = p;
                 pages--;
         }
-        rqstp->rq_arghi = arghi;
         return ! pages;
 }
 
@@ -139,24 +438,25 @@ svc_init_buffer(struct svc_rqst *rqstp, unsigned int size)
 static void
 svc_release_buffer(struct svc_rqst *rqstp)
 {
-        while (rqstp->rq_arghi)
-                put_page(rqstp->rq_argpages[--rqstp->rq_arghi]);
-        while (rqstp->rq_resused) {
-                if (rqstp->rq_respages[--rqstp->rq_resused] == NULL)
-                        continue;
-                put_page(rqstp->rq_respages[rqstp->rq_resused]);
-        }
-        rqstp->rq_argused = 0;
+        int i;
+        for (i=0; i<ARRAY_SIZE(rqstp->rq_pages); i++)
+                if (rqstp->rq_pages[i])
+                        put_page(rqstp->rq_pages[i]);
 }
 
 /*
- * Create a server thread
+ * Create a thread in the given pool.  Caller must hold BKL.
+ * On a NUMA or SMP machine, with a multi-pool serv, the thread
+ * will be restricted to run on the cpus belonging to the pool.
  */
-int
-svc_create_thread(svc_thread_fn func, struct svc_serv *serv)
+static int
+__svc_create_thread(svc_thread_fn func, struct svc_serv *serv,
+                    struct svc_pool *pool)
 {
         struct svc_rqst *rqstp;
         int             error = -ENOMEM;
+        int             have_oldmask = 0;
+        cpumask_t       oldmask;
 
         rqstp = kzalloc(sizeof(*rqstp), GFP_KERNEL);
         if (!rqstp)
@@ -166,12 +466,25 @@ svc_create_thread(svc_thread_fn func, struct svc_serv *serv)
 
         if (!(rqstp->rq_argp = kmalloc(serv->sv_xdrsize, GFP_KERNEL))
          || !(rqstp->rq_resp = kmalloc(serv->sv_xdrsize, GFP_KERNEL))
-         || !svc_init_buffer(rqstp, serv->sv_bufsz))
+         || !svc_init_buffer(rqstp, serv->sv_max_mesg))
                 goto out_thread;
 
         serv->sv_nrthreads++;
+        spin_lock_bh(&pool->sp_lock);
+        pool->sp_nrthreads++;
+        list_add(&rqstp->rq_all, &pool->sp_all_threads);
+        spin_unlock_bh(&pool->sp_lock);
         rqstp->rq_server = serv;
+        rqstp->rq_pool = pool;
+
+        if (serv->sv_nrpools > 1)
+                have_oldmask = svc_pool_map_set_cpumask(pool->sp_id, &oldmask);
+
         error = kernel_thread((int (*)(void *)) func, rqstp, 0);
+
+        if (have_oldmask)
+                set_cpus_allowed(current, oldmask);
+
         if (error < 0)
                 goto out_thread;
         svc_sock_update_bufs(serv);
@@ -185,17 +498,136 @@ out_thread:
 }
 
 /*
- * Destroy an RPC server thread
+ * Create a thread in the default pool.  Caller must hold BKL.
+ */
+int
+svc_create_thread(svc_thread_fn func, struct svc_serv *serv)
+{
+        return __svc_create_thread(func, serv, &serv->sv_pools[0]);
+}
+
+/*
+ * Choose a pool in which to create a new thread, for svc_set_num_threads
+ */
+static inline struct svc_pool *
+choose_pool(struct svc_serv *serv, struct svc_pool *pool, unsigned int *state)
+{
+        if (pool != NULL)
+                return pool;
+
+        return &serv->sv_pools[(*state)++ % serv->sv_nrpools];
+}
+
+/*
+ * Choose a thread to kill, for svc_set_num_threads
+ */
+static inline struct task_struct *
+choose_victim(struct svc_serv *serv, struct svc_pool *pool, unsigned int *state)
+{
+        unsigned int i;
+        struct task_struct *task = NULL;
+
+        if (pool != NULL) {
+                spin_lock_bh(&pool->sp_lock);
+        } else {
+                /* choose a pool in round-robin fashion */
+                for (i = 0; i < serv->sv_nrpools; i++) {
+                        pool = &serv->sv_pools[--(*state) % serv->sv_nrpools];
+                        spin_lock_bh(&pool->sp_lock);
+                        if (!list_empty(&pool->sp_all_threads))
+                                goto found_pool;
+                        spin_unlock_bh(&pool->sp_lock);
+                }
+                return NULL;
+        }
+
+found_pool:
+        if (!list_empty(&pool->sp_all_threads)) {
+                struct svc_rqst *rqstp;
+
+                /*
+                 * Remove from the pool->sp_all_threads list
+                 * so we don't try to kill it again.
+                 */
+                rqstp = list_entry(pool->sp_all_threads.next, struct svc_rqst, rq_all);
+                list_del_init(&rqstp->rq_all);
+                task = rqstp->rq_task;
+        }
+        spin_unlock_bh(&pool->sp_lock);
+
+        return task;
+}
+
+/*
+ * Create or destroy enough new threads to make the number
+ * of threads the given number.  If `pool' is non-NULL, applies
+ * only to threads in that pool, otherwise round-robins between
+ * all pools.  Must be called with a svc_get() reference and
+ * the BKL held.
+ *
+ * Destroying threads relies on the service threads filling in
+ * rqstp->rq_task, which only the nfs ones do.  Assumes the serv
+ * has been created using svc_create_pooled().
+ *
+ * Based on code that used to be in nfsd_svc() but tweaked
+ * to be pool-aware.
+ */
+int
+svc_set_num_threads(struct svc_serv *serv, struct svc_pool *pool, int nrservs)
+{
+        struct task_struct *victim;
+        int error = 0;
+        unsigned int state = serv->sv_nrthreads-1;
+
+        if (pool == NULL) {
+                /* The -1 assumes caller has done a svc_get() */
+                nrservs -= (serv->sv_nrthreads-1);
+        } else {
+                spin_lock_bh(&pool->sp_lock);
+                nrservs -= pool->sp_nrthreads;
+                spin_unlock_bh(&pool->sp_lock);
+        }
+
+        /* create new threads */
+        while (nrservs > 0) {
+                nrservs--;
+                __module_get(serv->sv_module);
+                error = __svc_create_thread(serv->sv_function, serv,
+                                            choose_pool(serv, pool, &state));
+                if (error < 0) {
+                        module_put(serv->sv_module);
+                        break;
+                }
+        }
+        /* destroy old threads */
+        while (nrservs < 0 &&
+               (victim = choose_victim(serv, pool, &state)) != NULL) {
+                send_sig(serv->sv_kill_signal, victim, 1);
+                nrservs++;
+        }
+
+        return error;
+}
+
+/*
+ * Called from a server thread as it's exiting.  Caller must hold BKL.
  */
 void
 svc_exit_thread(struct svc_rqst *rqstp)
 {
         struct svc_serv *serv = rqstp->rq_server;
+        struct svc_pool *pool = rqstp->rq_pool;
 
         svc_release_buffer(rqstp);
         kfree(rqstp->rq_resp);
         kfree(rqstp->rq_argp);
         kfree(rqstp->rq_auth_data);
+
+        spin_lock_bh(&pool->sp_lock);
+        pool->sp_nrthreads--;
+        list_del(&rqstp->rq_all);
+        spin_unlock_bh(&pool->sp_lock);
+
         kfree(rqstp);
 
         /* Release the server */
@@ -215,23 +647,32 @@ svc_register(struct svc_serv *serv, int proto, unsigned short port)
         unsigned long           flags;
         int                     i, error = 0, dummy;
 
-        progp = serv->sv_program;
-
-        dprintk("RPC: svc_register(%s, %s, %d)\n",
-                progp->pg_name, proto == IPPROTO_UDP? "udp" : "tcp", port);
-
         if (!port)
                 clear_thread_flag(TIF_SIGPENDING);
 
-        for (i = 0; i < progp->pg_nvers; i++) {
-                if (progp->pg_vers[i] == NULL)
-                        continue;
-                error = rpc_register(progp->pg_prog, i, proto, port, &dummy);
-                if (error < 0)
-                        break;
-                if (port && !dummy) {
-                        error = -EACCES;
-                        break;
+        for (progp = serv->sv_program; progp; progp = progp->pg_next) {
+                for (i = 0; i < progp->pg_nvers; i++) {
+                        if (progp->pg_vers[i] == NULL)
+                                continue;
+
+                        dprintk("RPC: svc_register(%s, %s, %d, %d)%s\n",
+                                        progp->pg_name,
+                                        proto == IPPROTO_UDP?  "udp" : "tcp",
+                                        port,
+                                        i,
+                                        progp->pg_vers[i]->vs_hidden?
+                                                " (but not telling portmap)" : "");
+
+                        if (progp->pg_vers[i]->vs_hidden)
+                                continue;
+
+                        error = rpc_register(progp->pg_prog, i, proto, port, &dummy);
+                        if (error < 0)
+                                break;
+                        if (port && !dummy) {
+                                error = -EACCES;
+                                break;
+                        }
                 }
         }
 
@@ -248,19 +689,20 @@ svc_register(struct svc_serv *serv, int proto, unsigned short port)
  * Process the RPC request.
  */
 int
-svc_process(struct svc_serv *serv, struct svc_rqst *rqstp)
+svc_process(struct svc_rqst *rqstp)
 {
         struct svc_program      *progp;
         struct svc_version      *versp = NULL;  /* compiler food */
         struct svc_procedure    *procp = NULL;
         struct kvec *           argv = &rqstp->rq_arg.head[0];
         struct kvec *           resv = &rqstp->rq_res.head[0];
+        struct svc_serv         *serv = rqstp->rq_server;
         kxdrproc_t              xdr;
-        u32                     *statp;
-        u32                     dir, prog, vers, proc,
-                                auth_stat, rpc_stat;
+        __be32                  *statp;
+        u32                     dir, prog, vers, proc;
+        __be32                  auth_stat, rpc_stat;
         int                     auth_res;
-        u32                     *accept_statp;
+        __be32                  *reply_statp;
 
         rpc_stat = rpc_success;
 
@@ -270,10 +712,10 @@ svc_process(struct svc_serv *serv, struct svc_rqst *rqstp)
         /* setup response xdr_buf.
          * Initially it has just one page 
          */
-        svc_take_page(rqstp); /* must succeed */
+        rqstp->rq_resused = 1;
         resv->iov_base = page_address(rqstp->rq_respages[0]);
         resv->iov_len = 0;
-        rqstp->rq_res.pages = rqstp->rq_respages+1;
+        rqstp->rq_res.pages = rqstp->rq_respages + 1;
         rqstp->rq_res.len = 0;
         rqstp->rq_res.page_base = 0;
         rqstp->rq_res.page_len = 0;
@@ -284,16 +726,16 @@ svc_process(struct svc_serv *serv, struct svc_rqst *rqstp)
         rqstp->rq_sendfile_ok = 1;
         /* tcp needs a space for the record length... */
         if (rqstp->rq_prot == IPPROTO_TCP)
-                svc_putu32(resv, 0);
+                svc_putnl(resv, 0);
 
         rqstp->rq_xid = svc_getu32(argv);
         svc_putu32(resv, rqstp->rq_xid);
 
-        dir  = ntohl(svc_getu32(argv));
-        vers = ntohl(svc_getu32(argv));
+        dir  = svc_getnl(argv);
+        vers = svc_getnl(argv);
 
         /* First words of reply: */
-        svc_putu32(resv, xdr_one);              /* REPLY */
+        svc_putnl(resv, 1);             /* REPLY */
 
         if (dir != 0)           /* direction != CALL */
                 goto err_bad_dir;
@@ -301,13 +743,13 @@ svc_process(struct svc_serv *serv, struct svc_rqst *rqstp)
                 goto err_bad_rpc;
 
         /* Save position in case we later decide to reject: */
-        accept_statp = resv->iov_base + resv->iov_len;
+        reply_statp = resv->iov_base + resv->iov_len;
 
-        svc_putu32(resv, xdr_zero);             /* ACCEPT */
+        svc_putnl(resv, 0);             /* ACCEPT */
 
-        rqstp->rq_prog = prog = ntohl(svc_getu32(argv));        /* program number */
-        rqstp->rq_vers = vers = ntohl(svc_getu32(argv));        /* version number */
-        rqstp->rq_proc = proc = ntohl(svc_getu32(argv));        /* procedure number */
+        rqstp->rq_prog = prog = svc_getnl(argv);        /* program number */
+        rqstp->rq_vers = vers = svc_getnl(argv);        /* version number */
+        rqstp->rq_proc = proc = svc_getnl(argv);        /* procedure number */
 
         progp = serv->sv_program;
 
@@ -361,7 +803,7 @@ svc_process(struct svc_serv *serv, struct svc_rqst *rqstp)
 
         /* Build the reply header. */
         statp = resv->iov_base +resv->iov_len;
-        svc_putu32(resv, rpc_success);          /* RPC_SUCCESS */
+        svc_putnl(resv, RPC_SUCCESS);
 
         /* Bump per-procedure stats counter */
         procp->pc_count++;
@@ -386,6 +828,11 @@ svc_process(struct svc_serv *serv, struct svc_rqst *rqstp)
                 *statp = procp->pc_func(rqstp, rqstp->rq_argp, rqstp->rq_resp);
 
                 /* Encode reply */
+                if (*statp == rpc_drop_reply) {
+                        if (procp->pc_release)
+                                procp->pc_release(rqstp, NULL, rqstp->rq_resp);
+                        goto dropit;
+                }
                 if (*statp == rpc_success && (xdr = procp->pc_encode)
                  && !xdr(rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) {
                         dprintk("svc: failed to encode reply\n");
@@ -439,26 +886,26 @@ err_bad_dir:
 
 err_bad_rpc:
         serv->sv_stats->rpcbadfmt++;
-        svc_putu32(resv, xdr_one);      /* REJECT */
-        svc_putu32(resv, xdr_zero);     /* RPC_MISMATCH */
-        svc_putu32(resv, xdr_two);      /* Only RPCv2 supported */
-        svc_putu32(resv, xdr_two);
+        svc_putnl(resv, 1);     /* REJECT */
+        svc_putnl(resv, 0);     /* RPC_MISMATCH */
+        svc_putnl(resv, 2);     /* Only RPCv2 supported */
+        svc_putnl(resv, 2);
         goto sendit;
 
 err_bad_auth:
         dprintk("svc: authentication failed (%d)\n", ntohl(auth_stat));
         serv->sv_stats->rpcbadauth++;
         /* Restore write pointer to location of accept status: */
-        xdr_ressize_check(rqstp, accept_statp);
-        svc_putu32(resv, xdr_one);      /* REJECT */
-        svc_putu32(resv, xdr_one);      /* AUTH_ERROR */
-        svc_putu32(resv, auth_stat);    /* status */
+        xdr_ressize_check(rqstp, reply_statp);
+        svc_putnl(resv, 1);     /* REJECT */
+        svc_putnl(resv, 1);     /* AUTH_ERROR */
+        svc_putnl(resv, ntohl(auth_stat));      /* status */
         goto sendit;
 
 err_bad_prog:
         dprintk("svc: unknown program %d\n", prog);
         serv->sv_stats->rpcbadfmt++;
-        svc_putu32(resv, rpc_prog_unavail);
+        svc_putnl(resv, RPC_PROG_UNAVAIL);
         goto sendit;
 
 err_bad_vers:
@@ -466,9 +913,9 @@ err_bad_vers:
         printk("svc: unknown version (%d)\n", vers);
 #endif
         serv->sv_stats->rpcbadfmt++;
-        svc_putu32(resv, rpc_prog_mismatch);
-        svc_putu32(resv, htonl(progp->pg_lovers));
-        svc_putu32(resv, htonl(progp->pg_hivers));
+        svc_putnl(resv, RPC_PROG_MISMATCH);
+        svc_putnl(resv, progp->pg_lovers);
+        svc_putnl(resv, progp->pg_hivers);
         goto sendit;
 
 err_bad_proc:
@@ -476,7 +923,7 @@ err_bad_proc:
         printk("svc: unknown procedure (%d)\n", proc);
 #endif
         serv->sv_stats->rpcbadfmt++;
-        svc_putu32(resv, rpc_proc_unavail);
+        svc_putnl(resv, RPC_PROC_UNAVAIL);
         goto sendit;
 
 err_garbage:
@@ -486,6 +933,21 @@ err_garbage:
         rpc_stat = rpc_garbage_args;
 err_bad:
         serv->sv_stats->rpcbadfmt++;
-        svc_putu32(resv, rpc_stat);
+        svc_putnl(resv, ntohl(rpc_stat));
         goto sendit;
 }
+
+/*
+ * Return (transport-specific) limit on the rpc payload.
+ */
+u32 svc_max_payload(const struct svc_rqst *rqstp)
+{
+        int max = RPCSVC_MAXPAYLOAD_TCP;
+
+        if (rqstp->rq_sock->sk_sock->type == SOCK_DGRAM)
+                max = RPCSVC_MAXPAYLOAD_UDP;
+        if (rqstp->rq_server->sv_max_payload < max)
+                max = rqstp->rq_server->sv_max_payload;
+        return max;
+}
+EXPORT_SYMBOL_GPL(svc_max_payload);
diff --git a/net/sunrpc/svcauth.c b/net/sunrpc/svcauth.c
index 5b28c6176806..8f2320aded5c 100644
--- a/net/sunrpc/svcauth.c
+++ b/net/sunrpc/svcauth.c
@@ -35,14 +35,14 @@ static struct auth_ops	*authtab[RPC_AUTH_MAXFLAVOR] = {
 };
 
 int
-svc_authenticate(struct svc_rqst *rqstp, u32 *authp)
+svc_authenticate(struct svc_rqst *rqstp, __be32 *authp)
 {
         rpc_authflavor_t        flavor;
         struct auth_ops         *aops;
 
         *authp = rpc_auth_ok;
 
-        flavor = ntohl(svc_getu32(&rqstp->rq_arg.head[0]));
+        flavor = svc_getnl(&rqstp->rq_arg.head[0]);
 
         dprintk("svc: svc_authenticate (%d)\n", flavor);
 
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 7e5707e2d6b6..e1bd933629fe 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -9,6 +9,7 @@
 #include <linux/seq_file.h>
 #include <linux/hash.h>
 #include <linux/string.h>
+#include <net/sock.h>
 
 #define RPCDBG_FACILITY RPCDBG_AUTH
 
@@ -145,7 +146,7 @@ static void ip_map_request(struct cache_detail *cd,
 {
         char text_addr[20];
         struct ip_map *im = container_of(h, struct ip_map, h);
-        __u32 addr = im->m_addr.s_addr;
+        __be32 addr = im->m_addr.s_addr;
         
         snprintf(text_addr, 20, "%u.%u.%u.%u",
                  ntohl(addr) >> 24 & 0xff,
@@ -249,10 +250,10 @@ static int ip_map_show(struct seq_file *m,
 
         seq_printf(m, "%s %d.%d.%d.%d %s\n",
                    im->m_class,
-                   htonl(addr.s_addr) >> 24 & 0xff,
-                   htonl(addr.s_addr) >> 16 & 0xff,
-                   htonl(addr.s_addr) >>  8 & 0xff,
-                   htonl(addr.s_addr) >>  0 & 0xff,
+                   ntohl(addr.s_addr) >> 24 & 0xff,
+                   ntohl(addr.s_addr) >> 16 & 0xff,
+                   ntohl(addr.s_addr) >>  8 & 0xff,
+                   ntohl(addr.s_addr) >>  0 & 0xff,
                    dom
                    );
         return 0;
@@ -348,12 +349,9 @@ int auth_unix_forget_old(struct auth_domain *dom)
 
 struct auth_domain *auth_unix_lookup(struct in_addr addr)
 {
-        struct ip_map key, *ipm;
+        struct ip_map *ipm;
         struct auth_domain *rv;
 
-        strcpy(key.m_class, "nfsd");
-        key.m_addr = addr;
-
         ipm = ip_map_lookup("nfsd", addr);
 
         if (!ipm)
@@ -378,6 +376,44 @@ void svcauth_unix_purge(void)
         cache_purge(&ip_map_cache);
 }
 
+static inline struct ip_map *
+ip_map_cached_get(struct svc_rqst *rqstp)
+{
+        struct ip_map *ipm = rqstp->rq_sock->sk_info_authunix;
+        if (ipm != NULL) {
+                if (!cache_valid(&ipm->h)) {
+                        /*
+                         * The entry has been invalidated since it was
+                         * remembered, e.g. by a second mount from the
+                         * same IP address.
+                         */
+                        rqstp->rq_sock->sk_info_authunix = NULL;
+                        cache_put(&ipm->h, &ip_map_cache);
+                        return NULL;
+                }
+                cache_get(&ipm->h);
+        }
+        return ipm;
+}
+
+static inline void
+ip_map_cached_put(struct svc_rqst *rqstp, struct ip_map *ipm)
+{
+        struct svc_sock *svsk = rqstp->rq_sock;
+
+        if (svsk->sk_sock->type == SOCK_STREAM && svsk->sk_info_authunix == NULL)
+                svsk->sk_info_authunix = ipm;   /* newly cached, keep the reference */
+        else
+                cache_put(&ipm->h, &ip_map_cache);
+}
+
+void
+svcauth_unix_info_release(void *info)
+{
+        struct ip_map *ipm = info;
+        cache_put(&ipm->h, &ip_map_cache);
+}
+
 static int
 svcauth_unix_set_client(struct svc_rqst *rqstp)
 {
@@ -387,8 +423,10 @@ svcauth_unix_set_client(struct svc_rqst *rqstp)
         if (rqstp->rq_proc == 0)
                 return SVC_OK;
 
-        ipm = ip_map_lookup(rqstp->rq_server->sv_program->pg_class,
-                            rqstp->rq_addr.sin_addr);
+        ipm = ip_map_cached_get(rqstp);
+        if (ipm == NULL)
+                ipm = ip_map_lookup(rqstp->rq_server->sv_program->pg_class,
+                                    rqstp->rq_addr.sin_addr);
 
         if (ipm == NULL)
                 return SVC_DENIED;
@@ -403,14 +441,14 @@ svcauth_unix_set_client(struct svc_rqst *rqstp)
                 case 0:
                         rqstp->rq_client = &ipm->m_client->h;
                         kref_get(&rqstp->rq_client->ref);
-                        cache_put(&ipm->h, &ip_map_cache);
+                        ip_map_cached_put(rqstp, ipm);
                         break;
         }
         return SVC_OK;
 }
 
 static int
-svcauth_null_accept(struct svc_rqst *rqstp, u32 *authp)
+svcauth_null_accept(struct svc_rqst *rqstp, __be32 *authp)
 {
         struct kvec     *argv = &rqstp->rq_arg.head[0];
         struct kvec     *resv = &rqstp->rq_res.head[0];
@@ -427,7 +465,7 @@ svcauth_null_accept(struct svc_rqst *rqstp, u32 *authp)
                 *authp = rpc_autherr_badcred;
                 return SVC_DENIED;
         }
-        if (svc_getu32(argv) != RPC_AUTH_NULL || svc_getu32(argv) != 0) {
+        if (svc_getu32(argv) != htonl(RPC_AUTH_NULL) || svc_getu32(argv) != 0) {
                 dprintk("svc: bad null verf\n");
                 *authp = rpc_autherr_badverf;
                 return SVC_DENIED;
@@ -441,8 +479,8 @@ svcauth_null_accept(struct svc_rqst *rqstp, u32 *authp)
                 return SVC_DROP; /* kmalloc failure - client must retry */
 
         /* Put NULL verifier */
-        svc_putu32(resv, RPC_AUTH_NULL);
-        svc_putu32(resv, 0);
+        svc_putnl(resv, RPC_AUTH_NULL);
+        svc_putnl(resv, 0);
 
         return SVC_OK;
 }
@@ -472,7 +510,7 @@ struct auth_ops svcauth_null = {
 
 
 static int
-svcauth_unix_accept(struct svc_rqst *rqstp, u32 *authp)
+svcauth_unix_accept(struct svc_rqst *rqstp, __be32 *authp)
 {
         struct kvec     *argv = &rqstp->rq_arg.head[0];
         struct kvec     *resv = &rqstp->rq_res.head[0];
@@ -488,31 +526,31 @@ svcauth_unix_accept(struct svc_rqst *rqstp, u32 *authp)
 
         svc_getu32(argv);                       /* length */
         svc_getu32(argv);                       /* time stamp */
-        slen = XDR_QUADLEN(ntohl(svc_getu32(argv)));    /* machname length */
+        slen = XDR_QUADLEN(svc_getnl(argv));    /* machname length */
         if (slen > 64 || (len -= (slen + 3)*4) < 0)
                 goto badcred;
-        argv->iov_base = (void*)((u32*)argv->iov_base + slen);  /* skip machname */
+        argv->iov_base = (void*)((__be32*)argv->iov_base + slen);       /* skip machname */
         argv->iov_len -= slen*4;
 
-        cred->cr_uid = ntohl(svc_getu32(argv));         /* uid */
-        cred->cr_gid = ntohl(svc_getu32(argv));         /* gid */
-        slen = ntohl(svc_getu32(argv));                 /* gids length */
+        cred->cr_uid = svc_getnl(argv);         /* uid */
+        cred->cr_gid = svc_getnl(argv);         /* gid */
+        slen = svc_getnl(argv);                 /* gids length */
         if (slen > 16 || (len -= (slen + 2)*4) < 0)
                 goto badcred;
         cred->cr_group_info = groups_alloc(slen);
         if (cred->cr_group_info == NULL)
                 return SVC_DROP;
         for (i = 0; i < slen; i++)
-                GROUP_AT(cred->cr_group_info, i) = ntohl(svc_getu32(argv));
+                GROUP_AT(cred->cr_group_info, i) = svc_getnl(argv);
 
-        if (svc_getu32(argv) != RPC_AUTH_NULL || svc_getu32(argv) != 0) {
+        if (svc_getu32(argv) != htonl(RPC_AUTH_NULL) || svc_getu32(argv) != 0) {
                 *authp = rpc_autherr_badverf;
                 return SVC_DENIED;
         }
 
         /* Put NULL verifier */
-        svc_putu32(resv, RPC_AUTH_NULL);
-        svc_putu32(resv, 0);
+        svc_putnl(resv, RPC_AUTH_NULL);
+        svc_putnl(resv, 0);
 
         return SVC_OK;
 
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 953aff89bcac..96521f16342b 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -31,6 +31,7 @@
 #include <linux/slab.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/file.h>
 #include <net/sock.h>
 #include <net/checksum.h>
 #include <net/ip.h>
@@ -45,13 +46,16 @@
 
 /* SMP locking strategy:
  *
- *      svc_serv->sv_lock protects most stuff for that service.
+ *      svc_pool->sp_lock protects most of the fields of that pool.
+ *      svc_serv->sv_lock protects sv_tempsocks, sv_permsocks, sv_tmpcnt.
+ *      when both need to be taken (rare), svc_serv->sv_lock is first.
+ *      BKL protects svc_serv->sv_nrthread.
+ *      svc_sock->sk_defer_lock protects the svc_sock->sk_deferred list
+ *      svc_sock->sk_flags.SK_BUSY prevents a svc_sock being enqueued multiply.
  *
  *      Some flags can be set to certain values at any time
  *      providing that certain rules are followed:
  *
- *      SK_BUSY  can be set to 0 at any time.  
- *              svc_sock_enqueue must be called afterwards
  *      SK_CONN, SK_DATA, can be set or cleared at any time.
  *              after a set, svc_sock_enqueue must be called.   
  *              after a clear, the socket must be read/accepted
@@ -73,23 +77,30 @@ static struct svc_deferred_req *svc_deferred_dequeue(struct svc_sock *svsk);
 static int svc_deferred_recv(struct svc_rqst *rqstp);
 static struct cache_deferred_req *svc_defer(struct cache_req *req);
 
+/* apparently the "standard" is that clients close
+ * idle connections after 5 minutes, servers after
+ * 6 minutes
+ *   http://www.connectathon.org/talks96/nfstcp.pdf
+ */
+static int svc_conn_age_period = 6*60;
+
 /*
- * Queue up an idle server thread.  Must have serv->sv_lock held.
+ * Queue up an idle server thread.  Must have pool->sp_lock held.
  * Note: this is really a stack rather than a queue, so that we only
- * use as many different threads as we need, and the rest don't polute
+ * use as many different threads as we need, and the rest don't pollute
  * the cache.
  */
 static inline void
-svc_serv_enqueue(struct svc_serv *serv, struct svc_rqst *rqstp)
+svc_thread_enqueue(struct svc_pool *pool, struct svc_rqst *rqstp)
 {
-        list_add(&rqstp->rq_list, &serv->sv_threads);
+        list_add(&rqstp->rq_list, &pool->sp_threads);
 }
 
 /*
- * Dequeue an nfsd thread.  Must have serv->sv_lock held.
+ * Dequeue an nfsd thread.  Must have pool->sp_lock held.
  */
 static inline void
-svc_serv_dequeue(struct svc_serv *serv, struct svc_rqst *rqstp)
+svc_thread_dequeue(struct svc_pool *pool, struct svc_rqst *rqstp)
 {
         list_del(&rqstp->rq_list);
 }
@@ -140,7 +151,9 @@ static void
 svc_sock_enqueue(struct svc_sock *svsk)
 {
         struct svc_serv *serv = svsk->sk_server;
+        struct svc_pool *pool;
         struct svc_rqst *rqstp;
+        int cpu;
 
         if (!(svsk->sk_flags &
               ( (1<<SK_CONN)|(1<<SK_DATA)|(1<<SK_CLOSE)|(1<<SK_DEFERRED)) ))
@@ -148,10 +161,14 @@ svc_sock_enqueue(struct svc_sock *svsk)
         if (test_bit(SK_DEAD, &svsk->sk_flags))
                 return;
 
-        spin_lock_bh(&serv->sv_lock);
+        cpu = get_cpu();
+        pool = svc_pool_for_cpu(svsk->sk_server, cpu);
+        put_cpu();
+
+        spin_lock_bh(&pool->sp_lock);
 
-        if (!list_empty(&serv->sv_threads) && 
-            !list_empty(&serv->sv_sockets))
+        if (!list_empty(&pool->sp_threads) &&
+            !list_empty(&pool->sp_sockets))
                 printk(KERN_ERR
                         "svc_sock_enqueue: threads and sockets both waiting??\n");
 
@@ -161,73 +178,79 @@ svc_sock_enqueue(struct svc_sock *svsk)
                 goto out_unlock;
         }
 
-        if (test_bit(SK_BUSY, &svsk->sk_flags)) {
-                /* Don't enqueue socket while daemon is receiving */
+        /* Mark socket as busy. It will remain in this state until the
+         * server has processed all pending data and put the socket back
+         * on the idle list.  We update SK_BUSY atomically because
+         * it also guards against trying to enqueue the svc_sock twice.
+         */
+        if (test_and_set_bit(SK_BUSY, &svsk->sk_flags)) {
+                /* Don't enqueue socket while already enqueued */
                 dprintk("svc: socket %p busy, not enqueued\n", svsk->sk_sk);
                 goto out_unlock;
         }
+        BUG_ON(svsk->sk_pool != NULL);
+        svsk->sk_pool = pool;
 
         set_bit(SOCK_NOSPACE, &svsk->sk_sock->flags);
-        if (((svsk->sk_reserved + serv->sv_bufsz)*2
+        if (((atomic_read(&svsk->sk_reserved) + serv->sv_max_mesg)*2
              > svc_sock_wspace(svsk))
             && !test_bit(SK_CLOSE, &svsk->sk_flags)
             && !test_bit(SK_CONN, &svsk->sk_flags)) {
                 /* Don't enqueue while not enough space for reply */
                 dprintk("svc: socket %p  no space, %d*2 > %ld, not enqueued\n",
-                        svsk->sk_sk, svsk->sk_reserved+serv->sv_bufsz,
+                        svsk->sk_sk, atomic_read(&svsk->sk_reserved)+serv->sv_max_mesg,
                         svc_sock_wspace(svsk));
+                svsk->sk_pool = NULL;
+                clear_bit(SK_BUSY, &svsk->sk_flags);
                 goto out_unlock;
         }
         clear_bit(SOCK_NOSPACE, &svsk->sk_sock->flags);
 
-        /* Mark socket as busy. It will remain in this state until the
-         * server has processed all pending data and put the socket back
-         * on the idle list.
-         */
-        set_bit(SK_BUSY, &svsk->sk_flags);
 
-        if (!list_empty(&serv->sv_threads)) {
-                rqstp = list_entry(serv->sv_threads.next,
+        if (!list_empty(&pool->sp_threads)) {
+                rqstp = list_entry(pool->sp_threads.next,
                                    struct svc_rqst,
                                    rq_list);
                 dprintk("svc: socket %p served by daemon %p\n",
                         svsk->sk_sk, rqstp);
-                svc_serv_dequeue(serv, rqstp);
+                svc_thread_dequeue(pool, rqstp);
                 if (rqstp->rq_sock)
                         printk(KERN_ERR 
                                 "svc_sock_enqueue: server %p, rq_sock=%p!\n",
                                 rqstp, rqstp->rq_sock);
                 rqstp->rq_sock = svsk;
-                svsk->sk_inuse++;
-                rqstp->rq_reserved = serv->sv_bufsz;
-                svsk->sk_reserved += rqstp->rq_reserved;
+                atomic_inc(&svsk->sk_inuse);
+                rqstp->rq_reserved = serv->sv_max_mesg;
+                atomic_add(rqstp->rq_reserved, &svsk->sk_reserved);
+                BUG_ON(svsk->sk_pool != pool);
                 wake_up(&rqstp->rq_wait);
         } else {
                 dprintk("svc: socket %p put into queue\n", svsk->sk_sk);
-                list_add_tail(&svsk->sk_ready, &serv->sv_sockets);
+                list_add_tail(&svsk->sk_ready, &pool->sp_sockets);
+                BUG_ON(svsk->sk_pool != pool);
         }
 
 out_unlock:
-        spin_unlock_bh(&serv->sv_lock);
+        spin_unlock_bh(&pool->sp_lock);
 }
 
 /*
- * Dequeue the first socket.  Must be called with the serv->sv_lock held.
+ * Dequeue the first socket.  Must be called with the pool->sp_lock held.
  */
 static inline struct svc_sock *
-svc_sock_dequeue(struct svc_serv *serv)
+svc_sock_dequeue(struct svc_pool *pool)
 {
         struct svc_sock *svsk;
 
-        if (list_empty(&serv->sv_sockets))
+        if (list_empty(&pool->sp_sockets))
                 return NULL;
 
-        svsk = list_entry(serv->sv_sockets.next,
+        svsk = list_entry(pool->sp_sockets.next,
                           struct svc_sock, sk_ready);
         list_del_init(&svsk->sk_ready);
 
         dprintk("svc: socket %p dequeued, inuse=%d\n",
-                svsk->sk_sk, svsk->sk_inuse);
+                svsk->sk_sk, atomic_read(&svsk->sk_inuse));
 
         return svsk;
 }
@@ -241,6 +264,7 @@ svc_sock_dequeue(struct svc_serv *serv)
 static inline void
 svc_sock_received(struct svc_sock *svsk)
 {
+        svsk->sk_pool = NULL;
         clear_bit(SK_BUSY, &svsk->sk_flags);
         svc_sock_enqueue(svsk);
 }
@@ -262,10 +286,8 @@ void svc_reserve(struct svc_rqst *rqstp, int space)
 
         if (space < rqstp->rq_reserved) {
                 struct svc_sock *svsk = rqstp->rq_sock;
-                spin_lock_bh(&svsk->sk_server->sv_lock);
-                svsk->sk_reserved -= (rqstp->rq_reserved - space);
+                atomic_sub((rqstp->rq_reserved - space), &svsk->sk_reserved);
                 rqstp->rq_reserved = space;
-                spin_unlock_bh(&svsk->sk_server->sv_lock);
 
                 svc_sock_enqueue(svsk);
         }
@@ -277,17 +299,11 @@ void svc_reserve(struct svc_rqst *rqstp, int space)
 static inline void
 svc_sock_put(struct svc_sock *svsk)
 {
-        struct svc_serv *serv = svsk->sk_server;
-
-        spin_lock_bh(&serv->sv_lock);
-        if (!--(svsk->sk_inuse) && test_bit(SK_DEAD, &svsk->sk_flags)) {
-                spin_unlock_bh(&serv->sv_lock);
+        if (atomic_dec_and_test(&svsk->sk_inuse) && test_bit(SK_DEAD, &svsk->sk_flags)) {
                 dprintk("svc: releasing dead socket\n");
                 sock_release(svsk->sk_sock);
                 kfree(svsk);
         }
-        else
-                spin_unlock_bh(&serv->sv_lock);
 }
 
 static void
@@ -297,7 +313,7 @@ svc_sock_release(struct svc_rqst *rqstp)
 
         svc_release_skb(rqstp);
 
-        svc_free_allpages(rqstp);
+        svc_free_res_pages(rqstp);
         rqstp->rq_res.page_len = 0;
         rqstp->rq_res.page_base = 0;
 
@@ -321,25 +337,33 @@ svc_sock_release(struct svc_rqst *rqstp)
 
 /*
  * External function to wake up a server waiting for data
+ * This really only makes sense for services like lockd
+ * which have exactly one thread anyway.
  */
 void
 svc_wake_up(struct svc_serv *serv)
 {
         struct svc_rqst *rqstp;
-
-        spin_lock_bh(&serv->sv_lock);
-        if (!list_empty(&serv->sv_threads)) {
-                rqstp = list_entry(serv->sv_threads.next,
-                                   struct svc_rqst,
-                                   rq_list);
-                dprintk("svc: daemon %p woken up.\n", rqstp);
-                /*
-                svc_serv_dequeue(serv, rqstp);
-                rqstp->rq_sock = NULL;
-                 */
-                wake_up(&rqstp->rq_wait);
+        unsigned int i;
+        struct svc_pool *pool;
+
+        for (i = 0; i < serv->sv_nrpools; i++) {
+                pool = &serv->sv_pools[i];
+
+                spin_lock_bh(&pool->sp_lock);
+                if (!list_empty(&pool->sp_threads)) {
+                        rqstp = list_entry(pool->sp_threads.next,
+                                           struct svc_rqst,
+                                           rq_list);
+                        dprintk("svc: daemon %p woken up.\n", rqstp);
+                        /*
+                        svc_thread_dequeue(pool, rqstp);
+                        rqstp->rq_sock = NULL;
+                         */
+                        wake_up(&rqstp->rq_wait);
+                }
+                spin_unlock_bh(&pool->sp_lock);
         }
-        spin_unlock_bh(&serv->sv_lock);
 }
 
 /*
@@ -388,7 +412,8 @@ svc_sendto(struct svc_rqst *rqstp, struct xdr_buf *xdr)
         /* send head */
         if (slen == xdr->head[0].iov_len)
                 flags = 0;
-        len = kernel_sendpage(sock, rqstp->rq_respages[0], 0, xdr->head[0].iov_len, flags);
+        len = kernel_sendpage(sock, rqstp->rq_respages[0], 0,
+                                  xdr->head[0].iov_len, flags);
         if (len != xdr->head[0].iov_len)
                 goto out;
         slen -= xdr->head[0].iov_len;
@@ -413,8 +438,9 @@ svc_sendto(struct svc_rqst *rqstp, struct xdr_buf *xdr)
         }
         /* send tail */
         if (xdr->tail[0].iov_len) {
-                result = kernel_sendpage(sock, rqstp->rq_respages[rqstp->rq_restailpage],
-                                             ((unsigned long)xdr->tail[0].iov_base)& (PAGE_SIZE-1),
+                result = kernel_sendpage(sock, rqstp->rq_respages[0],
+                                             ((unsigned long)xdr->tail[0].iov_base)
+                                                & (PAGE_SIZE-1),
                                              xdr->tail[0].iov_len, 0);
 
                 if (result > 0)
@@ -429,6 +455,56 @@ out:
 }
 
 /*
+ * Report socket names for nfsdfs
+ */
+static int one_sock_name(char *buf, struct svc_sock *svsk)
+{
+        int len;
+
+        switch(svsk->sk_sk->sk_family) {
+        case AF_INET:
+                len = sprintf(buf, "ipv4 %s %u.%u.%u.%u %d\n",
+                              svsk->sk_sk->sk_protocol==IPPROTO_UDP?
+                              "udp" : "tcp",
+                              NIPQUAD(inet_sk(svsk->sk_sk)->rcv_saddr),
+                              inet_sk(svsk->sk_sk)->num);
+                break;
+        default:
+                len = sprintf(buf, "*unknown-%d*\n",
+                               svsk->sk_sk->sk_family);
+        }
+        return len;
+}
+
+int
+svc_sock_names(char *buf, struct svc_serv *serv, char *toclose)
+{
+        struct svc_sock *svsk, *closesk = NULL;
+        int len = 0;
+
+        if (!serv)
+                return 0;
+        spin_lock(&serv->sv_lock);
+        list_for_each_entry(svsk, &serv->sv_permsocks, sk_list) {
+                int onelen = one_sock_name(buf+len, svsk);
+                if (toclose && strcmp(toclose, buf+len) == 0)
+                        closesk = svsk;
+                else
+                        len += onelen;
+        }
+        spin_unlock(&serv->sv_lock);
+        if (closesk)
+                /* Should unregister with portmap, but you cannot
+                 * unregister just one protocol...
+                 */
+                svc_delete_socket(closesk);
+        else if (toclose)
+                return -ENOENT;
+        return len;
+}
+EXPORT_SYMBOL(svc_sock_names);
+
+/*
  * Check input queue length
  */
 static int
@@ -557,11 +633,14 @@ svc_udp_recvfrom(struct svc_rqst *rqstp)
             /* udp sockets need large rcvbuf as all pending
              * requests are still in that buffer.  sndbuf must
              * also be large enough that there is enough space
-             * for one reply per thread.
+             * for one reply per thread.  We count all threads
+             * rather than threads in a particular pool, which
+             * provides an upper bound on the number of threads
+             * which will access the socket.
              */
             svc_sock_setbufsize(svsk->sk_sock,
-                                (serv->sv_nrthreads+3) * serv->sv_bufsz,
-                                (serv->sv_nrthreads+3) * serv->sv_bufsz);
+                                (serv->sv_nrthreads+3) * serv->sv_max_mesg,
+                                (serv->sv_nrthreads+3) * serv->sv_max_mesg);
 
         if ((rqstp->rq_deferred = svc_deferred_dequeue(svsk))) {
                 svc_sock_received(svsk);
@@ -631,9 +710,11 @@ svc_udp_recvfrom(struct svc_rqst *rqstp)
         if (len <= rqstp->rq_arg.head[0].iov_len) {
                 rqstp->rq_arg.head[0].iov_len = len;
                 rqstp->rq_arg.page_len = 0;
+                rqstp->rq_respages = rqstp->rq_pages+1;
         } else {
                 rqstp->rq_arg.page_len = len - rqstp->rq_arg.head[0].iov_len;
-                rqstp->rq_argused += (rqstp->rq_arg.page_len + PAGE_SIZE - 1)/ PAGE_SIZE;
+                rqstp->rq_respages = rqstp->rq_pages + 1 +
+                        (rqstp->rq_arg.page_len + PAGE_SIZE - 1)/ PAGE_SIZE;
         }
 
         if (serv->sv_stats)
@@ -668,8 +749,8 @@ svc_udp_init(struct svc_sock *svsk)
          * svc_udp_recvfrom will re-adjust if necessary
          */
         svc_sock_setbufsize(svsk->sk_sock,
-                            3 * svsk->sk_server->sv_bufsz,
-                            3 * svsk->sk_server->sv_bufsz);
+                            3 * svsk->sk_server->sv_max_mesg,
+                            3 * svsk->sk_server->sv_max_mesg);
 
         set_bit(SK_DATA, &svsk->sk_flags); /* might have come in before data_ready set up */
         set_bit(SK_CHNGBUF, &svsk->sk_flags);
@@ -844,7 +925,7 @@ svc_tcp_accept(struct svc_sock *svsk)
                                           struct svc_sock,
                                           sk_list);
                         set_bit(SK_CLOSE, &svsk->sk_flags);
-                        svsk->sk_inuse ++;
+                        atomic_inc(&svsk->sk_inuse);
                 }
                 spin_unlock_bh(&serv->sv_lock);
 
@@ -874,7 +955,7 @@ svc_tcp_recvfrom(struct svc_rqst *rqstp)
         struct svc_sock *svsk = rqstp->rq_sock;
         struct svc_serv *serv = svsk->sk_server;
         int             len;
-        struct kvec vec[RPCSVC_MAXPAGES];
+        struct kvec *vec;
         int pnum, vlen;
 
         dprintk("svc: tcp_recv %p data %d conn %d close %d\n",
@@ -892,7 +973,7 @@ svc_tcp_recvfrom(struct svc_rqst *rqstp)
                 return 0;
         }
 
-        if (test_bit(SK_CONN, &svsk->sk_flags)) {
+        if (svsk->sk_sk->sk_state == TCP_LISTEN) {
                 svc_tcp_accept(svsk);
                 svc_sock_received(svsk);
                 return 0;
@@ -902,13 +983,18 @@ svc_tcp_recvfrom(struct svc_rqst *rqstp)
                 /* sndbuf needs to have room for one request
                  * per thread, otherwise we can stall even when the
                  * network isn't a bottleneck.
+                 *
+                 * We count all threads rather than threads in a
+                 * particular pool, which provides an upper bound
+                 * on the number of threads which will access the socket.
+                 *
                  * rcvbuf just needs to be able to hold a few requests.
                  * Normally they will be removed from the queue 
                  * as soon a a complete request arrives.
                  */
                 svc_sock_setbufsize(svsk->sk_sock,
-                                    (serv->sv_nrthreads+3) * serv->sv_bufsz,
-                                    3 * serv->sv_bufsz);
+                                    (serv->sv_nrthreads+3) * serv->sv_max_mesg,
+                                    3 * serv->sv_max_mesg);
 
         clear_bit(SK_DATA, &svsk->sk_flags);
 
@@ -946,7 +1032,7 @@ svc_tcp_recvfrom(struct svc_rqst *rqstp)
                 }
                 svsk->sk_reclen &= 0x7fffffff;
                 dprintk("svc: TCP record, %d bytes\n", svsk->sk_reclen);
-                if (svsk->sk_reclen > serv->sv_bufsz) {
+                if (svsk->sk_reclen > serv->sv_max_mesg) {
                         printk(KERN_NOTICE "RPC: bad TCP reclen 0x%08lx (large)\n",
                                (unsigned long) svsk->sk_reclen);
                         goto err_delete;
@@ -967,15 +1053,17 @@ svc_tcp_recvfrom(struct svc_rqst *rqstp)
         len = svsk->sk_reclen;
         set_bit(SK_DATA, &svsk->sk_flags);
 
+        vec = rqstp->rq_vec;
         vec[0] = rqstp->rq_arg.head[0];
         vlen = PAGE_SIZE;
         pnum = 1;
         while (vlen < len) {
-                vec[pnum].iov_base = page_address(rqstp->rq_argpages[rqstp->rq_argused++]);
+                vec[pnum].iov_base = page_address(rqstp->rq_pages[pnum]);
                 vec[pnum].iov_len = PAGE_SIZE;
                 pnum++;
                 vlen += PAGE_SIZE;
         }
+        rqstp->rq_respages = &rqstp->rq_pages[pnum];
 
         /* Now receive data */
         len = svc_recvfrom(rqstp, vec, pnum, len);
@@ -1030,7 +1118,7 @@ svc_tcp_sendto(struct svc_rqst *rqstp)
 {
         struct xdr_buf  *xbufp = &rqstp->rq_res;
         int sent;
-        u32 reclen;
+        __be32 reclen;
 
         /* Set up the first element of the reply kvec.
          * Any other kvecs that may be in use have been taken
@@ -1083,8 +1171,8 @@ svc_tcp_init(struct svc_sock *svsk)
                  * svc_tcp_recvfrom will re-adjust if necessary
                  */
                 svc_sock_setbufsize(svsk->sk_sock,
-                                    3 * svsk->sk_server->sv_bufsz,
-                                    3 * svsk->sk_server->sv_bufsz);
+                                    3 * svsk->sk_server->sv_max_mesg,
+                                    3 * svsk->sk_server->sv_max_mesg);
 
                 set_bit(SK_CHNGBUF, &svsk->sk_flags);
                 set_bit(SK_DATA, &svsk->sk_flags);
@@ -1117,13 +1205,17 @@ svc_sock_update_bufs(struct svc_serv *serv)
 }
 
 /*
- * Receive the next request on any socket.
+ * Receive the next request on any socket.  This code is carefully
+ * organised not to touch any cachelines in the shared svc_serv
+ * structure, only cachelines in the local svc_pool.
  */
 int
-svc_recv(struct svc_serv *serv, struct svc_rqst *rqstp, long timeout)
+svc_recv(struct svc_rqst *rqstp, long timeout)
 {
         struct svc_sock         *svsk =NULL;
-        int                     len;
+        struct svc_serv         *serv = rqstp->rq_server;
+        struct svc_pool         *pool = rqstp->rq_pool;
+        int                     len, i;
         int                     pages;
         struct xdr_buf          *arg;
         DECLARE_WAITQUEUE(wait, current);
@@ -1140,27 +1232,22 @@ svc_recv(struct svc_serv *serv, struct svc_rqst *rqstp, long timeout)
                         "svc_recv: service %p, wait queue active!\n",
                          rqstp);
 
-        /* Initialize the buffers */
-        /* first reclaim pages that were moved to response list */
-        svc_pushback_allpages(rqstp);
 
         /* now allocate needed pages.  If we get a failure, sleep briefly */
-        pages = 2 + (serv->sv_bufsz + PAGE_SIZE -1) / PAGE_SIZE;
-        while (rqstp->rq_arghi < pages) {
-                struct page *p = alloc_page(GFP_KERNEL);
-                if (!p) {
-                        schedule_timeout_uninterruptible(msecs_to_jiffies(500));
-                        continue;
+        pages = (serv->sv_max_mesg + PAGE_SIZE) / PAGE_SIZE;
+        for (i=0; i < pages ; i++)
+                while (rqstp->rq_pages[i] == NULL) {
+                        struct page *p = alloc_page(GFP_KERNEL);
+                        if (!p)
+                                schedule_timeout_uninterruptible(msecs_to_jiffies(500));
+                        rqstp->rq_pages[i] = p;
                 }
-                rqstp->rq_argpages[rqstp->rq_arghi++] = p;
-        }
 
         /* Make arg->head point to first page and arg->pages point to rest */
         arg = &rqstp->rq_arg;
-        arg->head[0].iov_base = page_address(rqstp->rq_argpages[0]);
+        arg->head[0].iov_base = page_address(rqstp->rq_pages[0]);
         arg->head[0].iov_len = PAGE_SIZE;
-        rqstp->rq_argused = 1;
-        arg->pages = rqstp->rq_argpages + 1;
+        arg->pages = rqstp->rq_pages + 1;
         arg->page_base = 0;
         /* save at least one page for response */
         arg->page_len = (pages-2)*PAGE_SIZE;
@@ -1172,32 +1259,15 @@ svc_recv(struct svc_serv *serv, struct svc_rqst *rqstp, long timeout)
         if (signalled())
                 return -EINTR;
 
-        spin_lock_bh(&serv->sv_lock);
-        if (!list_empty(&serv->sv_tempsocks)) {
-                svsk = list_entry(serv->sv_tempsocks.next,
-                                  struct svc_sock, sk_list);
-                /* apparently the "standard" is that clients close
-                 * idle connections after 5 minutes, servers after
-                 * 6 minutes
-                 *   http://www.connectathon.org/talks96/nfstcp.pdf 
-                 */
-                if (get_seconds() - svsk->sk_lastrecv < 6*60
-                    || test_bit(SK_BUSY, &svsk->sk_flags))
-                        svsk = NULL;
-        }
-        if (svsk) {
-                set_bit(SK_BUSY, &svsk->sk_flags);
-                set_bit(SK_CLOSE, &svsk->sk_flags);
-                rqstp->rq_sock = svsk;
-                svsk->sk_inuse++;
-        } else if ((svsk = svc_sock_dequeue(serv)) != NULL) {
+        spin_lock_bh(&pool->sp_lock);
+        if ((svsk = svc_sock_dequeue(pool)) != NULL) {
                 rqstp->rq_sock = svsk;
-                svsk->sk_inuse++;
-                rqstp->rq_reserved = serv->sv_bufsz;    
-                svsk->sk_reserved += rqstp->rq_reserved;
+                atomic_inc(&svsk->sk_inuse);
+                rqstp->rq_reserved = serv->sv_max_mesg;
+                atomic_add(rqstp->rq_reserved, &svsk->sk_reserved);
         } else {
                 /* No data pending. Go to sleep */
-                svc_serv_enqueue(serv, rqstp);
+                svc_thread_enqueue(pool, rqstp);
 
                 /*
                  * We have to be able to interrupt this wait
@@ -1205,26 +1275,26 @@ svc_recv(struct svc_serv *serv, struct svc_rqst *rqstp, long timeout)
                  */
                 set_current_state(TASK_INTERRUPTIBLE);
                 add_wait_queue(&rqstp->rq_wait, &wait);
-                spin_unlock_bh(&serv->sv_lock);
+                spin_unlock_bh(&pool->sp_lock);
 
                 schedule_timeout(timeout);
 
                 try_to_freeze();
 
-                spin_lock_bh(&serv->sv_lock);
+                spin_lock_bh(&pool->sp_lock);
                 remove_wait_queue(&rqstp->rq_wait, &wait);
 
                 if (!(svsk = rqstp->rq_sock)) {
-                        svc_serv_dequeue(serv, rqstp);
-                        spin_unlock_bh(&serv->sv_lock);
+                        svc_thread_dequeue(pool, rqstp);
+                        spin_unlock_bh(&pool->sp_lock);
                         dprintk("svc: server %p, no data yet\n", rqstp);
                         return signalled()? -EINTR : -EAGAIN;
                 }
         }
-        spin_unlock_bh(&serv->sv_lock);
+        spin_unlock_bh(&pool->sp_lock);
 
-        dprintk("svc: server %p, socket %p, inuse=%d\n",
-                 rqstp, svsk, svsk->sk_inuse);
+        dprintk("svc: server %p, pool %u, socket %p, inuse=%d\n",
+                 rqstp, pool->sp_id, svsk, atomic_read(&svsk->sk_inuse));
         len = svsk->sk_recvfrom(rqstp);
         dprintk("svc: got len=%d\n", len);
 
@@ -1235,13 +1305,7 @@ svc_recv(struct svc_serv *serv, struct svc_rqst *rqstp, long timeout)
                 return -EAGAIN;
         }
         svsk->sk_lastrecv = get_seconds();
-        if (test_bit(SK_TEMP, &svsk->sk_flags)) {
-                /* push active sockets to end of list */
-                spin_lock_bh(&serv->sv_lock);
-                if (!list_empty(&svsk->sk_list))
-                        list_move_tail(&svsk->sk_list, &serv->sv_tempsocks);
-                spin_unlock_bh(&serv->sv_lock);
-        }
+        clear_bit(SK_OLD, &svsk->sk_flags);
 
         rqstp->rq_secure  = ntohs(rqstp->rq_addr.sin_port) < 1024;
         rqstp->rq_chandle.defer = svc_defer;
@@ -1301,6 +1365,58 @@ svc_send(struct svc_rqst *rqstp)
 }
 
 /*
+ * Timer function to close old temporary sockets, using
+ * a mark-and-sweep algorithm.
+ */
+static void
+svc_age_temp_sockets(unsigned long closure)
+{
+        struct svc_serv *serv = (struct svc_serv *)closure;
+        struct svc_sock *svsk;
+        struct list_head *le, *next;
+        LIST_HEAD(to_be_aged);
+
+        dprintk("svc_age_temp_sockets\n");
+
+        if (!spin_trylock_bh(&serv->sv_lock)) {
+                /* busy, try again 1 sec later */
+                dprintk("svc_age_temp_sockets: busy\n");
+                mod_timer(&serv->sv_temptimer, jiffies + HZ);
+                return;
+        }
+
+        list_for_each_safe(le, next, &serv->sv_tempsocks) {
+                svsk = list_entry(le, struct svc_sock, sk_list);
+
+                if (!test_and_set_bit(SK_OLD, &svsk->sk_flags))
+                        continue;
+                if (atomic_read(&svsk->sk_inuse) || test_bit(SK_BUSY, &svsk->sk_flags))
+                        continue;
+                atomic_inc(&svsk->sk_inuse);
+                list_move(le, &to_be_aged);
+                set_bit(SK_CLOSE, &svsk->sk_flags);
+                set_bit(SK_DETACHED, &svsk->sk_flags);
+        }
+        spin_unlock_bh(&serv->sv_lock);
+
+        while (!list_empty(&to_be_aged)) {
+                le = to_be_aged.next;
+                /* fiddling the sk_list node is safe 'cos we're SK_DETACHED */
+                list_del_init(le);
+                svsk = list_entry(le, struct svc_sock, sk_list);
+
+                dprintk("queuing svsk %p for closing, %lu seconds old\n",
+                        svsk, get_seconds() - svsk->sk_lastrecv);
+
+                /* a thread will dequeue and close it soon */
+                svc_sock_enqueue(svsk);
+                svc_sock_put(svsk);
+        }
+
+        mod_timer(&serv->sv_temptimer, jiffies + svc_conn_age_period * HZ);
+}
+
+/*
  * Initialize socket for RPC use and create svc_sock struct
  * XXX: May want to setsockopt SO_SNDBUF and SO_RCVBUF.
  */
@@ -1337,7 +1453,9 @@ svc_setup_socket(struct svc_serv *serv, struct socket *sock,
         svsk->sk_odata = inet->sk_data_ready;
         svsk->sk_owspace = inet->sk_write_space;
         svsk->sk_server = serv;
+        atomic_set(&svsk->sk_inuse, 0);
         svsk->sk_lastrecv = get_seconds();
+        spin_lock_init(&svsk->sk_defer_lock);
         INIT_LIST_HEAD(&svsk->sk_deferred);
         INIT_LIST_HEAD(&svsk->sk_ready);
         mutex_init(&svsk->sk_mutex);
@@ -1353,6 +1471,13 @@ svc_setup_socket(struct svc_serv *serv, struct socket *sock,
                 set_bit(SK_TEMP, &svsk->sk_flags);
                 list_add(&svsk->sk_list, &serv->sv_tempsocks);
                 serv->sv_tmpcnt++;
+                if (serv->sv_temptimer.function == NULL) {
+                        /* setup timer to age temp sockets */
+                        setup_timer(&serv->sv_temptimer, svc_age_temp_sockets,
+                                        (unsigned long)serv);
+                        mod_timer(&serv->sv_temptimer,
+                                        jiffies + svc_conn_age_period * HZ);
+                }
         } else {
                 clear_bit(SK_TEMP, &svsk->sk_flags);
                 list_add(&svsk->sk_list, &serv->sv_permsocks);
@@ -1367,6 +1492,38 @@ svc_setup_socket(struct svc_serv *serv, struct socket *sock,
         return svsk;
 }
 
+int svc_addsock(struct svc_serv *serv,
+                int fd,
+                char *name_return,
+                int *proto)
+{
+        int err = 0;
+        struct socket *so = sockfd_lookup(fd, &err);
+        struct svc_sock *svsk = NULL;
+
+        if (!so)
+                return err;
+        if (so->sk->sk_family != AF_INET)
+                err =  -EAFNOSUPPORT;
+        else if (so->sk->sk_protocol != IPPROTO_TCP &&
+            so->sk->sk_protocol != IPPROTO_UDP)
+                err =  -EPROTONOSUPPORT;
+        else if (so->state > SS_UNCONNECTED)
+                err = -EISCONN;
+        else {
+                svsk = svc_setup_socket(serv, so, &err, 1);
+                if (svsk)
+                        err = 0;
+        }
+        if (err) {
+                sockfd_put(so);
+                return err;
+        }
+        if (proto) *proto = so->sk->sk_protocol;
+        return one_sock_name(name_return, svsk);
+}
+EXPORT_SYMBOL_GPL(svc_addsock);
+
 /*
  * Create socket for RPC service.
  */
@@ -1393,14 +1550,12 @@ svc_create_socket(struct svc_serv *serv, int protocol, struct sockaddr_in *sin)
         if ((error = sock_create_kern(PF_INET, type, protocol, &sock)) < 0)
                 return error;
 
-        if (sin != NULL) {
-                if (type == SOCK_STREAM)
-                        sock->sk->sk_reuse = 1; /* allow address reuse */
-                error = kernel_bind(sock, (struct sockaddr *) sin,
-                                                sizeof(*sin));
-                if (error < 0)
-                        goto bummer;
-        }
+        if (type == SOCK_STREAM)
+                sock->sk->sk_reuse = 1; /* allow address reuse */
+        error = kernel_bind(sock, (struct sockaddr *) sin,
+                                        sizeof(*sin));
+        if (error < 0)
+                goto bummer;
 
         if (protocol == IPPROTO_TCP) {
                 if ((error = kernel_listen(sock, 64)) < 0)
@@ -1436,15 +1591,27 @@ svc_delete_socket(struct svc_sock *svsk)
 
         spin_lock_bh(&serv->sv_lock);
 
-        list_del_init(&svsk->sk_list);
-        list_del_init(&svsk->sk_ready);
+        if (!test_and_set_bit(SK_DETACHED, &svsk->sk_flags))
+                list_del_init(&svsk->sk_list);
+        /*
+         * We used to delete the svc_sock from whichever list
+         * it's sk_ready node was on, but we don't actually
+         * need to.  This is because the only time we're called
+         * while still attached to a queue, the queue itself
+         * is about to be destroyed (in svc_destroy).
+         */
         if (!test_and_set_bit(SK_DEAD, &svsk->sk_flags))
                 if (test_bit(SK_TEMP, &svsk->sk_flags))
                         serv->sv_tmpcnt--;
 
-        if (!svsk->sk_inuse) {
+        if (!atomic_read(&svsk->sk_inuse)) {
                 spin_unlock_bh(&serv->sv_lock);
-                sock_release(svsk->sk_sock);
+                if (svsk->sk_sock->file)
+                        sockfd_put(svsk->sk_sock);
+                else
+                        sock_release(svsk->sk_sock);
+                if (svsk->sk_info_authunix != NULL)
+                        svcauth_unix_info_release(svsk->sk_info_authunix);
                 kfree(svsk);
         } else {
                 spin_unlock_bh(&serv->sv_lock);
@@ -1475,7 +1642,6 @@ svc_makesock(struct svc_serv *serv, int protocol, unsigned short port)
 static void svc_revisit(struct cache_deferred_req *dreq, int too_many)
 {
         struct svc_deferred_req *dr = container_of(dreq, struct svc_deferred_req, handle);
-        struct svc_serv *serv = dreq->owner;
         struct svc_sock *svsk;
 
         if (too_many) {
@@ -1486,9 +1652,9 @@ static void svc_revisit(struct cache_deferred_req *dreq, int too_many)
         dprintk("revisit queued\n");
         svsk = dr->svsk;
         dr->svsk = NULL;
-        spin_lock_bh(&serv->sv_lock);
+        spin_lock_bh(&svsk->sk_defer_lock);
         list_add(&dr->handle.recent, &svsk->sk_deferred);
-        spin_unlock_bh(&serv->sv_lock);
+        spin_unlock_bh(&svsk->sk_defer_lock);
         set_bit(SK_DEFERRED, &svsk->sk_flags);
         svc_sock_enqueue(svsk);
         svc_sock_put(svsk);
@@ -1520,10 +1686,8 @@ svc_defer(struct cache_req *req)
                 dr->argslen = rqstp->rq_arg.len >> 2;
                 memcpy(dr->args, rqstp->rq_arg.head[0].iov_base-skip, dr->argslen<<2);
         }
-        spin_lock_bh(&rqstp->rq_server->sv_lock);
-        rqstp->rq_sock->sk_inuse++;
+        atomic_inc(&rqstp->rq_sock->sk_inuse);
         dr->svsk = rqstp->rq_sock;
-        spin_unlock_bh(&rqstp->rq_server->sv_lock);
 
         dr->handle.revisit = svc_revisit;
         return &dr->handle;
@@ -1543,6 +1707,7 @@ static int svc_deferred_recv(struct svc_rqst *rqstp)
         rqstp->rq_prot        = dr->prot;
         rqstp->rq_addr        = dr->addr;
         rqstp->rq_daddr       = dr->daddr;
+        rqstp->rq_respages    = rqstp->rq_pages;
         return dr->argslen<<2;
 }
 
@@ -1550,11 +1715,10 @@ static int svc_deferred_recv(struct svc_rqst *rqstp)
 static struct svc_deferred_req *svc_deferred_dequeue(struct svc_sock *svsk)
 {
         struct svc_deferred_req *dr = NULL;
-        struct svc_serv *serv = svsk->sk_server;
         
         if (!test_bit(SK_DEFERRED, &svsk->sk_flags))
                 return NULL;
-        spin_lock_bh(&serv->sv_lock);
+        spin_lock_bh(&svsk->sk_defer_lock);
         clear_bit(SK_DEFERRED, &svsk->sk_flags);
         if (!list_empty(&svsk->sk_deferred)) {
                 dr = list_entry(svsk->sk_deferred.next,
@@ -1563,6 +1727,6 @@ static struct svc_deferred_req *svc_deferred_dequeue(struct svc_sock *svsk)
                 list_del_init(&dr->handle.recent);
                 set_bit(SK_DEFERRED, &svsk->sk_flags);
         }
-        spin_unlock_bh(&serv->sv_lock);
+        spin_unlock_bh(&svsk->sk_defer_lock);
         return dr;
 }
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 6ac45103a272..9022eb8b37ed 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -18,8 +18,8 @@
 /*
  * XDR functions for basic NFS types
  */
-u32 *
-xdr_encode_netobj(u32 *p, const struct xdr_netobj *obj)
+__be32 *
+xdr_encode_netobj(__be32 *p, const struct xdr_netobj *obj)
 {
         unsigned int    quadlen = XDR_QUADLEN(obj->len);
 
@@ -29,8 +29,8 @@ xdr_encode_netobj(u32 *p, const struct xdr_netobj *obj)
         return p + XDR_QUADLEN(obj->len);
 }
 
-u32 *
-xdr_decode_netobj(u32 *p, struct xdr_netobj *obj)
+__be32 *
+xdr_decode_netobj(__be32 *p, struct xdr_netobj *obj)
 {
         unsigned int    len;
 
@@ -55,7 +55,7 @@ xdr_decode_netobj(u32 *p, struct xdr_netobj *obj)
  * Returns the updated current XDR buffer position
  *
  */
-u32 *xdr_encode_opaque_fixed(u32 *p, const void *ptr, unsigned int nbytes)
+__be32 *xdr_encode_opaque_fixed(__be32 *p, const void *ptr, unsigned int nbytes)
 {
         if (likely(nbytes != 0)) {
                 unsigned int quadlen = XDR_QUADLEN(nbytes);
@@ -79,21 +79,21 @@ EXPORT_SYMBOL(xdr_encode_opaque_fixed);
  *
  * Returns the updated current XDR buffer position
  */
-u32 *xdr_encode_opaque(u32 *p, const void *ptr, unsigned int nbytes)
+__be32 *xdr_encode_opaque(__be32 *p, const void *ptr, unsigned int nbytes)
 {
         *p++ = htonl(nbytes);
         return xdr_encode_opaque_fixed(p, ptr, nbytes);
 }
 EXPORT_SYMBOL(xdr_encode_opaque);
 
-u32 *
-xdr_encode_string(u32 *p, const char *string)
+__be32 *
+xdr_encode_string(__be32 *p, const char *string)
 {
         return xdr_encode_array(p, string, strlen(string));
 }
 
-u32 *
-xdr_decode_string_inplace(u32 *p, char **sp, int *lenp, int maxlen)
+__be32 *
+xdr_decode_string_inplace(__be32 *p, char **sp, int *lenp, int maxlen)
 {
         unsigned int    len;
 
@@ -432,7 +432,7 @@ xdr_shift_buf(struct xdr_buf *buf, size_t len)
  *       of the buffer length, and takes care of adjusting the kvec
  *       length for us.
  */
-void xdr_init_encode(struct xdr_stream *xdr, struct xdr_buf *buf, uint32_t *p)
+void xdr_init_encode(struct xdr_stream *xdr, struct xdr_buf *buf, __be32 *p)
 {
         struct kvec *iov = buf->head;
         int scratch_len = buf->buflen - buf->page_len - buf->tail[0].iov_len;
@@ -440,8 +440,8 @@ void xdr_init_encode(struct xdr_stream *xdr, struct xdr_buf *buf, uint32_t *p)
         BUG_ON(scratch_len < 0);
         xdr->buf = buf;
         xdr->iov = iov;
-        xdr->p = (uint32_t *)((char *)iov->iov_base + iov->iov_len);
-        xdr->end = (uint32_t *)((char *)iov->iov_base + scratch_len);
+        xdr->p = (__be32 *)((char *)iov->iov_base + iov->iov_len);
+        xdr->end = (__be32 *)((char *)iov->iov_base + scratch_len);
         BUG_ON(iov->iov_len > scratch_len);
 
         if (p != xdr->p && p != NULL) {
@@ -465,10 +465,10 @@ EXPORT_SYMBOL(xdr_init_encode);
  * bytes of data. If so, update the total xdr_buf length, and
  * adjust the length of the current kvec.
  */
-uint32_t * xdr_reserve_space(struct xdr_stream *xdr, size_t nbytes)
+__be32 * xdr_reserve_space(struct xdr_stream *xdr, size_t nbytes)
 {
-        uint32_t *p = xdr->p;
-        uint32_t *q;
+        __be32 *p = xdr->p;
+        __be32 *q;
 
         /* align nbytes on the next 32-bit boundary */
         nbytes += 3;
@@ -524,7 +524,7 @@ EXPORT_SYMBOL(xdr_write_pages);
  * @buf: pointer to XDR buffer from which to decode data
  * @p: current pointer inside XDR buffer
  */
-void xdr_init_decode(struct xdr_stream *xdr, struct xdr_buf *buf, uint32_t *p)
+void xdr_init_decode(struct xdr_stream *xdr, struct xdr_buf *buf, __be32 *p)
 {
         struct kvec *iov = buf->head;
         unsigned int len = iov->iov_len;
@@ -534,7 +534,7 @@ void xdr_init_decode(struct xdr_stream *xdr, struct xdr_buf *buf, uint32_t *p)
         xdr->buf = buf;
         xdr->iov = iov;
         xdr->p = p;
-        xdr->end = (uint32_t *)((char *)iov->iov_base + len);
+        xdr->end = (__be32 *)((char *)iov->iov_base + len);
 }
 EXPORT_SYMBOL(xdr_init_decode);
 
@@ -548,10 +548,10 @@ EXPORT_SYMBOL(xdr_init_decode);
  * If so return the current pointer, then update the current
  * pointer position.
  */
-uint32_t * xdr_inline_decode(struct xdr_stream *xdr, size_t nbytes)
+__be32 * xdr_inline_decode(struct xdr_stream *xdr, size_t nbytes)
 {
-        uint32_t *p = xdr->p;
-        uint32_t *q = p + XDR_QUADLEN(nbytes);
+        __be32 *p = xdr->p;
+        __be32 *q = p + XDR_QUADLEN(nbytes);
 
         if (unlikely(q > xdr->end || q < p))
                 return NULL;
@@ -599,8 +599,8 @@ void xdr_read_pages(struct xdr_stream *xdr, unsigned int len)
          * Position current pointer at beginning of tail, and
          * set remaining message length.
          */
-        xdr->p = (uint32_t *)((char *)iov->iov_base + padding);
-        xdr->end = (uint32_t *)((char *)iov->iov_base + end);
+        xdr->p = (__be32 *)((char *)iov->iov_base + padding);
+        xdr->end = (__be32 *)((char *)iov->iov_base + end);
 }
 EXPORT_SYMBOL(xdr_read_pages);
 
@@ -624,8 +624,8 @@ void xdr_enter_page(struct xdr_stream *xdr, unsigned int len)
          */
         if (len > PAGE_CACHE_SIZE - xdr->buf->page_base)
                 len = PAGE_CACHE_SIZE - xdr->buf->page_base;
-        xdr->p = (uint32_t *)(kaddr + xdr->buf->page_base);
-        xdr->end = (uint32_t *)((char *)xdr->p + len);
+        xdr->p = (__be32 *)(kaddr + xdr->buf->page_base);
+        xdr->end = (__be32 *)((char *)xdr->p + len);
 }
 EXPORT_SYMBOL(xdr_enter_page);
 
@@ -743,7 +743,7 @@ out:
 int
 xdr_decode_word(struct xdr_buf *buf, int base, u32 *obj)
 {
-        u32     raw;
+        __be32  raw;
         int     status;
 
         status = read_bytes_from_xdr_buf(buf, base, &raw, sizeof(*obj));
@@ -756,7 +756,7 @@ xdr_decode_word(struct xdr_buf *buf, int base, u32 *obj)
 int
 xdr_encode_word(struct xdr_buf *buf, int base, u32 obj)
 {
-        u32     raw = htonl(obj);
+        __be32  raw = htonl(obj);
 
         return write_bytes_to_xdr_buf(buf, base, &raw, sizeof(obj));
 }
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 1f786f68729d..80857470dc11 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -594,7 +594,7 @@ static void xprt_connect_status(struct rpc_task *task)
  * @xid: RPC XID of incoming reply
  *
  */
-struct rpc_rqst *xprt_lookup_rqst(struct rpc_xprt *xprt, u32 xid)
+struct rpc_rqst *xprt_lookup_rqst(struct rpc_xprt *xprt, __be32 xid)
 {
         struct list_head *pos;
 
@@ -801,7 +801,7 @@ void xprt_reserve(struct rpc_task *task)
         spin_unlock(&xprt->reserve_lock);
 }
 
-static inline u32 xprt_alloc_xid(struct rpc_xprt *xprt)
+static inline __be32 xprt_alloc_xid(struct rpc_xprt *xprt)
 {
         return xprt->xid++;
 }
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 9b62923a9c06..757fc91ef25d 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -548,7 +548,8 @@ static void xs_udp_data_ready(struct sock *sk, int len)
         struct rpc_rqst *rovr;
         struct sk_buff *skb;
         int err, repsize, copied;
-        u32 _xid, *xp;
+        u32 _xid;
+        __be32 *xp;
 
         read_lock(&sk->sk_callback_lock);
         dprintk("RPC:      xs_udp_data_ready...\n");
@@ -1365,7 +1366,7 @@ int xs_setup_udp(struct rpc_xprt *xprt, struct rpc_timeout *to)
         if (xprt->slot == NULL)
                 return -ENOMEM;
 
-        if (ntohs(addr->sin_port != 0))
+        if (ntohs(addr->sin_port) != 0)
                 xprt_set_bound(xprt);
         xprt->port = xs_get_random_port();
 
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 75a5968c2139..39744a33bd36 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -2,7 +2,7 @@
  * net/tipc/bearer.c: TIPC bearer code
  * 
  * Copyright (c) 1996-2006, Ericsson AB
- * Copyright (c) 2004-2005, Wind River Systems
+ * Copyright (c) 2004-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -191,14 +191,14 @@ void tipc_media_addr_printf(struct print_buf *pb, struct tipc_media_addr *a)
         if ((i < media_count) && (m_ptr->addr2str != NULL)) {
                 char addr_str[MAX_ADDR_STR];
 
-                tipc_printf(pb, "%s(%s) ", m_ptr->name, 
+                tipc_printf(pb, "%s(%s)", m_ptr->name,
                             m_ptr->addr2str(a, addr_str, sizeof(addr_str)));
         } else {
                 unchar *addr = (unchar *)&a->dev_addr;
 
-                tipc_printf(pb, "UNKNOWN(%u):", media_type);
+                tipc_printf(pb, "UNKNOWN(%u)", media_type);
                 for (i = 0; i < (sizeof(*a) - sizeof(a->type)); i++) {
-                        tipc_printf(pb, "%02x ", addr[i]);
+                        tipc_printf(pb, "-%02x", addr[i]);
                 }
         }
 }
diff --git a/net/tipc/config.c b/net/tipc/config.c
index 285e1bc2d880..ed1351ed05e1 100644
--- a/net/tipc/config.c
+++ b/net/tipc/config.c
@@ -2,7 +2,7 @@
  * net/tipc/config.c: TIPC configuration management code
  * 
  * Copyright (c) 2002-2006, Ericsson AB
- * Copyright (c) 2004-2005, Wind River Systems
+ * Copyright (c) 2004-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -613,7 +613,8 @@ struct sk_buff *tipc_cfg_do_cmd(u32 orig_node, u16 cmd, const void *request_area
                 rep_tlv_buf = tipc_cfg_reply_unsigned(tipc_net_id);
                 break;
         default:
-                rep_tlv_buf = NULL;
+                rep_tlv_buf = tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
+                                                          " (unknown command)");
                 break;
         }
 
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 0539a8362858..6f5b7ee31180 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -57,7 +57,7 @@ void tipc_socket_stop(void);
 int  tipc_netlink_start(void);
 void tipc_netlink_stop(void);
 
-#define TIPC_MOD_VER "1.6.1"
+#define TIPC_MOD_VER "1.6.2"
 
 #ifndef CONFIG_TIPC_ZONES
 #define CONFIG_TIPC_ZONES 3
@@ -90,7 +90,7 @@ int tipc_random;
 atomic_t tipc_user_count = ATOMIC_INIT(0);
 
 const char tipc_alphabet[] = 
-        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_";
+        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_.";
 
 /* configurable TIPC parameters */
 
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 762aac2572be..4638947c2326 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -65,7 +65,7 @@
 #define assert(i)  BUG_ON(!(i))
 
 struct tipc_msg;
-extern struct print_buf *TIPC_CONS, *TIPC_LOG;
+extern struct print_buf *TIPC_NULL, *TIPC_CONS, *TIPC_LOG;
 extern struct print_buf *TIPC_TEE(struct print_buf *, struct print_buf *);
 void tipc_msg_print(struct print_buf*,struct tipc_msg *,const char*);
 void tipc_printf(struct print_buf *, const char *fmt, ...);
@@ -83,9 +83,9 @@ void tipc_dump(struct print_buf*,const char *fmt, ...);
 #define warn(fmt, arg...) tipc_printf(TIPC_OUTPUT, KERN_WARNING "TIPC: " fmt, ## arg)
 #define info(fmt, arg...) tipc_printf(TIPC_OUTPUT, KERN_NOTICE "TIPC: " fmt, ## arg)
 
-#define dbg(fmt, arg...)  do {if (DBG_OUTPUT) tipc_printf(DBG_OUTPUT, fmt, ## arg);} while(0)
-#define msg_dbg(msg, txt) do {if (DBG_OUTPUT) tipc_msg_print(DBG_OUTPUT, msg, txt);} while(0)
-#define dump(fmt, arg...) do {if (DBG_OUTPUT) tipc_dump(DBG_OUTPUT, fmt, ##arg);} while(0)
+#define dbg(fmt, arg...)  do {if (DBG_OUTPUT != TIPC_NULL) tipc_printf(DBG_OUTPUT, fmt, ## arg);} while(0)
+#define msg_dbg(msg, txt) do {if (DBG_OUTPUT != TIPC_NULL) tipc_msg_print(DBG_OUTPUT, msg, txt);} while(0)
+#define dump(fmt, arg...) do {if (DBG_OUTPUT != TIPC_NULL) tipc_dump(DBG_OUTPUT, fmt, ##arg);} while(0)
 
 
 /*      
@@ -94,11 +94,11 @@ void tipc_dump(struct print_buf*,const char *fmt, ...);
  * here, or on a per .c file basis, by redefining these symbols.  The following
  * print buffer options are available:
  *
- * NULL                         : Output to null print buffer (i.e. print nowhere)
- * TIPC_CONS                    : Output to system console
- * TIPC_LOG                     : Output to TIPC log buffer 
- * &buf                         : Output to user-defined buffer (struct print_buf *)
- * TIPC_TEE(&buf_a,&buf_b)      : Output to two print buffers (eg. TIPC_TEE(TIPC_CONS,TIPC_LOG) )
+ * TIPC_NULL               : null buffer (i.e. print nowhere)
+ * TIPC_CONS               : system console
+ * TIPC_LOG                : TIPC log buffer
+ * &buf                    : user-defined buffer (struct print_buf *)
+ * TIPC_TEE(&buf_a,&buf_b) : list of buffers (eg. TIPC_TEE(TIPC_CONS,TIPC_LOG))
  */
 
 #ifndef TIPC_OUTPUT
@@ -106,7 +106,7 @@ void tipc_dump(struct print_buf*,const char *fmt, ...);
 #endif
 
 #ifndef DBG_OUTPUT
-#define DBG_OUTPUT NULL
+#define DBG_OUTPUT TIPC_NULL
 #endif
 
 #else
@@ -136,7 +136,7 @@ void tipc_dump(struct print_buf*,const char *fmt, ...);
 #define TIPC_OUTPUT TIPC_CONS
 
 #undef  DBG_OUTPUT
-#define DBG_OUTPUT NULL
+#define DBG_OUTPUT TIPC_NULL
 
 #endif                    
 
@@ -275,11 +275,15 @@ static inline void k_term_timer(struct timer_list *timer)
 /*
  * TIPC message buffer code
  *
- * TIPC message buffer headroom leaves room for 14 byte Ethernet header, 
+ * TIPC message buffer headroom reserves space for a link-level header
+ * (in case the message is sent off-node),
  * while ensuring TIPC header is word aligned for quicker access
+ *
+ * The largest header currently supported is 18 bytes, which is used when
+ * the standard 14 byte Ethernet header has 4 added bytes for VLAN info
  */
 
-#define BUF_HEADROOM 16u 
+#define BUF_HEADROOM 20u
 
 struct tipc_skb_cb {
         void *handle;
diff --git a/net/tipc/dbg.c b/net/tipc/dbg.c
index 55130655e1ed..d8af4c28695d 100644
--- a/net/tipc/dbg.c
+++ b/net/tipc/dbg.c
@@ -1,8 +1,8 @@
 /*
- * net/tipc/dbg.c: TIPC print buffer routines for debuggign
+ * net/tipc/dbg.c: TIPC print buffer routines for debugging
  * 
  * Copyright (c) 1996-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
+ * Copyright (c) 2005-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -38,11 +38,12 @@
 #include "config.h"
 #include "dbg.h"
 
-#define MAX_STRING 512
-
-static char print_string[MAX_STRING];
+static char print_string[TIPC_PB_MAX_STR];
 static DEFINE_SPINLOCK(print_lock);
 
+static struct print_buf null_buf = { NULL, 0, NULL, NULL };
+struct print_buf *TIPC_NULL = &null_buf;
+
 static struct print_buf cons_buf = { NULL, 0, NULL, NULL };
 struct print_buf *TIPC_CONS = &cons_buf;
 
@@ -62,68 +63,83 @@ struct print_buf *TIPC_LOG = &log_buf;
 /*
  * Locking policy when using print buffers.
  *
- * 1) Routines of the form printbuf_XXX() rely on the caller to prevent
- *    simultaneous use of the print buffer(s) being manipulated.
- * 2) tipc_printf() uses 'print_lock' to prevent simultaneous use of
- *    'print_string' and to protect its print buffer(s).
- * 3) TIPC_TEE() uses 'print_lock' to protect its print buffer(s).
- * 4) Routines of the form log_XXX() uses 'print_lock' to protect TIPC_LOG.
+ * The following routines use 'print_lock' for protection:
+ * 1) tipc_printf()  - to protect its print buffer(s) and 'print_string'
+ * 2) TIPC_TEE()     - to protect its print buffer(s)
+ * 3) tipc_dump()    - to protect its print buffer(s) and 'print_string'
+ * 4) tipc_log_XXX() - to protect TIPC_LOG
+ *
+ * All routines of the form tipc_printbuf_XXX() rely on the caller to prevent
+ * simultaneous use of the print buffer(s) being manipulated.
  */
 
 /**
  * tipc_printbuf_init - initialize print buffer to empty
+ * @pb: pointer to print buffer structure
+ * @raw: pointer to character array used by print buffer
+ * @size: size of character array
+ *
+ * Makes the print buffer a null device that discards anything written to it
+ * if the character array is too small (or absent).
  */
 
-void tipc_printbuf_init(struct print_buf *pb, char *raw, u32 sz)
+void tipc_printbuf_init(struct print_buf *pb, char *raw, u32 size)
 {
-        if (!pb || !raw || (sz < (MAX_STRING + 1)))
-                return;
-
-        pb->crs = pb->buf = raw;
-        pb->size = sz;
+        pb->buf = raw;
+        pb->crs = raw;
+        pb->size = size;
         pb->next = NULL;
-        pb->buf[0] = 0;
-        pb->buf[sz-1] = ~0;
+
+        if (size < TIPC_PB_MIN_SIZE) {
+                pb->buf = NULL;
+        } else if (raw) {
+                pb->buf[0] = 0;
+                pb->buf[size-1] = ~0;
+        }
 }
 
 /**
  * tipc_printbuf_reset - reinitialize print buffer to empty state
+ * @pb: pointer to print buffer structure
  */
 
 void tipc_printbuf_reset(struct print_buf *pb)
 {
-        if (pb && pb->buf)
-                tipc_printbuf_init(pb, pb->buf, pb->size);
+        tipc_printbuf_init(pb, pb->buf, pb->size);
 }
 
 /**
  * tipc_printbuf_empty - test if print buffer is in empty state
+ * @pb: pointer to print buffer structure
+ *
+ * Returns non-zero if print buffer is empty.
  */
 
 int tipc_printbuf_empty(struct print_buf *pb)
 {
-        return (!pb || !pb->buf || (pb->crs == pb->buf));
+        return (!pb->buf || (pb->crs == pb->buf));
 }
 
 /**
  * tipc_printbuf_validate - check for print buffer overflow
+ * @pb: pointer to print buffer structure
  * 
  * Verifies that a print buffer has captured all data written to it. 
  * If data has been lost, linearize buffer and prepend an error message
  * 
- * Returns length of print buffer data string (including trailing NULL)
+ * Returns length of print buffer data string (including trailing NUL)
  */
 
 int tipc_printbuf_validate(struct print_buf *pb)
 {
-        char *err = "             *** PRINT BUFFER WRAPPED AROUND ***\n";
+        char *err = "\n\n*** PRINT BUFFER OVERFLOW ***\n\n";
         char *cp_buf;
         struct print_buf cb;
 
-        if (!pb || !pb->buf)
+        if (!pb->buf)
                 return 0;
 
-        if (pb->buf[pb->size - 1] == '\0') {
+        if (pb->buf[pb->size - 1] == 0) {
                 cp_buf = kmalloc(pb->size, GFP_ATOMIC);
                 if (cp_buf != NULL){
                         tipc_printbuf_init(&cb, cp_buf, pb->size);
@@ -141,6 +157,8 @@ int tipc_printbuf_validate(struct print_buf *pb)
 
 /**
  * tipc_printbuf_move - move print buffer contents to another print buffer
+ * @pb_to: pointer to destination print buffer structure
+ * @pb_from: pointer to source print buffer structure
  * 
  * Current contents of destination print buffer (if any) are discarded.
  * Source print buffer becomes empty if a successful move occurs.
@@ -152,21 +170,22 @@ void tipc_printbuf_move(struct print_buf *pb_to, struct print_buf *pb_from)
 
         /* Handle the cases where contents can't be moved */
 
-        if (!pb_to || !pb_to->buf)
+        if (!pb_to->buf)
                 return;
 
-        if (!pb_from || !pb_from->buf) {
+        if (!pb_from->buf) {
                 tipc_printbuf_reset(pb_to);
                 return;
         }
 
         if (pb_to->size < pb_from->size) {
                 tipc_printbuf_reset(pb_to);
-                tipc_printf(pb_to, "*** PRINT BUFFER OVERFLOW ***");
+                tipc_printf(pb_to, "*** PRINT BUFFER MOVE ERROR ***");
                 return;
         }
 
         /* Copy data from char after cursor to end (if used) */
+
         len = pb_from->buf + pb_from->size - pb_from->crs - 2;
         if ((pb_from->buf[pb_from->size-1] == 0) && (len > 0)) {
                 strcpy(pb_to->buf, pb_from->crs + 1);
@@ -175,6 +194,7 @@ void tipc_printbuf_move(struct print_buf *pb_to, struct print_buf *pb_from)
                 pb_to->crs = pb_to->buf;
 
         /* Copy data from start to cursor (always) */
+
         len = pb_from->crs - pb_from->buf;
         strcpy(pb_to->crs, pb_from->buf);
         pb_to->crs += len;
@@ -184,6 +204,8 @@ void tipc_printbuf_move(struct print_buf *pb_to, struct print_buf *pb_from)
 
 /**
  * tipc_printf - append formatted output to print buffer chain
+ * @pb: pointer to chain of print buffers (may be NULL)
+ * @fmt: formatted info to be printed
  */
 
 void tipc_printf(struct print_buf *pb, const char *fmt, ...)
@@ -195,8 +217,8 @@ void tipc_printf(struct print_buf *pb, const char *fmt, ...)
 
         spin_lock_bh(&print_lock);
         FORMAT(print_string, chars_to_add, fmt);
-        if (chars_to_add >= MAX_STRING)
-                strcpy(print_string, "*** STRING TOO LONG ***");
+        if (chars_to_add >= TIPC_PB_MAX_STR)
+                strcpy(print_string, "*** PRINT BUFFER STRING TOO LONG ***");
 
         while (pb) {
                 if (pb == TIPC_CONS)
@@ -206,6 +228,10 @@ void tipc_printf(struct print_buf *pb, const char *fmt, ...)
                         if (chars_to_add <= chars_left) {
                                 strcpy(pb->crs, print_string);
                                 pb->crs += chars_to_add;
+                        } else if (chars_to_add >= (pb->size - 1)) {
+                                strcpy(pb->buf, print_string + chars_to_add + 1
+                                       - pb->size);
+                                pb->crs = pb->buf + pb->size - 1;
                         } else {
                                 strcpy(pb->buf, print_string + chars_left);
                                 save_char = print_string[chars_left];
@@ -224,6 +250,10 @@ void tipc_printf(struct print_buf *pb, const char *fmt, ...)
 
 /**
  * TIPC_TEE - perform next output operation on both print buffers  
+ * @b0: pointer to chain of print buffers (may be NULL)
+ * @b1: pointer to print buffer to add to chain
+ *
+ * Returns pointer to print buffer chain.
  */
 
 struct print_buf *TIPC_TEE(struct print_buf *b0, struct print_buf *b1)
@@ -232,8 +262,6 @@ struct print_buf *TIPC_TEE(struct print_buf *b0, struct print_buf *b1)
 
         if (!b0 || (b0 == b1))
                 return b1;
-        if (!b1)
-                return b0;
 
         spin_lock_bh(&print_lock);
         while (pb->next) {
@@ -256,7 +284,7 @@ static void print_to_console(char *crs, int len)
         int rest = len;
 
         while (rest > 0) {
-                int sz = rest < MAX_STRING ? rest : MAX_STRING;
+                int sz = rest < TIPC_PB_MAX_STR ? rest : TIPC_PB_MAX_STR;
                 char c = crs[sz];
 
                 crs[sz] = 0;
@@ -275,36 +303,48 @@ static void printbuf_dump(struct print_buf *pb)
 {
         int len;
 
+        if (!pb->buf) {
+                printk("*** PRINT BUFFER NOT ALLOCATED ***");
+                return;
+        }
+
         /* Dump print buffer from char after cursor to end (if used) */
+
         len = pb->buf + pb->size - pb->crs - 2;
         if ((pb->buf[pb->size - 1] == 0) && (len > 0))
                 print_to_console(pb->crs + 1, len);
 
         /* Dump print buffer from start to cursor (always) */
+
         len = pb->crs - pb->buf;
         print_to_console(pb->buf, len);
 }
 
 /**
  * tipc_dump - dump non-console print buffer(s) to console
+ * @pb: pointer to chain of print buffers
  */
 
 void tipc_dump(struct print_buf *pb, const char *fmt, ...)
 {
+        struct print_buf *pb_next;
         int len;
 
         spin_lock_bh(&print_lock);
-        FORMAT(TIPC_CONS->buf, len, fmt);
-        printk(TIPC_CONS->buf);
+        FORMAT(print_string, len, fmt);
+        printk(print_string);
 
         for (; pb; pb = pb->next) {
-                if (pb == TIPC_CONS)
-                        continue;
-                printk("\n---- Start of dump,%s log ----\n\n", 
-                       (pb == TIPC_LOG) ? "global" : "local");
-                printbuf_dump(pb);
-                tipc_printbuf_reset(pb);
-                printk("\n-------- End of dump --------\n");
+                if (pb != TIPC_CONS) {
+                        printk("\n---- Start of %s log dump ----\n\n",
+                               (pb == TIPC_LOG) ? "global" : "local");
+                        printbuf_dump(pb);
+                        tipc_printbuf_reset(pb);
+                        printk("\n---- End of dump ----\n");
+                }
+                pb_next = pb->next;
+                pb->next = NULL;
+                pb = pb_next;
         }
         spin_unlock_bh(&print_lock);
 }
@@ -324,7 +364,8 @@ void tipc_log_stop(void)
 }
 
 /**
- * tipc_log_reinit - set TIPC log print buffer to specified size
+ * tipc_log_reinit - (re)initialize TIPC log print buffer
+ * @log_size: print buffer size to use
  */
 
 void tipc_log_reinit(int log_size)
@@ -332,10 +373,11 @@ void tipc_log_reinit(int log_size)
         tipc_log_stop();
 
         if (log_size) {
-                if (log_size <= MAX_STRING)
-                        log_size = MAX_STRING + 1;
+                if (log_size < TIPC_PB_MIN_SIZE)
+                        log_size = TIPC_PB_MIN_SIZE;
                 spin_lock_bh(&print_lock);
-                tipc_printbuf_init(TIPC_LOG, kmalloc(log_size, GFP_ATOMIC), log_size);
+                tipc_printbuf_init(TIPC_LOG, kmalloc(log_size, GFP_ATOMIC),
+                                   log_size);
                 spin_unlock_bh(&print_lock);
         }
 }
diff --git a/net/tipc/dbg.h b/net/tipc/dbg.h
index 227f050d2a52..467c0bc78a79 100644
--- a/net/tipc/dbg.h
+++ b/net/tipc/dbg.h
@@ -2,7 +2,7 @@
  * net/tipc/dbg.h: Include file for TIPC print buffer routines
  * 
  * Copyright (c) 1997-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
+ * Copyright (c) 2005-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -37,6 +37,14 @@
 #ifndef _TIPC_DBG_H
 #define _TIPC_DBG_H
 
+/**
+ * struct print_buf - TIPC print buffer structure
+ * @buf: pointer to character array containing print buffer contents
+ * @size: size of character array
+ * @crs: pointer to first unused space in character array (i.e. final NUL)
+ * @next: used to link print buffers when printing to more than one at a time
+ */
+
 struct print_buf {
         char *buf;
         u32 size;
@@ -44,7 +52,10 @@ struct print_buf {
         struct print_buf *next;
 };
 
-void tipc_printbuf_init(struct print_buf *pb, char *buf, u32 sz);
+#define TIPC_PB_MIN_SIZE 64     /* minimum size for a print buffer's array */
+#define TIPC_PB_MAX_STR 512     /* max printable string (with trailing NUL) */
+
+void tipc_printbuf_init(struct print_buf *pb, char *buf, u32 size);
 void tipc_printbuf_reset(struct print_buf *pb);
 int  tipc_printbuf_empty(struct print_buf *pb);
 int  tipc_printbuf_validate(struct print_buf *pb);
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index ee94de92ae99..3b0cd12f37da 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -132,6 +132,28 @@ static struct sk_buff *tipc_disc_init_msg(u32 type,
 }
 
 /**
+ * disc_dupl_alert - issue node address duplication alert
+ * @b_ptr: pointer to bearer detecting duplication
+ * @node_addr: duplicated node address
+ * @media_addr: media address advertised by duplicated node
+ */
+
+static void disc_dupl_alert(struct bearer *b_ptr, u32 node_addr,
+                            struct tipc_media_addr *media_addr)
+{
+        char node_addr_str[16];
+        char media_addr_str[64];
+        struct print_buf pb;
+
+        addr_string_fill(node_addr_str, node_addr);
+        tipc_printbuf_init(&pb, media_addr_str, sizeof(media_addr_str));
+        tipc_media_addr_printf(&pb, media_addr);
+        tipc_printbuf_validate(&pb);
+        warn("Duplicate %s using %s seen on <%s>\n",
+             node_addr_str, media_addr_str, b_ptr->publ.name);
+}
+
+/**
  * tipc_disc_recv_msg - handle incoming link setup message (request or response)
  * @buf: buffer containing message
  */
@@ -157,8 +179,11 @@ void tipc_disc_recv_msg(struct sk_buff *buf)
                 return;
         if (!tipc_addr_node_valid(orig))
                 return;
-        if (orig == tipc_own_addr)
+        if (orig == tipc_own_addr) {
+                if (memcmp(&media_addr, &b_ptr->publ.addr, sizeof(media_addr)))
+                        disc_dupl_alert(b_ptr, tipc_own_addr, &media_addr);
                 return;
+        }
         if (!in_scope(dest, tipc_own_addr))
                 return;
         if (is_slave(tipc_own_addr) && is_slave(orig))
@@ -170,7 +195,8 @@ void tipc_disc_recv_msg(struct sk_buff *buf)
                 struct sk_buff *rbuf;
                 struct tipc_media_addr *addr;
                 struct node *n_ptr = tipc_node_find(orig);
-                int link_up;
+                int link_fully_up;
+
                 dbg(" in own cluster\n");
                 if (n_ptr == NULL) {
                         n_ptr = tipc_node_create(orig);
@@ -190,14 +216,19 @@ void tipc_disc_recv_msg(struct sk_buff *buf)
                 }
                 addr = &link->media_addr;
                 if (memcmp(addr, &media_addr, sizeof(*addr))) {
+                        if (tipc_link_is_up(link) || (!link->started)) {
+                                disc_dupl_alert(b_ptr, orig, &media_addr);
+                                spin_unlock_bh(&n_ptr->lock);
+                                return;
+                        }
                         warn("Resetting link <%s>, peer interface address changed\n",
                              link->name);
                         memcpy(addr, &media_addr, sizeof(*addr));
                         tipc_link_reset(link);     
                 }
-                link_up = tipc_link_is_up(link);
+                link_fully_up = (link->state == WORKING_WORKING);
                 spin_unlock_bh(&n_ptr->lock);                
-                if ((type == DSC_RESP_MSG) || link_up)
+                if ((type == DSC_RESP_MSG) || link_fully_up)
                         return;
                 rbuf = tipc_disc_init_msg(DSC_RESP_MSG, 1, orig, b_ptr);
                 if (rbuf != NULL) {
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 693f02eca6d6..1bb983c8130b 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -132,7 +132,7 @@ static void link_print(struct link *l_ptr, struct print_buf *buf,
  * allow the output from multiple links to be intermixed.  For this reason
  * routines of the form "dbg_link_XXX()" have been created that will capture
  * debug info into a link's personal print buffer, which can then be dumped
- * into the TIPC system log (LOG) upon request.
+ * into the TIPC system log (TIPC_LOG) upon request.
  *
  * To enable per-link debugging, use LINK_LOG_BUF_SIZE to specify the size
  * of the print buffer used by each link.  If LINK_LOG_BUF_SIZE is set to 0,
@@ -141,7 +141,7 @@ static void link_print(struct link *l_ptr, struct print_buf *buf,
  * when there is only a single link in the system being debugged.
  *
  * Notes:
- * - When enabled, LINK_LOG_BUF_SIZE should be set to at least 1000 (bytes)
+ * - When enabled, LINK_LOG_BUF_SIZE should be set to at least TIPC_PB_MIN_SIZE
  * - "l_ptr" must be valid when using dbg_link_XXX() macros  
  */
 
@@ -159,13 +159,13 @@ static void link_print(struct link *l_ptr, struct print_buf *buf,
 
 static void dbg_print_link(struct link *l_ptr, const char *str)
 {
-        if (DBG_OUTPUT)
+        if (DBG_OUTPUT != TIPC_NULL)
                 link_print(l_ptr, DBG_OUTPUT, str);
 }
 
 static void dbg_print_buf_chain(struct sk_buff *root_buf)
 {
-        if (DBG_OUTPUT) {
+        if (DBG_OUTPUT != TIPC_NULL) {
                 struct sk_buff *buf = root_buf;
 
                 while (buf) {
@@ -1666,8 +1666,9 @@ static void link_retransmit_failure(struct link *l_ptr, struct sk_buff *buf)
                 char addr_string[16];
 
                 tipc_printf(TIPC_OUTPUT, "Msg seq number: %u,  ", msg_seqno(msg));
-                tipc_printf(TIPC_OUTPUT, "Outstanding acks: %u\n", (u32)TIPC_SKB_CB(buf)->handle);
-                
+                tipc_printf(TIPC_OUTPUT, "Outstanding acks: %lu\n",
+                                     (unsigned long) TIPC_SKB_CB(buf)->handle);
+
                 n_ptr = l_ptr->owner->next;
                 tipc_node_lock(n_ptr);
 
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index f0b063bcc2a9..03bd659c43ca 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -122,7 +122,7 @@ void tipc_named_publish(struct publication *publ)
         struct sk_buff *buf;
         struct distr_item *item;
 
-        list_add(&publ->local_list, &publ_root);
+        list_add_tail(&publ->local_list, &publ_root);
         publ_cnt++;
 
         buf = named_prepare_buf(PUBLICATION, ITEM_SIZE, 0);
diff --git a/net/tipc/node.c b/net/tipc/node.c
index fc6d09630ccd..886bda5e88db 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -648,7 +648,7 @@ struct sk_buff *tipc_node_get_links(const void *req_tlv_area, int req_tlv_space)
                 return tipc_cfg_reply_error_string(TIPC_CFG_INVALID_VALUE
                                                    " (network address)");
 
-        if (!tipc_nodes)
+        if (tipc_mode != TIPC_NET_MODE)
                 return tipc_cfg_reply_none();
         
         /* Get space for all unicast links + multicast link */
diff --git a/net/tipc/port.c b/net/tipc/port.c
index b9c8c6b9e94f..c1a1a76759b5 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -505,8 +505,13 @@ static void port_timeout(unsigned long ref)
         struct port *p_ptr = tipc_port_lock(ref);
         struct sk_buff *buf = NULL;
 
-        if (!p_ptr || !p_ptr->publ.connected)
+        if (!p_ptr)
+                return;
+
+        if (!p_ptr->publ.connected) {
+                tipc_port_unlock(p_ptr);
                 return;
+        }
 
         /* Last probe answered ? */
         if (p_ptr->probing_state == PROBING) {
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 32d778448a00..2a6a5a6b4c12 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2,7 +2,7 @@
  * net/tipc/socket.c: TIPC socket API
  * 
  * Copyright (c) 2001-2006, Ericsson AB
- * Copyright (c) 2004-2005, Wind River Systems
+ * Copyright (c) 2004-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -629,6 +629,9 @@ static int send_stream(struct kiocb *iocb, struct socket *sock,
                         return -ENOTCONN;
         }
 
+        if (unlikely(m->msg_name))
+                return -EISCONN;
+
         /* 
          * Send each iovec entry using one or more messages
          *
@@ -641,6 +644,8 @@ static int send_stream(struct kiocb *iocb, struct socket *sock,
         curr_iovlen = m->msg_iovlen;
         my_msg.msg_iov = &my_iov;
         my_msg.msg_iovlen = 1;
+        my_msg.msg_flags = m->msg_flags;
+        my_msg.msg_name = NULL;
         bytes_sent = 0;
 
         while (curr_iovlen--) {
@@ -941,7 +946,7 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
         int sz_to_copy;
         int sz_copied = 0;
         int needed;
-        char *crs = m->msg_iov->iov_base;
+        char __user *crs = m->msg_iov->iov_base;
         unsigned char *buf_crs;
         u32 err;
         int res;
@@ -1203,7 +1208,8 @@ static u32 dispatch(struct tipc_port *tport, struct sk_buff *buf)
         atomic_inc(&tipc_queue_size);
         skb_queue_tail(&sock->sk->sk_receive_queue, buf);
 
-        wake_up_interruptible(sock->sk->sk_sleep);
+        if (waitqueue_active(sock->sk->sk_sleep))
+                wake_up_interruptible(sock->sk->sk_sleep);
         return TIPC_OK;
 }
 
@@ -1218,7 +1224,8 @@ static void wakeupdispatch(struct tipc_port *tport)
 {
         struct tipc_sock *tsock = (struct tipc_sock *)tport->usr_handle;
 
-        wake_up_interruptible(tsock->sk.sk_sleep);
+        if (waitqueue_active(tsock->sk.sk_sleep))
+                wake_up_interruptible(tsock->sk.sk_sleep);
 }
 
 /**
@@ -1496,7 +1503,7 @@ static int setsockopt(struct socket *sock,
                 return -ENOPROTOOPT;
         if (ol < sizeof(value))
                 return -EINVAL;
-        if ((res = get_user(value, (u32 *)ov)))
+        if ((res = get_user(value, (u32 __user *)ov)))
                 return res;
 
         if (down_interruptible(&tsock->sem)) 
@@ -1541,7 +1548,7 @@ static int setsockopt(struct socket *sock,
  */
 
 static int getsockopt(struct socket *sock, 
-                      int lvl, int opt, char __user *ov, int *ol)
+                      int lvl, int opt, char __user *ov, int __user *ol)
 {
         struct tipc_sock *tsock = tipc_sk(sock->sk);
         int len;
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index c51600ba5f4a..7a918f12a5df 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -155,7 +155,7 @@ void tipc_subscr_report_overlap(struct subscription *sub,
             sub->seq.upper, found_lower, found_upper);
         if (!tipc_subscr_overlap(sub, found_lower, found_upper))
                 return;
-        if (!must && (sub->filter != TIPC_SUB_PORTS))
+        if (!must && !(sub->filter & TIPC_SUB_PORTS))
                 return;
         subscr_send_event(sub, found_lower, found_upper, event, port_ref, node);
 }
@@ -176,6 +176,13 @@ static void subscr_timeout(struct subscription *sub)
         if (subscriber == NULL)
                 return;
 
+        /* Validate timeout (in case subscription is being cancelled) */
+
+        if (sub->timeout == TIPC_WAIT_FOREVER) {
+                tipc_ref_unlock(subscriber_ref);
+                return;
+        }
+
         /* Unlink subscription from name table */
 
         tipc_nametbl_unsubscribe(sub);
@@ -199,6 +206,20 @@ static void subscr_timeout(struct subscription *sub)
 }
 
 /**
+ * subscr_del - delete a subscription within a subscription list
+ *
+ * Called with subscriber locked.
+ */
+
+static void subscr_del(struct subscription *sub)
+{
+        tipc_nametbl_unsubscribe(sub);
+        list_del(&sub->subscription_list);
+        kfree(sub);
+        atomic_dec(&topsrv.subscription_count);
+}
+
+/**
  * subscr_terminate - terminate communication with a subscriber
  * 
  * Called with subscriber locked.  Routine must temporarily release this lock
@@ -227,12 +248,9 @@ static void subscr_terminate(struct subscriber *subscriber)
                         k_cancel_timer(&sub->timer);
                         k_term_timer(&sub->timer);
                 }
-                tipc_nametbl_unsubscribe(sub);
-                list_del(&sub->subscription_list);
-                dbg("Term: Removed sub %u,%u,%u from subscriber %x list\n",
+                dbg("Term: Removing sub %u,%u,%u from subscriber %x list\n",
                     sub->seq.type, sub->seq.lower, sub->seq.upper, subscriber);
-                kfree(sub);
-                atomic_dec(&topsrv.subscription_count);
+                subscr_del(sub);
         }
 
         /* Sever connection to subscriber */
@@ -253,6 +271,49 @@ static void subscr_terminate(struct subscriber *subscriber)
 }
 
 /**
+ * subscr_cancel - handle subscription cancellation request
+ *
+ * Called with subscriber locked.  Routine must temporarily release this lock
+ * to enable the subscription timeout routine to finish without deadlocking;
+ * the lock is then reclaimed to allow caller to release it upon return.
+ *
+ * Note that fields of 's' use subscriber's endianness!
+ */
+
+static void subscr_cancel(struct tipc_subscr *s,
+                          struct subscriber *subscriber)
+{
+        struct subscription *sub;
+        struct subscription *sub_temp;
+        int found = 0;
+
+        /* Find first matching subscription, exit if not found */
+
+        list_for_each_entry_safe(sub, sub_temp, &subscriber->subscription_list,
+                                 subscription_list) {
+                if (!memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr))) {
+                        found = 1;
+                        break;
+                }
+        }
+        if (!found)
+                return;
+
+        /* Cancel subscription timer (if used), then delete subscription */
+
+        if (sub->timeout != TIPC_WAIT_FOREVER) {
+                sub->timeout = TIPC_WAIT_FOREVER;
+                spin_unlock_bh(subscriber->lock);
+                k_cancel_timer(&sub->timer);
+                k_term_timer(&sub->timer);
+                spin_lock_bh(subscriber->lock);
+        }
+        dbg("Cancel: removing sub %u,%u,%u from subscriber %x list\n",
+            sub->seq.type, sub->seq.lower, sub->seq.upper, subscriber);
+        subscr_del(sub);
+}
+
+/**
  * subscr_subscribe - create subscription for subscriber
  * 
  * Called with subscriber locked
@@ -263,6 +324,21 @@ static void subscr_subscribe(struct tipc_subscr *s,
 {
         struct subscription *sub;
 
+        /* Determine/update subscriber's endianness */
+
+        if (s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE))
+                subscriber->swap = 0;
+        else
+                subscriber->swap = 1;
+
+        /* Detect & process a subscription cancellation request */
+
+        if (s->filter & htohl(TIPC_SUB_CANCEL, subscriber->swap)) {
+                s->filter &= ~htohl(TIPC_SUB_CANCEL, subscriber->swap);
+                subscr_cancel(s, subscriber);
+                return;
+        }
+
         /* Refuse subscription if global limit exceeded */
 
         if (atomic_read(&topsrv.subscription_count) >= tipc_max_subscriptions) {
@@ -281,13 +357,6 @@ static void subscr_subscribe(struct tipc_subscr *s,
                 return;
         }
 
-        /* Determine/update subscriber's endianness */
-
-        if ((s->filter == TIPC_SUB_PORTS) || (s->filter == TIPC_SUB_SERVICE))
-                subscriber->swap = 0;
-        else
-                subscriber->swap = 1;
-
         /* Initialize subscription object */
 
         memset(sub, 0, sizeof(*sub));
@@ -296,8 +365,8 @@ static void subscr_subscribe(struct tipc_subscr *s,
         sub->seq.upper = htohl(s->seq.upper, subscriber->swap);
         sub->timeout = htohl(s->timeout, subscriber->swap);
         sub->filter = htohl(s->filter, subscriber->swap);
-        if ((((sub->filter != TIPC_SUB_PORTS) 
-              && (sub->filter != TIPC_SUB_SERVICE)))
+        if ((!(sub->filter & TIPC_SUB_PORTS)
+             == !(sub->filter & TIPC_SUB_SERVICE))
             || (sub->seq.lower > sub->seq.upper)) {
                 warn("Subscription rejected, illegal request\n");
                 kfree(sub);
diff --git a/net/xfrm/xfrm_hash.h b/net/xfrm/xfrm_hash.h
index d3abb0b7dc62..d401dc8f05ed 100644
--- a/net/xfrm/xfrm_hash.h
+++ b/net/xfrm/xfrm_hash.h
@@ -41,27 +41,28 @@ static inline unsigned int __xfrm_dst_hash(xfrm_address_t *daddr, xfrm_address_t
         return (h ^ (h >> 16)) & hmask;
 }
 
-static inline unsigned __xfrm_src_hash(xfrm_address_t *saddr,
+static inline unsigned __xfrm_src_hash(xfrm_address_t *daddr,
+                                       xfrm_address_t *saddr,
                                        unsigned short family,
                                        unsigned int hmask)
 {
         unsigned int h = family;
         switch (family) {
         case AF_INET:
-                h ^= __xfrm4_addr_hash(saddr);
+                h ^= __xfrm4_daddr_saddr_hash(daddr, saddr);
                 break;
         case AF_INET6:
-                h ^= __xfrm6_addr_hash(saddr);
+                h ^= __xfrm6_daddr_saddr_hash(daddr, saddr);
                 break;
         };
         return (h ^ (h >> 16)) & hmask;
 }
 
 static inline unsigned int
-__xfrm_spi_hash(xfrm_address_t *daddr, u32 spi, u8 proto, unsigned short family,
+__xfrm_spi_hash(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family,
                 unsigned int hmask)
 {
-        unsigned int h = spi ^ proto;
+        unsigned int h = (__force u32)spi ^ proto;
         switch (family) {
         case AF_INET:
                 h ^= __xfrm4_addr_hash(daddr);
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index dfc90bb1cf1f..e8198a2c785d 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -46,7 +46,7 @@ EXPORT_SYMBOL(secpath_dup);
 
 /* Fetch spi and seq from ipsec header */
 
-int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq)
+int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq)
 {
         int offset, offset_seq;
 
@@ -62,7 +62,7 @@ int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq)
         case IPPROTO_COMP:
                 if (!pskb_may_pull(skb, sizeof(struct ip_comp_hdr)))
                         return -EINVAL;
-                *spi = htonl(ntohs(*(u16*)(skb->h.raw + 2)));
+                *spi = htonl(ntohs(*(__be16*)(skb->h.raw + 2)));
                 *seq = 0;
                 return 0;
         default:
@@ -72,8 +72,8 @@ int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq)
         if (!pskb_may_pull(skb, 16))
                 return -EINVAL;
 
-        *spi = *(u32*)(skb->h.raw + offset);
-        *seq = *(u32*)(skb->h.raw + offset_seq);
+        *spi = *(__be32*)(skb->h.raw + offset);
+        *seq = *(__be32*)(skb->h.raw + offset_seq);
         return 0;
 }
 EXPORT_SYMBOL(xfrm_parse_spi);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index b6e2e79d7261..7736b23c3f03 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -778,8 +778,9 @@ void xfrm_policy_flush(u8 type)
         for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
                 struct xfrm_policy *pol;
                 struct hlist_node *entry;
-                int i;
+                int i, killed;
 
+                killed = 0;
         again1:
                 hlist_for_each_entry(pol, entry,
                                      &xfrm_policy_inexact[dir], bydst) {
@@ -790,6 +791,7 @@ void xfrm_policy_flush(u8 type)
                         write_unlock_bh(&xfrm_policy_lock);
 
                         xfrm_policy_kill(pol);
+                        killed++;
 
                         write_lock_bh(&xfrm_policy_lock);
                         goto again1;
@@ -807,13 +809,14 @@ void xfrm_policy_flush(u8 type)
                                 write_unlock_bh(&xfrm_policy_lock);
 
                                 xfrm_policy_kill(pol);
+                                killed++;
 
                                 write_lock_bh(&xfrm_policy_lock);
                                 goto again2;
                         }
                 }
 
-                xfrm_policy_count[dir] = 0;
+                xfrm_policy_count[dir] -= killed;
         }
         atomic_inc(&flow_cache_genid);
         write_unlock_bh(&xfrm_policy_lock);
@@ -880,30 +883,32 @@ out:
 }
 EXPORT_SYMBOL(xfrm_policy_walk);
 
-/* Find policy to apply to this flow. */
-
+/*
+ * Find policy to apply to this flow.
+ *
+ * Returns 0 if policy found, else an -errno.
+ */
 static int xfrm_policy_match(struct xfrm_policy *pol, struct flowi *fl,
                              u8 type, u16 family, int dir)
 {
         struct xfrm_selector *sel = &pol->selector;
-        int match;
+        int match, ret = -ESRCH;
 
         if (pol->family != family ||
             pol->type != type)
-                return 0;
+                return ret;
 
         match = xfrm_selector_match(sel, fl, family);
-        if (match) {
-                if (!security_xfrm_policy_lookup(pol, fl->secid, dir))
-                        return 1;
-        }
+        if (match)
+                ret = security_xfrm_policy_lookup(pol, fl->secid, dir);
 
-        return 0;
+        return ret;
 }
 
 static struct xfrm_policy *xfrm_policy_lookup_bytype(u8 type, struct flowi *fl,
                                                      u16 family, u8 dir)
 {
+        int err;
         struct xfrm_policy *pol, *ret;
         xfrm_address_t *daddr, *saddr;
         struct hlist_node *entry;
@@ -919,7 +924,15 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(u8 type, struct flowi *fl,
         chain = policy_hash_direct(daddr, saddr, family, dir);
         ret = NULL;
         hlist_for_each_entry(pol, entry, chain, bydst) {
-                if (xfrm_policy_match(pol, fl, type, family, dir)) {
+                err = xfrm_policy_match(pol, fl, type, family, dir);
+                if (err) {
+                        if (err == -ESRCH)
+                                continue;
+                        else {
+                                ret = ERR_PTR(err);
+                                goto fail;
+                        }
+                } else {
                         ret = pol;
                         priority = ret->priority;
                         break;
@@ -927,36 +940,53 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(u8 type, struct flowi *fl,
         }
         chain = &xfrm_policy_inexact[dir];
         hlist_for_each_entry(pol, entry, chain, bydst) {
-                if (xfrm_policy_match(pol, fl, type, family, dir) &&
-                    pol->priority < priority) {
+                err = xfrm_policy_match(pol, fl, type, family, dir);
+                if (err) {
+                        if (err == -ESRCH)
+                                continue;
+                        else {
+                                ret = ERR_PTR(err);
+                                goto fail;
+                        }
+                } else if (pol->priority < priority) {
                         ret = pol;
                         break;
                 }
         }
         if (ret)
                 xfrm_pol_hold(ret);
+fail:
         read_unlock_bh(&xfrm_policy_lock);
 
         return ret;
 }
 
-static void xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir,
+static int xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir,
                                void **objp, atomic_t **obj_refp)
 {
         struct xfrm_policy *pol;
+        int err = 0;
 
 #ifdef CONFIG_XFRM_SUB_POLICY
         pol = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_SUB, fl, family, dir);
-        if (pol)
+        if (IS_ERR(pol)) {
+                err = PTR_ERR(pol);
+                pol = NULL;
+        }
+        if (pol || err)
                 goto end;
 #endif
         pol = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_MAIN, fl, family, dir);
-
+        if (IS_ERR(pol)) {
+                err = PTR_ERR(pol);
+                pol = NULL;
+        }
 #ifdef CONFIG_XFRM_SUB_POLICY
 end:
 #endif
         if ((*objp = (void *) pol) != NULL)
                 *obj_refp = &pol->refcnt;
+        return err;
 }
 
 static inline int policy_to_flow_dir(int dir)
@@ -986,12 +1016,16 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struc
                                                 sk->sk_family);
                 int err = 0;
 
-                if (match)
-                  err = security_xfrm_policy_lookup(pol, fl->secid, policy_to_flow_dir(dir));
-
-                if (match && !err)
-                        xfrm_pol_hold(pol);
-                else
+                if (match) {
+                        err = security_xfrm_policy_lookup(pol, fl->secid,
+                                        policy_to_flow_dir(dir));
+                        if (!err)
+                                xfrm_pol_hold(pol);
+                        else if (err == -ESRCH)
+                                pol = NULL;
+                        else
+                                pol = ERR_PTR(err);
+                } else
                         pol = NULL;
         }
         read_unlock_bh(&xfrm_policy_lock);
@@ -1283,8 +1317,11 @@ restart:
         pol_dead = 0;
         xfrm_nr = 0;
 
-        if (sk && sk->sk_policy[1])
+        if (sk && sk->sk_policy[1]) {
                 policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
+                if (IS_ERR(policy))
+                        return PTR_ERR(policy);
+        }
 
         if (!policy) {
                 /* To accelerate a bit...  */
@@ -1294,6 +1331,8 @@ restart:
 
                 policy = flow_cache_lookup(fl, dst_orig->ops->family,
                                            dir, xfrm_policy_lookup);
+                if (IS_ERR(policy))
+                        return PTR_ERR(policy);
         }
 
         if (!policy)
@@ -1340,6 +1379,10 @@ restart:
                                                             fl, family,
                                                             XFRM_POLICY_OUT);
                         if (pols[1]) {
+                                if (IS_ERR(pols[1])) {
+                                        err = PTR_ERR(pols[1]);
+                                        goto error;
+                                }
                                 if (pols[1]->action == XFRM_POLICY_BLOCK) {
                                         err = -EPERM;
                                         goto error;
@@ -1571,13 +1614,19 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
         }
 
         pol = NULL;
-        if (sk && sk->sk_policy[dir])
+        if (sk && sk->sk_policy[dir]) {
                 pol = xfrm_sk_policy_lookup(sk, dir, &fl);
+                if (IS_ERR(pol))
+                        return 0;
+        }
 
         if (!pol)
                 pol = flow_cache_lookup(&fl, family, fl_dir,
                                         xfrm_policy_lookup);
 
+        if (IS_ERR(pol))
+                return 0;
+
         if (!pol) {
                 if (skb->sp && secpath_has_nontransport(skb->sp, 0, &xerr_idx)) {
                         xfrm_secpath_reject(xerr_idx, skb, &fl);
@@ -1596,6 +1645,8 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
                                                     &fl, family,
                                                     XFRM_POLICY_IN);
                 if (pols[1]) {
+                        if (IS_ERR(pols[1]))
+                                return 0;
                         pols[1]->curlft.use_time = (unsigned long)xtime.tv_sec;
                         npols ++;
                 }
@@ -1703,7 +1754,7 @@ static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
 
 static int stale_bundle(struct dst_entry *dst)
 {
-        return !xfrm_bundle_ok((struct xfrm_dst *)dst, NULL, AF_UNSPEC, 0);
+        return !xfrm_bundle_ok(NULL, (struct xfrm_dst *)dst, NULL, AF_UNSPEC, 0);
 }
 
 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
@@ -1825,7 +1876,8 @@ EXPORT_SYMBOL(xfrm_init_pmtu);
  * still valid.
  */
 
-int xfrm_bundle_ok(struct xfrm_dst *first, struct flowi *fl, int family, int strict)
+int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first,
+                struct flowi *fl, int family, int strict)
 {
         struct dst_entry *dst = &first->u.dst;
         struct xfrm_dst *last;
@@ -1842,7 +1894,7 @@ int xfrm_bundle_ok(struct xfrm_dst *first, struct flowi *fl, int family, int str
 
                 if (fl && !xfrm_selector_match(&dst->xfrm->sel, fl, family))
                         return 0;
-                if (fl && !security_xfrm_flow_state_match(fl, dst->xfrm))
+                if (fl && !security_xfrm_flow_state_match(fl, dst->xfrm, pol))
                         return 0;
                 if (dst->xfrm->km.state != XFRM_STATE_VALID)
                         return 0;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 9f63edd39346..84bbf8474f3e 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -63,14 +63,15 @@ static inline unsigned int xfrm_dst_hash(xfrm_address_t *daddr,
         return __xfrm_dst_hash(daddr, saddr, reqid, family, xfrm_state_hmask);
 }
 
-static inline unsigned int xfrm_src_hash(xfrm_address_t *addr,
+static inline unsigned int xfrm_src_hash(xfrm_address_t *daddr,
+                                         xfrm_address_t *saddr,
                                          unsigned short family)
 {
-        return __xfrm_src_hash(addr, family, xfrm_state_hmask);
+        return __xfrm_src_hash(daddr, saddr, family, xfrm_state_hmask);
 }
 
 static inline unsigned int
-xfrm_spi_hash(xfrm_address_t *daddr, u32 spi, u8 proto, unsigned short family)
+xfrm_spi_hash(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
 {
         return __xfrm_spi_hash(daddr, spi, proto, family, xfrm_state_hmask);
 }
@@ -92,13 +93,17 @@ static void xfrm_hash_transfer(struct hlist_head *list,
                                     nhashmask);
                 hlist_add_head(&x->bydst, ndsttable+h);
 
-                h = __xfrm_src_hash(&x->props.saddr, x->props.family,
+                h = __xfrm_src_hash(&x->id.daddr, &x->props.saddr,
+                                    x->props.family,
                                     nhashmask);
                 hlist_add_head(&x->bysrc, nsrctable+h);
 
-                h = __xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto,
-                                    x->props.family, nhashmask);
-                hlist_add_head(&x->byspi, nspitable+h);
+                if (x->id.spi) {
+                        h = __xfrm_spi_hash(&x->id.daddr, x->id.spi,
+                                            x->id.proto, x->props.family,
+                                            nhashmask);
+                        hlist_add_head(&x->byspi, nspitable+h);
+                }
         }
 }
 
@@ -421,7 +426,7 @@ xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
         return 0;
 }
 
-static struct xfrm_state *__xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto, unsigned short family)
+static struct xfrm_state *__xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto, unsigned short family)
 {
         unsigned int h = xfrm_spi_hash(daddr, spi, proto, family);
         struct xfrm_state *x;
@@ -455,7 +460,7 @@ static struct xfrm_state *__xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8
 
 static struct xfrm_state *__xfrm_state_lookup_byaddr(xfrm_address_t *daddr, xfrm_address_t *saddr, u8 proto, unsigned short family)
 {
-        unsigned int h = xfrm_src_hash(saddr, family);
+        unsigned int h = xfrm_src_hash(daddr, saddr, family);
         struct xfrm_state *x;
         struct hlist_node *entry;
 
@@ -584,7 +589,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                 if (km_query(x, tmpl, pol) == 0) {
                         x->km.state = XFRM_STATE_ACQ;
                         hlist_add_head(&x->bydst, xfrm_state_bydst+h);
-                        h = xfrm_src_hash(saddr, family);
+                        h = xfrm_src_hash(daddr, saddr, family);
                         hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
                         if (x->id.spi) {
                                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
@@ -609,6 +614,14 @@ out:
         return x;
 }
 
+static void xfrm_hash_grow_check(int have_hash_collision)
+{
+        if (have_hash_collision &&
+            (xfrm_state_hmask + 1) < xfrm_state_hashmax &&
+            xfrm_state_num > xfrm_state_hmask)
+                schedule_work(&xfrm_hash_work);
+}
+
 static void __xfrm_state_insert(struct xfrm_state *x)
 {
         unsigned int h;
@@ -619,10 +632,10 @@ static void __xfrm_state_insert(struct xfrm_state *x)
                           x->props.reqid, x->props.family);
         hlist_add_head(&x->bydst, xfrm_state_bydst+h);
 
-        h = xfrm_src_hash(&x->props.saddr, x->props.family);
+        h = xfrm_src_hash(&x->id.daddr, &x->props.saddr, x->props.family);
         hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
 
-        if (xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY)) {
+        if (x->id.spi) {
                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto,
                                   x->props.family);
 
@@ -637,10 +650,7 @@ static void __xfrm_state_insert(struct xfrm_state *x)
 
         xfrm_state_num++;
 
-        if (x->bydst.next != NULL &&
-            (xfrm_state_hmask + 1) < xfrm_state_hashmax &&
-            xfrm_state_num > xfrm_state_hmask)
-                schedule_work(&xfrm_hash_work);
+        xfrm_hash_grow_check(x->bydst.next != NULL);
 }
 
 /* xfrm_state_lock is held */
@@ -745,9 +755,13 @@ static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 re
                 x->timer.expires = jiffies + XFRM_ACQ_EXPIRES*HZ;
                 add_timer(&x->timer);
                 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
-                h = xfrm_src_hash(saddr, family);
+                h = xfrm_src_hash(daddr, saddr, family);
                 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
                 wake_up(&km_waitq);
+
+                xfrm_state_num++;
+
+                xfrm_hash_grow_check(x->bydst.next != NULL);
         }
 
         return x;
@@ -916,7 +930,7 @@ err:
 EXPORT_SYMBOL(xfrm_state_check);
 
 struct xfrm_state *
-xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto,
+xfrm_state_lookup(xfrm_address_t *daddr, __be32 spi, u8 proto,
                   unsigned short family)
 {
         struct xfrm_state *x;
@@ -1040,7 +1054,7 @@ u32 xfrm_get_acqseq(void)
 EXPORT_SYMBOL(xfrm_get_acqseq);
 
 void
-xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi)
+xfrm_alloc_spi(struct xfrm_state *x, __be32 minspi, __be32 maxspi)
 {
         unsigned int h;
         struct xfrm_state *x0;
@@ -1057,10 +1071,10 @@ xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi)
                 x->id.spi = minspi;
         } else {
                 u32 spi = 0;
-                minspi = ntohl(minspi);
-                maxspi = ntohl(maxspi);
-                for (h=0; h<maxspi-minspi+1; h++) {
-                        spi = minspi + net_random()%(maxspi-minspi+1);
+                u32 low = ntohl(minspi);
+                u32 high = ntohl(maxspi);
+                for (h=0; h<high-low+1; h++) {
+                        spi = low + net_random()%(high-low+1);
                         x0 = xfrm_state_lookup(&x->id.daddr, htonl(spi), x->id.proto, x->props.family);
                         if (x0 == NULL) {
                                 x->id.spi = htonl(spi);
@@ -1180,11 +1194,10 @@ static void xfrm_replay_timer_handler(unsigned long data)
         spin_unlock(&x->lock);
 }
 
-int xfrm_replay_check(struct xfrm_state *x, u32 seq)
+int xfrm_replay_check(struct xfrm_state *x, __be32 net_seq)
 {
         u32 diff;
-
-        seq = ntohl(seq);
+        u32 seq = ntohl(net_seq);
 
         if (unlikely(seq == 0))
                 return -EINVAL;
@@ -1206,11 +1219,10 @@ int xfrm_replay_check(struct xfrm_state *x, u32 seq)
 }
 EXPORT_SYMBOL(xfrm_replay_check);
 
-void xfrm_replay_advance(struct xfrm_state *x, u32 seq)
+void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
 {
         u32 diff;
-
-        seq = ntohl(seq);
+        u32 seq = ntohl(net_seq);
 
         if (seq > x->replay.seq) {
                 diff = seq - x->replay.seq;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index c59a78d2923a..2b2e59d8ffbc 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -211,6 +211,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
         case XFRM_MODE_TRANSPORT:
         case XFRM_MODE_TUNNEL:
         case XFRM_MODE_ROUTEOPTIMIZATION:
+        case XFRM_MODE_BEET:
                 break;
 
         default:
@@ -1991,15 +1992,6 @@ static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
         xp->type = XFRM_POLICY_TYPE_MAIN;
         copy_templates(xp, ut, nr);
 
-        if (!xp->security) {
-                int err = security_xfrm_sock_policy_alloc(xp, sk);
-                if (err) {
-                        kfree(xp);
-                        *dir = err;
-                        return NULL;
-                }
-        }
-
         *dir = p->dir;
 
         return xp;