Merge bk://kernel.bkbits.net/davem/sparc-2.5

into home.osdl.org:/home/torvalds/v2.5/linux

84 files changed, 4509 insertions, 949 deletions

diff --git a/Documentation/networking/ifenslave.c b/Documentation/networking/ifenslave.c
index 2e64bcbc295c..bf1b1d7548ae 100644
--- a/Documentation/networking/ifenslave.c
+++ b/Documentation/networking/ifenslave.c
@@ -27,7 +27,7 @@
  *    - 2001/02/16 Chad N. Tindel <ctindel at ieee dot org> :
  *       - Master is now brought down before setting the MAC address.  In
  *         the 2.4 kernel you can't change the MAC address while the device is
- *         up because you get EBUSY.  
+ *         up because you get EBUSY.
  *
  *    - 2001/09/13 Takao Indoh <indou dot takao at jp dot fujitsu dot com>
  *       - Added the ability to change the active interface on a mode 1 bond
@@ -44,17 +44,60 @@
  *
  *    - 2002/10/31 Tony Cureington <tony.cureington * hp_com> :
  *       - If the master does not have a hardware address when the first slave
- *         is enslaved, the master is assigned the hardware address of that 
- *         slave - there is a comment in bonding.c stating "ifenslave takes 
- *         care of this now." This corrects the problem of slaves having 
- *         different hardware addresses in active-backup mode when 
+ *         is enslaved, the master is assigned the hardware address of that
+ *         slave - there is a comment in bonding.c stating "ifenslave takes
+ *         care of this now." This corrects the problem of slaves having
+ *         different hardware addresses in active-backup mode when
  *         multiple interfaces are specified on a single ifenslave command
  *         (ifenslave bond0 eth0 eth1).
  *
+ *    - 2003/03/18 - Tsippy Mendelson <tsippy.mendelson at intel dot com> and
+ *                   Shmulik Hen <shmulik.hen at intel dot com>
+ *       - Moved setting the slave's mac address and openning it, from
+ *         the application to the driver. This enables support of modes
+ *         that need to use the unique mac address of each slave.
+ *         The driver also takes care of closing the slave and restoring its
+ *         original mac address upon release.
+ *         In addition, block possibility of enslaving before the master is up.
+ *         This prevents putting the system in an undefined state.
+ *
+ *    - 2003/05/01 - Amir Noam <amir.noam at intel dot com>
+ *       - Added ABI version control to restore compatibility between
+ *         new/old ifenslave and new/old bonding.
+ *       - Prevent adding an adapter that is already a slave.
+ *         Fixes the problem of stalling the transmission and leaving
+ *         the slave in a down state.
+ *
+ *    - 2003/05/01 - Shmulik Hen <shmulik.hen at intel dot com>
+ *       - Prevent enslaving if the bond device is down.
+ *         Fixes the problem of leaving the system in unstable state and
+ *         halting when trying to remove the module.
+ *       - Close socket on all abnormal exists.
+ *       - Add versioning scheme that follows that of the bonding driver.
+ *         current version is 1.0.0 as a base line.
+ *
+ *    - 2003/05/22 - Jay Vosburgh <fubar at us dot ibm dot com>
+ *	 - ifenslave -c was broken; it's now fixed
+ *	 - Fixed problem with routes vanishing from master during enslave
+ *	   processing.
+ *
+ *    - 2003/05/27 - Amir Noam <amir.noam at intel dot com>
+ *	 - Fix backward compatibility issues:
+ *	   For drivers not using ABI versions, slave was set down while
+ *	   it should be left up before enslaving.
+ *	   Also, master was not set down and the default set_mac_address()
+ *	   would fail and generate an error message in the system log.
+ * 	 - For opt_c: slave should not be set to the master's setting
+ *	   while it is running. It was already set during enslave. To
+ *	   simplify things, it is now handeled separately.
  */
 
+#define APP_VERSION	"1.0.12"
+#define APP_RELDATE	"June 30, 2003"
+#define APP_NAME	"ifenslave"
+
 static char *version =
-"ifenslave.c:v0.07 9/9/97  Donald Becker (becker@cesdis.gsfc.nasa.gov).\n"
+APP_NAME ".c:v" APP_VERSION " (" APP_RELDATE ") "  "\nDonald Becker (becker@cesdis.gsfc.nasa.gov).\n"
 "detach support added on 2000/10/02 by Willy Tarreau (willy at meta-x.org).\n"
 "2.4 kernel support added on 2001/02/16 by Chad N. Tindel (ctindel at ieee dot org.\n";
 
@@ -103,6 +146,12 @@ static const char *howto_msg =
 #include <linux/if_bonding.h>
 #include <linux/sockios.h>
 
+typedef unsigned long long u64;	/* hack, so we may include kernel's ethtool.h */
+typedef __uint32_t u32;		/* ditto */
+typedef __uint16_t u16;		/* ditto */
+typedef __uint8_t u8;		/* ditto */
+#include <linux/ethtool.h>
+
 struct option longopts[] = {
  /* { name  has_arg  *flag  val } */
     {"all-interfaces", 0, 0, 'a'},	/* Show all interfaces. */
@@ -130,18 +179,19 @@ opt_howto = 0;
 int skfd = -1;					/* AF_INET socket for ioctl() calls.	*/
 
 static void if_print(char *ifname);
+static int get_abi_ver(char *master_ifname);
 
 int
 main(int argc, char **argv)
 {
 	struct ifreq  ifr2, if_hwaddr, if_ipaddr, if_metric, if_mtu, if_dstaddr;
 	struct ifreq  if_netmask, if_brdaddr, if_flags;
-	int goterr = 0;
+	int rv, goterr = 0;
 	int c, errflag = 0;
 	sa_family_t master_family;
 	char **spp, *master_ifname, *slave_ifname;
 	int hwaddr_notset;
-	int master_up;
+	int abi_ver = 0;
 
 	while ((c = getopt_long(argc, argv, "acdfrvV?h", longopts, 0)) != EOF)
 		switch (c) {
@@ -207,6 +257,7 @@ main(int argc, char **argv)
 		char **tempp = spp;
 		if ((master_ifname == NULL)||(slave_ifname == NULL)||(*tempp++ != NULL)) {
 			fprintf(stderr, usage_msg);
+			(void) close(skfd);
 			return 2;
 		}
 	}
@@ -218,6 +269,13 @@ main(int argc, char **argv)
 		exit(0);
 	}
 
+	/* exchange abi version with bonding driver */
+	abi_ver = get_abi_ver(master_ifname);
+	if (abi_ver < 0) {
+		(void) close(skfd);
+		exit(1);
+	}
+
 	/* Get the vitals from the master interface. */
 	{
 		struct ifreq *ifra[7] = { &if_ipaddr, &if_mtu, &if_dstaddr,
@@ -242,6 +300,13 @@ main(int argc, char **argv)
 			}
 		}
 
+		/* check if master is up; if not then fail any operation */
+		if (!(if_flags.ifr_flags & IFF_UP)) {
+			fprintf(stderr, "Illegal operation; the specified master interface '%s' is not up.\n", master_ifname);
+			(void) close(skfd);
+			exit (1);
+		}
+
 		hwaddr_notset = 1; /* assume master's address not set yet */
 		for (i = 0; hwaddr_notset && (i < 6); i++) {
 			hwaddr_notset &= ((unsigned char *)if_hwaddr.ifr_hwaddr.sa_data)[i] == 0;
@@ -254,7 +319,7 @@ main(int argc, char **argv)
 					" with ethernet-like network interfaces.\n"
 					" Use the '-f' option to force the operation.\n",
 					master_ifname);
-
+			(void) close(skfd);
 			exit (1);
 		}
 		master_family = if_hwaddr.ifr_hwaddr.sa_family;
@@ -278,143 +343,153 @@ main(int argc, char **argv)
 					fprintf(stderr,	"SIOCBONDRELEASE: cannot detach %s from %s. errno=%s.\n",
 							slave_ifname, master_ifname, strerror(errno));
 			}
-			else {  /* we'll set the interface down to avoid any conflicts due to
-					   same IP/MAC */
+			else if (abi_ver < 1) {
+			      	/* The driver is using an old ABI, so we'll set the interface
+				 * down to avoid any conflicts due to same IP/MAC
+				 */
 				strncpy(ifr2.ifr_name, slave_ifname, IFNAMSIZ);
 				if (ioctl(skfd, SIOCGIFFLAGS, &ifr2) < 0) {
 					int saved_errno = errno;
 					fprintf(stderr, "SIOCGIFFLAGS on %s failed: %s\n", slave_ifname,
-							strerror(saved_errno));
+						strerror(saved_errno));
 				}
 				else {
 					ifr2.ifr_flags &= ~(IFF_UP | IFF_RUNNING);
 					if (ioctl(skfd, SIOCSIFFLAGS, &ifr2) < 0) {
 						int saved_errno = errno;
 						fprintf(stderr, "Shutting down interface %s failed: %s\n",
-								slave_ifname, strerror(saved_errno));
+							slave_ifname, strerror(saved_errno));
 					}
 				}
 			}
-		}
-		else {  /* attach a slave interface to the master */
-			/* two possibilities :
-			   - if hwaddr_notset, do nothing.  The bond will assign the
-			     hwaddr from its first slave.
-			   - if !hwaddr_notset, assign the master's hwaddr to each slave
-			*/
+		} else if (opt_c) { /* change primary slave */
+			strncpy(if_flags.ifr_name, master_ifname, IFNAMSIZ);
+			strncpy(if_flags.ifr_slave, slave_ifname, IFNAMSIZ);
+			if ((ioctl(skfd, SIOCBONDCHANGEACTIVE, &if_flags) < 0) &&
+			    (ioctl(skfd, BOND_CHANGE_ACTIVE_OLD, &if_flags) < 0)) {
+				fprintf(stderr,	"SIOCBONDCHANGEACTIVE: %s.\n", strerror(errno));
+			}
+		} else {  /* attach a slave interface to the master */
 
 			strncpy(ifr2.ifr_name, slave_ifname, IFNAMSIZ);
 			if (ioctl(skfd, SIOCGIFFLAGS, &ifr2) < 0) {
 				int saved_errno = errno;
 				fprintf(stderr, "SIOCGIFFLAGS on %s failed: %s\n", slave_ifname,
 						strerror(saved_errno));
+				(void) close(skfd);
 				return 1;
 			}
 
+			if ((ifr2.ifr_flags & IFF_SLAVE) && !opt_r) {
+				fprintf(stderr, "%s is already a slave\n", slave_ifname);
+				(void) close(skfd);
+				return 1;
+			}
+
+			/* if hwaddr_notset, assign the slave hw address to the master */
 			if (hwaddr_notset) {
-				/* assign the slave hw address to the 
-				 * master since it currently does not 
+				/* assign the slave hw address to the
+				 * master since it currently does not
 				 * have one; otherwise, slaves may
-				 * have different hw addresses in 
-				 * active-backup mode as seen when enslaving 
+				 * have different hw addresses in
+				 * active-backup mode as seen when enslaving
 				 * using "ifenslave bond0 eth0 eth1" because
 				 * hwaddr_notset is set outside this loop.
 				 * TODO: put this and the "else" portion in
 				 *       a function.
 				 */
-				goterr = 0;
-				master_up = 0;
-				if (if_flags.ifr_flags & IFF_UP) {
-					if_flags.ifr_flags &= ~IFF_UP;
-					if (ioctl(skfd, SIOCSIFFLAGS, 
-							&if_flags) < 0) {
-						goterr = 1;
-						fprintf(stderr, 
-							"Shutting down "
-							"interface %s failed: "
-							"%s\n",
-							master_ifname, 
-							strerror(errno));
-					} else {
-						/* we took the master down, 
-						 * so we must bring it up 
-						 */
-						master_up = 1; 
-					}
+				/* get the slaves MAC address */
+				strncpy(if_hwaddr.ifr_name, slave_ifname,
+					IFNAMSIZ);
+				rv = ioctl(skfd, SIOCGIFHWADDR, &if_hwaddr);
+				if (-1 == rv) {
+					fprintf(stderr, "Could not get MAC "
+						"address of %s: %s\n",
+						slave_ifname,
+						strerror(errno));
+					strncpy(if_hwaddr.ifr_name,
+						master_ifname, IFNAMSIZ);
+					goterr = 1;
 				}
 
 				if (!goterr) {
-					/* get the slaves MAC address */
-					strncpy(if_hwaddr.ifr_name, 
-							slave_ifname, IFNAMSIZ);
-					if (ioctl(skfd, SIOCGIFHWADDR, 
-							&if_hwaddr) < 0) {
-						fprintf(stderr, 
-							"Could not get MAC "
-							"address of %s: %s\n",
-							slave_ifname, 
-							strerror(errno));
-						strncpy(if_hwaddr.ifr_name, 
-							master_ifname, 
-							IFNAMSIZ);
-						goterr=1;
+					if (abi_ver < 1) {
+						/* In ABI versions older than 1, the
+						 * master's set_mac routine couldn't
+						 * work if it was up, because it
+						 * used the default ethernet set_mac
+						 * function.
+						 */
+						/* bring master down */
+						if_flags.ifr_flags &= ~IFF_UP;
+						if (ioctl(skfd, SIOCSIFFLAGS,
+								&if_flags) < 0) {
+							goterr = 1;
+							fprintf(stderr,
+								"Shutting down "
+								"interface %s failed: "
+								"%s\n",
+								master_ifname,
+								strerror(errno));
+						}
 					}
-				}
 
-				if (!goterr) {
-					strncpy(if_hwaddr.ifr_name, 
+					strncpy(if_hwaddr.ifr_name,
 						master_ifname, IFNAMSIZ);
-					if (ioctl(skfd, SIOCSIFHWADDR, 
+					if (ioctl(skfd, SIOCSIFHWADDR,
 							&if_hwaddr) < 0) {
-						fprintf(stderr, 
+						fprintf(stderr,
 							"Could not set MAC "
 							"address of %s: %s\n",
-							master_ifname, 
+							master_ifname,
 							strerror(errno));
 						goterr=1;
 					} else {
 						hwaddr_notset = 0;
 					}
-				}
 
-				if (master_up) {
-					if_flags.ifr_flags |= IFF_UP;
-					if (ioctl(skfd, SIOCSIFFLAGS, 
-							&if_flags) < 0) {
-						fprintf(stderr, 
-							"Bringing up interface "
-							"%s failed: %s\n",
-							master_ifname, 
-							strerror(errno));
+					if (abi_ver < 1) {
+						/* bring master back up */
+						if_flags.ifr_flags |= IFF_UP;
+						if (ioctl(skfd, SIOCSIFFLAGS,
+							  &if_flags) < 0) {
+							fprintf(stderr,
+								"Bringing up interface "
+								"%s failed: %s\n",
+								master_ifname,
+								strerror(errno));
+						}
 					}
 				}
+			} else if (abi_ver < 1) { /* if (hwaddr_notset) */
 
-			} else {  
-				/* we'll assign master's hwaddr to this slave */
+			      	/* The driver is using an old ABI, so we'll set the interface
+				 * down and assign the master's hwaddr to it
+				 */
 				if (ifr2.ifr_flags & IFF_UP) {
 					ifr2.ifr_flags &= ~IFF_UP;
 					if (ioctl(skfd, SIOCSIFFLAGS, &ifr2) < 0) {
 						int saved_errno = errno;
 						fprintf(stderr, "Shutting down interface %s failed: %s\n",
-								slave_ifname, strerror(saved_errno));
+							slave_ifname, strerror(saved_errno));
 					}
 				}
-	
+
 				strncpy(if_hwaddr.ifr_name, slave_ifname, IFNAMSIZ);
 				if (ioctl(skfd, SIOCSIFHWADDR, &if_hwaddr) < 0) {
 					int saved_errno = errno;
 					fprintf(stderr, "SIOCSIFHWADDR on %s failed: %s\n", if_hwaddr.ifr_name,
-							strerror(saved_errno));
+						strerror(saved_errno));
 					if (saved_errno == EBUSY)
 						fprintf(stderr, "  The slave device %s is busy: it must be"
-								" idle before running this command.\n", slave_ifname);
+							" idle before running this command.\n", slave_ifname);
 					else if (saved_errno == EOPNOTSUPP)
 						fprintf(stderr, "  The slave device you specified does not support"
-								" setting the MAC address.\n  Your kernel likely does not"
-								" support slave devices.\n");
+							" setting the MAC address.\n  Your kernel likely does not"
+							" support slave devices.\n");
 					else if (saved_errno == EINVAL)
 						fprintf(stderr, "  The slave device's address type does not match"
-								" the master's address type.\n");
+							" the master's address type.\n");
 				} else {
 					if (verbose) {
 						unsigned char *hwaddr = if_hwaddr.ifr_hwaddr.sa_data;
@@ -424,10 +499,11 @@ main(int argc, char **argv)
 					}
 				}
 			}
-	
+
 			if (*spp  &&  !strcmp(*spp, "metric")) {
 				if (*++spp == NULL) {
 					fprintf(stderr, usage_msg);
+					(void) close(skfd);
 					exit(2);
 				}
 				if_metric.ifr_metric = atoi(*spp);
@@ -439,7 +515,7 @@ main(int argc, char **argv)
 				}
 				spp++;
 			}
-	
+
 			if (strncpy(if_ipaddr.ifr_name, slave_ifname, IFNAMSIZ) <= 0
 				|| ioctl(skfd, SIOCSIFADDR, &if_ipaddr) < 0) {
 				fprintf(stderr,
@@ -452,16 +528,16 @@ main(int argc, char **argv)
 						   slave_ifname, ipaddr[0], ipaddr[1], ipaddr[2], ipaddr[3]);
 				}
 			}
-	
+
 			if (strncpy(if_mtu.ifr_name, slave_ifname, IFNAMSIZ) <= 0
-				|| ioctl(skfd, SIOCSIFMTU, &if_mtu) < 0) { 
+				|| ioctl(skfd, SIOCSIFMTU, &if_mtu) < 0) {
 				fprintf(stderr, "Something broke setting the slave MTU: %s.\n",
 						strerror(errno));
 			} else {
 				if (verbose)
 					printf("Set the slave's (%s) MTU to %d.\n", slave_ifname, if_mtu.ifr_mtu);
 			}
-	
+
 			if (strncpy(if_dstaddr.ifr_name, slave_ifname, IFNAMSIZ) <= 0
 				|| ioctl(skfd, SIOCSIFDSTADDR, &if_dstaddr) < 0) {
 				fprintf(stderr, "Error setting the slave (%s) with SIOCSIFDSTADDR: %s.\n",
@@ -473,7 +549,7 @@ main(int argc, char **argv)
 						   slave_ifname, ipaddr[0], ipaddr[1], ipaddr[2], ipaddr[3]);
 				}
 			}
-	
+
 			if (strncpy(if_brdaddr.ifr_name, slave_ifname, IFNAMSIZ) <= 0
 				|| ioctl(skfd, SIOCSIFBRDADDR, &if_brdaddr) < 0) {
 				fprintf(stderr,
@@ -486,7 +562,7 @@ main(int argc, char **argv)
 						   slave_ifname, ipaddr[0], ipaddr[1], ipaddr[2], ipaddr[3]);
 				}
 			}
-			
+
 			if (strncpy(if_netmask.ifr_name, slave_ifname, IFNAMSIZ) <= 0
 				|| ioctl(skfd, SIOCSIFNETMASK, &if_netmask) < 0) {
 				fprintf(stderr,
@@ -499,34 +575,45 @@ main(int argc, char **argv)
 						   slave_ifname, ipaddr[0], ipaddr[1], ipaddr[2], ipaddr[3]);
 				}
 			}
-			
-			ifr2.ifr_flags |= IFF_UP; /* the interface will need to be up to be bonded */
-			if ((ifr2.ifr_flags &= ~(IFF_SLAVE | IFF_MASTER)) == 0
-				|| strncpy(ifr2.ifr_name, slave_ifname, IFNAMSIZ) <= 0
-				|| ioctl(skfd, SIOCSIFFLAGS, &ifr2) < 0) {
-				fprintf(stderr,
-						"Something broke setting the slave (%s) flags: %s.\n",
-						slave_ifname, strerror(errno));
+
+			if (abi_ver < 1) {
+
+			      	/* The driver is using an old ABI, so we'll set the interface
+				 * up before enslaving it
+				 */
+				ifr2.ifr_flags |= IFF_UP;
+				if ((ifr2.ifr_flags &= ~(IFF_SLAVE | IFF_MASTER)) == 0
+					|| strncpy(ifr2.ifr_name, slave_ifname, IFNAMSIZ) <= 0
+					|| ioctl(skfd, SIOCSIFFLAGS, &ifr2) < 0) {
+						fprintf(stderr,
+							"Something broke setting the slave (%s) flags: %s.\n",
+							slave_ifname, strerror(errno));
+				} else {
+					if (verbose)
+						printf("Set the slave's (%s) flags %4.4x.\n",
+							slave_ifname, if_flags.ifr_flags);
+				}
 			} else {
-				if (verbose)
-					printf("Set the slave's (%s) flags %4.4x.\n", slave_ifname, if_flags.ifr_flags);
+				/* the bonding module takes care of setting the slave's mac address
+			 	 * and opening its interface
+			 	 */
+				if (ifr2.ifr_flags & IFF_UP) { /* the interface will need to be down */
+					ifr2.ifr_flags &= ~IFF_UP;
+					if (ioctl(skfd, SIOCSIFFLAGS, &ifr2) < 0) {
+						int saved_errno = errno;
+						fprintf(stderr, "Shutting down interface %s failed: %s\n",
+							slave_ifname, strerror(saved_errno));
+					}
+				}
 			}
-	
+
 			/* Do the real thing */
-			if ( ! opt_r) {
+			if (!opt_r) {
 				strncpy(if_flags.ifr_name, master_ifname, IFNAMSIZ);
 				strncpy(if_flags.ifr_slave, slave_ifname, IFNAMSIZ);
-				if (!opt_c) {
-					if ((ioctl(skfd, SIOCBONDENSLAVE, &if_flags) < 0) &&
-					    (ioctl(skfd, BOND_ENSLAVE_OLD, &if_flags) < 0)) {
-						fprintf(stderr,	"SIOCBONDENSLAVE: %s.\n", strerror(errno));
-					}
-				}
-				else {
-					if ((ioctl(skfd, SIOCBONDCHANGEACTIVE, &if_flags) < 0) &&
-					    (ioctl(skfd, BOND_CHANGE_ACTIVE_OLD, &if_flags) < 0)) {
-						fprintf(stderr,	"SIOCBONDCHANGEACTIVE: %s.\n", strerror(errno));
-					}
+				if ((ioctl(skfd, SIOCBONDENSLAVE, &if_flags) < 0) &&
+				    (ioctl(skfd, BOND_ENSLAVE_OLD, &if_flags) < 0)) {
+					fprintf(stderr,	"SIOCBONDENSLAVE: %s.\n", strerror(errno));
 				}
 			}
 		}
@@ -540,7 +627,7 @@ main(int argc, char **argv)
 
 static short mif_flags;
 
-/* Get the interface configuration from the kernel. */
+/* Get the inteface configuration from the kernel. */
 static int if_getconfig(char *ifname)
 {
 	struct ifreq ifr;
@@ -639,7 +726,38 @@ static void if_print(char *ifname)
 	}
 }
 
-
+static int get_abi_ver(char *master_ifname)
+{
+	struct ifreq ifr;
+	struct ethtool_drvinfo info;
+	int abi_ver = 0;
+
+	memset(&ifr, 0, sizeof(ifr));
+	strncpy(ifr.ifr_name, master_ifname, IFNAMSIZ);
+	ifr.ifr_data = (caddr_t)&info;
+
+	info.cmd = ETHTOOL_GDRVINFO;
+	strncpy(info.driver, "ifenslave", 32);
+	snprintf(info.fw_version, 32, "%d", BOND_ABI_VERSION);
+	if (ioctl(skfd, SIOCETHTOOL, &ifr) >= 0) {
+		char *endptr;
+
+		abi_ver = strtoul(info.fw_version, &endptr, 0);
+		if (*endptr) {
+			fprintf(stderr, "Error: got invalid string as an ABI "
+				"version from the bonding module\n");
+			return -1;
+		}
+	}
+
+	if (verbose) {
+        	printf("ABI ver is %d\n", abi_ver);
+	}
+	return abi_ver;
+}
+
+
+
 /*
  * Local variables:
  *  version-control: t
diff --git a/MAINTAINERS b/MAINTAINERS
index 0974c38c05ef..483e47856944 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -420,8 +420,8 @@ L:	linux-computone@lazuli.wittsend.com
 S:	Supported
 
 COMX/MULTIGATE SYNC SERIAL DRIVERS
-P:	Gergely Madarasz
-M:	Gergely Madarasz <gorgo@itc.hu>
+P:	Pasztor Szilard
+M:	Pasztor Szilard <don@itc.hu>
 S:	Supported
 
 COSA/SRP SYNC SERIAL DRIVER
diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index a72eb1909f49..1e5f124f6071 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -110,6 +110,7 @@
 #include <linux/mii.h>
 #include <linux/completion.h>
 #include <linux/crc32.h>
+#include <linux/suspend.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
 
@@ -1597,6 +1598,9 @@ static int rtl8139_thread (void *data)
 		timeout = next_tick;
 		do {
 			timeout = interruptible_sleep_on_timeout (&tp->thr_wait, timeout);
+			/* make swsusp happy with our thread */
+			if (current->flags & PF_FREEZE)
+				refrigerator(PF_IOTHREAD);
 		} while (!signal_pending (current) && (timeout > 0));
 
 		if (signal_pending (current)) {
diff --git a/drivers/net/arcnet/arc-rimi.c b/drivers/net/arcnet/arc-rimi.c
index 3ff5688314d8..db091f95f553 100644
--- a/drivers/net/arcnet/arc-rimi.c
+++ b/drivers/net/arcnet/arc-rimi.c
@@ -47,7 +47,6 @@ static void arcrimi_command(struct net_device *dev, int command);
 static int arcrimi_status(struct net_device *dev);
 static void arcrimi_setmask(struct net_device *dev, int mask);
 static int arcrimi_reset(struct net_device *dev, int really_reset);
-static void arcrimi_openclose(struct net_device *dev, bool open);
 static void arcrimi_copy_to_card(struct net_device *dev, int bufnum, int offset,
 				 void *buf, int count);
 static void arcrimi_copy_from_card(struct net_device *dev, int bufnum, int offset,
@@ -179,7 +178,7 @@ static int __init arcrimi_found(struct net_device *dev)
 	lp->hw.status = arcrimi_status;
 	lp->hw.intmask = arcrimi_setmask;
 	lp->hw.reset = arcrimi_reset;
-	lp->hw.open_close = arcrimi_openclose;
+	lp->hw.owner = THIS_MODULE;
 	lp->hw.copy_to_card = arcrimi_copy_to_card;
 	lp->hw.copy_from_card = arcrimi_copy_from_card;
 	lp->mem_start = ioremap(dev->mem_start, dev->mem_end - dev->mem_start + 1);
@@ -254,15 +253,6 @@ static int arcrimi_reset(struct net_device *dev, int really_reset)
 	return 0;
 }
 
-
-static void arcrimi_openclose(struct net_device *dev, int open)
-{
-	if (open)
-		MOD_INC_USE_COUNT;
-	else
-		MOD_DEC_USE_COUNT;
-}
-
 static void arcrimi_setmask(struct net_device *dev, int mask)
 {
 	struct arcnet_local *lp = (struct arcnet_local *) dev->priv;
diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
index 59857e6ce402..992f4cc8cf53 100644
--- a/drivers/net/arcnet/arcnet.c
+++ b/drivers/net/arcnet/arcnet.c
@@ -343,7 +343,10 @@ void arcdev_setup(struct net_device *dev)
 static int arcnet_open(struct net_device *dev)
 {
 	struct arcnet_local *lp = (struct arcnet_local *) dev->priv;
-	int count, newmtu;
+	int count, newmtu, error;
+
+	if (!try_module_get(lp->hw.owner))
+		return -ENODEV;
 
 	BUGLVL(D_PROTO) {
 		int count;
@@ -360,8 +363,9 @@ static int arcnet_open(struct net_device *dev)
 	/* try to put the card in a defined state - if it fails the first
 	 * time, actually reset it.
 	 */
+	error = -ENODEV;
 	if (ARCRESET(0) && ARCRESET(1))
-		return -ENODEV;
+		goto out_module_put;
 
 	newmtu = choose_mtu();
 	if (newmtu < dev->mtu)
@@ -391,7 +395,7 @@ static int arcnet_open(struct net_device *dev)
 	lp->rfc1201.sequence = 1;
 
 	/* bring up the hardware driver */
-	ARCOPEN(1);
+	lp->hw.open(dev);
 
 	if (dev->dev_addr[0] == 0)
 		BUGMSG(D_NORMAL, "WARNING!  Station address 00 is reserved "
@@ -415,6 +419,10 @@ static int arcnet_open(struct net_device *dev)
 	netif_start_queue(dev);
 
 	return 0;
+
+ out_module_put:
+	module_put(lp->hw.owner);
+	return error;
 }
 
 
@@ -432,8 +440,8 @@ static int arcnet_close(struct net_device *dev)
 	mdelay(1);
 
 	/* shut down the card */
-	ARCOPEN(0);
-
+	lp->hw.close(dev);
+	module_put(lp->hw.owner);
 	return 0;
 }
 
diff --git a/drivers/net/arcnet/com20020-isa.c b/drivers/net/arcnet/com20020-isa.c
index 5e6e3f54c7f2..8cc69625cc10 100644
--- a/drivers/net/arcnet/com20020-isa.c
+++ b/drivers/net/arcnet/com20020-isa.c
@@ -131,14 +131,6 @@ MODULE_PARM(clockp, "i");
 MODULE_PARM(clockm, "i");
 MODULE_LICENSE("GPL");
 
-static void com20020isa_open_close(struct net_device *dev, bool open)
-{
-	if (open)
-		MOD_INC_USE_COUNT;
-	else
-		MOD_DEC_USE_COUNT;
-}
-
 int init_module(void)
 {
 	struct net_device *dev;
@@ -160,7 +152,7 @@ int init_module(void)
 	lp->clockp = clockp & 7;
 	lp->clockm = clockm & 3;
 	lp->timeout = timeout & 3;
-	lp->hw.open_close_ll = com20020isa_open_close;
+	lp->owner = THIS_MODULE;
 
 	dev->base_addr = io;
 	dev->irq = irq;
diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c
index aa0a3626194c..f0c41c94ec05 100644
--- a/drivers/net/arcnet/com20020-pci.c
+++ b/drivers/net/arcnet/com20020-pci.c
@@ -60,14 +60,6 @@ MODULE_PARM(clockp, "i");
 MODULE_PARM(clockm, "i");
 MODULE_LICENSE("GPL");
 
-static void com20020pci_open_close(struct net_device *dev, bool open)
-{
-	if (open)
-		MOD_INC_USE_COUNT;
-	else
-		MOD_DEC_USE_COUNT;
-}
-
 static int __devinit com20020pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
 	struct net_device *dev;
@@ -111,7 +103,7 @@ static int __devinit com20020pci_probe(struct pci_dev *pdev, const struct pci_de
 	lp->clockp = clockp & 7;
 	lp->clockm = clockm & 3;
 	lp->timeout = timeout;
-	lp->hw.open_close_ll = com20020pci_open_close;
+	lp->hw.owner = THIS_MODULE;
 
 	if (check_region(ioaddr, ARCNET_TOTAL_SIZE)) {
 		BUGMSG(D_INIT, "IO region %xh-%xh already allocated.\n",
diff --git a/drivers/net/arcnet/com20020.c b/drivers/net/arcnet/com20020.c
index c37a1f6c9456..650bec307c7c 100644
--- a/drivers/net/arcnet/com20020.c
+++ b/drivers/net/arcnet/com20020.c
@@ -50,13 +50,12 @@ static void com20020_command(struct net_device *dev, int command);
 static int com20020_status(struct net_device *dev);
 static void com20020_setmask(struct net_device *dev, int mask);
 static int com20020_reset(struct net_device *dev, int really_reset);
-static void com20020_openclose(struct net_device *dev, bool open);
 static void com20020_copy_to_card(struct net_device *dev, int bufnum,
 				  int offset, void *buf, int count);
 static void com20020_copy_from_card(struct net_device *dev, int bufnum,
 				    int offset, void *buf, int count);
 static void com20020_set_mc_list(struct net_device *dev);
-
+static void com20020_close(struct net_device *, bool);
 
 static void com20020_copy_from_card(struct net_device *dev, int bufnum,
 				    int offset, void *buf, int count)
@@ -162,13 +161,14 @@ int __devinit com20020_found(struct net_device *dev, int shared)
 
 	lp = (struct arcnet_local *) dev->priv;
 
+	lp->hw.owner = THIS_MODULE;
 	lp->hw.command = com20020_command;
 	lp->hw.status = com20020_status;
 	lp->hw.intmask = com20020_setmask;
 	lp->hw.reset = com20020_reset;
-	lp->hw.open_close = com20020_openclose;
 	lp->hw.copy_to_card = com20020_copy_to_card;
 	lp->hw.copy_from_card = com20020_copy_from_card;
+	lp->hw.close = com20020_close;
 
 	dev->set_multicast_list = com20020_set_mc_list;
 
@@ -298,25 +298,18 @@ static int com20020_status(struct net_device *dev)
 	return ASTATUS();
 }
 
-
-static void com20020_openclose(struct net_device *dev, bool open)
+static void com20020_close(struct net_device *dev, bool open)
 {
 	struct arcnet_local *lp = (struct arcnet_local *) dev->priv;
 	int ioaddr = dev->base_addr;
 
-	if (open) {
-		MOD_INC_USE_COUNT;
-	}
-	else {
+	if (!open) {
 		/* disable transmitter */
 		lp->config &= ~TXENcfg;
 		SETCONF;
-		MOD_DEC_USE_COUNT;
 	}
-	lp->hw.open_close_ll(dev, open);
 }
 
-
 /* Set or clear the multicast filter for this adaptor.
  * num_addrs == -1    Promiscuous mode, receive all packets
  * num_addrs == 0       Normal mode, clear multicast list
diff --git a/drivers/net/arcnet/com90io.c b/drivers/net/arcnet/com90io.c
index 4ff5287daf9b..1d18fc62f7a7 100644
--- a/drivers/net/arcnet/com90io.c
+++ b/drivers/net/arcnet/com90io.c
@@ -47,7 +47,6 @@ static void com90io_command(struct net_device *dev, int command);
 static int com90io_status(struct net_device *dev);
 static void com90io_setmask(struct net_device *dev, int mask);
 static int com90io_reset(struct net_device *dev, int really_reset);
-static void com90io_openclose(struct net_device *dev, bool open);
 static void com90io_copy_to_card(struct net_device *dev, int bufnum, int offset,
 				 void *buf, int count);
 static void com90io_copy_from_card(struct net_device *dev, int bufnum, int offset,
@@ -257,7 +256,7 @@ static int __init com90io_found(struct net_device *dev)
 	lp->hw.status = com90io_status;
 	lp->hw.intmask = com90io_setmask;
 	lp->hw.reset = com90io_reset;
-	lp->hw.open_close = com90io_openclose;
+	lp->hw.owner = THIS_MODULE;
 	lp->hw.copy_to_card = com90io_copy_to_card;
 	lp->hw.copy_from_card = com90io_copy_from_card;
 
@@ -344,14 +343,6 @@ static void com90io_setmask(struct net_device *dev, int mask)
 	AINTMASK(mask);
 }
 
-static void com90io_openclose(struct net_device *dev, int open)
-{
-	if (open)
-		MOD_INC_USE_COUNT;
-	else
-		MOD_DEC_USE_COUNT;
-}
-
 static void com90io_copy_to_card(struct net_device *dev, int bufnum, int offset,
 				 void *buf, int count)
 {
diff --git a/drivers/net/arcnet/com90xx.c b/drivers/net/arcnet/com90xx.c
index 8c50eccf1540..f87660123972 100644
--- a/drivers/net/arcnet/com90xx.c
+++ b/drivers/net/arcnet/com90xx.c
@@ -58,7 +58,6 @@ static void com90xx_command(struct net_device *dev, int command);
 static int com90xx_status(struct net_device *dev);
 static void com90xx_setmask(struct net_device *dev, int mask);
 static int com90xx_reset(struct net_device *dev, int really_reset);
-static void com90xx_openclose(struct net_device *dev, bool open);
 static void com90xx_copy_to_card(struct net_device *dev, int bufnum, int offset,
 				 void *buf, int count);
 static void com90xx_copy_from_card(struct net_device *dev, int bufnum, int offset,
@@ -450,7 +449,7 @@ static int __init com90xx_found(struct net_device *dev0, int ioaddr, int airq,
 	lp->hw.status = com90xx_status;
 	lp->hw.intmask = com90xx_setmask;
 	lp->hw.reset = com90xx_reset;
-	lp->hw.open_close = com90xx_openclose;
+	lp->hw.owner = THIS_MODULE;
 	lp->hw.copy_to_card = com90xx_copy_to_card;
 	lp->hw.copy_from_card = com90xx_copy_from_card;
 	lp->mem_start = ioremap(dev->mem_start, dev->mem_end - dev->mem_start + 1);
@@ -570,16 +569,6 @@ int com90xx_reset(struct net_device *dev, int really_reset)
 	return 0;
 }
 
-
-static void com90xx_openclose(struct net_device *dev, bool open)
-{
-	if (open)
-		MOD_INC_USE_COUNT;
-	else
-		MOD_DEC_USE_COUNT;
-}
-
-
 static void com90xx_copy_to_card(struct net_device *dev, int bufnum, int offset,
 				 void *buf, int count)
 {
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 3b7d0f98f418..81ec0344e5c1 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -1,6 +1,7 @@
 /* b44.c: Broadcom 4400 device driver.
  *
  * Copyright (C) 2002 David S. Miller (davem@redhat.com)
+ * Fixed by Pekka Pietikainen (pp@ee.oulu.fi)
  */
 
 #include <linux/kernel.h>
@@ -14,6 +15,7 @@
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <linux/init.h>
+#include <linux/version.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -23,8 +25,8 @@
 
 #define DRV_MODULE_NAME		"b44"
 #define PFX DRV_MODULE_NAME	": "
-#define DRV_MODULE_VERSION	"0.6"
-#define DRV_MODULE_RELDATE	"Nov 11, 2002"
+#define DRV_MODULE_VERSION	"0.9"
+#define DRV_MODULE_RELDATE	"Jul 14, 2003"
 
 #define B44_DEF_MSG_ENABLE	  \
 	(NETIF_MSG_DRV		| \
@@ -78,6 +80,15 @@ MODULE_PARM_DESC(b44_debug, "B44 bitmapped debugging message enable value");
 
 static int b44_debug = -1;	/* -1 == use B44_DEF_MSG_ENABLE as value */
 
+#ifndef PCI_DEVICE_ID_BCM4401
+#define PCI_DEVICE_ID_BCM4401      0x4401
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
+#define IRQ_RETVAL(x) 
+#define irqreturn_t void
+#endif
+
 static struct pci_device_id b44_pci_tbl[] __devinitdata = {
 	{ PCI_VENDOR_ID_BROADCOM, PCI_DEVICE_ID_BCM4401,
 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0UL },
@@ -259,7 +270,7 @@ static int ssb_is_core_up(struct b44 *bp)
 		== SBTMSLOW_CLOCK);
 }
 
-static void __b44_cam_write(struct b44 *bp, char *data, int index)
+static void __b44_cam_write(struct b44 *bp, unsigned char *data, int index)
 {
 	u32 val;
 
@@ -521,7 +532,7 @@ static void b44_check_phy(struct b44 *bp)
 			/* Link now up */
 			netif_carrier_on(bp->dev);
 			b44_link_report(bp);
-		} else if (netif_carrier_ok(bp->dev)) {
+		} else if (netif_carrier_ok(bp->dev) && !(bmsr & BMSR_LSTATUS)) {
 			/* Link now down */
 			netif_carrier_off(bp->dev);
 			b44_link_report(bp);
@@ -650,8 +661,7 @@ static void b44_recycle_rx(struct b44 *bp, int src_idx, u32 dest_idx_unmasked)
 	src_map = &bp->rx_buffers[src_idx];
 
 	dest_map->skb = src_map->skb;
-	rh = (struct rx_header *)
-		(src_map->skb->data - bp->rx_offset);
+	rh = (struct rx_header *) src_map->skb->data;
 	rh->len = 0;
 	rh->flags = 0;
 	pci_unmap_addr_set(dest_map, mapping,
@@ -660,9 +670,12 @@ static void b44_recycle_rx(struct b44 *bp, int src_idx, u32 dest_idx_unmasked)
 	ctrl = src_desc->ctrl;
 	if (dest_idx == (B44_RX_RING_SIZE - 1))
 		ctrl |= cpu_to_le32(DESC_CTRL_EOT);
+	else
+		ctrl &= cpu_to_le32(~DESC_CTRL_EOT);
 
 	dest_desc->ctrl = ctrl;
 	dest_desc->addr = src_desc->addr;
+	src_map->skb = NULL;
 }
 
 static int b44_rx(struct b44 *bp, int budget)
@@ -685,7 +698,7 @@ static int b44_rx(struct b44 *bp, int budget)
 		pci_dma_sync_single(bp->pdev, map,
 				    RX_PKT_BUF_SZ,
 				    PCI_DMA_FROMDEVICE);
-		rh = (struct rx_header *) (skb->data - bp->rx_offset);
+		rh = (struct rx_header *) skb->data;
 		len = cpu_to_le16(rh->len);
 		if ((len > (RX_PKT_BUF_SZ - bp->rx_offset)) ||
 		    (rh->flags & cpu_to_le16(RX_FLAG_ERRORS))) {
@@ -718,7 +731,9 @@ static int b44_rx(struct b44 *bp, int budget)
 				goto drop_it;
 			pci_unmap_single(bp->pdev, map,
 					 skb_size, PCI_DMA_FROMDEVICE);
-			skb_put(skb, len);
+			/* Leave out rx_header */
+                	skb_put(skb, len+bp->rx_offset);
+            	        skb_pull(skb,bp->rx_offset);
 		} else {
 			struct sk_buff *copy_skb;
 
@@ -730,8 +745,8 @@ static int b44_rx(struct b44 *bp, int budget)
 			copy_skb->dev = bp->dev;
 			skb_reserve(copy_skb, 2);
 			skb_put(copy_skb, len);
-			/* DMA sync done above */
-			memcpy(copy_skb->data, skb->data, len);
+			/* DMA sync done above, copy just the actual packet */
+			memcpy(copy_skb->data, skb->data+bp->rx_offset, len);
 
 			skb = copy_skb;
 		}
@@ -748,6 +763,7 @@ static int b44_rx(struct b44 *bp, int budget)
 	}
 
 	bp->rx_cons = cons;
+	bw32(B44_DMARX_PTR, cons * sizeof(struct dma_desc));
 
 	return received;
 }
@@ -764,6 +780,7 @@ static int b44_poll(struct net_device *netdev, int *budget)
 		b44_tx(bp);
 		/* spin_unlock(&bp->tx_lock); */
 	}
+	spin_unlock_irq(&bp->lock);
 
 	done = 1;
 	if (bp->istat & ISTAT_RX) {
@@ -783,10 +800,12 @@ static int b44_poll(struct net_device *netdev, int *budget)
 	}
 
 	if (bp->istat & ISTAT_ERRORS) {
+		spin_lock_irq(&bp->lock);
 		b44_halt(bp);
 		b44_init_rings(bp);
 		b44_init_hw(bp);
 		netif_wake_queue(bp->dev);
+		spin_unlock_irq(&bp->lock);
 		done = 1;
 	}
 
@@ -794,7 +813,6 @@ static int b44_poll(struct net_device *netdev, int *budget)
 		netif_rx_complete(netdev);
 		b44_enable_ints(bp);
 	}
-	spin_unlock_irq(&bp->lock);
 
 	return (done ? 0 : 1);
 }
@@ -885,7 +903,7 @@ static int b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
 		ctrl |= DESC_CTRL_EOT;
 
 	bp->tx_ring[entry].ctrl = cpu_to_le32(ctrl);
-	bp->tx_ring[entry].addr = cpu_to_le32((u32) mapping);
+	bp->tx_ring[entry].addr = cpu_to_le32((u32) mapping+bp->dma_offset);
 
 	entry = NEXT_TX(entry);
 
@@ -1173,8 +1191,8 @@ static int b44_init_hw(struct b44 *bp)
 	__b44_set_rx_mode(bp->dev);
 
 	/* MTU + eth header + possible VLAN tag + struct rx_header */
-	bw32(B44_RXMAXLEN, bp->dev->mtu + ETH_HLEN + 8 + 24);
-	bw32(B44_TXMAXLEN, bp->dev->mtu + ETH_HLEN + 8 + 24);
+	bw32(B44_RXMAXLEN, bp->dev->mtu + ETH_HLEN + 8 + RX_HEADER_LEN);
+	bw32(B44_TXMAXLEN, bp->dev->mtu + ETH_HLEN + 8 + RX_HEADER_LEN);
 
 	bw32(B44_TX_WMARK, 56); /* XXX magic */
 	bw32(B44_DMATX_CTRL, DMATX_CTRL_ENABLE);
@@ -1184,6 +1202,7 @@ static int b44_init_hw(struct b44 *bp)
 	bw32(B44_DMARX_ADDR, bp->rx_ring_dma + bp->dma_offset);
 
 	bw32(B44_DMARX_PTR, bp->rx_pending);
+	bp->rx_prod = bp->rx_pending;	
 
 	bw32(B44_MIB_CTRL, MIB_CTRL_CLR_ON_READ);
 
@@ -1345,6 +1364,8 @@ static void __b44_set_rx_mode(struct net_device *dev)
 			__b44_load_mcast(bp, dev);
 
 		bw32(B44_RXCONFIG, val);
+        	val = br32(B44_CAM_CTRL);
+	        bw32(B44_CAM_CTRL, val | CAM_CTRL_ENABLE);
 	}
 }
 
@@ -1678,8 +1699,9 @@ static int __devinit b44_get_invariants(struct b44 *bp)
 	bp->core_unit = ssb_core_unit(bp);
 	bp->dma_offset = ssb_get_addr(bp, SBID_PCI_DMA, 0);
 
-	bp->flags |= B44_FLAG_BUGGY_TXPTR;
-
+	/* XXX - really required? 
+	   bp->flags |= B44_FLAG_BUGGY_TXPTR;
+         */
 out:
 	return err;
 }
diff --git a/drivers/net/b44.h b/drivers/net/b44.h
index c06416d3d7a6..1686505558cd 100644
--- a/drivers/net/b44.h
+++ b/drivers/net/b44.h
@@ -142,7 +142,7 @@
 #define  MDIO_OP_READ		2
 #define  MDIO_DATA_SB_MASK	0xc0000000 /* Start Bits */
 #define  MDIO_DATA_SB_SHIFT	30
-#define  MDIO_DATA_SB_START	0x10000000 /* Start Of Frame */
+#define  MDIO_DATA_SB_START	0x40000000 /* Start Of Frame */
 #define B44_EMAC_IMASK	0x0418UL /* EMAC Interrupt Mask */
 #define B44_EMAC_ISTAT	0x041CUL /* EMAC Interrupt Status */
 #define  EMAC_INT_MII		0x00000001 /* MII MDIO Interrupt */
diff --git a/drivers/net/e1000/e1000_ethtool.c b/drivers/net/e1000/e1000_ethtool.c
index 1e001f83822d..ebd061afc2fa 100644
--- a/drivers/net/e1000/e1000_ethtool.c
+++ b/drivers/net/e1000/e1000_ethtool.c
@@ -1475,6 +1475,107 @@ err_geeprom_ioctl:
 			return -EFAULT;
 		return 0;
 	}
+	case ETHTOOL_GRXCSUM: {
+		struct ethtool_value edata = { ETHTOOL_GRXCSUM };
+
+		edata.data = adapter->rx_csum;
+		if (copy_to_user(addr, &edata, sizeof(edata)))
+			return -EFAULT;
+		return 0;
+	}
+	case ETHTOOL_SRXCSUM: {
+		struct ethtool_value edata;
+
+		if (copy_from_user(&edata, addr, sizeof(edata)))
+			return -EFAULT;
+		adapter->rx_csum = edata.data;
+		if(netif_running(netdev)) {
+			e1000_down(adapter);
+			e1000_up(adapter);
+		} else
+			e1000_reset(adapter);
+		return 0;
+	}
+	case ETHTOOL_GTXCSUM: {
+		struct ethtool_value edata = { ETHTOOL_GTXCSUM };
+
+		edata.data =
+			(netdev->features & NETIF_F_HW_CSUM) != 0;
+		if (copy_to_user(addr, &edata, sizeof(edata)))
+			return -EFAULT;
+		return 0;
+	}
+	case ETHTOOL_STXCSUM: {
+		struct ethtool_value edata;
+
+		if (copy_from_user(&edata, addr, sizeof(edata)))
+			return -EFAULT;
+
+		if(adapter->hw.mac_type < e1000_82543) {
+			if (edata.data != 0)
+				return -EINVAL;
+			return 0;
+		}
+
+		if (edata.data)
+			netdev->features |= NETIF_F_HW_CSUM;
+		else
+			netdev->features &= ~NETIF_F_HW_CSUM;
+
+		return 0;
+	}
+	case ETHTOOL_GSG: {
+		struct ethtool_value edata = { ETHTOOL_GSG };
+
+		edata.data =
+			(netdev->features & NETIF_F_SG) != 0;
+		if (copy_to_user(addr, &edata, sizeof(edata)))
+			return -EFAULT;
+		return 0;
+	}
+	case ETHTOOL_SSG: {
+		struct ethtool_value edata;
+
+		if (copy_from_user(&edata, addr, sizeof(edata)))
+			return -EFAULT;
+
+		if (edata.data)
+			netdev->features |= NETIF_F_SG;
+		else
+			netdev->features &= ~NETIF_F_SG;
+
+		return 0;
+	}
+#ifdef NETIF_F_TSO
+	case ETHTOOL_GTSO: {
+		struct ethtool_value edata = { ETHTOOL_GTSO };
+
+		edata.data = (netdev->features & NETIF_F_TSO) != 0;
+		if (copy_to_user(addr, &edata, sizeof(edata)))
+			return -EFAULT;
+		return 0;
+	}
+	case ETHTOOL_STSO: {
+		struct ethtool_value edata;
+
+		if (copy_from_user(&edata, addr, sizeof(edata)))
+			return -EFAULT;
+
+		if ((adapter->hw.mac_type < e1000_82544) ||
+		    (adapter->hw.mac_type == e1000_82547)) {
+			if (edata.data != 0)
+				return -EINVAL;
+			return 0;
+		}
+
+		if (edata.data)
+			netdev->features |= NETIF_F_TSO;
+		else
+			netdev->features &= ~NETIF_F_TSO;
+
+		return 0;
+	}
+#endif
 	default:
 		return -EOPNOTSUPP;
 	}
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 8f734f3cb9b5..57a850096e89 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -50,7 +50,7 @@
 
 char e1000_driver_name[] = "e1000";
 char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
-char e1000_driver_version[] = "5.1.13-k1";
+char e1000_driver_version[] = "5.1.13-k2";
 char e1000_copyright[] = "Copyright (c) 1999-2003 Intel Corporation.";
 
 /* e1000_pci_tbl - PCI Device ID Table
diff --git a/drivers/net/ne2k-pci.c b/drivers/net/ne2k-pci.c
index 927b4b9a6e82..51c4bccb98e2 100644
--- a/drivers/net/ne2k-pci.c
+++ b/drivers/net/ne2k-pci.c
@@ -635,6 +635,7 @@ static void __devexit ne2k_pci_remove_one (struct pci_dev *pdev)
 
 	unregister_netdev(dev);
 	release_region(dev->base_addr, NE_IO_EXTENT);
+	kfree(dev->priv);
 	kfree(dev);
 	pci_set_drvdata(pdev, NULL);
 }
diff --git a/drivers/net/pcmcia/3c574_cs.c b/drivers/net/pcmcia/3c574_cs.c
index 581c579dac80..88732c54c2a7 100644
--- a/drivers/net/pcmcia/3c574_cs.c
+++ b/drivers/net/pcmcia/3c574_cs.c
@@ -296,7 +296,8 @@ static dev_link_t *tc574_attach(void)
 	lp = dev->priv;
 	link = &lp->link;
 	link->priv = dev;
-	
+
+	spin_lock_init(&lp->window_lock);
 	init_timer(&link->release);
 	link->release.function = &tc574_release;
 	link->release.data = (unsigned long)link;
diff --git a/drivers/net/sk_mca.c b/drivers/net/sk_mca.c
index 8f5d3f07d55c..2df9e6e87707 100644
--- a/drivers/net/sk_mca.c
+++ b/drivers/net/sk_mca.c
@@ -254,8 +254,7 @@ static void SetLANCE(struct SKMCA_NETDEV *dev, u16 addr, u16 value)
 
 	/* disable interrupts */
 
-	save_flags(flags);
-	cli();
+	spin_lock_irqsave(&priv->lock, flags);
 
 	/* wait until no transfer is pending */
 
@@ -281,7 +280,7 @@ static void SetLANCE(struct SKMCA_NETDEV *dev, u16 addr, u16 value)
 
 	/* reenable interrupts */
 
-	restore_flags(flags);
+	spin_lock_irqrestore(&priv->lock, flags);
 }
 
 /* get LANCE register */
@@ -294,8 +293,7 @@ static u16 GetLANCE(struct SKMCA_NETDEV *dev, u16 addr)
 
 	/* disable interrupts */
 
-	save_flags(flags);
-	cli();
+	spin_lock_irqsave(&priv->lock, flags);
 
 	/* wait until no transfer is pending */
 
@@ -321,7 +319,7 @@ static u16 GetLANCE(struct SKMCA_NETDEV *dev, u16 addr)
 
 	/* reenable interrupts */
 
-	restore_flags(flags);
+	spin_lock_irqrestore(&priv->lock, flags);
 
 	return res;
 }
@@ -968,8 +966,9 @@ static int skmca_tx(struct sk_buff *skb, struct SKMCA_NETDEV *dev)
 #endif
 
 	/* one more descriptor busy */
-	save_flags(flags);
-	cli();
+
+	spin_lock_irqsave(&priv->lock, flags);
+
 	priv->nexttxput++;
 	if (priv->nexttxput >= TXCOUNT)
 		priv->nexttxput = 0;
@@ -994,7 +993,7 @@ static int skmca_tx(struct sk_buff *skb, struct SKMCA_NETDEV *dev)
 	if (priv->txbusy == 0)
 		SetLANCE(dev, LANCE_CSR0, CSR0_INEA | CSR0_TDMD);
 
-	restore_flags(flags);
+	spin_lock_irqrestore(&priv->lock, flags);
 
       tx_done:
 
diff --git a/drivers/net/sk_mca.h b/drivers/net/sk_mca.h
index 8a379b0e76c7..d80751bfb46b 100644
--- a/drivers/net/sk_mca.h
+++ b/drivers/net/sk_mca.h
@@ -53,6 +53,7 @@ typedef struct {
 	int realirq;		/* memorizes actual IRQ, even when 
 				   currently not allocated          */
 	skmca_medium medium;	/* physical cannector               */
+	spinlock_t lock;
 } skmca_priv;
 
 /* card registers: control/status register bits */
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index 2410ff0efdba..95d888c3a94d 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -122,11 +122,14 @@
 	- No filtering multicast in promisc mode (Edward Peng)
 	- Fix for Rhine-I Tx timeouts
 
+	LK1.1.19 (Roger Luethi)
+	- Increase Tx threshold for unspecified errors
+
 */
 
 #define DRV_NAME	"via-rhine"
-#define DRV_VERSION	"1.1.18-2.5"
-#define DRV_RELDATE	"July-4-2003"
+#define DRV_VERSION	"1.1.19-2.5"
+#define DRV_RELDATE	"July-12-2003"
 
 
 /* A few user-configurable values.
@@ -1664,9 +1667,13 @@ static void via_rhine_error(struct net_device *dev, int intr_status)
 	}
 	if ((intr_status & IntrTxError) && ~( IntrTxAborted | IntrTxUnderrun |
 										   IntrTxDescRace )) {
-		if (debug > 2)
-			printk(KERN_INFO "%s: Unspecified error.\n",
-				   dev->name);
+		if (np->tx_thresh < 0xE0) {
+			writeb(np->tx_thresh += 0x20, ioaddr + TxConfig);
+		}
+		if (debug > 1)
+			printk(KERN_INFO "%s: Unspecified error. Tx "
+				   "threshold now %2.2x.\n",
+				   dev->name, np->tx_thresh);
 	}
 	if (intr_status & ( IntrTxAborted | IntrTxUnderrun | IntrTxDescRace |
 						IntrTxError ))
diff --git a/drivers/net/wan/Kconfig b/drivers/net/wan/Kconfig
index 3bba268e0dd6..77f5ace58eaa 100644
--- a/drivers/net/wan/Kconfig
+++ b/drivers/net/wan/Kconfig
@@ -60,9 +60,10 @@ config COSA
 #
 # COMX drivers
 #
+# Not updated to 2.6.
 config COMX
 	tristate "MultiGate (COMX) synchronous serial boards support"
-	depends on WAN && (ISA || PCI)
+	depends on WAN && (ISA || PCI) && OBSOLETE
 	---help---
 	  Say Y if you want to use any board from the MultiGate (COMX) family.
 	  These boards are synchronous serial adapters for the PC,
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 9965de5f57a0..5f97d1cfb12b 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -296,6 +296,14 @@ config PCMCIA_ATMEL
 	 firmware package can be downloaded from
 	 http://www.thekelleys.org.uk/atmel/atmel_firmware.tar.gz
 
+config PCMCIA_WL3501
+      tristate "Planet WL3501 PCMCIA cards"
+      depends on NET_RADIO && EXPERIMENTAL && PCMCIA
+       ---help---
+         A driver for WL3501 PCMCIA 802.11 wireless cards made by Planet.
+	 It has basic support for Linux wireless extensions and initial
+	 micro support for ethtool.
+
 # yes, this works even when no drivers are selected
 config NET_WIRELESS
 	bool
diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
index 08cc56bd06cf..b37c4faaf3ff 100644
--- a/drivers/net/wireless/Makefile
+++ b/drivers/net/wireless/Makefile
@@ -23,4 +23,4 @@ obj-$(CONFIG_AIRO_CS)		+= airo_cs.o airo.o
 # 16-bit wireless PCMCIA client drivers
 obj-$(CONFIG_PCMCIA_RAYCS)	+= ray_cs.o
 obj-$(CONFIG_PCMCIA_ATMEL)      += atmel_cs.o atmel.o 
-
+obj-$(CONFIG_PCMCIA_WL3501)	+= wl3501_cs.o
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index e9f8c83b0a2e..458e1c6e200b 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -648,9 +648,38 @@ typedef struct {
 	u16 currentXmitRate;
 	u16 apDevExtensions;
 	u16 normalizedSignalStrength;
-	u16 _reserved1;
+	u16 shortPreamble;
 	u8 apIP[4];
-	u16 _reserved[7];
+	u8 noisePercent; /* Noise percent in last second */
+	u8 noisedBm; /* Noise dBm in last second */
+	u8 noiseAvePercent; /* Noise percent in last minute */
+	u8 noiseAvedBm; /* Noise dBm in last minute */
+	u8 noiseMaxPercent; /* Highest noise percent in last minute */
+	u8 noiseMaxdBm; /* Highest noise dbm in last minute */
+	u16 load;
+	u8 carrier[4];
+	u16 assocStatus;
+#define STAT_NOPACKETS 0
+#define STAT_NOCARRIERSET 10
+#define STAT_GOTCARRIERSET 11
+#define STAT_WRONGSSID 20
+#define STAT_BADCHANNEL 25
+#define STAT_BADBITRATES 30
+#define STAT_BADPRIVACY 35
+#define STAT_APFOUND 40
+#define STAT_APREJECTED 50
+#define STAT_AUTHENTICATING 60
+#define STAT_DEAUTHENTICATED 61
+#define STAT_AUTHTIMEOUT 62
+#define STAT_ASSOCIATING 70
+#define STAT_DEASSOCIATED 71
+#define STAT_ASSOCTIMEOUT 72
+#define STAT_NOTAIROAP 73
+#define STAT_ASSOCIATED 80
+#define STAT_LEAPING 90
+#define STAT_LEAPFAILED 91
+#define STAT_LEAPTIMEDOUT 92
+#define STAT_LEAPCOMPLETE 93
 } StatusRid;
 
 typedef struct {
@@ -923,8 +952,8 @@ static int get_dec_u16( char *buffer, int *start, int limit );
 static void OUT4500( struct airo_info *, u16 register, u16 value );
 static unsigned short IN4500( struct airo_info *, u16 register );
 static u16 setup_card(struct airo_info*, u8 *mac);
-static int enable_MAC( struct airo_info *ai, Resp *rsp );
-static void disable_MAC(struct airo_info *ai);
+static int enable_MAC( struct airo_info *ai, Resp *rsp, int lock );
+static void disable_MAC(struct airo_info *ai, int lock);
 static void enable_interrupts(struct airo_info*);
 static void disable_interrupts(struct airo_info*);
 static u16 issuecommand(struct airo_info*, Cmd *pCmd, Resp *pRsp);
@@ -938,11 +967,11 @@ static int fast_bap_read(struct airo_info*, u16 *pu16Dst, int bytelen,
 static int bap_write(struct airo_info*, const u16 *pu16Src, int bytelen,
 		     int whichbap);
 static int PC4500_accessrid(struct airo_info*, u16 rid, u16 accmd);
-static int PC4500_readrid(struct airo_info*, u16 rid, void *pBuf, int len);
+static int PC4500_readrid(struct airo_info*, u16 rid, void *pBuf, int len, int lock);
 static int PC4500_writerid(struct airo_info*, u16 rid, const void
-			   *pBuf, int len);
+			   *pBuf, int len, int lock);
 static int do_writerid( struct airo_info*, u16 rid, const void *rid_data,
-			int len );
+			int len, int dummy );
 static u16 transmit_allocate(struct airo_info*, int lenPayload, int raw);
 static int transmit_802_3_packet(struct airo_info*, int len, char *pPacket);
 static int transmit_802_11_packet(struct airo_info*, int len, char *pPacket);
@@ -986,7 +1015,6 @@ struct airo_info {
 #define FLAG_PROMISC   IFF_PROMISC	/* 0x100 - include/linux/if.h */
 #define FLAG_RADIO_OFF 0x02		/* User disabling of MAC */
 #define FLAG_RADIO_DOWN 0x08		/* ifup/ifdown disabling of MAC */
-#define FLAG_LOCKED    2		/* 0x04 - use as a bit offset */
 #define FLAG_FLASHING  0x10
 #define FLAG_ADHOC        0x01 /* Needed by MIC */
 #define FLAG_MIC_CAPABLE  0x20
@@ -999,6 +1027,7 @@ struct airo_info {
 	tdsRssiEntry *rssi;
 	struct semaphore sem;
 	struct task_struct *task;
+	struct work_struct stats_task;
 	struct work_struct promisc_task;
 	struct {
 		struct sk_buff *skb;
@@ -1056,7 +1085,7 @@ static int readBSSListRid(struct airo_info *ai, int first,
 			ai->task = NULL;
 		}
 	rc = PC4500_readrid(ai, first ? RID_BSSLISTFIRST : RID_BSSLISTNEXT,
-			    list, sizeof(*list));
+			    list, sizeof(*list), 1);
 
 	list->len = le16_to_cpu(list->len);
 	list->index = le16_to_cpu(list->index);
@@ -1071,7 +1100,7 @@ static int readBSSListRid(struct airo_info *ai, int first,
 
 static int readWepKeyRid(struct airo_info*ai, WepKeyRid *wkr, int temp) {
 	int rc = PC4500_readrid(ai, temp ? RID_WEP_TEMP : RID_WEP_PERM,
-				wkr, sizeof(*wkr));
+				wkr, sizeof(*wkr), 1);
 
 	wkr->len = le16_to_cpu(wkr->len);
 	wkr->kindex = le16_to_cpu(wkr->kindex);
@@ -1080,17 +1109,17 @@ static int readWepKeyRid(struct airo_info*ai, WepKeyRid *wkr, int temp) {
 }
 /* In the writeXXXRid routines we copy the rids so that we don't screwup
  * the originals when we endian them... */
-static int writeWepKeyRid(struct airo_info*ai, WepKeyRid *pwkr, int perm) {
+static int writeWepKeyRid(struct airo_info*ai, WepKeyRid *pwkr, int perm, int lock) {
 	int rc;
 	WepKeyRid wkr = *pwkr;
 
 	wkr.len = cpu_to_le16(wkr.len);
 	wkr.kindex = cpu_to_le16(wkr.kindex);
 	wkr.klen = cpu_to_le16(wkr.klen);
-	rc = PC4500_writerid(ai, RID_WEP_TEMP, &wkr, sizeof(wkr));
+	rc = PC4500_writerid(ai, RID_WEP_TEMP, &wkr, sizeof(wkr), lock);
 	if (rc!=SUCCESS) printk(KERN_ERR "airo:  WEP_TEMP set %x\n", rc);
 	if (perm) {
-		rc = PC4500_writerid(ai, RID_WEP_PERM, &wkr, sizeof(wkr));
+		rc = PC4500_writerid(ai, RID_WEP_PERM, &wkr, sizeof(wkr), lock);
 		if (rc!=SUCCESS) {
 			printk(KERN_ERR "airo:  WEP_PERM set %x\n", rc);
 		}
@@ -1100,7 +1129,7 @@ static int writeWepKeyRid(struct airo_info*ai, WepKeyRid *pwkr, int perm) {
 
 static int readSsidRid(struct airo_info*ai, SsidRid *ssidr) {
 	int i;
-	int rc = PC4500_readrid(ai, RID_SSID, ssidr, sizeof(*ssidr));
+	int rc = PC4500_readrid(ai, RID_SSID, ssidr, sizeof(*ssidr), 1);
 
 	ssidr->len = le16_to_cpu(ssidr->len);
 	for(i = 0; i < 3; i++) {
@@ -1117,10 +1146,10 @@ static int writeSsidRid(struct airo_info*ai, SsidRid *pssidr) {
 	for(i = 0; i < 3; i++) {
 		ssidr.ssids[i].len = cpu_to_le16(ssidr.ssids[i].len);
 	}
-	rc = PC4500_writerid(ai, RID_SSID, &ssidr, sizeof(ssidr));
+	rc = PC4500_writerid(ai, RID_SSID, &ssidr, sizeof(ssidr), 1);
 	return rc;
 }
-static int readConfigRid(struct airo_info*ai) {
+static int readConfigRid(struct airo_info*ai, int lock) {
 	int rc;
 	u16 *s;
 	ConfigRid cfg;
@@ -1128,7 +1157,7 @@ static int readConfigRid(struct airo_info*ai) {
 	if (ai->config.len)
 		return SUCCESS;
 
-	rc = PC4500_readrid(ai, RID_ACTUALCONFIG, &cfg, sizeof(cfg));
+	rc = PC4500_readrid(ai, RID_ACTUALCONFIG, &cfg, sizeof(cfg), lock);
 	if (rc != SUCCESS)
 		return rc;
 
@@ -1157,7 +1186,7 @@ static inline void checkThrottle(struct airo_info *ai) {
 		}
 	}
 }
-static int writeConfigRid(struct airo_info*ai) {
+static int writeConfigRid(struct airo_info*ai, int lock) {
 	u16 *s;
 	ConfigRid cfgr;
 
@@ -1184,33 +1213,34 @@ static int writeConfigRid(struct airo_info*ai) {
 	for(s = &cfgr.arlThreshold; s <= &cfgr.autoWake; s++)
 		*s = cpu_to_le16(*s);
 
-	return PC4500_writerid( ai, RID_CONFIG, &cfgr, sizeof(cfgr));
+	return PC4500_writerid( ai, RID_CONFIG, &cfgr, sizeof(cfgr), lock);
 }
 static int readStatusRid(struct airo_info*ai, StatusRid *statr) {
-	int rc = PC4500_readrid(ai, RID_STATUS, statr, sizeof(*statr));
+	int rc = PC4500_readrid(ai, RID_STATUS, statr, sizeof(*statr), 1);
 	u16 *s;
 
 	statr->len = le16_to_cpu(statr->len);
 	for(s = &statr->mode; s <= &statr->SSIDlen; s++) *s = le16_to_cpu(*s);
 
-	for(s = &statr->beaconPeriod; s <= &statr->_reserved[9]; s++)
+	for(s = &statr->beaconPeriod; s <= &statr->shortPreamble; s++)
 		*s = le16_to_cpu(*s);
-
+	statr->load = le16_to_cpu(statr->load);
+	statr->assocStatus = le16_to_cpu(statr->assocStatus);
 	return rc;
 }
 static int readAPListRid(struct airo_info*ai, APListRid *aplr) {
-	int rc =  PC4500_readrid(ai, RID_APLIST, aplr, sizeof(*aplr));
+	int rc =  PC4500_readrid(ai, RID_APLIST, aplr, sizeof(*aplr), 1);
 	aplr->len = le16_to_cpu(aplr->len);
 	return rc;
 }
 static int writeAPListRid(struct airo_info*ai, APListRid *aplr) {
 	int rc;
 	aplr->len = cpu_to_le16(aplr->len);
-	rc = PC4500_writerid(ai, RID_APLIST, aplr, sizeof(*aplr));
+	rc = PC4500_writerid(ai, RID_APLIST, aplr, sizeof(*aplr), 1);
 	return rc;
 }
 static int readCapabilityRid(struct airo_info*ai, CapabilityRid *capr) {
-	int rc = PC4500_readrid(ai, RID_CAPABILITIES, capr, sizeof(*capr));
+	int rc = PC4500_readrid(ai, RID_CAPABILITIES, capr, sizeof(*capr), 1);
 	u16 *s;
 
 	capr->len = le16_to_cpu(capr->len);
@@ -1221,8 +1251,8 @@ static int readCapabilityRid(struct airo_info*ai, CapabilityRid *capr) {
 		*s = le16_to_cpu(*s);
 	return rc;
 }
-static int readStatsRid(struct airo_info*ai, StatsRid *sr, int rid) {
-	int rc = PC4500_readrid(ai, rid, sr, sizeof(*sr));
+static int readStatsRid(struct airo_info*ai, StatsRid *sr, int rid, int lock) {
+	int rc = PC4500_readrid(ai, rid, sr, sizeof(*sr), lock);
 	u32 *i;
 
 	sr->len = le16_to_cpu(sr->len);
@@ -1242,8 +1272,8 @@ static int airo_open(struct net_device *dev) {
 	 * is open (to pipeline changes and speed-up card setup). If
 	 * those changes are not yet commited, do it now - Jean II */
 	if(info->need_commit) {
-		disable_MAC(info);
-		writeConfigRid(info);
+		disable_MAC(info, 1);
+		writeConfigRid(info, 1);
 	}
 
 	if (info->wifidev != dev) {
@@ -1251,7 +1281,7 @@ static int airo_open(struct net_device *dev) {
 		info->flags &= ~FLAG_RADIO_DOWN;
 		enable_interrupts(info);
 	}
-	enable_MAC(info, &rsp);
+	enable_MAC(info, &rsp, 1);
 
 	netif_start_queue(dev);
 	return 0;
@@ -1430,29 +1460,41 @@ static int airo_start_xmit11(struct sk_buff *skb, struct net_device *dev) {
 	return 0;
 }
 
+static void airo_read_stats(struct airo_info *ai) {
+	StatsRid stats_rid;
+	u32 *vals = stats_rid.vals;
+
+	if (down_trylock(&ai->sem) == 0) {
+		readStatsRid(ai, &stats_rid, RID_STATS, 0);
+		up(&ai->sem);
+
+		ai->stats.rx_packets = vals[43] + vals[44] + vals[45];
+		ai->stats.tx_packets = vals[39] + vals[40] + vals[41];
+		ai->stats.rx_bytes = vals[92];
+		ai->stats.tx_bytes = vals[91];
+		ai->stats.rx_errors = vals[0] + vals[2] + vals[3] + vals[4];
+		ai->stats.tx_errors = vals[42] + ai->stats.tx_fifo_errors;
+		ai->stats.multicast = vals[43];
+		ai->stats.collisions = vals[89];
+
+		/* detailed rx_errors: */
+		ai->stats.rx_length_errors = vals[3];
+		ai->stats.rx_crc_errors = vals[4];
+		ai->stats.rx_frame_errors = vals[2];
+		ai->stats.rx_fifo_errors = vals[0];
+	} else {
+		ai->stats_task.func = (void (*)(void *))airo_read_stats;
+		ai->stats_task.data = (void *)ai;
+		schedule_work(&ai->stats_task);
+	}
+}
+
 struct net_device_stats *airo_get_stats(struct net_device *dev)
 {
 	struct airo_info *local =  dev->priv;
-	StatsRid stats_rid;
-	u32 *vals = stats_rid.vals;
 
-	/* Get stats out of the card */
-	readStatsRid(local, &stats_rid, RID_STATS);
-
-	local->stats.rx_packets = vals[43] + vals[44] + vals[45];
-	local->stats.tx_packets = vals[39] + vals[40] + vals[41];
-	local->stats.rx_bytes = vals[92];
-	local->stats.tx_bytes = vals[91];
-	local->stats.rx_errors = vals[0] + vals[2] + vals[3] + vals[4];
-	local->stats.tx_errors = vals[42] + local->stats.tx_fifo_errors;
-	local->stats.multicast = vals[43];
-	local->stats.collisions = vals[89];
-
-	/* detailed rx_errors: */
-	local->stats.rx_length_errors = vals[3];
-	local->stats.rx_crc_errors = vals[4];
-	local->stats.rx_frame_errors = vals[2];
-	local->stats.rx_fifo_errors = vals[0];
+	/* Get stats out of the card if available */
+	airo_read_stats(local);
 
 	return &local->stats;
 }
@@ -1507,9 +1549,9 @@ static int airo_set_mac_address(struct net_device *dev, void *p)
 
 	memcpy (ai->config.macAddr, addr->sa_data, dev->addr_len);
 	ai->need_commit = 1;
-	disable_MAC(ai);
-	writeConfigRid (ai);
-	enable_MAC(ai, &rsp);
+	disable_MAC(ai, 1);
+	writeConfigRid (ai, 1);
+	enable_MAC(ai, &rsp, 1);
 	memcpy (ai->dev->dev_addr, addr->sa_data, dev->addr_len);
 	if (ai->wifidev)
 		memcpy (ai->wifidev->dev_addr, addr->sa_data, dev->addr_len);
@@ -1538,7 +1580,7 @@ static int airo_close(struct net_device *dev) {
 		 * stack (i.e. the network stack won't try to broadcast
 		 * anything on the interface and routes are gone. Jean II */
 		ai->flags |= FLAG_RADIO_DOWN;
-		disable_MAC(ai);
+		disable_MAC(ai, 1);
 #endif
 		disable_interrupts( ai );
 	}
@@ -1762,6 +1804,9 @@ int reset_airo_card( struct net_device *dev ) {
 	int i;
 	struct airo_info *ai = dev->priv;
 
+
+	if (down_interruptible(&ai->sem))
+		return -1;
 	waitbusy (ai);
 	OUT4500(ai,COMMAND,CMD_SOFTRESET);
 	set_current_state (TASK_UNINTERRUPTIBLE);
@@ -1771,6 +1816,7 @@ int reset_airo_card( struct net_device *dev ) {
 	schedule_timeout (HZ/5);
 	if ( setup_card(ai, dev->dev_addr ) != SUCCESS ) {
 		printk( KERN_ERR "airo: MAC could not be enabled\n" );
+		up(&ai->sem);
 		return -1;
 	} else {
 		printk( KERN_INFO "airo: MAC enabled %s %x:%x:%x:%x:%x:%x\n",
@@ -1788,6 +1834,7 @@ int reset_airo_card( struct net_device *dev ) {
 	}
 	enable_interrupts( ai );
 	netif_wake_queue(dev);
+	up(&ai->sem);
 	return 0;
 }
 
@@ -1800,9 +1847,7 @@ static void airo_send_event(struct net_device *dev) {
 	StatusRid status_rid;
 
 	if (down_trylock(&ai->sem) == 0) {
-		__set_bit(FLAG_LOCKED, &ai->flags);
-		PC4500_readrid(ai, RID_STATUS, &status_rid, sizeof(status_rid));
-		clear_bit(FLAG_LOCKED, &ai->flags);
+		PC4500_readrid(ai, RID_STATUS, &status_rid, sizeof(status_rid), 0);
 		up(&ai->sem);
 		wrqu.data.length = 0;
 		wrqu.data.flags = 0;
@@ -1823,9 +1868,7 @@ static void airo_read_mic(struct airo_info *ai) {
 	MICRid mic_rid;
 
 	if (down_trylock(&ai->sem) == 0) {
-		__set_bit(FLAG_LOCKED, &ai->flags);
-		PC4500_readrid(ai, RID_MIC, &mic_rid, sizeof(mic_rid));
-		clear_bit(FLAG_LOCKED, &ai->flags);
+		PC4500_readrid(ai, RID_MIC, &mic_rid, sizeof(mic_rid), 0);
 		up(&ai->sem);
 #ifdef MICSUPPORT
 		micinit (ai, &mic_rid);
@@ -1866,7 +1909,8 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
 
 		if ( status & EV_MIC ) {
 			OUT4500( apriv, EVACK, EV_MIC );
-			airo_read_mic( apriv );
+			if (apriv->flags & FLAG_MIC_CAPABLE)
+				airo_read_mic( apriv );
 		}
 		if ( status & EV_LINK ) {
 #if WIRELESS_EXT > 13
@@ -2057,6 +2101,28 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
 				}
 			}
 			if (len) {
+#if 0 && WIRELESS_EXT > 15
+#ifdef IW_WIRELESS_SPY		/* defined in iw_handler.h */
+				if (apriv->spy_data.spy_number > 0) {
+					char *sa;
+					struct iw_quality wstats;
+					/* Prepare spy data : addr + qual */
+					sa = (char*)buffer + ((apriv->flags & FLAG_802_11) ? 10 : 6);
+					if (!(apriv->flags & FLAG_802_11)) {
+						bap_setup (apriv, fid, 8, BAP0);
+						bap_read (apriv, (u16*)hdr.rssi, 2, BAP0);
+					}
+					wstats.qual = hdr.rssi[0];
+					if (apriv->rssi)
+						wstats.level = 0x100 - apriv->rssi[hdr.rssi[1]].rssidBm;
+					else
+						wstats.level = (hdr.rssi[1] + 321) / 2;
+					wstats.updated = 3;	
+					/* Update spy records */
+					wireless_spy_update(dev, sa, &wstats);
+				}
+#endif /* IW_WIRELESS_SPY */
+#else /* WIRELESS_EXT > 15 */
 #ifdef WIRELESS_SPY
 				if (apriv->spy_number > 0) {
 					int i;
@@ -2082,6 +2148,7 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
 						}
 				}
 #endif /* WIRELESS_SPY  */
+#endif /* WIRELESS_EXT > 15 */
 				OUT4500( apriv, EVACK, EV_RX);
 
 				if (apriv->flags & FLAG_802_11) {
@@ -2113,17 +2180,17 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
 				if ( ( apriv->fids[i] & 0xffff ) == fid ) {
 					len = apriv->fids[i] >> 16;
 					index = i;
-					/* Set up to be used again */
-					apriv->fids[i] &= 0xffff;
 				}
 			}
 			if (index != -1) {
-				netif_wake_queue(dev);
 				if (status & EV_TXEXC)
 					get_tx_error(apriv, index);
-			}
-			OUT4500( apriv, EVACK, status & (EV_TX | EV_TXEXC));
-			if (index==-1) {
+				OUT4500( apriv, EVACK, status & (EV_TX | EV_TXEXC));
+				/* Set up to be used again */
+				apriv->fids[index] &= 0xffff;
+				netif_wake_queue(dev);
+			} else {
+				OUT4500( apriv, EVACK, status & (EV_TX | EV_TXEXC));
 				printk( KERN_ERR "airo: Unallocated FID was used to xmit\n" );
 			}
 		}
@@ -2169,7 +2236,7 @@ static u16 IN4500( struct airo_info *ai, u16 reg ) {
 	return rc;
 }
 
-static int enable_MAC( struct airo_info *ai, Resp *rsp ) {
+static int enable_MAC( struct airo_info *ai, Resp *rsp, int lock ) {
 	int rc;
         Cmd cmd;
 
@@ -2182,7 +2249,7 @@ static int enable_MAC( struct airo_info *ai, Resp *rsp ) {
 	if (ai->flags & (FLAG_RADIO_OFF|FLAG_RADIO_DOWN)) return SUCCESS;
 	memset(&cmd, 0, sizeof(cmd));
 	cmd.cmd = MAC_ENABLE;
-	if (test_bit(FLAG_LOCKED, &ai->flags) != 0)
+	if (!lock)
 		return issuecommand(ai, &cmd, rsp);
 
 	if (down_interruptible(&ai->sem))
@@ -2192,13 +2259,13 @@ static int enable_MAC( struct airo_info *ai, Resp *rsp ) {
 	return rc;
 }
 
-static void disable_MAC( struct airo_info *ai ) {
+static void disable_MAC( struct airo_info *ai, int lock ) {
         Cmd cmd;
 	Resp rsp;
 
 	memset(&cmd, 0, sizeof(cmd));
 	cmd.cmd = MAC_DISABLE; // disable in case already enabled
-	if (test_bit(FLAG_LOCKED, &ai->flags) != 0) {
+	if (!lock) {
 		issuecommand(ai, &cmd, &rsp);
 		return;
 	}
@@ -2276,13 +2343,13 @@ static u16 setup_card(struct airo_info *ai, u8 *mac)
 		CapabilityRid cap_rid;
 
 		// general configuration (read/modify/write)
-		status = readConfigRid(ai);
+		status = readConfigRid(ai, 1);
 		if ( status != SUCCESS ) return ERROR;
 
 		status = readCapabilityRid(ai, &cap_rid);
 		if ( status != SUCCESS ) return ERROR;
 
-		status = PC4500_readrid(ai,RID_RSSI,&rssi_rid,sizeof(rssi_rid));
+		status = PC4500_readrid(ai,RID_RSSI,&rssi_rid,sizeof(rssi_rid),1);
 		if ( status == SUCCESS ) {
 			if (ai->rssi || (ai->rssi = kmalloc(512, GFP_KERNEL)) != NULL)
 				memcpy(ai->rssi, (u8*)&rssi_rid + 2, 512);
@@ -2346,14 +2413,14 @@ static u16 setup_card(struct airo_info *ai, u8 *mac)
 		}
 	}
 
-	status = writeConfigRid(ai);
+	status = writeConfigRid(ai, 1);
 	if ( status != SUCCESS ) return ERROR;
 
 	/* Set up the SSID list */
 	status = writeSsidRid(ai, &mySsid);
 	if ( status != SUCCESS ) return ERROR;
 
-	status = enable_MAC(ai, &rsp);
+	status = enable_MAC(ai, &rsp, 1);
 	if ( status != SUCCESS || (rsp.status & 0xFF00) != 0) {
 		printk( KERN_ERR "airo: Bad MAC enable reason = %x, rid = %x, offset = %d\n", rsp.rsp0, rsp.rsp1, rsp.rsp2 );
 		return ERROR;
@@ -2568,13 +2635,12 @@ static int PC4500_accessrid(struct airo_info *ai, u16 rid, u16 accmd)
 
 /*  Note, that we are using BAP1 which is also used by transmit, so
  *  we must get a lock. */
-static int PC4500_readrid(struct airo_info *ai, u16 rid, void *pBuf, int len)
+static int PC4500_readrid(struct airo_info *ai, u16 rid, void *pBuf, int len, int lock)
 {
-	u16 status, dolock = 0;
+	u16 status;
         int rc = SUCCESS;
 
-	if (test_bit(FLAG_LOCKED, &ai->flags) == 0) {
-		dolock = 1;
+	if (lock) {
 		if (down_interruptible(&ai->sem))
 			return ERROR;
 	}
@@ -2602,7 +2668,7 @@ static int PC4500_readrid(struct airo_info *ai, u16 rid, void *pBuf, int len)
 	// read remainder of the rid
 	rc = bap_read(ai, ((u16*)pBuf)+1, len, BAP1);
 done:
-	if (dolock)
+	if (lock)
 		up(&ai->sem);
 	return rc;
 }
@@ -2610,13 +2676,14 @@ done:
 /*  Note, that we are using BAP1 which is also used by transmit, so
  *  make sure this isnt called when a transmit is happening */
 static int PC4500_writerid(struct airo_info *ai, u16 rid,
-			   const void *pBuf, int len)
+			   const void *pBuf, int len, int lock)
 {
-	u16 status, dolock = 0;
+	u16 status;
 	int rc = SUCCESS;
 
-	if (test_bit(FLAG_LOCKED, &ai->flags) == 0) {
-		dolock = 1;
+	*(u16*)pBuf = cpu_to_le16((u16)len);
+
+	if (lock) {
 		if (down_interruptible(&ai->sem))
 			return ERROR;
 	}
@@ -2634,7 +2701,7 @@ static int PC4500_writerid(struct airo_info *ai, u16 rid,
 	// ---now commit the rid data
 	rc = PC4500_accessrid(ai, rid, 0x100|CMD_ACCESS);
  done:
-	if (dolock)
+	if (lock)
 		up(&ai->sem);
         return rc;
 }
@@ -2653,11 +2720,11 @@ static u16 transmit_allocate(struct airo_info *ai, int lenPayload, int raw)
 	if (down_interruptible(&ai->sem))
 		return ERROR;
 	if (issuecommand(ai, &cmd, &rsp) != SUCCESS) {
-		txFid = 0;
+		txFid = ERROR;
 		goto done;
 	}
 	if ( (rsp.status & 0xFF00) != 0) {
-		txFid = 0;
+		txFid = ERROR;
 		goto done;
 	}
 	/* wait for the allocate event/indication
@@ -2704,7 +2771,7 @@ static int transmit_802_3_packet(struct airo_info *ai, int len, char *pPacket)
 
 	len >>= 16;
 
-	if (len < ETH_ALEN * 2) {
+	if (len <= ETH_ALEN * 2) {
 		printk( KERN_WARNING "Short packet %d\n", len );
 		return ERROR;
 	}
@@ -3160,7 +3227,7 @@ static int proc_stats_rid_open( struct inode *inode,
 		return -ENOMEM;
 	}
 
-	readStatsRid(apriv, &stats, rid);
+	readStatsRid(apriv, &stats, rid, 1);
 
         j = 0;
 	for(i=0; statsLabels[i]!=(char *)-1 &&
@@ -3195,18 +3262,21 @@ static int get_dec_u16( char *buffer, int *start, int limit ) {
 	return value;
 }
 
+static int airo_config_commit(struct net_device *dev,
+			      struct iw_request_info *info, void *zwrq,
+			      char *extra);
+
 static void proc_config_on_close( struct inode *inode, struct file *file ) {
 	struct proc_data *data = file->private_data;
 	struct proc_dir_entry *dp = PDE(inode);
 	struct net_device *dev = dp->data;
 	struct airo_info *ai = dev->priv;
-	Resp rsp;
 	char *line;
-	int need_reset = 0;
 
 	if ( !data->writelen ) return;
 
-	readConfigRid(ai);
+	readConfigRid(ai, 1);
+	ai->need_commit = 1;
 
 	line = data->wbuffer;
 	while( line[0] ) {
@@ -3214,7 +3284,7 @@ static void proc_config_on_close( struct inode *inode, struct file *file ) {
 		if ( !strncmp( line, "Mode: ", 6 ) ) {
 			line += 6;
 			if ((ai->config.rmode & 0xff) >= RXMODE_RFMON)
-					need_reset = 1;
+					ai->need_commit = 2;
 			ai->config.rmode &= 0xfe00;
 			ai->flags &= ~FLAG_802_11;
 			ai->config.opmode &= 0xFF00;
@@ -3392,22 +3462,7 @@ static void proc_config_on_close( struct inode *inode, struct file *file ) {
 		while( line[0] && line[0] != '\n' ) line++;
 		if ( line[0] ) line++;
 	}
-	disable_MAC(ai);
-	if (need_reset) {
-		APListRid APList_rid;
-		SsidRid SSID_rid;
-
-		readAPListRid(ai, &APList_rid);
-		readSsidRid(ai, &SSID_rid);
-		reset_airo_card(dev);
-		disable_MAC(ai);
-		writeSsidRid(ai, &SSID_rid);
-		writeAPListRid(ai, &APList_rid);
-	}
-	writeConfigRid(ai);
-	enable_MAC(ai, &rsp);
-	if (need_reset)
-		airo_set_promisc(ai);
+	airo_config_commit(dev, NULL, NULL, NULL);
 }
 
 static char *get_rmode(u16 mode) {
@@ -3443,7 +3498,7 @@ static int proc_config_open( struct inode *inode, struct file *file ) {
 	data->maxwritelen = 2048;
 	data->on_close = proc_config_on_close;
 
-	readConfigRid(ai);
+	readConfigRid(ai, 1);
 
 	i = sprintf( data->rbuffer,
 		     "Mode: %s\n"
@@ -3535,9 +3590,9 @@ static void proc_SSID_on_close( struct inode *inode, struct file *file ) {
 		       offset < data->writelen ) offset++;
 		offset++;
 	}
-	disable_MAC(ai);
+	disable_MAC(ai, 1);
 	writeSsidRid(ai, &SSID_rid);
-	enable_MAC(ai, &rsp);
+	enable_MAC(ai, &rsp, 1);
 }
 
 inline static u8 hexVal(char c) {
@@ -3576,20 +3631,20 @@ static void proc_APList_on_close( struct inode *inode, struct file *file ) {
 			}
 		}
 	}
-	disable_MAC(ai);
+	disable_MAC(ai, 1);
 	writeAPListRid(ai, &APList_rid);
-	enable_MAC(ai, &rsp);
+	enable_MAC(ai, &rsp, 1);
 }
 
 /* This function wraps PC4500_writerid with a MAC disable */
 static int do_writerid( struct airo_info *ai, u16 rid, const void *rid_data,
-			int len ) {
+			int len, int dummy ) {
 	int rc;
 	Resp rsp;
 
-	disable_MAC(ai);
-	rc = PC4500_writerid(ai, rid, rid_data, len);
-	enable_MAC(ai, &rsp);
+	disable_MAC(ai, 1);
+	rc = PC4500_writerid(ai, rid, rid_data, len, 1);
+	enable_MAC(ai, &rsp, 1);
 	return rc;
 }
 
@@ -3617,7 +3672,7 @@ static int get_wep_key(struct airo_info *ai, u16 index) {
 }
 
 static int set_wep_key(struct airo_info *ai, u16 index,
-		       const char *key, u16 keylen, int perm ) {
+		       const char *key, u16 keylen, int perm, int lock ) {
 	static const unsigned char macaddr[ETH_ALEN] = { 0x01, 0, 0, 0, 0, 0 };
 	WepKeyRid wkr;
 
@@ -3639,7 +3694,7 @@ static int set_wep_key(struct airo_info *ai, u16 index,
 		printk(KERN_INFO "Setting key %d\n", index);
 	}
 
-	writeWepKeyRid(ai, &wkr, perm);
+	writeWepKeyRid(ai, &wkr, perm, lock);
 	return 0;
 }
 
@@ -3662,7 +3717,7 @@ static void proc_wepkey_on_close( struct inode *inode, struct file *file ) {
 	    (data->wbuffer[1] == ' ' || data->wbuffer[1] == '\n')) {
 		index = data->wbuffer[0] - '0';
 		if (data->wbuffer[1] == '\n') {
-			set_wep_key(ai, index, 0, 0, 1);
+			set_wep_key(ai, index, 0, 0, 1, 1);
 			return;
 		}
 		j = 2;
@@ -3681,7 +3736,7 @@ static void proc_wepkey_on_close( struct inode *inode, struct file *file ) {
 			break;
 		}
 	}
-	set_wep_key(ai, index, key, i/3, 1);
+	set_wep_key(ai, index, key, i/3, 1, 1);
 }
 
 static int proc_wepkey_open( struct inode *inode, struct file *file ) {
@@ -3928,10 +3983,9 @@ static void timer_func( u_long data ) {
 			add_timer(&apriv->timer);
 			return;
 		}
-		__set_bit(FLAG_LOCKED, &apriv->flags);
 
-		readConfigRid(apriv);
-		disable_MAC(apriv);
+		readConfigRid(apriv, 0);
+		disable_MAC(apriv, 0);
 		switch(apriv->config.authType) {
 		case AUTH_ENCRYPT:
 /* So drop to OPEN */
@@ -3939,13 +3993,13 @@ static void timer_func( u_long data ) {
 			break;
 		case AUTH_SHAREDKEY:
 			if (apriv->keyindex < auto_wep) {
-				set_wep_key(apriv, apriv->keyindex, 0, 0, 0);
+				set_wep_key(apriv, apriv->keyindex, 0, 0, 0, 0);
 				apriv->config.authType = AUTH_SHAREDKEY;
 				apriv->keyindex++;
 			} else {
 			        /* Drop to ENCRYPT */
 				apriv->keyindex = 0;
-				set_wep_key(apriv, apriv->defindex, 0, 0, 0);
+				set_wep_key(apriv, apriv->defindex, 0, 0, 0, 0);
 				apriv->config.authType = AUTH_ENCRYPT;
 			}
 			break;
@@ -3953,9 +4007,8 @@ static void timer_func( u_long data ) {
 			apriv->config.authType = AUTH_SHAREDKEY;
 		}
 		apriv->need_commit = 1;
-		writeConfigRid(apriv);
-		enable_MAC(apriv, &rsp);
-		clear_bit(FLAG_LOCKED, &apriv->flags);
+		writeConfigRid(apriv, 0);
+		enable_MAC(apriv, &rsp, 0);
 		up(&apriv->sem);
 
 /* Schedule check to see if the change worked */
@@ -4135,9 +4188,11 @@ static int airo_get_freq(struct net_device *dev,
 	struct airo_info *local = dev->priv;
 	StatusRid status_rid;		/* Card status info */
 
-	readStatusRid(local, &status_rid);
+	if ((local->config.opmode & 0xFF) == MODE_STA_ESS)
+		status_rid.channel = local->config.channelSet;
+	else
+		readStatusRid(local, &status_rid);
 
-	/* Will return zero in infrastructure mode */
 #ifdef WEXT_USECHANNELS
 	fwrq->m = ((int)status_rid.channel) + 1;
 	fwrq->e = 0;
@@ -4191,9 +4246,9 @@ static int airo_set_essid(struct net_device *dev,
 		SSID_rid.ssids[index].len = dwrq->length - 1;
 	}
 	/* Write it to the card */
-	disable_MAC(local);
+	disable_MAC(local, 1);
 	writeSsidRid(local, &SSID_rid);
-	enable_MAC(local, &rsp);
+	enable_MAC(local, &rsp, 1);
 
 	return 0;
 }
@@ -4255,9 +4310,9 @@ static int airo_set_wap(struct net_device *dev,
 		memset(&APList_rid, 0, sizeof(APList_rid));
 		APList_rid.len = sizeof(APList_rid);
 		memcpy(APList_rid.ap[0], awrq->sa_data, ETH_ALEN);
-		disable_MAC(local);
+		disable_MAC(local, 1);
 		writeAPListRid(local, &APList_rid);
-		enable_MAC(local, &rsp);
+		enable_MAC(local, &rsp, 1);
 	}
 	return 0;
 }
@@ -4506,28 +4561,47 @@ static int airo_set_mode(struct net_device *dev,
 			 char *extra)
 {
 	struct airo_info *local = dev->priv;
+	int commit = 1;
+
+	if ((local->config.rmode & 0xff) >= RXMODE_RFMON)
+		commit = 2;
 
 	switch(*uwrq) {
 		case IW_MODE_ADHOC:
 			local->config.opmode &= 0xFF00;
 			local->config.opmode |= MODE_STA_IBSS;
+			local->config.rmode &= 0xfe00;
+			local->flags &= ~FLAG_802_11;
 			break;
 		case IW_MODE_INFRA:
 			local->config.opmode &= 0xFF00;
 			local->config.opmode |= MODE_STA_ESS;
+			local->config.rmode &= 0xfe00;
+			local->flags &= ~FLAG_802_11;
 			break;
 		case IW_MODE_MASTER:
 			local->config.opmode &= 0xFF00;
 			local->config.opmode |= MODE_AP;
+			local->config.rmode &= 0xfe00;
+			local->flags &= ~FLAG_802_11;
 			break;
 		case IW_MODE_REPEAT:
 			local->config.opmode &= 0xFF00;
 			local->config.opmode |= MODE_AP_RPTR;
+			local->config.rmode &= 0xfe00;
+			local->flags &= ~FLAG_802_11;
+			break;
+		case IW_MODE_MONITOR:
+			local->config.opmode &= 0xFF00;
+			local->config.opmode |= MODE_STA_ESS;
+			local->config.rmode &= 0xfe00;
+			local->config.rmode |= RXMODE_RFMON | RXMODE_DISABLE_802_3_HEADER;
+			local->flags |= FLAG_802_11;
 			break;
 		default:
 			return -EINVAL;
 	}
-	local->need_commit = 1;
+	local->need_commit = commit;
 
 	return -EINPROGRESS;		/* Call commit handler */
 }
@@ -4613,7 +4687,7 @@ static int airo_set_encode(struct net_device *dev,
 			/* Copy the key in the driver */
 			memcpy(key.key, extra, dwrq->length);
 			/* Send the key to the card */
-			set_wep_key(local, index, key.key, key.len, 1);
+			set_wep_key(local, index, key.key, key.len, 1, 1);
 		}
 		/* WE specify that if a valid key is set, encryption
 		 * should be enabled (user may turn it off later)
@@ -4627,7 +4701,7 @@ static int airo_set_encode(struct net_device *dev,
 		/* Do we want to just set the transmit key index ? */
 		int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
 		if ((index>=0) && (index<(cap_rid.softCap&0x80)?4:1)) {
-			set_wep_key(local, index, 0, 0, 1);
+			set_wep_key(local, index, 0, 0, 1, 1);
 		} else
 			/* Don't complain if only change the mode */
 			if(!dwrq->flags & IW_ENCODE_MODE) {
@@ -5272,7 +5346,7 @@ static int airo_get_scan(struct net_device *dev,
 	 * consequences are begnign. So I don't bother fixing it - Javier */
 
 	/* Try to read the first entry of the scan result */
-	rc = PC4500_readrid(ai, RID_BSSLISTFIRST, &BSSList, sizeof(BSSList));
+	rc = PC4500_readrid(ai, RID_BSSLISTFIRST, &BSSList, sizeof(BSSList), 1);
 	if((rc) || (BSSList.index == 0xffff)) {
 		/* Client error, no scan results...
 		 * The caller need to restart the scan. */
@@ -5288,7 +5362,7 @@ static int airo_get_scan(struct net_device *dev,
 
 		/* Read next entry */
 		rc = PC4500_readrid(ai, RID_BSSLISTNEXT,
-				    &BSSList, sizeof(BSSList));
+				    &BSSList, sizeof(BSSList), 1);
 	}
 	/* Length of data */
 	dwrq->length = (current_ev - extra);
@@ -5298,6 +5372,7 @@ static int airo_get_scan(struct net_device *dev,
 }
 #endif	/* WIRELESS_EXT > 13 */
 
+#if WIRELESS_EXT <= 15
 #ifdef WIRELESS_SPY
 /*------------------------------------------------------------------*/
 /*
@@ -5360,6 +5435,7 @@ static int airo_get_spy(struct net_device *dev,
 	return 0;
 }
 #endif			/* WIRELESS_SPY */
+#endif /* WIRELESS_EXT <= 15 */
 
 /*------------------------------------------------------------------*/
 /*
@@ -5378,9 +5454,22 @@ static int airo_config_commit(struct net_device *dev,
 
 	/* Some of the "SET" function may have modified some of the
 	 * parameters. It's now time to commit them in the card */
-	disable_MAC(local);
-	writeConfigRid(local);
-	enable_MAC(local, &rsp);
+	disable_MAC(local, 1);
+	if (local->need_commit > 1) {
+		APListRid APList_rid;
+		SsidRid SSID_rid;
+
+		readAPListRid(local, &APList_rid);
+		readSsidRid(local, &SSID_rid);
+		reset_airo_card(dev);
+		disable_MAC(local, 1);
+		writeSsidRid(local, &SSID_rid);
+		writeAPListRid(local, &APList_rid);
+	}
+	writeConfigRid(local, 1);
+	enable_MAC(local, &rsp, 1);
+	if (local->need_commit > 1)
+		airo_set_promisc(local);
 
 	return 0;
 }
@@ -5417,6 +5506,12 @@ static const iw_handler		airo_handler[] =
 	(iw_handler) NULL,			/* SIOCGIWPRIV */
 	(iw_handler) NULL,			/* SIOCSIWSTATS */
 	(iw_handler) NULL,			/* SIOCGIWSTATS */
+#if WIRELESS_EXT > 15
+	iw_handler_set_spy,			/* SIOCSIWSPY */
+	iw_handler_get_spy,			/* SIOCGIWSPY */
+	iw_handler_set_thrspy,			/* SIOCSIWTHRSPY */
+	iw_handler_get_thrspy,			/* SIOCGIWTHRSPY */
+#else /* WIRELESS_EXT > 15 */
 #ifdef WIRELESS_SPY
 	(iw_handler) airo_set_spy,		/* SIOCSIWSPY */
 	(iw_handler) airo_get_spy,		/* SIOCGIWSPY */
@@ -5426,6 +5521,7 @@ static const iw_handler		airo_handler[] =
 #endif	/* WIRELESS_SPY */
 	(iw_handler) NULL,			/* -- hole -- */
 	(iw_handler) NULL,			/* -- hole -- */
+#endif /* WIRELESS_EXT > 15 */
 	(iw_handler) airo_set_wap,		/* SIOCSIWAP */
 	(iw_handler) airo_get_wap,		/* SIOCGIWAP */
 	(iw_handler) NULL,			/* -- hole -- */
@@ -5479,6 +5575,11 @@ static const struct iw_handler_def	airo_handler_def =
 	.standard	= (iw_handler *) airo_handler,
 	.private	= (iw_handler *) airo_private_handler,
 	.private_args	= (struct iw_priv_args *) airo_private_args,
+#if 0 && WIRELESS_EXT > 15
+	.spy_offset	= ((void *) (&((struct airo_info *) NULL)->spy_data) -
+			   (void *) NULL),
+#endif /* WIRELESS_EXT > 15 */
+
 };
 
 #endif /* WIRELESS_EXT > 12 */
@@ -5864,7 +5965,7 @@ struct iw_statistics *airo_get_wireless_stats(struct net_device *dev)
 
 	/* Get stats out of the card */
 	readStatusRid(local, &status_rid);
-	readStatsRid(local, &stats_rid, RID_STATS);
+	readStatsRid(local, &stats_rid, RID_STATS, 1);
 
 	/* The status */
 	local->wstats.status = status_rid.mode;
@@ -5902,18 +6003,14 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) {
 	unsigned short ridcode;
 	unsigned char *iobuf;
 	struct airo_info *ai = dev->priv;
-	int ret = 0;
 
 	if (ai->flags & FLAG_FLASHING)
 		return -EIO;
-	iobuf = kmalloc(RIDS_SIZE, GFP_KERNEL);
-	if (!iobuf)
-		return -ENOMEM;
 
 	switch(comp->command)
 	{
 	case AIROGCAP:      ridcode = RID_CAPABILITIES; break;
-	case AIROGCFG: writeConfigRid (ai);
+	case AIROGCFG: writeConfigRid (ai, 1);
 			    ridcode = RID_CONFIG;       break;
 	case AIROGSLIST:    ridcode = RID_SSID;         break;
 	case AIROGVLIST:    ridcode = RID_APLIST;       break;
@@ -5921,17 +6018,13 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) {
 	case AIROGEHTENC:   ridcode = RID_ETHERENCAP;   break;
 	case AIROGWEPKTMP:  ridcode = RID_WEP_TEMP;
 		/* Only super-user can read WEP keys */
-		if (!capable(CAP_NET_ADMIN)) {
-			ret = -EPERM;
-			goto rr_free;
-		}
+		if (!capable(CAP_NET_ADMIN))
+			return -EPERM;
 		break;
 	case AIROGWEPKNV:   ridcode = RID_WEP_PERM;
 		/* Only super-user can read WEP keys */
-		if (!capable(CAP_NET_ADMIN)) {
-			ret = -EPERM;
-			goto rr_free;
-		}
+		if (!capable(CAP_NET_ADMIN))
+			return -EPERM;
 		break;
 	case AIROGSTAT:     ridcode = RID_STATUS;       break;
 	case AIROGSTATSD32: ridcode = RID_STATSDELTA;   break;
@@ -5939,25 +6032,29 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) {
 	case AIROGMICSTATS:
 		if (copy_to_user(comp->data, &ai->micstats,
 				 min((int)comp->len,(int)sizeof(ai->micstats))))
-			ret = -EFAULT;
-		goto rr_free;
+			return -EFAULT;
+		return 0;
 	default:
-		ret = -EINVAL;
-		goto rr_free;
+		return -EINVAL;
+		break;
 	}
 
-	PC4500_readrid(ai,ridcode,iobuf,RIDS_SIZE);
+	if ((iobuf = kmalloc(RIDS_SIZE, GFP_KERNEL)) == NULL)
+		return -ENOMEM;
+
+	PC4500_readrid(ai,ridcode,iobuf,RIDS_SIZE, 1);
 	/* get the count of bytes in the rid  docs say 1st 2 bytes is it.
 	 * then return it to the user
 	 * 9/22/2000 Honor user given length
 	 */
 
 	if (copy_to_user(comp->data, iobuf,
-			 min((int)comp->len, (int)RIDS_SIZE)))
-		ret = -EFAULT;
-rr_free:
-	kfree(iobuf);
-	return ret;
+			 min((int)comp->len, (int)RIDS_SIZE))) {
+		kfree (iobuf);
+		return -EFAULT;
+	}
+	kfree (iobuf);
+	return 0;
 }
 
 /*
@@ -5968,9 +6065,8 @@ static int writerids(struct net_device *dev, aironet_ioctl *comp) {
 	struct airo_info *ai = dev->priv;
 	int  ridcode, enabled;
 	Resp      rsp;
-	static int (* writer)(struct airo_info *, u16 rid, const void *, int);
+	static int (* writer)(struct airo_info *, u16 rid, const void *, int, int);
 	unsigned char *iobuf;
-	int ret = 0;
 
 	/* Only super-user can write RIDs */
 	if (!capable(CAP_NET_ADMIN))
@@ -5979,10 +6075,6 @@ static int writerids(struct net_device *dev, aironet_ioctl *comp) {
 	if (ai->flags & FLAG_FLASHING)
 		return -EIO;
 
-	iobuf = kmalloc(RIDS_SIZE, GFP_KERNEL);
-	if (!iobuf)
-		return -ENOMEM;
-
 	ridcode = 0;
 	writer = do_writerid;
 
@@ -6003,47 +6095,52 @@ static int writerids(struct net_device *dev, aironet_ioctl *comp) {
 		 * same with MAC off
 		 */
 	case AIROPMACON:
-		if (enable_MAC(ai, &rsp) != 0)
-			ret = -EIO;
-		goto wr_free;
+		if (enable_MAC(ai, &rsp, 1) != 0)
+			return -EIO;
+		return 0;
 
 		/*
 		 * Evidently this code in the airo driver does not get a symbol
 		 * as disable_MAC. it's probably so short the compiler does not gen one.
 		 */
 	case AIROPMACOFF:
-		disable_MAC(ai);
-		goto wr_free;
+		disable_MAC(ai, 1);
+		return 0;
 
 		/* This command merely clears the counts does not actually store any data
 		 * only reads rid. But as it changes the cards state, I put it in the
 		 * writerid routines.
 		 */
 	case AIROPSTCLR:
-		PC4500_readrid(ai,RID_STATSDELTACLEAR,iobuf,RIDS_SIZE);
+		if ((iobuf = kmalloc(RIDS_SIZE, GFP_KERNEL)) == NULL)
+			return -ENOMEM;
+
+		PC4500_readrid(ai,RID_STATSDELTACLEAR,iobuf,RIDS_SIZE, 1);
 
 		enabled = ai->micstats.enabled;
 		memset(&ai->micstats,0,sizeof(ai->micstats));
 		ai->micstats.enabled = enabled;
 
 		if (copy_to_user(comp->data, iobuf,
-				 min((int)comp->len, (int)RIDS_SIZE)))
-			ret = -EFAULT;
-		goto wr_free;
+				 min((int)comp->len, (int)RIDS_SIZE))) {
+			kfree (iobuf);
+			return -EFAULT;
+		}
+		kfree (iobuf);
+		return 0;
 
 	default:
-		ret = -EOPNOTSUPP;	/* Blarg! */
-		goto wr_free;
+		return -EOPNOTSUPP;	/* Blarg! */
 	}
+	if(comp->len > RIDS_SIZE)
+		return -EINVAL;
 
-	if (comp->len > RIDS_SIZE) {
-		ret = -EINVAL;
-		goto wr_free;
-	}
+	if ((iobuf = kmalloc(RIDS_SIZE, GFP_KERNEL)) == NULL)
+		return -ENOMEM;
 
 	if (copy_from_user(iobuf,comp->data,comp->len)) {
-		ret = -EFAULT;
-		goto wr_free;
+		kfree (iobuf);
+		return -EFAULT;
 	}
 
 	if (comp->command == AIROPCFG) {
@@ -6058,11 +6155,12 @@ static int writerids(struct net_device *dev, aironet_ioctl *comp) {
 			ai->flags &= ~FLAG_ADHOC;
 	}
 
-	if((*writer)(ai, ridcode, iobuf,comp->len))
-		ret = -EIO;
-wr_free:
-	kfree(iobuf);
-	return ret;
+	if((*writer)(ai, ridcode, iobuf,comp->len,1)) {
+		kfree (iobuf);
+		return -EIO;
+	}
+	kfree (iobuf);
+	return 0;
 }
 
 /*****************************************************************************
@@ -6140,7 +6238,7 @@ int flashcard(struct net_device *dev, aironet_ioctl *comp) {
  */
 
 int cmdreset(struct airo_info *ai) {
-	disable_MAC(ai);
+	disable_MAC(ai, 1);
 
 	if(!waitbusy (ai)){
 		printk(KERN_INFO "Waitbusy hang before RESET\n");
diff --git a/drivers/net/wireless/wl3501.h b/drivers/net/wireless/wl3501.h
new file mode 100644
index 000000000000..74419a831fd5
--- /dev/null
+++ b/drivers/net/wireless/wl3501.h
@@ -0,0 +1,552 @@
+#ifndef __WL3501_H__
+#define __WL3501_H__
+
+#include <linux/spinlock.h>
+#include "ieee802_11.h"
+
+/* define for WLA 2.0 */
+#define WL3501_BLKSZ 256
+/*
+ * ID for input Signals of DRIVER block
+ * bit[7-5] is block ID: 000
+ * bit[4-0] is signal ID
+*/
+enum wl3501_signals {
+	WL3501_SIG_ALARM,
+	WL3501_SIG_MD_CONFIRM,
+	WL3501_SIG_MD_IND,
+	WL3501_SIG_ASSOC_CONFIRM,
+	WL3501_SIG_ASSOC_IND,
+	WL3501_SIG_AUTH_CONFIRM,
+	WL3501_SIG_AUTH_IND,
+	WL3501_SIG_DEAUTH_CONFIRM,
+	WL3501_SIG_DEAUTH_IND,
+	WL3501_SIG_DISASSOC_CONFIRM,
+	WL3501_SIG_DISASSOC_IND,
+	WL3501_SIG_GET_CONFIRM,
+	WL3501_SIG_JOIN_CONFIRM,
+	WL3501_SIG_PWR_MGMT_CONFIRM,
+	WL3501_SIG_REASSOC_CONFIRM,
+	WL3501_SIG_REASSOC_IND,
+	WL3501_SIG_SCAN_CONFIRM,
+	WL3501_SIG_SET_CONFIRM,
+	WL3501_SIG_START_CONFIRM,
+	WL3501_SIG_RESYNC_CONFIRM,
+	WL3501_SIG_SITE_CONFIRM,
+	WL3501_SIG_SAVE_CONFIRM,
+	WL3501_SIG_RFTEST_CONFIRM,
+/*
+ * ID for input Signals of MLME block
+ * bit[7-5] is block ID: 010
+ * bit[4-0] is signal ID
+ */
+	WL3501_SIG_ASSOC_REQ = 0x20,
+	WL3501_SIG_AUTH_REQ,
+	WL3501_SIG_DEAUTH_REQ,
+	WL3501_SIG_DISASSOC_REQ,
+	WL3501_SIG_GET_REQ,
+	WL3501_SIG_JOIN_REQ,
+	WL3501_SIG_PWR_MGMT_REQ,
+	WL3501_SIG_REASSOC_REQ,
+	WL3501_SIG_SCAN_REQ,
+	WL3501_SIG_SET_REQ,
+	WL3501_SIG_START_REQ,
+	WL3501_SIG_MD_REQ,
+	WL3501_SIG_RESYNC_REQ,
+	WL3501_SIG_SITE_REQ,
+	WL3501_SIG_SAVE_REQ,
+	WL3501_SIG_RF_TEST_REQ,
+	WL3501_SIG_MM_CONFIRM = 0x60,
+	WL3501_SIG_MM_IND,
+};
+
+enum wl3501_mib_attribs {
+	WL3501_MIB_ATTR_STATION_ID,
+	WL3501_MIB_ATTR_AUTH_ALGORITHMS,
+	WL3501_MIB_ATTR_AUTH_TYPE,
+	WL3501_MIB_ATTR_MEDIUM_OCCUPANCY_LIMIT,
+	WL3501_MIB_ATTR_CF_POLLABLE,
+	WL3501_MIB_ATTR_CFP_PERIOD,
+	WL3501_MIB_ATTR_CFPMAX_DURATION,
+	WL3501_MIB_ATTR_AUTH_RESP_TMOUT,
+	WL3501_MIB_ATTR_RX_DTIMS,
+	WL3501_MIB_ATTR_PRIV_OPT_IMPLEMENTED,
+	WL3501_MIB_ATTR_PRIV_INVOKED,
+	WL3501_MIB_ATTR_WEP_DEFAULT_KEYS,
+	WL3501_MIB_ATTR_WEP_DEFAULT_KEY_ID,
+	WL3501_MIB_ATTR_WEP_KEY_MAPPINGS,
+	WL3501_MIB_ATTR_WEP_KEY_MAPPINGS_LEN,
+	WL3501_MIB_ATTR_EXCLUDE_UNENCRYPTED,
+	WL3501_MIB_ATTR_WEP_ICV_ERROR_COUNT,
+	WL3501_MIB_ATTR_WEP_UNDECRYPTABLE_COUNT,
+	WL3501_MIB_ATTR_WEP_EXCLUDED_COUNT,
+	WL3501_MIB_ATTR_MAC_ADDR,
+	WL3501_MIB_ATTR_GROUP_ADDRS,
+	WL3501_MIB_ATTR_RTS_THRESHOLD,
+	WL3501_MIB_ATTR_SHORT_RETRY_LIMIT,
+	WL3501_MIB_ATTR_LONG_RETRY_LIMIT,
+	WL3501_MIB_ATTR_FRAG_THRESHOLD,
+	WL3501_MIB_ATTR_MAX_TX_MSDU_LIFETIME,
+	WL3501_MIB_ATTR_MAX_RX_LIFETIME,
+	WL3501_MIB_ATTR_MANUFACTURER_ID,
+	WL3501_MIB_ATTR_PRODUCT_ID,
+	WL3501_MIB_ATTR_TX_FRAG_COUNT,
+	WL3501_MIB_ATTR_MULTICAST_TX_FRAME_COUNT,
+	WL3501_MIB_ATTR_FAILED_COUNT,
+	WL3501_MIB_ATTR_RX_FRAG_COUNT,
+	WL3501_MIB_ATTR_MULTICAST_RX_COUNT,
+	WL3501_MIB_ATTR_FCS_ERROR_COUNT,
+	WL3501_MIB_ATTR_RETRY_COUNT,
+	WL3501_MIB_ATTR_MULTIPLE_RETRY_COUNT,
+	WL3501_MIB_ATTR_RTS_SUCCESS_COUNT,
+	WL3501_MIB_ATTR_RTS_FAILURE_COUNT,
+	WL3501_MIB_ATTR_ACK_FAILURE_COUNT,
+	WL3501_MIB_ATTR_FRAME_DUPLICATE_COUNT,
+	WL3501_MIB_ATTR_PHY_TYPE,
+	WL3501_MIB_ATTR_REG_DOMAINS_SUPPORT,
+	WL3501_MIB_ATTR_CURRENT_REG_DOMAIN,
+	WL3501_MIB_ATTR_SLOT_TIME,
+	WL3501_MIB_ATTR_CCA_TIME,
+	WL3501_MIB_ATTR_RX_TX_TURNAROUND_TIME,
+	WL3501_MIB_ATTR_TX_PLCP_DELAY,
+	WL3501_MIB_ATTR_RX_TX_SWITCH_TIME,
+	WL3501_MIB_ATTR_TX_RAMP_ON_TIME,
+	WL3501_MIB_ATTR_TX_RF_DELAY,
+	WL3501_MIB_ATTR_SIFS_TIME,
+	WL3501_MIB_ATTR_RX_RF_DELAY,
+	WL3501_MIB_ATTR_RX_PLCP_DELAY,
+	WL3501_MIB_ATTR_MAC_PROCESSING_DELAY,
+	WL3501_MIB_ATTR_TX_RAMP_OFF_TIME,
+	WL3501_MIB_ATTR_PREAMBLE_LEN,
+	WL3501_MIB_ATTR_PLCP_HEADER_LEN,
+	WL3501_MIB_ATTR_MPDU_DURATION_FACTOR,
+	WL3501_MIB_ATTR_AIR_PROPAGATION_TIME,
+	WL3501_MIB_ATTR_TEMP_TYPE,
+	WL3501_MIB_ATTR_CW_MIN,
+	WL3501_MIB_ATTR_CW_MAX,
+	WL3501_MIB_ATTR_SUPPORT_DATA_RATES_TX,
+	WL3501_MIB_ATTR_SUPPORT_DATA_RATES_RX,
+	WL3501_MIB_ATTR_MPDU_MAX_LEN,
+	WL3501_MIB_ATTR_SUPPORT_TX_ANTENNAS,
+	WL3501_MIB_ATTR_CURRENT_TX_ANTENNA,
+	WL3501_MIB_ATTR_SUPPORT_RX_ANTENNAS,
+	WL3501_MIB_ATTR_DIVERSITY_SUPPORT,
+	WL3501_MIB_ATTR_DIVERSITY_SELECTION_RS,
+	WL3501_MIB_ATTR_NR_SUPPORTED_PWR_LEVELS,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL1,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL2,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL3,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL4,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL5,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL6,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL7,
+	WL3501_MIB_ATTR_TX_PWR_LEVEL8,
+	WL3501_MIB_ATTR_CURRENT_TX_PWR_LEVEL,
+	WL3501_MIB_ATTR_CURRENT_CHAN,
+	WL3501_MIB_ATTR_CCA_MODE_SUPPORTED,
+	WL3501_MIB_ATTR_CURRENT_CCA_MODE,
+	WL3501_MIB_ATTR_ED_THRESHOLD,
+	WL3501_MIB_ATTR_SINTHESIZER_LOCKED,
+	WL3501_MIB_ATTR_CURRENT_PWR_STATE,
+	WL3501_MIB_ATTR_DOZE_TURNON_TIME,
+	WL3501_MIB_ATTR_RCR33,
+	WL3501_MIB_ATTR_DEFAULT_CHAN,
+	WL3501_MIB_ATTR_SSID,
+	WL3501_MIB_ATTR_PWR_MGMT_ENABLE,
+	WL3501_MIB_ATTR_NET_CAPABILITY,
+	WL3501_MIB_ATTR_ROUTING,
+};
+
+enum wl3501_net_type {
+	WL3501_NET_TYPE_INFRA,
+	WL3501_NET_TYPE_ADHOC,
+	WL3501_NET_TYPE_ANY_BSS,
+};
+
+enum wl3501_scan_type {
+	WL3501_SCAN_TYPE_ACTIVE,
+	WL3501_SCAN_TYPE_PASSIVE,
+};
+
+enum wl3501_tx_result {
+	WL3501_TX_RESULT_SUCCESS,
+	WL3501_TX_RESULT_NO_BSS,
+	WL3501_TX_RESULT_RETRY_LIMIT,
+};
+
+enum wl3501_sys_type {
+	WL3501_SYS_TYPE_OPEN,
+	WL3501_SYS_TYPE_SHARE_KEY,
+};
+
+enum wl3501_status {
+	WL3501_STATUS_SUCCESS,
+	WL3501_STATUS_INVALID,
+	WL3501_STATUS_TIMEOUT,
+	WL3501_STATUS_REFUSED,
+	WL3501_STATUS_MANY_REQ,
+	WL3501_STATUS_ALREADY_BSS,
+};
+
+#define WL3501_MGMT_CAPABILITY_ESS		0x0001  /* see 802.11 p.58 */
+#define WL3501_MGMT_CAPABILITY_IBSS		0x0002  /*      - " -	   */
+#define WL3501_MGMT_CAPABILITY_CF_POLLABLE	0x0004  /*      - " -	   */
+#define WL3501_MGMT_CAPABILITY_CF_POLL_REQUEST	0x0008  /*      - " -	   */
+#define WL3501_MGMT_CAPABILITY_PRIVACY		0x0010  /*      - " -	   */
+
+#define IW_REG_DOMAIN_FCC	0x10	/* Channel 1 to 11	USA    */
+#define IW_REG_DOMAIN_DOC	0x20	/* Channel 1 to 11	Canada */
+#define IW_REG_DOMAIN_ETSI	0x30	/* Channel 1 to 13	Europe */
+#define IW_REG_DOMAIN_SPAIN	0x31	/* Channel 10 to 11	Spain  */
+#define IW_REG_DOMAIN_FRANCE	0x32	/* Channel 10 to 13	France */
+#define IW_REG_DOMAIN_MKK	0x40	/* Channel 14		Japan  */
+#define IW_REG_DOMAIN_MKK1	0x41	/* Channel 1-14		Japan  */
+#define IW_REG_DOMAIN_ISRAEL	0x50	/* Channel 3 - 9	Israel */
+
+#define WL3501_ESSID_MAX_LEN (IW_ESSID_MAX_SIZE + 2)
+
+struct wl3501_tx_hdr {
+	u16	tx_cnt;
+	u8	sync[16];
+	u16	sfd;
+	u8	signal;
+	u8	service;
+	u16	len;
+	u16	crc16;
+	u16	frame_ctrl;
+	u16	duration_id;
+	u8	addr1[ETH_ALEN];
+	u8	addr2[ETH_ALEN];
+	u8	addr3[ETH_ALEN];
+	u16	seq_ctrl;
+	u8	addr4[ETH_ALEN];
+};
+
+struct wl3501_rx_hdr {
+	u16	rx_next_blk;
+	u16	rc_next_frame_blk;
+	u8	rx_blk_ctrl;
+	u8	rx_next_frame;
+	u8	rx_next_frame1;
+	u8	rssi;
+	char	time[8];
+	u8	signal;
+	u8	service;
+	u16	len;
+	u16	crc16;
+	u16	frame_ctrl;
+	u16	duration;
+	u8	addr1[ETH_ALEN];
+	u8	addr2[ETH_ALEN];
+	u8	addr3[ETH_ALEN];
+	u16	seq;
+	u8	addr4[ETH_ALEN];
+};
+
+struct wl3501_start_req {
+	u16	next_blk;
+	u8	sig_id;
+	u8	bss_type;
+	u16	beacon_period;
+	u16	dtim_period;
+	u16	probe_delay;
+	u16	cap_info;
+	char	ssid[WL3501_ESSID_MAX_LEN];
+	u8	bss_basic_rate_set[10];
+	u8	operational_rate_set[10];
+	u8	cf_pset[8];
+	u8	phy_pset[3];
+	u8	ibss_pset[4];
+};
+
+struct wl3501_assoc_req {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	timeout;
+	u16	cap_info;
+	u16	listen_interval;
+	u8	mac_addr[ETH_ALEN];
+};
+
+struct wl3501_assoc_confirm {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	status;
+};
+
+struct wl3501_assoc_ind {
+	u16	next_blk;
+	u8	sig_id;
+	u8	mac_addr[ETH_ALEN];
+};
+
+struct wl3501_auth_req {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	type;
+	u16	timeout;
+	u8	mac_addr[ETH_ALEN];
+};
+
+struct wl3501_auth_confirm {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	type;
+	u16	status;
+	u8	mac_addr[ETH_ALEN];
+};
+
+struct wl3501_get_req {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	mib_attrib;
+};
+
+struct wl3501_get_confirm {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	mib_status;
+	u16	mib_attrib;
+	u8	mib_value[100];
+};
+
+struct wl3501_join_req {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u8	operational_rate_set[10];
+	u16	reserved2;
+	u16	timeout;
+	u16	probe_delay;
+	u8	timestamp[8];
+	u8	local_time[8];
+	u16	beacon_period;
+	u16	dtim_period;
+	u16	cap_info;
+	u8	bss_type;
+	u8	bssid[ETH_ALEN];
+	char	ssid[WL3501_ESSID_MAX_LEN];
+	u8	phy_pset[3];
+	u8	cf_pset[8];
+	u8	ibss_pset[4];
+	u8	bss_basic_rate_set[10];
+};
+
+struct wl3501_join_confirm {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	status;
+};
+
+struct wl3501_pwr_mgmt_req {
+	u16	next_blk;
+	u8	sig_id;
+	u8	pwr_save;
+	u8	wake_up;
+	u8	receive_dtims;
+};
+
+struct wl3501_pwr_mgmt_confirm {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	status;
+};
+
+struct wl3501_scan_req {
+	u16			next_blk;
+	u8			sig_id;
+	u8			bss_type;
+	u16			probe_delay;
+	u16			min_chan_time;
+	u16			max_chan_time;
+	u8			chan_list[14];
+	u8			bssid[ETH_ALEN];
+	char			ssid[WL3501_ESSID_MAX_LEN];
+	enum wl3501_scan_type	scan_type;
+};
+
+struct wl3501_scan_confirm {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	status;
+	char	timestamp[8];
+	char	localtime[8];
+	u16	beacon_period;
+	u16	dtim_period;
+	u16	cap_info;
+	u8	bss_type;
+	u8	bssid[ETH_ALEN];
+	char	ssid[WL3501_ESSID_MAX_LEN];
+	u8	phy_pset[3];
+	u8	cf_pset[8];
+	u8	ibss_pset[4];
+	u8	bss_basic_rate_set[10];
+	u8	rssi;
+};
+
+struct wl3501_start_confirm {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	status;
+};
+
+struct wl3501_md_req {
+	u16	next_blk;
+	u8	sig_id;
+	u8	routing;
+	u16	data;
+	u16	size;
+	u8	pri;
+	u8	service_class;
+	u8	daddr[ETH_ALEN];
+	u8	saddr[ETH_ALEN];
+};
+
+struct wl3501_md_ind {
+	u16	next_blk;
+	u8	sig_id;
+	u8	routing;
+	u16	data;
+	u16	size;
+	u8	reception;
+	u8	pri;
+	u8	service_class;
+	u8	daddr[ETH_ALEN];
+	u8	saddr[ETH_ALEN];
+};
+
+struct wl3501_md_confirm {
+	u16	next_blk;
+	u8	sig_id;
+	u8	reserved;
+	u16	data;
+	u8	status;
+	u8	pri;
+	u8	service_class;
+};
+
+struct wl3501_resync_req {
+	u16	next_blk;
+	u8	sig_id;
+};
+
+/* Definitions for supporting clone adapters. */
+/* System Interface Registers (SIR space) */
+#define WL3501_NIC_GCR ((u8)0x00)	/* SIR0 - General Conf Register */
+#define WL3501_NIC_BSS ((u8)0x01)	/* SIR1 - Bank Switching Select Reg */
+#define WL3501_NIC_LMAL ((u8)0x02)	/* SIR2 - Local Mem addr Reg [7:0] */
+#define WL3501_NIC_LMAH ((u8)0x03)	/* SIR3 - Local Mem addr Reg [14:8] */
+#define WL3501_NIC_IODPA ((u8)0x04)	/* SIR4 - I/O Data Port A */
+#define WL3501_NIC_IODPB ((u8)0x05)	/* SIR5 - I/O Data Port B */
+#define WL3501_NIC_IODPC ((u8)0x06)	/* SIR6 - I/O Data Port C */
+#define WL3501_NIC_IODPD ((u8)0x07)	/* SIR7 - I/O Data Port D */
+
+/* Bits in GCR */
+#define WL3501_GCR_SWRESET ((u8)0x80)
+#define WL3501_GCR_CORESET ((u8)0x40)
+#define WL3501_GCR_DISPWDN ((u8)0x20)
+#define WL3501_GCR_ECWAIT  ((u8)0x10)
+#define WL3501_GCR_ECINT   ((u8)0x08)
+#define WL3501_GCR_INT2EC  ((u8)0x04)
+#define WL3501_GCR_ENECINT ((u8)0x02)
+#define WL3501_GCR_DAM     ((u8)0x01)
+
+/* Bits in BSS (Bank Switching Select Register) */
+#define WL3501_BSS_FPAGE0 ((u8)0x20)	/* Flash memory page0 */
+#define WL3501_BSS_FPAGE1 ((u8)0x28)
+#define WL3501_BSS_FPAGE2 ((u8)0x30)
+#define WL3501_BSS_FPAGE3 ((u8)0x38)
+#define WL3501_BSS_SPAGE0 ((u8)0x00)	/* SRAM page0 */
+#define WL3501_BSS_SPAGE1 ((u8)0x08)
+#define WL3501_BSS_SPAGE2 ((u8)0x10)
+#define WL3501_BSS_SPAGE3 ((u8)0x18)
+
+/* Define Driver Interface */
+/* Refer IEEE 802.11 */
+/* Tx packet header, include PLCP and MPDU */
+/* Tx PLCP Header */
+struct wl3501_80211_tx_plcp_hdr {
+	u8	sync[16];
+	u16	sfd;
+	u8	signal;
+	u8	service;
+	u16	len;
+	u16	crc16;
+} __attribute__ ((packed));
+
+struct wl3501_80211_tx_hdr {
+	struct wl3501_80211_tx_plcp_hdr	pclp_hdr;
+	struct ieee802_11_hdr		mac_hdr;
+} __attribute__ ((packed));
+
+/*
+   Reserve the beginning Tx space for descriptor use.
+
+   TxBlockOffset -->	*----*----*----*----* \
+	(TxFreeDesc)	|  0 |  1 |  2 |  3 |  \
+			|  4 |  5 |  6 |  7 |   |
+			|  8 |  9 | 10 | 11 |   TX_DESC * 20
+			| 12 | 13 | 14 | 15 |   |
+			| 16 | 17 | 18 | 19 |  /
+   TxBufferBegin -->	*----*----*----*----* /
+   (TxBufferHead)	| 		    |
+   (TxBufferTail)	| 		    |
+			|    Send Buffer    |
+			| 		    |
+			|		    |
+			*-------------------*
+   TxBufferEnd    -------------------------/
+
+*/
+
+struct wl3501_card {
+	int				base_addr;
+	u8				mac_addr[ETH_ALEN];
+	spinlock_t			lock;
+	wait_queue_head_t		wait;
+	struct wl3501_get_confirm	sig_get_confirm;
+	struct wl3501_pwr_mgmt_confirm	sig_pwr_mgmt_confirm;
+	u16				tx_buffer_size;
+	u16				tx_buffer_head;
+	u16				tx_buffer_tail;
+	u16				tx_buffer_cnt;
+	u16				esbq_req_start;
+	u16				esbq_req_end;
+	u16				esbq_req_head;
+	u16				esbq_req_tail;
+	u16				esbq_confirm_start;
+	u16				esbq_confirm_end;
+	u16				esbq_confirm;
+	u8				essid[WL3501_ESSID_MAX_LEN];
+	u8				bssid[ETH_ALEN];
+	int				net_type;
+	u8				keep_essid[WL3501_ESSID_MAX_LEN];
+	char				nick[32];
+	char				card_name[32];
+	char				firmware_date[32];
+	u8				chan;
+	u8				cap_info;
+	u16				start_seg;
+	u16				bss_cnt;
+	u16				join_sta_bss;
+	u8				rssi;
+	u8				adhoc_times;
+	u8				reg_domain;
+	u8				version[2];
+	struct wl3501_scan_confirm	bss_set[20];
+	struct net_device_stats 	stats;
+	struct iw_statistics		wstats;
+	struct iw_spy_data		spy_data;
+	struct dev_node_t		node;
+};
+#endif
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
new file mode 100644
index 000000000000..f9d423f30d68
--- /dev/null
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -0,0 +1,2296 @@
+/*
+ * WL3501 Wireless LAN PCMCIA Card Driver for Linux
+ * Written originally for Linux 2.0.30 by Fox Chen, mhchen@golf.ccl.itri.org.tw
+ * Ported to 2.2, 2.4 & 2.5 by Arnaldo Carvalho de Melo <acme@conectiva.com.br>
+ * Wireless extensions in 2.4 by Gustavo Niemeyer <niemeyer@conectiva.com>
+ *
+ * References used by Fox Chen while writing the original driver for 2.0.30:
+ *
+ *   1. WL24xx packet drivers (tooasm.asm)
+ *   2. Access Point Firmware Interface Specification for IEEE 802.11 SUTRO
+ *   3. IEEE 802.11
+ *   4. Linux network driver (/usr/src/linux/drivers/net)
+ *   5. ISA card driver - wl24.c
+ *   6. Linux PCMCIA skeleton driver - skeleton.c
+ *   7. Linux PCMCIA 3c589 network driver - 3c589_cs.c
+ *
+ * Tested with WL2400 firmware 1.2, Linux 2.0.30, and pcmcia-cs-2.9.12
+ *   1. Performance: about 165 Kbytes/sec in TCP/IP with Ad-Hoc mode.
+ *      rsh 192.168.1.3 "dd if=/dev/zero bs=1k count=1000" > /dev/null
+ *      (Specification 2M bits/sec. is about 250 Kbytes/sec., but we must deduct
+ *       ETHER/IP/UDP/TCP header, and acknowledgement overhead)
+ *
+ * Tested with Planet AP in 2.4.17, 184 Kbytes/s in UDP in Infrastructure mode,
+ * 173 Kbytes/s in TCP.
+ *
+ * Tested with Planet AP in 2.5.73-bk, 216 Kbytes/s in Infrastructure mode
+ * with a SMP machine (dual pentium 100), using pktgen, 432 pps (pkt_size = 60)
+ */
+#undef REALLY_SLOW_IO	/* most systems can safely undef this */
+
+#include <linux/config.h>
+#include <linux/delay.h>
+#include <linux/types.h>
+#include <linux/ethtool.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/in.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/fcntl.h>
+#include <linux/if_arp.h>
+#include <linux/ioport.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/timer.h>
+#include <linux/wireless.h>
+
+#include <net/iw_handler.h>
+
+#include <pcmcia/version.h>
+#include <pcmcia/cs_types.h>
+#include <pcmcia/cs.h>
+#include <pcmcia/cistpl.h>
+#include <pcmcia/cisreg.h>
+#include <pcmcia/ds.h>
+
+#include <asm/io.h>
+#include <asm/uaccess.h>
+#include <asm/system.h>
+
+#include "wl3501.h"
+
+#ifndef __i386__
+#define slow_down_io()
+#endif
+
+/* For rough constant delay */
+#define WL3501_NOPLOOP(n) { int x = 0; while (x++ < n) slow_down_io(); }
+
+/*
+ * All the PCMCIA modules use PCMCIA_DEBUG to control debugging.  If you do not
+ * define PCMCIA_DEBUG at all, all the debug code will be left out.  If you
+ * compile with PCMCIA_DEBUG=0, the debug code will be present but disabled --
+ * but it can then be enabled for specific modules at load time with a
+ * 'pc_debug=#' option to insmod.
+ */
+#define PCMCIA_DEBUG 0
+#ifdef PCMCIA_DEBUG
+static int pc_debug = PCMCIA_DEBUG;
+MODULE_PARM(pc_debug, "i");
+#define dprintk(n, format, args...) \
+	{ if (pc_debug > (n)) \
+		printk(KERN_INFO "%s: " format "\n", __FUNCTION__, ##args); }
+#else
+#define dprintk(n, format, args...)
+#endif
+
+#define wl3501_outb(a, b) { outb(a, b); slow_down_io(); }
+#define wl3501_outb_p(a, b) { outb_p(a, b); slow_down_io(); }
+#define wl3501_outsb(a, b, c) { outsb(a, b, c); slow_down_io(); }
+
+#define WL3501_RELEASE_TIMEOUT (25 * HZ)
+#define WL3501_MAX_ADHOC_TRIES 16
+
+#define WL3501_RESUME	0
+#define WL3501_SUSPEND	1
+
+/* Parameters that can be set with 'insmod' */
+/* Bit map of interrupts to choose from */
+/* This means pick from 15, 14, 12, 11, 10, 9, 7, 5, 4, and 3 */
+static unsigned long wl3501_irq_mask = 0xdeb8;
+static int wl3501_irq_list[4] = { -1 };
+
+/*
+ * The event() function is this driver's Card Services event handler.  It will
+ * be called by Card Services when an appropriate card status event is
+ * received. The config() and release() entry points are used to configure or
+ * release a socket, in response to card insertion and ejection events.  They
+ * are invoked from the wl24 event handler.
+ */
+static void wl3501_config(dev_link_t *link);
+static void wl3501_release(unsigned long arg);
+static int wl3501_event(event_t event, int pri, event_callback_args_t *args);
+
+/*
+ * The dev_info variable is the "key" that is used to match up this
+ * device driver with appropriate cards, through the card configuration
+ * database.
+ */
+static dev_info_t wl3501_dev_info = "wl3501_cs";
+
+static int wl3501_chan2freq[] = {
+	[0]  = 2412, [1]  = 2417, [2]  = 2422, [3]  = 2427, [4] = 2432,
+	[5]  = 2437, [6]  = 2442, [7]  = 2447, [8]  = 2452, [9] = 2457,
+	[10] = 2462, [11] = 2467, [12] = 2472, [13] = 2477,
+};
+
+static const struct {
+	int reg_domain;
+	int min, max, deflt;
+} iw_channel_table[] = {
+	{
+		.reg_domain = IW_REG_DOMAIN_FCC,
+		.min	    = 1,
+		.max	    = 11,
+		.deflt	    = 1,
+	},
+	{
+		.reg_domain = IW_REG_DOMAIN_DOC,
+		.min	    = 1,
+		.max	    = 11,
+		.deflt	    = 1,
+	},
+	{
+		.reg_domain = IW_REG_DOMAIN_ETSI,
+		.min	    = 1,
+		.max	    = 13,
+		.deflt	    = 1,
+	},
+	{
+		.reg_domain = IW_REG_DOMAIN_SPAIN,
+		.min	    = 10,
+		.max	    = 11,
+		.deflt	    = 10,
+	},
+	{
+		.reg_domain = IW_REG_DOMAIN_FRANCE,
+		.min	    = 10,
+		.max	    = 13,
+		.deflt	    = 10,
+	},
+	{
+		.reg_domain = IW_REG_DOMAIN_MKK,
+		.min	    = 14,
+		.max	    = 14,
+		.deflt	    = 14,
+	},
+	{
+		.reg_domain = IW_REG_DOMAIN_MKK1,
+		.min	    = 1,
+		.max	    = 14,
+		.deflt	    = 1,
+	},
+	{
+		.reg_domain = IW_REG_DOMAIN_ISRAEL,
+		.min	    = 3,
+		.max	    = 9,
+		.deflt	    = 9,
+	},
+};
+
+/**
+ * iw_valid_channel - validate channel in regulatory domain
+ * @reg_comain - regulatory domain
+ * @channel - channel to validate
+ *
+ * Returns 0 if invalid in the specified regulatory domain, non-zero if valid.
+ */
+static int iw_valid_channel(int reg_domain, int channel)
+{
+	int i, rc = 0;
+
+	for (i = 0; i < ARRAY_SIZE(iw_channel_table); i++)
+		if (reg_domain == iw_channel_table[i].reg_domain) {
+			rc = channel >= iw_channel_table[i].min &&
+			     channel <= iw_channel_table[i].max;
+			break;
+		}
+	return rc;
+}
+
+/**
+ * iw_default_channel - get default channel for a regulatory domain
+ * @reg_comain - regulatory domain
+ *
+ * Returns the default channel for a regulatory domain
+ */
+static int iw_default_channel(int reg_domain)
+{
+	int i, rc = 1;
+
+	for (i = 0; i < ARRAY_SIZE(iw_channel_table); i++)
+		if (reg_domain == iw_channel_table[i].reg_domain) {
+			rc = iw_channel_table[i].deflt;
+			break;
+		}
+	return rc;
+}
+
+/*
+ * A linked list of "instances" of the wl24 device.  Each actual PCMCIA card
+ * corresponds to one device instance, and is described by one dev_link_t
+ * structure (defined in ds.h).
+ *
+ * You may not want to use a linked list for this -- for example, the memory
+ * card driver uses an array of dev_link_t pointers, where minor device numbers
+ * are used to derive the corresponding array index.
+ */
+static dev_link_t *wl3501_dev_list;
+
+static inline void wl3501_switch_page(struct wl3501_card *this, u8 page)
+{
+	wl3501_outb(page, this->base_addr + WL3501_NIC_BSS);
+}
+
+/*
+ * Get Ethernet MAC addresss.
+ *
+ * WARNING: We switch to FPAGE0 and switc back again.
+ *          Making sure there is no other WL function beening called by ISR.
+ */
+static int wl3501_get_flash_mac_addr(struct wl3501_card *this)
+{
+	int base_addr = this->base_addr;
+
+	/* get MAC addr */
+	wl3501_outb(WL3501_BSS_FPAGE3, base_addr + WL3501_NIC_BSS); /* BSS */
+	wl3501_outb(0x00, base_addr + WL3501_NIC_LMAL);	/* LMAL */
+	wl3501_outb(0x40, base_addr + WL3501_NIC_LMAH);	/* LMAH */
+
+	/* wait for reading EEPROM */
+	WL3501_NOPLOOP(100);
+	this->mac_addr[0] = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	this->mac_addr[1] = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	this->mac_addr[2] = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	this->mac_addr[3] = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	this->mac_addr[4] = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	this->mac_addr[5] = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	this->reg_domain = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	wl3501_outb(WL3501_BSS_FPAGE0, base_addr + WL3501_NIC_BSS);
+	wl3501_outb(0x04, base_addr + WL3501_NIC_LMAL);
+	wl3501_outb(0x40, base_addr + WL3501_NIC_LMAH);
+	WL3501_NOPLOOP(100);
+	this->version[0] = inb(base_addr + WL3501_NIC_IODPA);
+	WL3501_NOPLOOP(100);
+	this->version[1] = inb(base_addr + WL3501_NIC_IODPA);
+	/* switch to SRAM Page 0 (for safety) */
+	wl3501_switch_page(this, WL3501_BSS_SPAGE0);
+
+	/* The MAC addr should be 00:60:... */
+	return this->mac_addr[0] == 0x00 && this->mac_addr[1] == 0x60;
+}
+
+/**
+ * wl3501_set_to_wla - Move 'size' bytes from PC to card
+ * @dest: Card addressing space
+ * @src: PC addressing space
+ * @size: Bytes to move
+ *
+ * Move 'size' bytes from PC to card. (Shouldn't be interrupted)
+ */
+void wl3501_set_to_wla(struct wl3501_card *this, u16 dest, void *src, int size)
+{
+	/* switch to SRAM Page 0 */
+	wl3501_switch_page(this, (dest & 0x8000) ? WL3501_BSS_SPAGE1 :
+						   WL3501_BSS_SPAGE0);
+	/* set LMAL and LMAH */
+	wl3501_outb(dest & 0xff, this->base_addr + WL3501_NIC_LMAL);
+	wl3501_outb(((dest >> 8) & 0x7f), this->base_addr + WL3501_NIC_LMAH);
+
+	/* rep out to Port A */
+	wl3501_outsb(this->base_addr + WL3501_NIC_IODPA, src, size);
+}
+
+/**
+ * wl3501_get_from_wla - Move 'size' bytes from card to PC
+ * @src: Card addressing space
+ * @dest: PC addressing space
+ * @size: Bytes to move
+ *
+ * Move 'size' bytes from card to PC. (Shouldn't be interrupted)
+ */
+void wl3501_get_from_wla(struct wl3501_card *this, u16 src, void *dest,
+			 int size)
+{
+	/* switch to SRAM Page 0 */
+	wl3501_switch_page(this, (src & 0x8000) ? WL3501_BSS_SPAGE1 :
+						  WL3501_BSS_SPAGE0);
+	/* set LMAL and LMAH */
+	wl3501_outb(src & 0xff, this->base_addr + WL3501_NIC_LMAL);
+	wl3501_outb((src >> 8) & 0x7f, this->base_addr + WL3501_NIC_LMAH);
+
+	/* rep get from Port A */
+	insb(this->base_addr + WL3501_NIC_IODPA, dest, size);
+}
+
+/*
+ * Get/Allocate a free Tx Data Buffer
+ *
+ *  *--------------*-----------------*----------------------------------*
+ *  |    PLCP      |    MAC Header   |  DST  SRC         Data ...       |
+ *  |  (24 bytes)  |    (30 bytes)   |  (6)  (6)  (Ethernet Row Data)   |
+ *  *--------------*-----------------*----------------------------------*
+ *  \               \- IEEE 802.11 -/ \-------------- len --------------/
+ *   \-struct wl3501_80211_tx_hdr--/   \-------- Ethernet Frame -------/
+ *
+ * Return = Postion in Card
+ */
+static u16 wl3501_get_tx_buffer(struct wl3501_card *this, u16 len)
+{
+	u16 next, blk_cnt = 0, zero = 0;
+	u16 full_len = sizeof(struct wl3501_80211_tx_hdr) + len;
+	u16 ret = 0;
+
+	if (full_len > this->tx_buffer_cnt * 254)
+		goto out;
+	ret = this->tx_buffer_head;
+	while (full_len) {
+		if (full_len < 254)
+			full_len = 0;
+		else
+			full_len -= 254;
+		wl3501_get_from_wla(this, this->tx_buffer_head, &next,
+				    sizeof(next));
+		if (!full_len)
+			wl3501_set_to_wla(this, this->tx_buffer_head, &zero,
+					  sizeof(zero));
+		this->tx_buffer_head = next;
+		blk_cnt++;
+		/* if buffer is not enough */
+		if (!next && full_len) {
+			this->tx_buffer_head = ret;
+			ret = 0;
+			goto out;
+		}
+	}
+	this->tx_buffer_cnt -= blk_cnt;
+out:
+	return ret;
+}
+
+/*
+ * Free an allocated Tx Buffer. ptr must be correct position.
+ */
+static void wl3501_free_tx_buffer(struct wl3501_card *this, u16 ptr)
+{
+	/* check if all space is not free */
+	if (!this->tx_buffer_head)
+		this->tx_buffer_head = ptr;
+	else
+		wl3501_set_to_wla(this, this->tx_buffer_tail,
+				  &ptr, sizeof(ptr));
+	while (ptr) {
+		u16 next;
+
+		this->tx_buffer_cnt++;
+		wl3501_get_from_wla(this, ptr, &next, sizeof(next));
+		this->tx_buffer_tail = ptr;
+		ptr = next;
+	}
+}
+
+static int wl3501_esbq_req_test(struct wl3501_card *this)
+{
+	u8 tmp;
+
+	wl3501_get_from_wla(this, this->esbq_req_head + 3, &tmp, sizeof(tmp));
+	return tmp & 0x80;
+}
+
+static void wl3501_esbq_req(struct wl3501_card *this, u16 *ptr)
+{
+	u16 tmp = 0;
+
+	wl3501_set_to_wla(this, this->esbq_req_head, ptr, 2);
+	wl3501_set_to_wla(this, this->esbq_req_head + 2, &tmp, sizeof(tmp));
+	this->esbq_req_head += 4;
+	if (this->esbq_req_head >= this->esbq_req_end)
+		this->esbq_req_head = this->esbq_req_start;
+}
+
+static int wl3501_esbq_exec(struct wl3501_card *this, void *sig, int sig_size)
+{
+	int rc = -EIO;
+
+	if (wl3501_esbq_req_test(this)) {
+		u16 ptr = wl3501_get_tx_buffer(this, sig_size);
+		if (ptr) {
+			wl3501_set_to_wla(this, ptr, sig, sig_size);
+			wl3501_esbq_req(this, &ptr);
+			rc = 0;
+		}
+	}
+	return rc;
+}
+
+static int wl3501_get_mib_value(struct wl3501_card *this, u8 index,
+				void *bf, int size)
+{
+	struct wl3501_get_req sig = {
+		.sig_id	    = WL3501_SIG_GET_REQ,
+		.mib_attrib = index,
+	};
+	unsigned long flags;
+	int rc = -EIO;
+
+	spin_lock_irqsave(&this->lock, flags);
+	if (wl3501_esbq_req_test(this)) {
+		u16 ptr = wl3501_get_tx_buffer(this, sizeof(sig));
+		if (ptr) {
+			wl3501_set_to_wla(this, ptr, &sig, sizeof(sig));
+			wl3501_esbq_req(this, &ptr);
+			this->sig_get_confirm.mib_status = 255;
+			spin_unlock_irqrestore(&this->lock, flags);
+			rc = wait_event_interruptible(this->wait,
+				this->sig_get_confirm.mib_status != 255);
+			if (!rc)
+				memcpy(bf, this->sig_get_confirm.mib_value,
+				       size);
+			goto out;
+		}
+	}
+	spin_unlock_irqrestore(&this->lock, flags);
+out:
+	return rc;
+}
+
+static int wl3501_pwr_mgmt(struct wl3501_card *this, int suspend)
+{
+	struct wl3501_pwr_mgmt_req sig = {
+		.sig_id		= WL3501_SIG_PWR_MGMT_REQ,
+		.pwr_save	= suspend,
+		.wake_up	= !suspend,
+		.receive_dtims	= 10,
+	};
+	unsigned long flags;
+	int rc = -EIO;
+
+	spin_lock_irqsave(&this->lock, flags);
+	if (wl3501_esbq_req_test(this)) {
+		u16 ptr = wl3501_get_tx_buffer(this, sizeof(sig));
+		if (ptr) {
+			wl3501_set_to_wla(this, ptr, &sig, sizeof(sig));
+			wl3501_esbq_req(this, &ptr);
+			this->sig_pwr_mgmt_confirm.status = 255;
+			spin_unlock_irqrestore(&this->lock, flags);
+			rc = wait_event_interruptible(this->wait,
+				this->sig_pwr_mgmt_confirm.status != 255);
+			printk(KERN_INFO "%s: %s status=%d\n", __FUNCTION__,
+			       suspend ? "suspend" : "resume",
+			       this->sig_pwr_mgmt_confirm.status);
+			goto out;
+		}
+	}
+	spin_unlock_irqrestore(&this->lock, flags);
+out:
+	return rc;
+}
+
+/**
+ * wl3501_send_pkt - Send a packet.
+ * @this - card
+ *
+ * Send a packet.
+ *
+ * data = Ethernet raw frame.  (e.g. data[0] - data[5] is Dest MAC Addr,
+ *                                   data[6] - data[11] is Src MAC Addr)
+ * Ref: IEEE 802.11
+ */
+static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len)
+{
+	u16 bf, sig_bf, next, tmplen, pktlen;
+	struct wl3501_md_req sig = {
+		.sig_id = WL3501_SIG_MD_REQ,
+	};
+	u8 *pdata = (char *)data;
+	int rc = -EIO;
+
+	if (wl3501_esbq_req_test(this)) {
+		sig_bf = wl3501_get_tx_buffer(this, sizeof(sig));
+		rc = -ENOMEM;
+		if (!sig_bf)	/* No free buffer available */
+			goto out;
+		bf = wl3501_get_tx_buffer(this, len + 26 + 24);
+		if (!bf) {
+			/* No free buffer available */
+			wl3501_free_tx_buffer(this, sig_bf);
+			goto out;
+		}
+		rc = 0;
+		memcpy(&sig.daddr[0], pdata, 12);
+		pktlen = len - 12;
+		pdata += 12;
+		sig.data = bf;
+		if (((*pdata) * 256 + (*(pdata + 1))) > 1500) {
+			u8 addr4[ETH_ALEN] = {
+				[0] = 0xAA, [1] = 0xAA, [2] = 0x03, [4] = 0x00,
+			};
+
+			wl3501_set_to_wla(this, bf + 2 +
+					  offsetof(struct wl3501_tx_hdr, addr4),
+					  addr4, sizeof(addr4));
+			sig.size = pktlen + 24 + 4 + 6;
+			if (pktlen > (254 - sizeof(struct wl3501_tx_hdr))) {
+				tmplen = 254 - sizeof(struct wl3501_tx_hdr);
+				pktlen -= tmplen;
+			} else {
+				tmplen = pktlen;
+				pktlen = 0;
+			}
+			wl3501_set_to_wla(this,
+					  bf + 2 + sizeof(struct wl3501_tx_hdr),
+					  pdata, tmplen);
+			pdata += tmplen;
+			wl3501_get_from_wla(this, bf, &next, sizeof(next));
+			bf = next;
+		} else {
+			sig.size = pktlen + 24 + 4 - 2;
+			pdata += 2;
+			pktlen -= 2;
+			if (pktlen > (254 - sizeof(struct wl3501_tx_hdr) + 6)) {
+				tmplen = 254 - sizeof(struct wl3501_tx_hdr) + 6;
+				pktlen -= tmplen;
+			} else {
+				tmplen = pktlen;
+				pktlen = 0;
+			}
+			wl3501_set_to_wla(this, bf + 2 +
+					  offsetof(struct wl3501_tx_hdr, addr4),
+					  pdata, tmplen);
+			pdata += tmplen;
+			wl3501_get_from_wla(this, bf, &next, sizeof(next));
+			bf = next;
+		}
+		while (pktlen > 0) {
+			if (pktlen > 254) {
+				tmplen = 254;
+				pktlen -= 254;
+			} else {
+				tmplen = pktlen;
+				pktlen = 0;
+			}
+			wl3501_set_to_wla(this, bf + 2, pdata, tmplen);
+			pdata += tmplen;
+			wl3501_get_from_wla(this, bf, &next, sizeof(next));
+			bf = next;
+		}
+		wl3501_set_to_wla(this, sig_bf, &sig, sizeof(sig));
+		wl3501_esbq_req(this, &sig_bf);
+	}
+out:
+	return rc;
+}
+
+static int wl3501_mgmt_resync(struct wl3501_card *this)
+{
+	struct wl3501_resync_req sig = {
+		.sig_id = WL3501_SIG_RESYNC_REQ,
+	};
+
+	return wl3501_esbq_exec(this, &sig, sizeof(sig));
+}
+
+static inline int wl3501_fw_bss_type(struct wl3501_card *this)
+{
+	return this->net_type == IW_MODE_INFRA ? WL3501_NET_TYPE_INFRA :
+						 WL3501_NET_TYPE_ADHOC;
+}
+
+static inline int wl3501_fw_cap_info(struct wl3501_card *this)
+{
+	return this->net_type == IW_MODE_INFRA ? WL3501_MGMT_CAPABILITY_ESS :
+						 WL3501_MGMT_CAPABILITY_IBSS;
+}
+
+static int wl3501_mgmt_scan(struct wl3501_card *this, u16 chan_time)
+{
+	struct wl3501_scan_req sig = {
+		.sig_id		= WL3501_SIG_SCAN_REQ,
+		.scan_type	= WL3501_SCAN_TYPE_ACTIVE,
+		.probe_delay	= 0x10,
+		.min_chan_time	= chan_time,
+		.max_chan_time	= chan_time,
+		.bss_type	= wl3501_fw_bss_type(this),
+	};
+
+	this->bss_cnt = this->join_sta_bss = 0;
+	return wl3501_esbq_exec(this, &sig, sizeof(sig));
+}
+
+static int wl3501_mgmt_join(struct wl3501_card *this, u16 stas)
+{
+	struct wl3501_join_req sig = {
+		.sig_id	  = WL3501_SIG_JOIN_REQ,
+		.timeout  = 10,
+		.phy_pset = {
+			[2] = this->chan,
+		},
+	};
+
+	memcpy(&sig.beacon_period, &this->bss_set[stas].beacon_period, 72);
+	return wl3501_esbq_exec(this, &sig, sizeof(sig));
+}
+
+static int wl3501_mgmt_start(struct wl3501_card *this)
+{
+	struct wl3501_start_req sig = {
+		.sig_id			= WL3501_SIG_START_REQ,
+		.beacon_period		= 400,
+		.dtim_period		= 1,
+		.phy_pset		= {
+			[0] = 3, [1] = 1, [2] = this->chan,
+		},
+		.bss_basic_rate_set	= {
+			[0] = 0x01, [1] = 0x02, [2] = 0x82, [3] = 0x84,
+		},
+		.operational_rate_set	= {
+			[0] = 0x01, [1] = 0x02, [2] = 0x82, [3] = 0x84,
+		},
+		.ibss_pset		= {
+			[0] = 6, [1] = 2, [2] = 10,
+		},
+		.bss_type		= wl3501_fw_bss_type(this),
+		.cap_info		= wl3501_fw_cap_info(this),
+	};
+
+	memcpy(sig.ssid, this->essid, WL3501_ESSID_MAX_LEN);
+	memcpy(this->keep_essid, this->essid, WL3501_ESSID_MAX_LEN);
+	return wl3501_esbq_exec(this, &sig, sizeof(sig));
+}
+
+static void wl3501_mgmt_scan_confirm(struct wl3501_card *this, u16 addr)
+{
+	u16 i = 0;
+	int matchflag = 0;
+	struct wl3501_scan_confirm sig;
+
+	dprintk(3, "entry");
+	wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
+	if (sig.status == WL3501_STATUS_SUCCESS) {
+		dprintk(3, "success");
+		if ((this->net_type == IW_MODE_INFRA &&
+		     (sig.cap_info & WL3501_MGMT_CAPABILITY_ESS)) ||
+		    (this->net_type == IW_MODE_ADHOC &&
+		     (sig.cap_info & WL3501_MGMT_CAPABILITY_IBSS)) ||
+		    this->net_type == IW_MODE_AUTO) {
+			if (!this->essid[1])
+				matchflag = 1;
+			else if (this->essid[1] == 3 &&
+				 !strncmp((char *)&this->essid[2], "ANY", 3))
+				matchflag = 1;
+			else if (this->essid[1] != sig.ssid[1])
+				matchflag = 0;
+			else if (memcmp(&this->essid[2], &sig.ssid[2],
+					this->essid[1]))
+				matchflag = 0;
+			else
+				matchflag = 1;
+			if (matchflag) {
+				for (i = 0; i < this->bss_cnt; i++) {
+					if (!memcmp(this->bss_set[i].bssid,
+						    sig.bssid, ETH_ALEN)) {
+						matchflag = 0;
+						break;
+					}
+				}
+			}
+			if (matchflag && (i < 20)) {
+				memcpy(&this->bss_set[i].beacon_period,
+				       &sig.beacon_period, 73);
+				this->bss_cnt++;
+				this->rssi = sig.rssi;
+			}
+		}
+	} else if (sig.status == WL3501_STATUS_TIMEOUT) {
+		dprintk(3, "timeout");
+		this->join_sta_bss = 0;
+		for (i = this->join_sta_bss; i < this->bss_cnt; i++)
+			if (!wl3501_mgmt_join(this, i))
+				break;
+		this->join_sta_bss = i;
+		if (this->join_sta_bss == this->bss_cnt) {
+			if (this->net_type == IW_MODE_INFRA)
+				wl3501_mgmt_scan(this, 100);
+			else {
+				this->adhoc_times++;
+				if (this->adhoc_times > WL3501_MAX_ADHOC_TRIES)
+					wl3501_mgmt_start(this);
+				else
+					wl3501_mgmt_scan(this, 100);
+			}
+		}
+	}
+}
+
+/**
+ * wl3501_block_interrupt - Mask interrupt from SUTRO
+ * @this - card
+ *
+ * Mask interrupt from SUTRO. (i.e. SUTRO cannot interrupt the HOST)
+ * Return: 1 if interrupt is originally enabled
+ */
+static int wl3501_block_interrupt(struct wl3501_card *this)
+{
+	u8 old = inb(this->base_addr + WL3501_NIC_GCR);
+	u8 new = old & (~(WL3501_GCR_ECINT | WL3501_GCR_INT2EC |
+			WL3501_GCR_ENECINT));
+
+	wl3501_outb(new, this->base_addr + WL3501_NIC_GCR);
+	return old & WL3501_GCR_ENECINT;
+}
+
+/**
+ * wl3501_unblock_interrupt - Enable interrupt from SUTRO
+ * @this - card
+ *
+ * Enable interrupt from SUTRO. (i.e. SUTRO can interrupt the HOST)
+ * Return: 1 if interrupt is originally enabled
+ */
+static int wl3501_unblock_interrupt(struct wl3501_card *this)
+{
+	u8 old = inb(this->base_addr + WL3501_NIC_GCR);
+	u8 new = (old & ~(WL3501_GCR_ECINT | WL3501_GCR_INT2EC)) |
+		  WL3501_GCR_ENECINT;
+
+	wl3501_outb(new, this->base_addr + WL3501_NIC_GCR);
+	return old & WL3501_GCR_ENECINT;
+}
+
+/**
+ * wl3501_receive - Receive data from Receive Queue.
+ *
+ * Receive data from Receive Queue.
+ *
+ * @this: card
+ * @bf: address of host
+ * @size: size of buffer.
+ */
+static u16 wl3501_receive(struct wl3501_card *this, u8 *bf, u16 size)
+{
+	u16 next_addr, next_addr1;
+	u8 *data = bf + 12;
+
+	size -= 12;
+	wl3501_get_from_wla(this, this->start_seg + 2,
+			    &next_addr, sizeof(next_addr));
+	if (size > WL3501_BLKSZ - sizeof(struct wl3501_rx_hdr)) {
+		wl3501_get_from_wla(this,
+				    this->start_seg +
+					sizeof(struct wl3501_rx_hdr), data,
+				    WL3501_BLKSZ -
+					sizeof(struct wl3501_rx_hdr));
+		size -= WL3501_BLKSZ - sizeof(struct wl3501_rx_hdr);
+		data += WL3501_BLKSZ - sizeof(struct wl3501_rx_hdr);
+	} else {
+		wl3501_get_from_wla(this,
+				    this->start_seg +
+					sizeof(struct wl3501_rx_hdr),
+				    data, size);
+		size = 0;
+	}
+	while (size > 0) {
+		if (size > WL3501_BLKSZ - 5) {
+			wl3501_get_from_wla(this, next_addr + 5, data,
+					    WL3501_BLKSZ - 5);
+			size -= WL3501_BLKSZ - 5;
+			data += WL3501_BLKSZ - 5;
+			wl3501_get_from_wla(this, next_addr + 2, &next_addr1,
+					    sizeof(next_addr1));
+			next_addr = next_addr1;
+		} else {
+			wl3501_get_from_wla(this, next_addr + 5, data, size);
+			size = 0;
+		}
+	}
+	return 0;
+}
+
+static void wl3501_esbq_req_free(struct wl3501_card *this)
+{
+	u8 tmp;
+	u16 addr;
+
+	if (this->esbq_req_head == this->esbq_req_tail)
+		goto out;
+	wl3501_get_from_wla(this, this->esbq_req_tail + 3, &tmp, sizeof(tmp));
+	if (!(tmp & 0x80))
+		goto out;
+	wl3501_get_from_wla(this, this->esbq_req_tail, &addr, sizeof(addr));
+	wl3501_free_tx_buffer(this, addr);
+	this->esbq_req_tail += 4;
+	if (this->esbq_req_tail >= this->esbq_req_end)
+		this->esbq_req_tail = this->esbq_req_start;
+out:
+	return;
+}
+
+static int wl3501_esbq_confirm(struct wl3501_card *this)
+{
+	u8 tmp;
+
+	wl3501_get_from_wla(this, this->esbq_confirm + 3, &tmp, sizeof(tmp));
+	return tmp & 0x80;
+}
+
+static void wl3501_online(struct net_device *dev)
+{
+	struct wl3501_card *this = dev->priv;
+
+	printk(KERN_INFO "%s: Wireless LAN online. BSSID: "
+	       "%02X %02X %02X %02X %02X %02X\n", dev->name,
+	       this->bssid[0], this->bssid[1], this->bssid[2],
+	       this->bssid[3], this->bssid[4], this->bssid[5]);
+	netif_wake_queue(dev);
+}
+
+static void wl3501_esbq_confirm_done(struct wl3501_card *this)
+{
+	u8 tmp = 0;
+
+	wl3501_set_to_wla(this, this->esbq_confirm + 3, &tmp, sizeof(tmp));
+	this->esbq_confirm += 4;
+	if (this->esbq_confirm >= this->esbq_confirm_end)
+		this->esbq_confirm = this->esbq_confirm_start;
+}
+
+static int wl3501_mgmt_auth(struct wl3501_card *this)
+{
+	struct wl3501_auth_req sig = {
+		.sig_id	 = WL3501_SIG_AUTH_REQ,
+		.type	 = WL3501_SYS_TYPE_OPEN,
+		.timeout = 1000,
+	};
+
+	dprintk(3, "entry");
+	memcpy(sig.mac_addr, this->bssid, ETH_ALEN);
+	return wl3501_esbq_exec(this, &sig, sizeof(sig));
+}
+
+static int wl3501_mgmt_association(struct wl3501_card *this)
+{
+	struct wl3501_assoc_req sig = {
+		.sig_id		 = WL3501_SIG_ASSOC_REQ,
+		.timeout	 = 1000,
+		.listen_interval = 5,
+		.cap_info	 = this->cap_info,
+	};
+
+	dprintk(3, "entry");
+	memcpy(sig.mac_addr, this->bssid, ETH_ALEN);
+	return wl3501_esbq_exec(this, &sig, sizeof(sig));
+}
+
+static void wl3501_mgmt_join_confirm(struct net_device *dev, u16 addr)
+{
+	struct wl3501_card *this = dev->priv;
+	struct wl3501_join_confirm sig;
+
+	dprintk(3, "entry");
+	wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
+	if (sig.status == WL3501_STATUS_SUCCESS) {
+		if (this->net_type == IW_MODE_INFRA) {
+			if (this->join_sta_bss < this->bss_cnt) {
+				const int i = this->join_sta_bss;
+				memcpy(this->bssid,
+				       this->bss_set[i].bssid, ETH_ALEN);
+				this->chan = this->bss_set[i].phy_pset[2];
+				memcpy(this->keep_essid, this->bss_set[i].ssid,
+				       WL3501_ESSID_MAX_LEN);
+				wl3501_mgmt_auth(this);
+			}
+		} else {
+			const int i = this->join_sta_bss;
+			memcpy(this->bssid, this->bss_set[i].bssid, ETH_ALEN);
+			this->chan = this->bss_set[i].phy_pset[2];
+			memcpy(this->keep_essid,
+			       this->bss_set[i].ssid, WL3501_ESSID_MAX_LEN);
+			wl3501_online(dev);
+		}
+	} else {
+		int i;
+		this->join_sta_bss++;
+		for (i = this->join_sta_bss; i < this->bss_cnt; i++)
+			if (!wl3501_mgmt_join(this, i))
+				break;
+		this->join_sta_bss = i;
+		if (this->join_sta_bss == this->bss_cnt) {
+			if (this->net_type == IW_MODE_INFRA)
+				wl3501_mgmt_scan(this, 100);
+			else {
+				this->adhoc_times++;
+				if (this->adhoc_times > WL3501_MAX_ADHOC_TRIES)
+					wl3501_mgmt_start(this);
+				else
+					wl3501_mgmt_scan(this, 100);
+			}
+		}
+	}
+}
+
+static inline void wl3501_alarm_interrupt(struct net_device *dev,
+					  struct wl3501_card *this)
+{
+	if (this->net_type == IW_MODE_INFRA) {
+		printk(KERN_INFO "Wireless LAN offline\n");
+		netif_stop_queue(dev);
+		wl3501_mgmt_resync(this);
+	}
+}
+
+static inline void wl3501_md_confirm_interrupt(struct net_device *dev,
+					       struct wl3501_card *this,
+					       u16 addr)
+{
+	struct wl3501_md_confirm sig;
+
+	dprintk(3, "entry");
+	wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
+	wl3501_free_tx_buffer(this, sig.data);
+	if (netif_queue_stopped(dev))
+		netif_wake_queue(dev);
+}
+
+static inline void wl3501_md_ind_interrupt(struct net_device *dev,
+					   struct wl3501_card *this, u16 addr)
+{
+	struct wl3501_md_ind sig;
+	struct sk_buff *skb;
+	u8 rssi, addr4[ETH_ALEN];
+	u16 pkt_len;
+
+	wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
+	this->start_seg = sig.data;
+	wl3501_get_from_wla(this,
+			    sig.data + offsetof(struct wl3501_rx_hdr, rssi),
+			    &rssi, sizeof(rssi));
+	this->rssi = rssi <= 63 ? (rssi * 100) / 64 : 255;
+
+	wl3501_get_from_wla(this,
+			    sig.data +
+				offsetof(struct wl3501_rx_hdr, addr4),
+			    &addr4, sizeof(addr4));
+	if (!(addr4[0] == 0xAA && addr4[1] == 0xAA &&
+	      addr4[2] == 0x03 && addr4[4] == 0x00)) {
+		printk(KERN_INFO "Insupported packet type!\n");
+		return;
+	}
+	pkt_len = sig.size + 12 - 24 - 4 - 6;
+
+	skb = dev_alloc_skb(pkt_len + 5);
+
+	if (!skb) {
+		printk(KERN_WARNING "%s: Can't alloc a sk_buff of size %d.\n",
+		       dev->name, pkt_len);
+		this->stats.rx_dropped++;
+	} else {
+		skb->dev = dev;
+		skb_reserve(skb, 2); /* IP headers on 16 bytes boundaries */
+		eth_copy_and_sum(skb, (unsigned char *)&sig.daddr, 12, 0);
+		wl3501_receive(this, skb->data, pkt_len);
+		skb_put(skb, pkt_len);
+		skb->protocol	= eth_type_trans(skb, dev);
+		dev->last_rx	= jiffies;
+		this->stats.rx_packets++;
+		this->stats.rx_bytes += skb->len;
+		netif_rx(skb);
+	}
+}
+
+static inline void wl3501_get_confirm_interrupt(struct wl3501_card *this,
+						u16 addr, void *sig, int size)
+{
+	dprintk(3, "entry");
+	wl3501_get_from_wla(this, addr, &this->sig_get_confirm,
+			    sizeof(this->sig_get_confirm));
+	wake_up(&this->wait);
+}
+
+static inline void wl3501_start_confirm_interrupt(struct net_device *dev,
+						  struct wl3501_card *this,
+						  u16 addr)
+{
+	struct wl3501_start_confirm sig;
+
+	dprintk(3, "entry");
+	wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
+	if (sig.status == WL3501_STATUS_SUCCESS)
+		netif_wake_queue(dev);
+}
+
+static inline void wl3501_assoc_confirm_interrupt(struct net_device *dev,
+						  u16 addr)
+{
+	struct wl3501_card *this = dev->priv;
+	struct wl3501_assoc_confirm sig;
+
+	dprintk(3, "entry");
+	wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
+
+	if (sig.status == WL3501_STATUS_SUCCESS)
+		wl3501_online(dev);
+}
+
+static inline void wl3501_auth_confirm_interrupt(struct wl3501_card *this,
+						 u16 addr)
+{
+	struct wl3501_auth_confirm sig;
+
+	dprintk(3, "entry");
+	wl3501_get_from_wla(this, addr, &sig, sizeof(sig));
+
+	if (sig.status == WL3501_STATUS_SUCCESS)
+		wl3501_mgmt_association(this);
+	else
+		wl3501_mgmt_resync(this);
+}
+
+static inline void wl3501_rx_interrupt(struct net_device *dev)
+{
+	int morepkts;
+	u16 addr;
+	u8 sig_id;
+	struct wl3501_card *this = dev->priv;
+
+	dprintk(3, "entry");
+loop:
+	morepkts = 0;
+	if (!wl3501_esbq_confirm(this))
+		goto free;
+	wl3501_get_from_wla(this, this->esbq_confirm, &addr, sizeof(addr));
+	wl3501_get_from_wla(this, addr + 2, &sig_id, sizeof(sig_id));
+
+	switch (sig_id) {
+	case WL3501_SIG_DEAUTH_IND:
+	case WL3501_SIG_DISASSOC_IND:
+	case WL3501_SIG_ALARM:
+		wl3501_alarm_interrupt(dev, this);
+		break;
+	case WL3501_SIG_MD_CONFIRM:
+		wl3501_md_confirm_interrupt(dev, this, addr);
+		break;
+	case WL3501_SIG_MD_IND:
+		wl3501_md_ind_interrupt(dev, this, addr);
+		break;
+	case WL3501_SIG_GET_CONFIRM:
+		wl3501_get_confirm_interrupt(this, addr,
+					     &this->sig_get_confirm,
+					     sizeof(this->sig_get_confirm));
+		break;
+	case WL3501_SIG_PWR_MGMT_CONFIRM:
+		wl3501_get_confirm_interrupt(this, addr,
+					     &this->sig_pwr_mgmt_confirm,
+					    sizeof(this->sig_pwr_mgmt_confirm));
+		break;
+	case WL3501_SIG_START_CONFIRM:
+		wl3501_start_confirm_interrupt(dev, this, addr);
+		break;
+	case WL3501_SIG_SCAN_CONFIRM:
+		wl3501_mgmt_scan_confirm(this, addr);
+		break;
+	case WL3501_SIG_JOIN_CONFIRM:
+		wl3501_mgmt_join_confirm(dev, addr);
+		break;
+	case WL3501_SIG_ASSOC_CONFIRM:
+		wl3501_assoc_confirm_interrupt(dev, addr);
+		break;
+	case WL3501_SIG_AUTH_CONFIRM:
+		wl3501_auth_confirm_interrupt(this, addr);
+		break;
+	case WL3501_SIG_RESYNC_CONFIRM:
+		wl3501_mgmt_resync(this); /* FIXME: should be resync_confirm */
+		break;
+	}
+	wl3501_esbq_confirm_done(this);
+	morepkts = 1;
+	/* free request if necessary */
+free:
+	wl3501_esbq_req_free(this);
+	if (morepkts)
+		goto loop;
+}
+
+static inline void wl3501_ack_interrupt(struct wl3501_card *this)
+{
+	wl3501_outb(WL3501_GCR_ECINT, this->base_addr + WL3501_NIC_GCR);
+}
+
+/**
+ * wl3501_interrupt - Hardware interrupt from card.
+ * @irq - Interrupt number
+ * @dev_id - net_device
+ * @regs - registers
+ *
+ * We must acknowledge the interrupt as soon as possible, and block the
+ * interrupt from the same card immediately to prevent re-entry.
+ *
+ * Before accessing the Control_Status_Block, we must lock SUTRO first.
+ * On the other hand, to prevent SUTRO from malfunctioning, we must
+ * unlock the SUTRO as soon as possible.
+ */
+static irqreturn_t wl3501_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+{
+	struct net_device *dev = (struct net_device *)dev_id;
+	struct wl3501_card *this;
+	int handled = 1;
+
+	if (!dev)
+		goto unknown;
+	this = dev->priv;
+	spin_lock(&this->lock);
+	wl3501_ack_interrupt(this);
+	wl3501_block_interrupt(this);
+	wl3501_rx_interrupt(dev);
+	wl3501_unblock_interrupt(this);
+	spin_unlock(&this->lock);
+out:
+	return IRQ_RETVAL(handled);
+unknown:
+	handled = 0;
+	printk(KERN_ERR "%s: irq %d for unknown device.\n", __FUNCTION__, irq);
+	goto out;
+}
+
+static int wl3501_reset_board(struct wl3501_card *this)
+{
+	u8 tmp = 0;
+	int i, rc = 0;
+
+	/* Coreset */
+	wl3501_outb_p(WL3501_GCR_CORESET, this->base_addr + WL3501_NIC_GCR);
+	wl3501_outb_p(0, this->base_addr + WL3501_NIC_GCR);
+	wl3501_outb_p(WL3501_GCR_CORESET, this->base_addr + WL3501_NIC_GCR);
+
+	/* Reset SRAM 0x480 to zero */
+	wl3501_set_to_wla(this, 0x480, &tmp, sizeof(tmp));
+
+	/* Start up */
+	wl3501_outb_p(0, this->base_addr + WL3501_NIC_GCR);
+
+	WL3501_NOPLOOP(1024 * 50);
+
+	wl3501_unblock_interrupt(this);	/* acme: was commented */
+
+	/* Polling Self_Test_Status */
+	for (i = 0; i < 10000; i++) {
+		wl3501_get_from_wla(this, 0x480, &tmp, sizeof(tmp));
+
+		if (tmp == 'W') {
+			/* firmware complete all test successfully */
+			tmp = 'A';
+			wl3501_set_to_wla(this, 0x480, &tmp, sizeof(tmp));
+			goto out;
+		}
+		WL3501_NOPLOOP(10);
+	}
+	printk(KERN_WARNING "%s: failed to reset the board!\n", __FUNCTION__);
+	rc = -ENODEV;
+out:
+	return rc;
+}
+
+static int wl3501_init_firmware(struct wl3501_card *this)
+{
+	u16 ptr, next;
+	int rc = wl3501_reset_board(this);
+
+	if (rc)
+		goto fail;
+	this->card_name[0] = '\0';
+	wl3501_get_from_wla(this, 0x1a00,
+			    this->card_name, sizeof(this->card_name));
+	this->card_name[sizeof(this->card_name) - 1] = '\0';
+	this->firmware_date[0] = '\0';
+	wl3501_get_from_wla(this, 0x1a40,
+			    this->firmware_date, sizeof(this->firmware_date));
+	this->firmware_date[sizeof(this->firmware_date) - 1] = '\0';
+	/* Switch to SRAM Page 0 */
+	wl3501_switch_page(this, WL3501_BSS_SPAGE0);
+	/* Read parameter from card */
+	wl3501_get_from_wla(this, 0x482, &this->esbq_req_start, 2);
+	wl3501_get_from_wla(this, 0x486, &this->esbq_req_end, 2);
+	wl3501_get_from_wla(this, 0x488, &this->esbq_confirm_start, 2);
+	wl3501_get_from_wla(this, 0x48c, &this->esbq_confirm_end, 2);
+	wl3501_get_from_wla(this, 0x48e, &this->tx_buffer_head, 2);
+	wl3501_get_from_wla(this, 0x492, &this->tx_buffer_size, 2);
+	this->esbq_req_tail	= this->esbq_req_head = this->esbq_req_start;
+	this->esbq_req_end     += this->esbq_req_start;
+	this->esbq_confirm	= this->esbq_confirm_start;
+	this->esbq_confirm_end += this->esbq_confirm_start;
+	/* Initial Tx Buffer */
+	this->tx_buffer_cnt = 1;
+	ptr = this->tx_buffer_head;
+	next = ptr + WL3501_BLKSZ;
+	while ((next - this->tx_buffer_head) < this->tx_buffer_size) {
+		this->tx_buffer_cnt++;
+		wl3501_set_to_wla(this, ptr, &next, sizeof(next));
+		ptr = next;
+		next = ptr + WL3501_BLKSZ;
+	}
+	rc = 0;
+	next = 0;
+	wl3501_set_to_wla(this, ptr, &next, sizeof(next));
+	this->tx_buffer_tail = ptr;
+out:
+	return rc;
+fail:
+	printk(KERN_WARNING "%s: failed!\n", __FUNCTION__);
+	goto out;
+}
+
+static int wl3501_close(struct net_device *dev)
+{
+	struct wl3501_card *this = dev->priv;
+	int rc = -ENODEV;
+	unsigned long flags;
+	dev_link_t *link;
+
+	spin_lock_irqsave(&this->lock, flags);
+	/* Check if the device is in wl3501_dev_list */
+	for (link = wl3501_dev_list; link; link = link->next)
+		if (link->priv == dev)
+			break;
+	if (!link)
+		goto out;
+	link->open--;
+
+	/* Stop wl3501_hard_start_xmit() from now on */
+	netif_stop_queue(dev);
+	wl3501_ack_interrupt(this);
+
+	/* Mask interrupts from the SUTRO */
+	wl3501_block_interrupt(this);
+
+	if (link->state & DEV_STALE_CONFIG) {
+		link->release.expires = jiffies + WL3501_RELEASE_TIMEOUT;
+		link->state |= DEV_RELEASE_PENDING;
+		add_timer(&link->release);
+	}
+	rc = 0;
+	printk(KERN_INFO "%s: WL3501 closed\n", dev->name);
+out:
+	spin_unlock_irqrestore(&this->lock, flags);
+	return rc;
+}
+
+/**
+ * wl3501_reset - Reset the SUTRO.
+ * @dev - network device
+ *
+ * It is almost the same as wl3501_open(). In fact, we may just wl3501_close()
+ * and wl3501_open() again, but I wouldn't like to free_irq() when the driver
+ * is running. It seems to be dangerous.
+ */
+static int wl3501_reset(struct net_device *dev)
+{
+	struct wl3501_card *this = dev->priv;
+	int rc = -ENODEV;
+
+	wl3501_block_interrupt(this);
+
+	if (wl3501_init_firmware(this)) {
+		printk(KERN_WARNING "%s: Can't initialize Firmware!\n",
+		       dev->name);
+		/* Free IRQ, and mark IRQ as unused */
+		free_irq(dev->irq, dev);
+		goto out;
+	}
+
+	/*
+	 * Queue has to be started only when the Card is Started
+	 */
+	netif_stop_queue(dev);
+	this->adhoc_times = 0;
+	wl3501_ack_interrupt(this);
+	wl3501_unblock_interrupt(this);
+	wl3501_mgmt_scan(this, 100);
+	dprintk(1, "%s: device reset", dev->name);
+	rc = 0;
+out:
+	return rc;
+}
+
+static void wl3501_tx_timeout(struct net_device *dev)
+{
+	struct wl3501_card *this = dev->priv;
+	struct net_device_stats *stats = &this->stats;
+	unsigned long flags;
+	int rc;
+
+	stats->tx_errors++;
+	spin_lock_irqsave(&this->lock, flags);
+	rc = wl3501_reset(dev);
+	spin_unlock_irqrestore(&this->lock, flags);
+	if (rc)
+		printk(KERN_ERR "%s: Error %d resetting card on Tx timeout!\n",
+		       dev->name, rc);
+	else {
+		dev->trans_start = jiffies;
+		netif_wake_queue(dev);
+	}
+}
+
+/*
+ * Return : 0 - OK
+ *	    1 - Could not transmit (dev_queue_xmit will queue it)
+ *		and try to sent it later
+ */
+static int wl3501_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+	int enabled, rc;
+	struct wl3501_card *this = dev->priv;
+	unsigned long flags;
+
+	spin_lock_irqsave(&this->lock, flags);
+	enabled = wl3501_block_interrupt(this);
+	dev->trans_start = jiffies;
+	rc = wl3501_send_pkt(this, skb->data, skb->len);
+	if (enabled)
+		wl3501_unblock_interrupt(this);
+	if (rc) {
+		++this->stats.tx_dropped;
+		netif_stop_queue(dev);
+	} else {
+		++this->stats.tx_packets;
+		this->stats.tx_bytes += skb->len;
+		kfree_skb(skb);
+
+		if (this->tx_buffer_cnt < 2)
+			netif_stop_queue(dev);
+	}
+	spin_unlock_irqrestore(&this->lock, flags);
+	return rc;
+}
+
+static int wl3501_open(struct net_device *dev)
+{
+	int rc = -ENODEV;
+	struct wl3501_card *this = dev->priv;
+	unsigned long flags;
+	dev_link_t *link;
+
+	spin_lock_irqsave(&this->lock, flags);
+	/* Check if the device is in wl3501_dev_list */
+	for (link = wl3501_dev_list; link; link = link->next)
+		if (link->priv == dev)
+			break;
+	if (!DEV_OK(link))
+		goto out;
+	netif_device_attach(dev);
+	link->open++;
+
+	/* Initial WL3501 firmware */
+	dprintk(1, "%s: Initialize WL3501 firmware...", dev->name);
+	if (wl3501_init_firmware(this))
+		goto fail;
+	/* Initial device variables */
+	this->adhoc_times = 0;
+	/* Acknowledge Interrupt, for cleaning last state */
+	wl3501_ack_interrupt(this);
+
+	/* Enable interrupt from card after all */
+	wl3501_unblock_interrupt(this);
+	wl3501_mgmt_scan(this, 100);
+	rc = 0;
+	dprintk(1, "%s: WL3501 opened", dev->name);
+	printk(KERN_INFO "%s: Card Name: %s\n"
+			 "%s: Firmware Date: %s\n",
+			 dev->name, this->card_name,
+			 dev->name, this->firmware_date);
+out:
+	spin_unlock_irqrestore(&this->lock, flags);
+	return rc;
+fail:
+	printk(KERN_WARNING "%s: Can't initialize firmware!\n", dev->name);
+	goto out;
+}
+
+/**
+ * wl3501_init - "initialize" board
+ * @dev - network device
+ *
+ * We never need to do anything when a wl3501 device is "initialized" by the net
+ * software, because we only register already-found cards.
+ */
+static int wl3501_init(struct net_device *dev)
+{
+	return 0;
+}
+
+struct net_device_stats *wl3501_get_stats(struct net_device *dev)
+{
+	struct wl3501_card *this = dev->priv;
+
+	return &this->stats;
+}
+
+struct iw_statistics *wl3501_get_wireless_stats(struct net_device *dev)
+{
+	struct wl3501_card *this = dev->priv;
+	struct iw_statistics *wstats = &this->wstats;
+	u32 value; /* size checked: it is u32 */
+
+	memset(wstats, 0, sizeof(*wstats));
+	wstats->status = netif_running(dev);
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_WEP_ICV_ERROR_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.code += value;
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_WEP_UNDECRYPTABLE_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.code += value;
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_WEP_EXCLUDED_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.code += value;
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_RETRY_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.retries	= value;
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_FAILED_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.misc += value;
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_RTS_FAILURE_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.misc += value;
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_ACK_FAILURE_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.misc += value;
+	if (!wl3501_get_mib_value(this, WL3501_MIB_ATTR_FRAME_DUPLICATE_COUNT,
+				  &value, sizeof(value)))
+		wstats->discard.misc += value;
+	return wstats;
+}
+
+static inline int wl3501_ethtool_ioctl(struct net_device *dev, void *uaddr)
+{
+	u32 ethcmd;
+	int rc = -EFAULT;
+
+	if (copy_from_user(&ethcmd, uaddr, sizeof(ethcmd)))
+		goto out;
+
+	switch (ethcmd) {
+	case ETHTOOL_GDRVINFO: {
+		struct ethtool_drvinfo info = { .cmd = ETHTOOL_GDRVINFO, };
+
+		strlcpy(info.driver, wl3501_dev_info, sizeof(info.driver));
+		rc = copy_to_user(uaddr, &info, sizeof(info)) ? -EFAULT : 1;
+	}
+	default:
+		rc = -EOPNOTSUPP;
+		break;
+	}
+out:
+	return rc;
+}
+
+/**
+ * wl3501_ioctl - Perform IOCTL call functions
+ * @dev - network device
+ * @ifreq - request
+ * @cmd - command
+ *
+ * Perform IOCTL call functions here. Some are privileged operations and the
+ * effective uid is checked in those cases.
+ *
+ * This part is optional. Needed only if you want to run wlu (unix version).
+ *
+ * CAUTION: To prevent interrupted by wl3501_interrupt() and timer-based
+ * wl3501_hard_start_xmit() from other interrupts, this should be run
+ * single-threaded.
+ */
+static int wl3501_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+{
+	int rc = -ENODEV;
+
+	if (netif_device_present(dev)) {
+		rc = -EOPNOTSUPP;
+		if (cmd == SIOCETHTOOL)
+			rc = wl3501_ethtool_ioctl(dev, (void *)rq->ifr_data);
+	}
+	return rc;
+}
+
+/**
+ * wl3501_detach - deletes a driver "instance"
+ * @link - FILL_IN
+ *
+ * This deletes a driver "instance". The device is de-registered with Card
+ * Services. If it has been released, all local data structures are freed.
+ * Otherwise, the structures will be freed when the device is released.
+ */
+static void wl3501_detach(dev_link_t *link)
+{
+	dev_link_t **linkp;
+
+	/* Locate device structure */
+	for (linkp = &wl3501_dev_list; *linkp; linkp = &(*linkp)->next)
+		if (*linkp == link)
+			break;
+	if (!*linkp)
+		goto out;
+
+	/* If the device is currently configured and active, we won't actually
+	 * delete it yet.  Instead, it is marked so that when the release()
+	 * function is called, that will trigger a proper detach(). */
+
+	if (link->state & DEV_CONFIG) {
+#ifdef PCMCIA_DEBUG
+		printk(KERN_DEBUG "wl3501_cs: detach postponed, '%s' "
+		       "still locked\n", link->dev->dev_name);
+#endif
+		link->state |= DEV_STALE_LINK;
+		goto out;
+	}
+
+	/* Break the link with Card Services */
+	if (link->handle)
+		CardServices(DeregisterClient, link->handle);
+
+	/* Unlink device structure, free pieces */
+	*linkp = link->next;
+
+	if (link->priv)
+		kfree(link->priv);
+	kfree(link);
+out:
+	return;
+}
+
+/**
+ * wl3501_flush_stale_links - Remove zombie instances
+ *
+ * Remove zombie instances (card removed, detach pending)
+ */
+static void wl3501_flush_stale_links(void)
+{
+	dev_link_t *link, *next;
+
+	for (link = wl3501_dev_list; link; link = next) {
+		next = link->next;
+		if (link->state & DEV_STALE_LINK)
+			wl3501_detach(link);
+	}
+}
+
+static int wl3501_get_name(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	strlcpy(wrqu->name, "IEEE 802.11-DS", sizeof(wrqu->name));
+	return 0;
+}
+
+static int wl3501_set_freq(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+	int channel = wrqu->freq.m;
+	int rc = -EINVAL;
+
+	if (iw_valid_channel(this->reg_domain, channel)) {
+		this->chan = channel;
+		rc = wl3501_reset(dev);
+	}
+	return rc;
+}
+
+static int wl3501_get_freq(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+
+	wrqu->freq.m = wl3501_chan2freq[this->chan - 1] * 100000;
+	wrqu->freq.e = 1;
+	return 0;
+}
+
+static int wl3501_set_mode(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	int rc = -EINVAL;
+
+	if (wrqu->mode == IW_MODE_INFRA ||
+	    wrqu->mode == IW_MODE_ADHOC ||
+	    wrqu->mode == IW_MODE_AUTO) {
+		struct wl3501_card *this = dev->priv;
+
+		this->net_type = wrqu->mode;
+		rc = wl3501_reset(dev);
+	}
+	return rc;
+}
+
+static int wl3501_get_mode(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+
+	wrqu->mode = this->net_type;
+	return 0;
+}
+
+static int wl3501_get_sens(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+
+	wrqu->sens.value = this->rssi;
+	wrqu->sens.disabled = !wrqu->sens.value;
+	wrqu->sens.fixed = 1;
+	return 0;
+}
+
+static int wl3501_get_range(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	struct iw_range *range = (struct iw_range *)extra;
+
+	/* Set the length (very important for backward compatibility) */
+	wrqu->data.length = sizeof(*range);
+
+	/* Set all the info we don't care or don't know about to zero */
+	memset(range, 0, sizeof(*range));
+
+	/* Set the Wireless Extension versions */
+	range->we_version_compiled	= WIRELESS_EXT;
+	range->we_version_source	= 1;
+	range->throughput		= 2 * 1000 * 1000;     /* ~2 Mb/s */
+	/* FIXME: study the code to fill in more fields... */
+	return 0;
+}
+
+static int wl3501_set_wap(struct net_device *dev, struct iw_request_info *info,
+			  union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+	static const u8 bcast[ETH_ALEN] = { 255, 255, 255, 255, 255, 255 };
+	int rc = -EINVAL;
+
+	/* FIXME: we support other ARPHRDs...*/
+	if (wrqu->ap_addr.sa_family != ARPHRD_ETHER)
+		goto out;
+	if (!memcmp(bcast, wrqu->ap_addr.sa_data, ETH_ALEN)) {
+		/* FIXME: rescan? */
+	} else
+		memcpy(this->bssid, wrqu->ap_addr.sa_data, ETH_ALEN);
+		/* FIXME: rescan? deassoc & scan? */
+	rc = 0;
+out:
+	return rc;
+}
+
+static int wl3501_get_wap(struct net_device *dev, struct iw_request_info *info,
+			  union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+
+	wrqu->ap_addr.sa_family = ARPHRD_ETHER;
+	memcpy(wrqu->ap_addr.sa_data, this->bssid, ETH_ALEN);
+	return 0;
+}
+
+static int wl3501_set_essid(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+	int rc = 0;
+
+	if (wrqu->data.flags) {
+		strlcpy(this->essid + 2, extra, min_t(u16, wrqu->data.length,
+						      IW_ESSID_MAX_SIZE));
+		rc = wl3501_reset(dev);
+	}
+	return rc;
+}
+
+static int wl3501_get_essid(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+	unsigned long flags;
+
+	spin_lock_irqsave(&this->lock, flags);
+	wrqu->essid.flags  = 1;
+	wrqu->essid.length = IW_ESSID_MAX_SIZE;
+	strlcpy(extra, this->essid + 2, IW_ESSID_MAX_SIZE);
+	spin_unlock_irqrestore(&this->lock, flags);
+	return 0;
+}
+
+static int wl3501_set_nick(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+
+	if (wrqu->data.length > sizeof(this->nick))
+		return -E2BIG;
+	strlcpy(this->nick, extra, wrqu->data.length);
+	return 0;
+}
+
+static int wl3501_get_nick(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	struct wl3501_card *this = dev->priv;
+
+	strlcpy(extra, this->nick, 32);
+	wrqu->data.length = strlen(extra);
+	return 0;
+}
+
+static int wl3501_get_rate(struct net_device *dev, struct iw_request_info *info,
+			   union iwreq_data *wrqu, char *extra)
+{
+	/*
+	 * FIXME: have to see from where to get this info, perhaps this card
+	 * works at 1 Mbit/s too... for now leave at 2 Mbit/s that is the most
+	 * common with the Planet Access Points. -acme
+	 */
+	wrqu->bitrate.value = 2000000;
+	wrqu->bitrate.fixed = 1;
+	return 0;
+}
+
+static int wl3501_get_rts_threshold(struct net_device *dev,
+				    struct iw_request_info *info,
+				    union iwreq_data *wrqu, char *extra)
+{
+	u16 threshold; /* size checked: it is u16 */
+	struct wl3501_card *this = dev->priv;
+	int rc = wl3501_get_mib_value(this, WL3501_MIB_ATTR_RTS_THRESHOLD,
+				      &threshold, sizeof(threshold));
+	if (!rc) {
+		wrqu->rts.value = threshold;
+		wrqu->rts.disabled = threshold >= 2347;
+		wrqu->rts.fixed = 1;
+	}
+	return rc;
+}
+
+static int wl3501_get_frag_threshold(struct net_device *dev,
+				     struct iw_request_info *info,
+				     union iwreq_data *wrqu, char *extra)
+{
+	u16 threshold; /* size checked: it is u16 */
+	struct wl3501_card *this = dev->priv;
+	int rc = wl3501_get_mib_value(this, WL3501_MIB_ATTR_FRAG_THRESHOLD,
+				      &threshold, sizeof(threshold));
+	if (!rc) {
+		wrqu->frag.value = threshold;
+		wrqu->frag.disabled = threshold >= 2346;
+		wrqu->frag.fixed = 1;
+	}
+	return rc;
+}
+
+static int wl3501_get_txpow(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	u16 txpow;
+	struct wl3501_card *this = dev->priv;
+	int rc = wl3501_get_mib_value(this,
+				      WL3501_MIB_ATTR_CURRENT_TX_PWR_LEVEL,
+				      &txpow, sizeof(txpow));
+	if (!rc) {
+		wrqu->txpower.value = txpow;
+		wrqu->txpower.disabled = 0;
+		/*
+		 * From the MIB values I think this can be configurable,
+		 * as it lists several tx power levels -acme
+		 */
+		wrqu->txpower.fixed = 0;
+		wrqu->txpower.flags = IW_TXPOW_MWATT;
+	}
+	return rc;
+}
+
+static int wl3501_get_retry(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	u8 retry; /* size checked: it is u8 */
+	struct wl3501_card *this = dev->priv;
+	int rc = wl3501_get_mib_value(this,
+				      WL3501_MIB_ATTR_LONG_RETRY_LIMIT,
+				      &retry, sizeof(retry));
+	if (rc)
+		goto out;
+	if (wrqu->retry.flags & IW_RETRY_MAX) {
+		wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
+		goto set_value;
+	}
+	rc = wl3501_get_mib_value(this, WL3501_MIB_ATTR_SHORT_RETRY_LIMIT,
+				  &retry, sizeof(retry));
+	if (rc)
+		goto out;
+	wrqu->retry.flags = IW_RETRY_LIMIT | IW_RETRY_MIN;
+set_value:
+	wrqu->retry.value = retry;
+	wrqu->retry.disabled = 0;
+out:
+	return rc;
+}
+
+static int wl3501_get_encode(struct net_device *dev,
+			     struct iw_request_info *info,
+			     union iwreq_data *wrqu, char *extra)
+{
+	u8 implemented, restricted, keys[100], len_keys, tocopy;
+	struct wl3501_card *this = dev->priv;
+	int rc = wl3501_get_mib_value(this,
+				      WL3501_MIB_ATTR_PRIV_OPT_IMPLEMENTED,
+				      &implemented, sizeof(implemented));
+	if (rc)
+		goto out;
+	if (!implemented) {
+		wrqu->encoding.flags = IW_ENCODE_DISABLED;
+		goto out;
+	}
+	rc = wl3501_get_mib_value(this, WL3501_MIB_ATTR_EXCLUDE_UNENCRYPTED,
+				  &restricted, sizeof(restricted));
+	if (rc)
+		goto out;
+	wrqu->encoding.flags = restricted ? IW_ENCODE_RESTRICTED :
+					    IW_ENCODE_OPEN;
+	rc = wl3501_get_mib_value(this, WL3501_MIB_ATTR_WEP_KEY_MAPPINGS_LEN,
+				  &len_keys, sizeof(len_keys));
+	if (rc)
+		goto out;
+	rc = wl3501_get_mib_value(this, WL3501_MIB_ATTR_WEP_KEY_MAPPINGS,
+				  keys, len_keys);
+	if (rc)
+		goto out;
+	tocopy = min_t(u8, len_keys, wrqu->encoding.length);
+	tocopy = min_t(u8, tocopy, 100);
+	wrqu->encoding.length = tocopy;
+	memset(extra, 0, tocopy);
+	memcpy(extra, keys, tocopy);
+out:
+	return rc;
+}
+
+static int wl3501_get_power(struct net_device *dev,
+			    struct iw_request_info *info,
+			    union iwreq_data *wrqu, char *extra)
+{
+	u8 pwr_state;
+	struct wl3501_card *this = dev->priv;
+	int rc = wl3501_get_mib_value(this,
+				      WL3501_MIB_ATTR_CURRENT_PWR_STATE,
+				      &pwr_state, sizeof(pwr_state));
+	if (rc)
+		goto out;
+	wrqu->power.disabled = !pwr_state;
+	wrqu->power.flags = IW_POWER_ON;
+out:
+	return rc;
+}
+
+static const iw_handler	wl3501_handler[] = {
+	[SIOCGIWNAME	- SIOCIWFIRST] = wl3501_get_name,
+	[SIOCSIWFREQ	- SIOCIWFIRST] = wl3501_set_freq,
+	[SIOCGIWFREQ	- SIOCIWFIRST] = wl3501_get_freq,
+	[SIOCSIWMODE	- SIOCIWFIRST] = wl3501_set_mode,
+	[SIOCGIWMODE	- SIOCIWFIRST] = wl3501_get_mode,
+	[SIOCGIWSENS	- SIOCIWFIRST] = wl3501_get_sens,
+	[SIOCGIWRANGE	- SIOCIWFIRST] = wl3501_get_range,
+	[SIOCSIWSPY	- SIOCIWFIRST] = iw_handler_set_spy,
+	[SIOCGIWSPY	- SIOCIWFIRST] = iw_handler_get_spy,
+	[SIOCSIWTHRSPY	- SIOCIWFIRST] = iw_handler_set_thrspy,
+	[SIOCGIWTHRSPY	- SIOCIWFIRST] = iw_handler_get_thrspy,
+	[SIOCSIWAP	- SIOCIWFIRST] = wl3501_set_wap,
+	[SIOCGIWAP	- SIOCIWFIRST] = wl3501_get_wap,
+	[SIOCSIWESSID	- SIOCIWFIRST] = wl3501_set_essid,
+	[SIOCGIWESSID	- SIOCIWFIRST] = wl3501_get_essid,
+	[SIOCSIWNICKN	- SIOCIWFIRST] = wl3501_set_nick,
+	[SIOCGIWNICKN	- SIOCIWFIRST] = wl3501_get_nick,
+	[SIOCGIWRATE	- SIOCIWFIRST] = wl3501_get_rate,
+	[SIOCGIWRTS	- SIOCIWFIRST] = wl3501_get_rts_threshold,
+	[SIOCGIWFRAG	- SIOCIWFIRST] = wl3501_get_frag_threshold,
+	[SIOCGIWTXPOW	- SIOCIWFIRST] = wl3501_get_txpow,
+	[SIOCGIWRETRY	- SIOCIWFIRST] = wl3501_get_retry,
+	[SIOCGIWENCODE	- SIOCIWFIRST] = wl3501_get_encode,
+	[SIOCGIWPOWER	- SIOCIWFIRST] = wl3501_get_power,
+};
+
+static const struct iw_handler_def wl3501_handler_def = {
+	.num_standard	= sizeof(wl3501_handler) / sizeof(iw_handler),
+	.standard	= (iw_handler *)wl3501_handler,
+	.spy_offset	= offsetof(struct wl3501_card, spy_data),
+};
+
+/**
+ * wl3501_attach - creates an "instance" of the driver
+ *
+ * Creates an "instance" of the driver, allocating local data structures for
+ * one device.  The device is registered with Card Services.
+ *
+ * The dev_link structure is initialized, but we don't actually configure the
+ * card at this point -- we wait until we receive a card insertion event.
+ */
+static dev_link_t *wl3501_attach(void)
+{
+	client_reg_t client_reg;
+	dev_link_t *link;
+	struct net_device *dev;
+	int ret, i;
+
+	wl3501_flush_stale_links();
+
+	/* Initialize the dev_link_t structure */
+	link = kmalloc(sizeof(*link), GFP_KERNEL);
+	if (!link)
+		goto out;
+	memset(link, 0, sizeof(struct dev_link_t));
+	init_timer(&link->release);
+	link->release.function	= wl3501_release;
+	link->release.data	= (unsigned long)link;
+
+	/* The io structure describes IO port mapping */
+	link->io.NumPorts1	= 16;
+	link->io.Attributes1	= IO_DATA_PATH_WIDTH_8;
+	link->io.IOAddrLines	= 5;
+
+	/* Interrupt setup */
+	link->irq.Attributes	= IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
+	link->irq.IRQInfo1	= IRQ_INFO2_VALID | IRQ_LEVEL_ID;
+	link->irq.IRQInfo2	= wl3501_irq_mask;
+	if (wl3501_irq_list[0] != -1)
+		for (i = 0; i < 4; i++)
+			link->irq.IRQInfo2 |= 1 << wl3501_irq_list[i];
+	link->irq.Handler = wl3501_interrupt;
+
+	/* General socket configuration */
+	link->conf.Attributes	= CONF_ENABLE_IRQ;
+	link->conf.Vcc		= 50;
+	link->conf.IntType	= INT_MEMORY_AND_IO;
+	link->conf.ConfigIndex	= 1;
+	link->conf.Present	= PRESENT_OPTION;
+
+	dev = alloc_etherdev(sizeof(struct wl3501_card));
+	if (!dev)
+		goto out_link;
+	dev->init		= wl3501_init;
+	dev->open		= wl3501_open;
+	dev->stop		= wl3501_close;
+	dev->hard_start_xmit	= wl3501_hard_start_xmit;
+	dev->tx_timeout		= wl3501_tx_timeout;
+	dev->watchdog_timeo	= 5 * HZ;
+	dev->get_stats		= wl3501_get_stats;
+	dev->get_wireless_stats = wl3501_get_wireless_stats;
+	dev->do_ioctl		= wl3501_ioctl;
+	dev->wireless_handlers	= (struct iw_handler_def *)&wl3501_handler_def;
+	netif_stop_queue(dev);
+	link->priv = link->irq.Instance = dev;
+
+	/* Register with Card Services */
+	link->next		 = wl3501_dev_list;
+	wl3501_dev_list		 = link;
+	client_reg.dev_info	 = &wl3501_dev_info;
+	client_reg.Attributes	 = INFO_IO_CLIENT | INFO_CARD_SHARE;
+	client_reg.EventMask	 = CS_EVENT_CARD_INSERTION |
+				   CS_EVENT_RESET_PHYSICAL |
+				   CS_EVENT_CARD_RESET |
+				   CS_EVENT_CARD_REMOVAL |
+				   CS_EVENT_PM_SUSPEND |
+				   CS_EVENT_PM_RESUME;
+	client_reg.event_handler = wl3501_event;
+	client_reg.Version	 = 0x0210;
+	client_reg.event_callback_args.client_data = link;
+	ret = CardServices(RegisterClient, &link->handle, &client_reg);
+	if (ret) {
+		cs_error(link->handle, RegisterClient, ret);
+		wl3501_detach(link);
+		link = NULL;
+	}
+out:
+	return link;
+out_link:
+	kfree(link);
+	link = NULL;
+	goto out;
+}
+
+#define CS_CHECK(fn, args...) \
+while ((last_ret = CardServices(last_fn = (fn), args)) != 0) goto cs_failed
+
+/**
+ * wl3501_config - configure the PCMCIA socket and make eth device available
+ * @link - FILL_IN
+ *
+ * wl3501_config() is scheduled to run after a CARD_INSERTION event is
+ * received, to configure the PCMCIA socket, and to make the ethernet device
+ * available to the system.
+ */
+static void wl3501_config(dev_link_t *link)
+{
+	tuple_t tuple;
+	cisparse_t parse;
+	client_handle_t handle = link->handle;
+	struct net_device *dev = link->priv;
+	int i = 0, j, last_fn, last_ret;
+	unsigned char bf[64];
+	struct wl3501_card *this;
+
+	/* This reads the card's CONFIG tuple to find its config registers. */
+	tuple.Attributes	= 0;
+	tuple.DesiredTuple	= CISTPL_CONFIG;
+	CS_CHECK(GetFirstTuple, handle, &tuple);
+	tuple.TupleData		= bf;
+	tuple.TupleDataMax	= sizeof(bf);
+	tuple.TupleOffset	= 0;
+	CS_CHECK(GetTupleData, handle, &tuple);
+	CS_CHECK(ParseTuple, handle, &tuple, &parse);
+	link->conf.ConfigBase	= parse.config.base;
+	link->conf.Present	= parse.config.rmask[0];
+
+	/* Configure card */
+	link->state |= DEV_CONFIG;
+
+	/* Try allocating IO ports.  This tries a few fixed addresses.  If you
+	 * want, you can also read the card's config table to pick addresses --
+	 * see the serial driver for an example. */
+
+	for (j = 0x280; j < 0x400; j += 0x20) {
+		/* The '^0x300' is so that we probe 0x300-0x3ff first, then
+		 * 0x200-0x2ff, and so on, because this seems safer */
+		link->io.BasePort1 = j;
+		link->io.BasePort2 = link->io.BasePort1 + 0x10;
+		i = CardServices(RequestIO, link->handle, &link->io);
+		if (i == CS_SUCCESS)
+			break;
+	}
+	if (i != CS_SUCCESS) {
+		cs_error(link->handle, RequestIO, i);
+		goto failed;
+	}
+
+	/* Now allocate an interrupt line. Note that this does not actually
+	 * assign a handler to the interrupt. */
+
+	CS_CHECK(RequestIRQ, link->handle, &link->irq);
+
+	/* This actually configures the PCMCIA socket -- setting up the I/O
+	 * windows and the interrupt mapping.  */
+
+	CS_CHECK(RequestConfiguration, link->handle, &link->conf);
+
+	dev->irq = link->irq.AssignedIRQ;
+	dev->base_addr = link->io.BasePort1;
+	if (register_netdev(dev)) {
+		printk(KERN_NOTICE "wl3501_cs: register_netdev() failed\n");
+		goto failed;
+	}
+
+	SET_MODULE_OWNER(dev);
+
+	this = dev->priv;
+	/*
+	 * At this point, the dev_node_t structure(s) should be initialized and
+	 * arranged in a linked list at link->dev.
+	 */
+	link->dev = &this->node;
+	link->state &= ~DEV_CONFIG_PENDING;
+
+	this->base_addr = dev->base_addr;
+
+	if (!wl3501_get_flash_mac_addr(this)) {
+		printk(KERN_WARNING "%s: Cant read MAC addr in flash ROM?\n",
+		       dev->name);
+		goto failed;
+	}
+	strcpy(this->node.dev_name, dev->name);
+
+	/* print probe information */
+	printk(KERN_INFO "%s: wl3501 @ 0x%3.3x, IRQ %d, MAC addr in flash ROM:",
+	       dev->name, this->base_addr, (int)dev->irq);
+	for (i = 0; i < 6; i++) {
+		dev->dev_addr[i] = ((char *)&this->mac_addr)[i];
+		printk("%c%02x", i ? ':' : ' ', dev->dev_addr[i]);
+	}
+	printk("\n");
+	/*
+	 * Initialize card parameters - added by jss
+	 */
+	this->net_type		= IW_MODE_INFRA;
+	this->bss_cnt		= 0;
+	this->join_sta_bss	= 0;
+	this->adhoc_times	= 0;
+	this->essid[0]		= 0;
+	this->essid[1]		= 3;
+	this->essid[2]		= 'A';
+	this->essid[3]		= 'N';
+	this->essid[4]		= 'Y';
+	this->card_name[0]	= '\0';
+	this->firmware_date[0]	= '\0';
+	this->rssi		= 255;
+	this->chan		= iw_default_channel(this->reg_domain);
+	strlcpy(this->nick, "Planet WL3501", sizeof(this->nick));
+	spin_lock_init(&this->lock);
+	init_waitqueue_head(&this->wait);
+	netif_start_queue(dev);
+	goto out;
+cs_failed:
+	cs_error(link->handle, last_fn, last_ret);
+failed:
+	wl3501_release((unsigned long)link);
+out:
+	return;
+}
+
+/**
+ * wl3501_release - unregister the net, release PCMCIA configuration
+ * @arg - link
+ *
+ * After a card is removed, wl3501_release() will unregister the net device,
+ * and release the PCMCIA configuration.  If the device is still open, this
+ * will be postponed until it is closed.
+ */
+static void wl3501_release(unsigned long arg)
+{
+	dev_link_t *link = (dev_link_t *)arg;
+	struct net_device *dev = link->priv;
+
+	/* If the device is currently in use, we won't release until it is
+	 * actually closed. */
+	if (link->open) {
+		dprintk(1, "release postponed, '%s' still open",
+			link->dev->dev_name);
+		link->state |= DEV_STALE_CONFIG;
+		goto out;
+	}
+
+	/* Unlink the device chain */
+	if (link->dev) {
+		unregister_netdev(dev);
+		link->dev = NULL;
+	}
+
+	/* Don't bother checking to see if these succeed or not */
+	CardServices(ReleaseConfiguration, link->handle);
+	CardServices(ReleaseIO, link->handle, &link->io);
+	CardServices(ReleaseIRQ, link->handle, &link->irq);
+	link->state &= ~DEV_CONFIG;
+
+	if (link->state & DEV_STALE_LINK)
+		wl3501_detach(link);
+out:
+	return;
+}
+
+/**
+ * wl3501_event - The card status event handler
+ * @event - event
+ * @pri - priority
+ * @args - arguments for this event
+ *
+ * The card status event handler. Mostly, this schedules other stuff to run
+ * after an event is received. A CARD_REMOVAL event also sets some flags to
+ * discourage the net drivers from trying to talk to the card any more.
+ *
+ * When a CARD_REMOVAL event is received, we immediately set a flag to block
+ * future accesses to this device. All the functions that actually access the
+ * device should check this flag to make sure the card is still present.
+ */
+static int wl3501_event(event_t event, int pri, event_callback_args_t *args)
+{
+	dev_link_t *link = args->client_data;
+	struct net_device *dev = link->priv;
+
+	switch (event) {
+	case CS_EVENT_CARD_REMOVAL:
+		link->state &= ~DEV_PRESENT;
+		if (link->state & DEV_CONFIG) {
+			while (link->open > 0)
+				wl3501_close(dev);
+			netif_device_detach(dev);
+			link->release.expires = jiffies +
+						WL3501_RELEASE_TIMEOUT;
+			add_timer(&link->release);
+		}
+		break;
+	case CS_EVENT_CARD_INSERTION:
+		link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
+		wl3501_config(link);
+		break;
+	case CS_EVENT_PM_SUSPEND:
+		link->state |= DEV_SUSPEND;
+		wl3501_pwr_mgmt(dev->priv, WL3501_SUSPEND);
+		/* Fall through... */
+	case CS_EVENT_RESET_PHYSICAL:
+		if (link->state & DEV_CONFIG) {
+			if (link->open)
+				netif_device_detach(dev);
+			CardServices(ReleaseConfiguration, link->handle);
+		}
+		break;
+	case CS_EVENT_PM_RESUME:
+		link->state &= ~DEV_SUSPEND;
+		wl3501_pwr_mgmt(dev->priv, WL3501_RESUME);
+		/* Fall through... */
+	case CS_EVENT_CARD_RESET:
+		if (link->state & DEV_CONFIG) {
+			CardServices(RequestConfiguration, link->handle,
+				     &link->conf);
+			if (link->open) {
+				wl3501_reset(dev);
+				netif_device_attach(dev);
+			}
+		}
+		break;
+	}
+	return 0;
+}
+
+static struct pcmcia_driver wl3501_driver = {
+	.owner          = THIS_MODULE,
+	.drv            = {
+		.name   = "wl3501_cs",
+	},
+	.attach         = wl3501_attach,
+	.detach         = wl3501_detach,
+};
+
+static int __init wl3501_init_module(void)
+{
+	servinfo_t serv;
+
+	dprintk(0, ": loading");
+	CardServices(GetCardServicesInfo, &serv);
+	if (serv.Revision != CS_RELEASE_CODE) {
+		printk(KERN_NOTICE
+		       "wl3501_cs: Card Services release does not match!\n"
+		       "Compiled with 0x%x, but current is 0x%lx\n",
+		       CS_RELEASE_CODE, (unsigned long)serv.Revision);
+		/* return -1; */
+	}
+	pcmcia_register_driver(&wl3501_driver);
+	return 0;
+}
+
+static void __exit wl3501_exit_module(void)
+{
+	dprintk(0, ": unloading");
+	pcmcia_unregister_driver(&wl3501_driver);
+	while (wl3501_dev_list) {
+		del_timer(&wl3501_dev_list->release);
+		/* Mark the device as non-existing to minimize calls to card */
+		wl3501_dev_list->state &= ~DEV_PRESENT;
+		if (wl3501_dev_list->state & DEV_CONFIG)
+			wl3501_release((unsigned long)wl3501_dev_list);
+		wl3501_detach(wl3501_dev_list);
+	}
+}
+
+module_init(wl3501_init_module);
+module_exit(wl3501_exit_module);
+
+MODULE_PARM(wl3501_irq_mask, "i");
+MODULE_PARM(wl3501_irq_list, "1-4i");
+MODULE_AUTHOR("Fox Chen <mhchen@golf.ccl.itri.org.tw>, "
+	      "Arnaldo Carvalho de Melo <acme@conectiva.com.br>,"
+	      "Gustavo Niemeyer <niemeyer@conectiva.com>");
+MODULE_DESCRIPTION("Planet wl3501 wireless driver");
+MODULE_LICENSE("GPL");
diff --git a/include/linux/arcdevice.h b/include/linux/arcdevice.h
index a8672f0ddeb6..66c7495e1834 100644
--- a/include/linux/arcdevice.h
+++ b/include/linux/arcdevice.h
@@ -291,12 +291,13 @@ struct arcnet_local {
 
 	/* hardware-specific functions */
 	struct {
+		struct module *owner;
 		void (*command) (struct net_device * dev, int cmd);
 		int (*status) (struct net_device * dev);
 		void (*intmask) (struct net_device * dev, int mask);
 		bool (*reset) (struct net_device * dev, bool really_reset);
-		void (*open_close) (struct net_device * dev, bool open);
-		void (*open_close_ll) (struct net_device * dev, bool open);
+		void (*open) (struct net_device * dev);
+		void (*close) (struct net_device * dev);
 
 		void (*copy_to_card) (struct net_device * dev, int bufnum, int offset,
 				      void *buf, int count);
@@ -312,7 +313,6 @@ struct arcnet_local {
 #define ACOMMAND(x)  (lp->hw.command(dev, (x)))
 #define ASTATUS()    (lp->hw.status(dev))
 #define AINTMASK(x)  (lp->hw.intmask(dev, (x)))
-#define ARCOPEN(x)   (lp->hw.open_close(dev, (x)))
 
 
 
diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index 55a3278ae951..f82118e5a618 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -281,6 +281,8 @@ struct ethtool_stats {
 #define ETHTOOL_GSTRINGS	0x0000001b /* get specified string set */
 #define ETHTOOL_PHYS_ID		0x0000001c /* identify the NIC */
 #define ETHTOOL_GSTATS		0x0000001d /* get NIC-specific statistics */
+#define ETHTOOL_GTSO		0x0000001e /* Get TSO enable (ethtool_value) */
+#define ETHTOOL_STSO		0x0000001f /* Set TSO enable (ethtool_value) */
 
 /* compatibility with older code */
 #define SPARC_ETH_GSET		ETHTOOL_GSET
diff --git a/include/linux/netfilter_bridge/ebt_stp.h b/include/linux/netfilter_bridge/ebt_stp.h
new file mode 100644
index 000000000000..e5fd67850f4d
--- /dev/null
+++ b/include/linux/netfilter_bridge/ebt_stp.h
@@ -0,0 +1,46 @@
+#ifndef __LINUX_BRIDGE_EBT_STP_H
+#define __LINUX_BRIDGE_EBT_STP_H
+
+#define EBT_STP_TYPE		0x0001
+
+#define EBT_STP_FLAGS		0x0002
+#define EBT_STP_ROOTPRIO	0x0004
+#define EBT_STP_ROOTADDR	0x0008
+#define EBT_STP_ROOTCOST	0x0010
+#define EBT_STP_SENDERPRIO	0x0020
+#define EBT_STP_SENDERADDR	0x0040
+#define EBT_STP_PORT		0x0080
+#define EBT_STP_MSGAGE		0x0100
+#define EBT_STP_MAXAGE		0x0200
+#define EBT_STP_HELLOTIME	0x0400
+#define EBT_STP_FWDD		0x0800
+
+#define EBT_STP_MASK		0x0fff
+#define EBT_STP_CONFIG_MASK	0x0ffe
+
+#define EBT_STP_MATCH "stp"
+
+struct ebt_stp_config_info
+{
+	uint8_t flags;
+	uint16_t root_priol, root_priou;
+	char root_addr[6], root_addrmsk[6];
+	uint32_t root_costl, root_costu;
+	uint16_t sender_priol, sender_priou;
+	char sender_addr[6], sender_addrmsk[6];
+	uint16_t portl, portu;
+	uint16_t msg_agel, msg_ageu;
+	uint16_t max_agel, max_ageu;
+	uint16_t hello_timel, hello_timeu;
+	uint16_t forward_delayl, forward_delayu;
+};
+
+struct ebt_stp_info
+{
+	uint8_t type;
+	struct ebt_stp_config_info config;
+	uint16_t bitmask;
+	uint16_t invflags;
+};
+
+#endif
diff --git a/include/linux/pfkeyv2.h b/include/linux/pfkeyv2.h
index cf3a2f162239..fbfa0f52fdc9 100644
--- a/include/linux/pfkeyv2.h
+++ b/include/linux/pfkeyv2.h
@@ -190,7 +190,9 @@ struct sadb_x_ipsecrequest {
 	uint16_t	sadb_x_ipsecrequest_proto;
 	uint8_t		sadb_x_ipsecrequest_mode;
 	uint8_t		sadb_x_ipsecrequest_level;
-	uint16_t	sadb_x_ipsecrequest_reqid;
+	uint16_t	sadb_x_ipsecrequest_reserved1;
+	uint32_t	sadb_x_ipsecrequest_reqid;
+	uint32_t	sadb_x_ipsecrequest_reserved2;
 } __attribute__((packed));
 /* sizeof(struct sadb_x_ipsecrequest) == 16 */
 
diff --git a/include/linux/xfrm.h b/include/linux/xfrm.h
index d660c5f97c58..64ea125f3562 100644
--- a/include/linux/xfrm.h
+++ b/include/linux/xfrm.h
@@ -126,7 +126,7 @@ enum
 struct xfrm_user_tmpl {
 	struct xfrm_id		id;
 	xfrm_address_t		saddr;
-	__u16			reqid;
+	__u32			reqid;
 	__u8			mode;
 	__u8			share;
 	__u8			optional;
@@ -162,8 +162,8 @@ struct xfrm_usersa_info {
 	struct xfrm_lifetime_cur	curlft;
 	struct xfrm_stats		stats;
 	__u32				seq;
+	__u32				reqid;
 	__u16				family;
-	__u16				reqid;
 	__u8				mode; /* 0=transport,1=tunnel */
 	__u8				replay_window;
 };
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index c421186227f7..8654632ff46f 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -45,7 +45,8 @@ extern int			ip6_del_rt(struct rt6_info *,
 					   void *rtattr);
 
 extern int			ip6_rt_addr_add(struct in6_addr *addr,
-						struct net_device *dev);
+						struct net_device *dev,
+						int anycast);
 
 extern int			ip6_rt_addr_del(struct in6_addr *addr,
 						struct net_device *dev);
@@ -118,5 +119,12 @@ static inline void ip6_dst_store(struct sock *sk, struct dst_entry *dst,
 	write_unlock(&sk->sk_dst_lock);
 }
 
+static inline int ipv6_unicast_destination(struct sk_buff *skb)
+{
+	struct rt6_info *rt = (struct rt6_info *) skb->dst;
+
+	return rt->rt6i_flags & RTF_LOCAL;
+}
+
 #endif
 #endif
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 5c6546accda9..8aeb974d8592 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -51,7 +51,7 @@
 /*
  *	Addr type
  *	
- *	type	-	unicast | multicast | anycast
+ *	type	-	unicast | multicast
  *	scope	-	local	| site	    | global
  *	v4	-	compat
  *	v4mapped
@@ -63,7 +63,6 @@
 
 #define IPV6_ADDR_UNICAST      	0x0001U	
 #define IPV6_ADDR_MULTICAST    	0x0002U	
-#define IPV6_ADDR_ANYCAST	0x0004U
 
 #define IPV6_ADDR_LOOPBACK	0x0010U
 #define IPV6_ADDR_LINKLOCAL	0x0020U
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 3793352764c0..506fd2cb1305 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -588,6 +588,7 @@ struct sctp6_sock {
 #endif /* CONFIG_IPV6 */
 
 #define sctp_sk(__sk) (&((struct sctp_sock *)__sk)->sctp)
+#define sctp_opt2sk(__sp) &container_of(__sp, struct sctp_sock, sctp)->sk
 
 /* Is a socket of this style? */
 #define sctp_style(sk, style) __sctp_style((sk), (SCTP_SOCKET_##style))
@@ -611,4 +612,23 @@ int static inline __sctp_sstate(const struct sock *sk, sctp_sock_state_t state)
 	return sk->sk_state == state;
 }
 
+/* Map v4-mapped v6 address back to v4 address */
+static inline void sctp_v6_map_v4(union sctp_addr *addr)
+{
+	addr->v4.sin_family = AF_INET;
+	addr->v4.sin_port = addr->v6.sin6_port;
+	addr->v4.sin_addr.s_addr = addr->v6.sin6_addr.s6_addr32[3];
+}
+
+/* Map v4 address to v4-mapped v6 address */
+static inline void sctp_v4_map_v6(union sctp_addr *addr)
+{
+	addr->v6.sin6_family = AF_INET6;
+	addr->v6.sin6_port = addr->v4.sin_port;
+	addr->v6.sin6_addr.s6_addr32[3] = addr->v4.sin_addr.s_addr;
+	addr->v6.sin6_addr.s6_addr32[0] = 0;
+	addr->v6.sin6_addr.s6_addr32[1] = 0;
+	addr->v6.sin6_addr.s6_addr32[2] = htonl(0x0000ffff);
+}
+
 #endif /* __net_sctp_h__ */
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index e9814d30bd46..a779754deaf6 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -231,7 +231,8 @@ struct sctp_chunk *sctp_make_data_empty(struct sctp_association *,
 struct sctp_chunk *sctp_make_ecne(const struct sctp_association *,
 				  const __u32);
 struct sctp_chunk *sctp_make_sack(const struct sctp_association *);
-struct sctp_chunk *sctp_make_shutdown(const struct sctp_association *asoc);
+struct sctp_chunk *sctp_make_shutdown(const struct sctp_association *asoc,
+				      const struct sctp_chunk *chunk);
 struct sctp_chunk *sctp_make_shutdown_ack(const struct sctp_association *asoc,
 					  const struct sctp_chunk *);
 struct sctp_chunk *sctp_make_shutdown_complete(const struct sctp_association *,
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 94bebc0b7ce0..aae255de586b 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -260,11 +260,13 @@ struct sctp_af {
 					 struct sock *sk);
 	void		(*to_sk_daddr)	(union sctp_addr *,
 					 struct sock *sk);
-	int		(*addr_valid)	(union sctp_addr *);
+	int		(*addr_valid)	(union sctp_addr *,
+					 struct sctp_opt *);
 	sctp_scope_t	(*scope) (union sctp_addr *);
 	void		(*inaddr_any)	(union sctp_addr *, unsigned short);
 	int		(*is_any)	(const union sctp_addr *);
-	int		(*available)	(const union sctp_addr *);
+	int		(*available)	(union sctp_addr *,
+					 struct sctp_opt *);
 	int		(*skb_iif)	(const struct sk_buff *sk);
 	int		(*is_ce)	(const struct sk_buff *sk);
 	void		(*seq_dump_addr)(struct seq_file *seq,
@@ -282,7 +284,7 @@ int sctp_register_af(struct sctp_af *);
 struct sctp_pf {
 	void (*event_msgname)(struct sctp_ulpevent *, char *, int *);
 	void (*skb_msgname)  (struct sk_buff *, char *, int *);
-	int  (*af_supported) (sa_family_t);
+	int  (*af_supported) (sa_family_t, struct sctp_opt *);
 	int  (*cmp_addr) (const union sctp_addr *,
 			  const union sctp_addr *,
 			  struct sctp_opt *);
@@ -291,6 +293,7 @@ struct sctp_pf {
 	int  (*supported_addrs)(const struct sctp_opt *, __u16 *);
 	struct sock *(*create_accept_sk) (struct sock *sk,
 					  struct sctp_association *asoc);
+	void (*addr_v4map) (struct sctp_opt *, union sctp_addr *);
 	struct sctp_af *af;
 };
 
diff --git a/include/net/sctp/ulpevent.h b/include/net/sctp/ulpevent.h
index d3ad0c86583d..949a23835584 100644
--- a/include/net/sctp/ulpevent.h
+++ b/include/net/sctp/ulpevent.h
@@ -40,6 +40,7 @@
  *   Jon Grimm             <jgrimm@us.ibm.com>
  *   La Monte H.P. Yarroll <piggy@acm.org>
  *   Karl Knutson          <karl@athena.chicago.il.us>
+ *   Sridhar Samudrala     <sri@us.ibm.com>
  *
  * Any bugs reported given to us we will try to fix... any fixes shared will
  * be incorporated into the next SCTP release.
@@ -53,7 +54,6 @@
  * growing this structure as it is at the maximum limit now.
  */
 struct sctp_ulpevent {
-	struct sctp_association *asoc;
 	struct sctp_sndrcvinfo sndrcvinfo;
 	int msg_flags;
 	int iif;
@@ -72,9 +72,10 @@ static inline struct sctp_ulpevent *sctp_skb2event(struct sk_buff *skb)
 }
 
 struct sctp_ulpevent *sctp_ulpevent_new(int size, int flags, int gfp);
-struct sctp_ulpevent *sctp_ulpevent_init(struct sctp_ulpevent *, int flags);
+void sctp_ulpevent_init(struct sctp_ulpevent *, int flags);
 void sctp_ulpevent_free(struct sctp_ulpevent *);
 int sctp_ulpevent_is_notification(const struct sctp_ulpevent *);
+void sctp_queue_purge_ulpevents(struct sk_buff_head *list);
 
 struct sctp_ulpevent *sctp_ulpevent_make_assoc_change(
 	const struct sctp_association *asoc,
diff --git a/include/net/sctp/user.h b/include/net/sctp/user.h
index 284ef27894ca..da96859dba92 100644
--- a/include/net/sctp/user.h
+++ b/include/net/sctp/user.h
@@ -1,38 +1,39 @@
 /* SCTP kernel reference Implementation
  * Copyright (c) 1999-2000 Cisco, Inc.
  * Copyright (c) 1999-2001 Motorola, Inc.
- * Copyright (c) 2001 International Business Machines, Corp.
- * 
+ * Copyright (c) 2001-2003 International Business Machines, Corp.
+ * Copyright (c) 2002 Intel Corp.
+ *
  * This file is part of the SCTP kernel reference Implementation
- * 
+ *
  * This header represents the structures and constants needed to support
- * the SCTP Extension to the Sockets API. 
- * 
- * The SCTP reference implementation is free software; 
- * you can redistribute it and/or modify it under the terms of 
+ * the SCTP Extension to the Sockets API.
+ *
+ * The SCTP reference implementation is free software;
+ * you can redistribute it and/or modify it under the terms of
  * the GNU General Public License as published by
  * the Free Software Foundation; either version 2, or (at your option)
  * any later version.
- * 
- * The SCTP reference implementation is distributed in the hope that it 
+ *
+ * The SCTP reference implementation is distributed in the hope that it
  * will be useful, but WITHOUT ANY WARRANTY; without even the implied
  *                 ************************
  * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
  * See the GNU General Public License for more details.
- * 
+ *
  * You should have received a copy of the GNU General Public License
  * along with GNU CC; see the file COPYING.  If not, write to
  * the Free Software Foundation, 59 Temple Place - Suite 330,
- * Boston, MA 02111-1307, USA.  
- * 
+ * Boston, MA 02111-1307, USA.
+ *
  * Please send any bug reports or fixes you make to the
  * email address(es):
  *    lksctp developers <lksctp-developers@lists.sourceforge.net>
- * 
+ *
  * Or submit a bug report through the following website:
  *    http://www.sf.net/projects/lksctp
  *
- * Written or modified by: 
+ * Written or modified by:
  *    La Monte H.P. Yarroll    <piggy@acm.org>
  *    R. Stewart               <randall@sctp.chicago.il.us>
  *    K. Morneau               <kmorneau@cisco.com>
@@ -41,61 +42,62 @@
  *    Jon Grimm                <jgrimm@us.ibm.com>
  *    Daisy Chang              <daisyc@us.ibm.com>
  *    Ryan Layer               <rmlayer@us.ibm.com>
- * 
- * 
+ *    Ardelle Fan	       <ardelle.fan@intel.com>
+ *    Sridhar Samudrala        <sri@us.ibm.com>
+ *
  * Any bugs reported given to us we will try to fix... any fixes shared will
  * be incorporated into the next SCTP release.
  */
-#include <linux/types.h>
-#include <linux/socket.h>
 
 #ifndef __net_sctp_user_h__
 #define __net_sctp_user_h__
 
+#include <linux/types.h>
+#include <linux/socket.h>
 
 typedef void * sctp_assoc_t;
 
 /* The following symbols come from the Sockets API Extensions for
- * SCTP <draft-ietf-tsvwg-sctpsocket-04.txt>.
+ * SCTP <draft-ietf-tsvwg-sctpsocket-07.txt>.
  */
 enum sctp_optname {
 	SCTP_RTOINFO,
 #define SCTP_RTOINFO SCTP_RTOINFO
-	SCTP_ASSOCRTXINFO,
-#define SCTP_ASSOCRTXINFO SCTP_ASSOCRTXINFO
+	SCTP_ASSOCINFO,
+#define SCTP_ASSOCINFO SCTP_ASSOCINFO
 	SCTP_INITMSG,
 #define SCTP_INITMSG SCTP_INITMSG
-	SCTP_AUTO_CLOSE,
-#define SCTP_AUTO_CLOSE SCTP_AUTO_CLOSE
-	SCTP_SET_PRIMARY_ADDR,
-#define SCTP_SET_PRIMARY_ADDR SCTP_SET_PRIMARY_ADDR
+	SCTP_NODELAY, 	/* Get/set nodelay option. */
+#define SCTP_NODELAY	SCTP_NODELAY
+	SCTP_AUTOCLOSE,
+#define SCTP_AUTOCLOSE SCTP_AUTOCLOSE
 	SCTP_SET_PEER_PRIMARY_ADDR, 
 #define SCTP_SET_PEER_PRIMARY_ADDR SCTP_SET_PEER_PRIMARY_ADDR
-	SCTP_SET_ADAPTATION_LAYER,      
-#define SCTP_SET_ADAPTATION_LAYER SCTP_SET_ADAPTATION_LAYER
-	SCTP_SET_STREAM_TIMEOUTS,
-#define SCTP_SET_STREAM_TIMEOUTS SCTP_SET_STREAM_TIMEOUTS
+	SCTP_PRIMARY_ADDR,
+#define SCTP_PRIMARY_ADDR SCTP_PRIMARY_ADDR
+	SCTP_ADAPTION_LAYER,      
+#define SCTP_ADAPTION_LAYER SCTP_ADAPTION_LAYER
 	SCTP_DISABLE_FRAGMENTS,
 #define SCTP_DISABLE_FRAGMENTS SCTP_DISABLE_FRAGMENTS
-	SCTP_SET_PEER_ADDR_PARAMS,
-#define SCTP_SET_PEER_ADDR_PARAMS SCTP_SET_PEER_ADDR_PARAMS
-	SCTP_GET_PEER_ADDR_PARAMS,
-#define SCTP_GET_PEER_ADDR_PARAMS SCTP_GET_PEER_ADDR_PARAMS
+	SCTP_PEER_ADDR_PARAMS,
+#define SCTP_PEER_ADDR_PARAMS SCTP_PEER_ADDR_PARAMS
+	SCTP_DEFAULT_SEND_PARAM,
+#define SCTP_DEFAULT_SEND_PARAM SCTP_DEFAULT_SEND_PARAM
+	SCTP_EVENTS,
+#define SCTP_EVENTS SCTP_EVENTS
+	SCTP_I_WANT_MAPPED_V4_ADDR,  /* Turn on/off mapped v4 addresses  */
+#define SCTP_I_WANT_MAPPED_V4_ADDR SCTP_I_WANT_MAPPED_V4_ADDR
+	SCTP_MAXSEG, 	/* Get/set maximum fragment. */
+#define SCTP_MAXSEG 	SCTP_MAXSEG
 	SCTP_STATUS,
 #define SCTP_STATUS SCTP_STATUS
 	SCTP_GET_PEER_ADDR_INFO,
 #define SCTP_GET_PEER_ADDR_INFO SCTP_GET_PEER_ADDR_INFO
-	SCTP_SET_EVENTS,
-#define SCTP_SET_EVENTS SCTP_SET_EVENTS
-	SCTP_AUTOCLOSE,
-#define SCTP_AUTOCLOSE SCTP_AUTOCLOSE
-	SCTP_SET_DEFAULT_SEND_PARAM,
-#define SCTP_SET_DEFAULT_SEND_PARAM SCTP_SET_DEFAULT_SEND_PARAM
-
-	SCTP_SOCKOPT_DEBUG_NAME = 42, /* FIXME */
-#define SCTP_SOCKOPT_DEBUG_NAME	SCTP_SOCKOPT_DEBUG_NAME
 
-	SCTP_SOCKOPT_BINDX_ADD, /* BINDX requests for adding addresses. */
+	/* Internal Socket Options. Some of the sctp library functions are 
+	 * implemented using these socket options.
+	 */
+	SCTP_SOCKOPT_BINDX_ADD = 100,/* BINDX requests for adding addresses. */
 #define SCTP_SOCKOPT_BINDX_ADD	SCTP_SOCKOPT_BINDX_ADD
 	SCTP_SOCKOPT_BINDX_REM, /* BINDX requests for removing addresses. */
 #define SCTP_SOCKOPT_BINDX_REM	SCTP_SOCKOPT_BINDX_REM
@@ -109,29 +111,8 @@ enum sctp_optname {
 #define SCTP_GET_LOCAL_ADDRS_NUM	SCTP_GET_LOCAL_ADDRS_NUM
 	SCTP_GET_LOCAL_ADDRS, 	/* Get all local addresss. */
 #define SCTP_GET_LOCAL_ADDRS	SCTP_GET_LOCAL_ADDRS
-	SCTP_NODELAY, 	/* Get/set nodelay option. */
-#define SCTP_NODELAY	SCTP_NODELAY
-	SCTP_I_WANT_MAPPED_V4_ADDR,  /* Turn on/off mapped v4 addresses  */
-#define SCTP_I_WANT_MAPPED_V4_ADDR SCTP_I_WANT_MAPPED_V4_ADDR
-	SCTP_MAXSEG, 	/* Get/set maximum fragment. */
-#define SCTP_MAXSEG 	SCTP_MAXSEG
 };
 
-
-/*
- * 5.2 SCTP msg_control Structures
- *
- * A key element of all SCTP-specific socket extensions is the use of
- * ancillary data to specify and access SCTP-specific data via the
- * struct msghdr's msg_control member used in sendmsg() and recvmsg().
- * Fine-grained control over initialization and sending parameters are
- * handled with ancillary data.
- *
- * Each ancillary data item is preceeded by a struct cmsghdr (see
- * Section 5.1), which defines the function and purpose of the data
- * contained in in the cmsg_data[] member.
- */
-
 /*
  * 5.2.1 SCTP Initiation Structure (SCTP_INIT)
  *
@@ -152,7 +133,6 @@ struct sctp_initmsg {
 	__u16 sinit_max_init_timeo;
 };
 
-
 /*
  * 5.2.2 SCTP Header Information Structure (SCTP_SNDRCV)
  *
@@ -214,7 +194,6 @@ typedef enum sctp_cmsg_type {
  *   following format:
  *
  */
-
 struct sctp_assoc_change {
 	__u16 sac_type;
 	__u16 sac_flags;
@@ -267,11 +246,11 @@ struct sctp_paddr_change {
  *   event that happened to the address.  They include:
  */
 enum sctp_spc_state {
-	ADDRESS_AVAILABLE,
-	ADDRESS_UNREACHABLE,
-	ADDRESS_REMOVED,
-	ADDRESS_ADDED,
-	ADDRESS_MADE_PRIM,
+	SCTP_ADDR_REACHABLE,
+	SCTP_ADDR_UNREACHABLE,
+	SCTP_ADDR_REMOVED,
+	SCTP_ADDR_ADDED,
+	SCTP_ADDR_MADE_PRIM,
 };
 
 
@@ -290,7 +269,6 @@ struct sctp_remote_error {
 	__u16 sre_flags;
 	__u32 sre_length;
 	__u16 sre_error;
-	__u16 sre_len;
 	sctp_assoc_t sre_assoc_id;
 	__u8 sre_data[0];
 };
@@ -324,7 +302,6 @@ struct sctp_send_failed {
  *                       Note that this does not necessarily mean that the
  *                       data was (or was not) successfully delivered.
  */
-
 enum sctp_ssf_flags {
 	SCTP_DATA_UNSENT,
 	SCTP_DATA_SENT,
@@ -336,7 +313,6 @@ enum sctp_ssf_flags {
  *   When a peer sends a SHUTDOWN, SCTP delivers this notification to
  *   inform the application that it should cease sending data.
  */
-
 struct sctp_shutdown_event {
 	__u16 sse_type;
 	__u16 sse_flags;
@@ -355,8 +331,8 @@ struct sctp_adaption_event {
 	__u16 sai_type;
 	__u16 sai_flags;
 	__u32 sai_length;
-	__u32 sai_adaptation_bits;
-	sctp_assoc_t sse_assoc_id;
+	__u32 sai_adaption_ind;
+	sctp_assoc_t sai_assoc_id;
 };
 
 /*
@@ -366,8 +342,7 @@ struct sctp_adaption_event {
  *   message this notification will be used to inidicate
  *   various events.
  */
-
-struct sctp_rcv_pdapi_event {
+struct sctp_pdapi_event {
 	__u16 pdapi_type;
 	__u16 pdapi_flags;
 	__u32 pdapi_length;
@@ -404,14 +379,14 @@ union sctp_notification {
 		__u16 sn_type;             /* Notification type. */
 		__u16 sn_flags;
 		__u32 sn_length;
-	} h;
+	} sn_header;
 	struct sctp_assoc_change sn_assoc_change;
-	struct sctp_paddr_change sn_padr_change;
+	struct sctp_paddr_change sn_paddr_change;
 	struct sctp_remote_error sn_remote_error;
 	struct sctp_send_failed sn_send_failed;
 	struct sctp_shutdown_event sn_shutdown_event;
 	struct sctp_adaption_event sn_adaption_event;
-	struct sctp_rcv_pdapi_event sn_rcv_pdapi_event;
+	struct sctp_pdapi_event sn_pdapi_event;
 };
 
 /* Section 5.3.1
@@ -448,75 +423,25 @@ typedef enum sctp_sn_error {
 } sctp_sn_error_t;
 
 /*
- *
- * 7.1.14 Peer Address Parameters
- *
- *   Applications can enable or disable heartbeats for any peer address
- *   of an association, modify an address's heartbeat interval, force a
- *   heartbeat to be sent immediately, and adjust the address's maximum
- *   number of retransmissions sent before an address is considered
- *   unreachable. The following structure is used to access and modify an
- *   address's parameters:
- */
-
-struct sctp_paddrparams {
-	struct sockaddr_storage	spp_address;
-	__u32			spp_hbinterval;
-	__u16			spp_pathmaxrxt;
-	sctp_assoc_t		spp_assoc_id;
-};
-
-/*
- * 7.2.2 Peer Address Information
- *
- *   Applications can retrieve information about a specific peer address
- *   of an association, including its reachability state, congestion
- *   window, and retransmission timer values.  This information is
- *   read-only. The following structure is used to access this
- *   information:
- */
-
-struct sctp_paddrinfo {
-	sctp_assoc_t		spinfo_assoc_id;
-	struct sockaddr_storage	spinfo_address;
-	__s32			spinfo_state;
-	__u32			spinfo_cwnd;
-	__u32			spinfo_srtt;
-	__u32			spinfo_rto;
-	__u32			spinfo_mtu;
-};
-
-/* Peer addresses's state. */
-enum sctp_spinfo_state {
-	SCTP_INACTIVE,
-	SCTP_ACTIVE,
-};
-
-/*
  * 7.1.1 Retransmission Timeout Parameters (SCTP_RTOINFO)
  *
  *   The protocol parameters used to initialize and bound retransmission
  *   timeout (RTO) are tunable.  See [SCTP] for more information on how
- *   these parameters are used in RTO calculation.  The peer address
- *   parameter is ignored for TCP style socket.
+ *   these parameters are used in RTO calculation. 
  */
-
 struct sctp_rtoinfo {
+	sctp_assoc_t	srto_assoc_id;
 	__u32		srto_initial;
 	__u32		srto_max;
 	__u32		srto_min;
-	sctp_assoc_t	srto_assoc_id;
 };
 
 /*
- * 7.1.2 Association Retransmission Parameter (SCTP_ASSOCRTXINFO)
+ * 7.1.2 Association Parameters (SCTP_ASSOCINFO)
  *
- *   The protocol parameter used to set the number of retransmissions
- *   sent before an association is considered unreachable.
- *   See [SCTP] for more information on how this parameter is used.  The
- *   peer address parameter is ignored for TCP style socket.
+ *   This option is used to both examine and set various association and
+ *   endpoint parameters.
  */
-
 struct sctp_assocparams {
 	sctp_assoc_t	sasoc_assoc_id;
 	__u16		sasoc_asocmaxrxt;
@@ -527,31 +452,81 @@ struct sctp_assocparams {
 };
 
 /*
- * 7.1.9 Set Primary Address (SCTP_SET_PRIMARY_ADDR)
+ * 7.1.9 Set Peer Primary Address (SCTP_SET_PEER_PRIMARY_ADDR)
  *
  *  Requests that the peer mark the enclosed address as the association
  *  primary. The enclosed address must be one of the association's
  *  locally bound addresses. The following structure is used to make a
  *   set primary request:
  */
-
-struct sctp_setprim {
-	struct sockaddr_storage ssp_addr;
-	sctp_assoc_t            ssp_assoc_id;
+struct sctp_setpeerprim {
+	sctp_assoc_t            sspp_assoc_id;
+	struct sockaddr_storage sspp_addr;
 };
 
 /*
- * 7.1.10 Set Peer Primary Address (SCTP_SET_PEER_PRIMARY_ADDR)
+ * 7.1.10 Set Primary Address (SCTP_PRIMARY_ADDR)
  *
  *  Requests that the local SCTP stack use the enclosed peer address as
  *  the association primary. The enclosed address must be one of the
  *  association peer's addresses. The following structure is used to
  *  make a set peer primary request:
  */
+struct sctp_prim {
+	sctp_assoc_t            ssp_assoc_id;
+	struct sockaddr_storage ssp_addr;
+};
 
-struct sctp_setpeerprim {
-	struct sockaddr_storage sspp_addr;
-	sctp_assoc_t            sspp_assoc_id;
+/*
+ * 7.1.11 Set Adaption Layer Indicator (SCTP_ADAPTION_LAYER)
+ *
+ * Requests that the local endpoint set the specified Adaption Layer
+ * Indication parameter for all future INIT and INIT-ACK exchanges.
+ */
+struct sctp_setadaption {
+	__u32	ssb_adaption_ind;
+};
+
+/*
+ * 7.1.13 Peer Address Parameters  (SCTP_PEER_ADDR_PARAMS)
+ *
+ *   Applications can enable or disable heartbeats for any peer address
+ *   of an association, modify an address's heartbeat interval, force a
+ *   heartbeat to be sent immediately, and adjust the address's maximum
+ *   number of retransmissions sent before an address is considered
+ *   unreachable. The following structure is used to access and modify an
+ *   address's parameters:
+ */
+struct sctp_paddrparams {
+	sctp_assoc_t		spp_assoc_id;
+	struct sockaddr_storage	spp_address;
+	__u32			spp_hbinterval;
+	__u16			spp_pathmaxrxt;
+};
+
+/*
+ * 7.2.2 Peer Address Information
+ *
+ *   Applications can retrieve information about a specific peer address
+ *   of an association, including its reachability state, congestion
+ *   window, and retransmission timer values.  This information is
+ *   read-only. The following structure is used to access this
+ *   information:
+ */
+struct sctp_paddrinfo {
+	sctp_assoc_t		spinfo_assoc_id;
+	struct sockaddr_storage	spinfo_address;
+	__s32			spinfo_state;
+	__u32			spinfo_cwnd;
+	__u32			spinfo_srtt;
+	__u32			spinfo_rto;
+	__u32			spinfo_mtu;
+};
+
+/* Peer addresses's state. */
+enum sctp_spinfo_state {
+	SCTP_INACTIVE,
+	SCTP_ACTIVE,
 };
 
 /*
@@ -575,34 +550,8 @@ struct sctp_status {
 	struct sctp_paddrinfo	sstat_primary;
 };
 
-
-/*
- * 7.1.12 Set Adaption Layer Indicator
- *
- * Requests that the local endpoint set the specified Adaption Layer
- * Indication parameter for all future
- *  INIT and INIT-ACK exchanges.
- */
-
-struct sctp_setadaption {
-	__u32	ssb_adaption_ind;
-};
-
-/*
- * 7.1.12 Set default message time outs (SCTP_SET_STREAM_TIMEOUTS)
- *
- * This option requests that the requested stream apply a
- *  default time-out for messages in queue.
- */
-struct sctp_setstrm_timeout   {
-	sctp_assoc_t	ssto_assoc_id;
-	__u32		ssto_timeout;
-	__u16		ssto_streamid_start;
-	__u16		ssto_streamid_end;
-};
-
 /*
- * 8.3 8.5 get all peer/local addresses on a socket
+ * 8.3, 8.5 get all peer/local addresses on a socket
  * This parameter struct is for getsockopt
  */
 struct sctp_getaddrs {
@@ -624,8 +573,8 @@ enum sctp_msg_flags {
  * The flags parameter is formed from the bitwise OR of zero or more of the
  * following currently defined flags:
  */
-#define BINDX_ADD_ADDR 0x01
-#define BINDX_REM_ADDR 0x02
+#define SCTP_BINDX_ADD_ADDR 0x01
+#define SCTP_BINDX_REM_ADDR 0x02
 
 /* This is the structure that is passed as an argument(optval) to
  * getsockopt(SCTP_SOCKOPT_PEELOFF).
@@ -636,6 +585,3 @@ typedef struct {
 } sctp_peeloff_arg_t;
 
 #endif /* __net_sctp_user_h__ */
-
-
-
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 4cb71a1e0313..e4618023716d 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -104,10 +104,10 @@ struct xfrm_state
 
 	/* Parameters of this state. */
 	struct {
+		u32		reqid;
 		u8		mode;
 		u8		replay_window;
 		u8		aalgo, ealgo, calgo;
-		u16		reqid;
 		u16		family;
 		xfrm_address_t	saddr;
 		int		header_len;
@@ -193,7 +193,7 @@ struct xfrm_state_afinfo {
 						struct xfrm_tmpl *tmpl,
 						xfrm_address_t *daddr, xfrm_address_t *saddr);
 	struct xfrm_state	*(*state_lookup)(xfrm_address_t *daddr, u32 spi, u8 proto);
-	struct xfrm_state	*(*find_acq)(u8 mode, u16 reqid, u8 proto, 
+	struct xfrm_state	*(*find_acq)(u8 mode, u32 reqid, u8 proto, 
 					     xfrm_address_t *daddr, xfrm_address_t *saddr, 
 					     int create);
 };
@@ -244,7 +244,7 @@ struct xfrm_tmpl
 /* Source address of tunnel. Ignored, if it is not a tunnel. */
 	xfrm_address_t		saddr;
 
-	__u16			reqid;
+	__u32			reqid;
 
 /* Mode: transport/tunnel */
 	__u8			mode;
@@ -801,7 +801,7 @@ struct xfrm_policy *xfrm_policy_byid(int dir, u32 id, int delete);
 void xfrm_policy_flush(void);
 u32 xfrm_get_acqseq(void);
 void xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);
-struct xfrm_state * xfrm_find_acq(u8 mode, u16 reqid, u8 proto, 
+struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto, 
 				  xfrm_address_t *daddr, xfrm_address_t *saddr, 
 				  int create, unsigned short family);
 extern void xfrm_policy_flush(void);
diff --git a/net/atm/common.c b/net/atm/common.c
index 936a57a74a49..63b649bb7800 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -478,6 +478,8 @@ int vcc_connect(struct socket *sock, int itf, short vpi, int vci)
 		return -EINVAL;
 	if (itf != ATM_ITF_ANY) {
 		dev = atm_dev_lookup(itf);
+		if (!dev)
+			return -ENODEV;
 		error = __vcc_connect(vcc, dev, vpi, vci);
 		if (error) {
 			atm_dev_put(dev);
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 3b9738d5c71f..cc075949cd30 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -692,10 +692,11 @@ lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
 
                 atm_return(vcc,skb->truesize);
                 if (*(uint16_t *)skb->data == htons(priv->lecid) ||
-                    !priv->lecd) { 
+                    !priv->lecd ||
+                    !(dev->flags & IFF_UP)) { 
                         /* Probably looping back, or if lecd is missing,
                            lecd has gone down */
-                        DPRINTK("Ignoring loopback frame...\n");
+                        DPRINTK("Ignoring frame...\n");
                         dev_kfree_skb(skb);
                         return;
                 }
diff --git a/net/atm/signaling.c b/net/atm/signaling.c
index fda2ae43a768..d95505c1c9f6 100644
--- a/net/atm/signaling.c
+++ b/net/atm/signaling.c
@@ -31,7 +31,9 @@
 
 
 struct atm_vcc *sigd = NULL;
+#ifdef WAIT_FOR_DEMON
 static DECLARE_WAIT_QUEUE_HEAD(sigd_sleep);
+#endif
 
 
 static void sigd_put_skb(struct sk_buff *skb)
@@ -255,6 +257,8 @@ int sigd_attach(struct atm_vcc *vcc)
 	vcc_insert_socket(vcc->sk);
 	set_bit(ATM_VF_META,&vcc->flags);
 	set_bit(ATM_VF_READY,&vcc->flags);
+#ifdef WAIT_FOR_DEMON
 	wake_up(&sigd_sleep);
+#endif
 	return 0;
 }
diff --git a/net/bridge/Makefile b/net/bridge/Makefile
index 068150c0f923..d86edb7281b0 100644
--- a/net/bridge/Makefile
+++ b/net/bridge/Makefile
@@ -4,12 +4,10 @@
 
 obj-$(CONFIG_BRIDGE) += bridge.o
 
-bridge-objs	:= br.o br_device.o br_fdb.o br_forward.o br_if.o br_input.o \
+bridge-y	:= br.o br_device.o br_fdb.o br_forward.o br_if.o br_input.o \
 			br_ioctl.o br_notify.o br_stp.o br_stp_bpdu.o \
 			br_stp_if.o br_stp_timer.o
 
-ifeq ($(CONFIG_NETFILTER),y)
-bridge-objs	+= br_netfilter.o
-endif
+bridge-$(CONFIG_NETFILTER)	+= br_netfilter.o
 
 obj-$(CONFIG_BRIDGE_NF_EBTABLES) += netfilter/
diff --git a/net/bridge/netfilter/Kconfig b/net/bridge/netfilter/Kconfig
index 4b6a1ed9367c..f04d9c9ee855 100644
--- a/net/bridge/netfilter/Kconfig
+++ b/net/bridge/netfilter/Kconfig
@@ -103,6 +103,16 @@ config BRIDGE_EBT_PKTTYPE
 	  If you want to compile it as a module, say M here and read
 	  <file:Documentation/modules.txt>.  If unsure, say `N'.
 
+config BRIDGE_EBT_STP
+	tristate "ebt: STP filter support"
+	depends on BRIDGE_NF_EBTABLES
+	help
+	  This option adds the Spanning Tree Protocol match, which
+	  allows STP header field filtering.
+
+	  If you want to compile it as a module, say M here and read
+	  <file:Documentation/modules.txt>.  If unsure, say `N'.
+
 config BRIDGE_EBT_SNAT
 	tristate "ebt: snat target support"
 	depends on BRIDGE_NF_EBTABLES
diff --git a/net/bridge/netfilter/Makefile b/net/bridge/netfilter/Makefile
index 871252bdb903..8da3110178a3 100644
--- a/net/bridge/netfilter/Makefile
+++ b/net/bridge/netfilter/Makefile
@@ -11,6 +11,7 @@ obj-$(CONFIG_BRIDGE_EBT_ARP) += ebt_arp.o
 obj-$(CONFIG_BRIDGE_EBT_VLAN) += ebt_vlan.o
 obj-$(CONFIG_BRIDGE_EBT_MARK) += ebt_mark_m.o
 obj-$(CONFIG_BRIDGE_EBT_PKTTYPE) += ebt_pkttype.o
+obj-$(CONFIG_BRIDGE_EBT_STP) += ebt_stp.o
 obj-$(CONFIG_BRIDGE_EBT_LOG) += ebt_log.o
 obj-$(CONFIG_BRIDGE_EBT_SNAT) += ebt_snat.o
 obj-$(CONFIG_BRIDGE_EBT_DNAT) += ebt_dnat.o
diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index fd9a6245ccb3..c8b3357cc090 100644
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -19,6 +19,17 @@ static int ebt_target_dnat(struct sk_buff **pskb, unsigned int hooknr,
 {
 	struct ebt_nat_info *info = (struct ebt_nat_info *)data;
 
+	if (skb_shared(*pskb) || skb_cloned(*pskb)) {
+		struct sk_buff *nskb;
+
+		nskb = skb_copy(*pskb, GFP_ATOMIC);
+		if (!nskb)
+			return NF_DROP;
+		if ((*pskb)->sk)
+			skb_set_owner_w(nskb, (*pskb)->sk);
+		kfree_skb(*pskb);
+		*pskb = nskb;
+	}
 	memcpy(((**pskb).mac.ethernet)->h_dest, info->mac,
 	   ETH_ALEN * sizeof(unsigned char));
 	return info->target;
diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
index be4346095c67..d97d05fdd14f 100644
--- a/net/bridge/netfilter/ebt_redirect.c
+++ b/net/bridge/netfilter/ebt_redirect.c
@@ -20,6 +20,17 @@ static int ebt_target_redirect(struct sk_buff **pskb, unsigned int hooknr,
 {
 	struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
 
+	if (skb_shared(*pskb) || skb_cloned(*pskb)) {
+		struct sk_buff *nskb;
+
+		nskb = skb_copy(*pskb, GFP_ATOMIC);
+		if (!nskb)
+			return NF_DROP;
+		if ((*pskb)->sk)
+			skb_set_owner_w(nskb, (*pskb)->sk);
+		kfree_skb(*pskb);
+		*pskb = nskb;
+	}
 	if (hooknr != NF_BR_BROUTING)
 		memcpy((**pskb).mac.ethernet->h_dest,
 		   in->br_port->br->dev->dev_addr, ETH_ALEN);
diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index 3c0a6506d846..c457ac90c5c6 100644
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -11,6 +11,7 @@
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/netfilter_bridge/ebt_nat.h>
 #include <linux/module.h>
+#include <net/sock.h>
 
 static int ebt_target_snat(struct sk_buff **pskb, unsigned int hooknr,
    const struct net_device *in, const struct net_device *out,
@@ -18,6 +19,17 @@ static int ebt_target_snat(struct sk_buff **pskb, unsigned int hooknr,
 {
 	struct ebt_nat_info *info = (struct ebt_nat_info *) data;
 
+	if (skb_shared(*pskb) || skb_cloned(*pskb)) {
+		struct sk_buff *nskb;
+
+		nskb = skb_copy(*pskb, GFP_ATOMIC);
+		if (!nskb)
+			return NF_DROP;
+		if ((*pskb)->sk)
+			skb_set_owner_w(nskb, (*pskb)->sk);
+		kfree_skb(*pskb);
+		*pskb = nskb;
+	}
 	memcpy(((**pskb).mac.ethernet)->h_source, info->mac,
 	   ETH_ALEN * sizeof(unsigned char));
 	return info->target;
diff --git a/net/bridge/netfilter/ebt_stp.c b/net/bridge/netfilter/ebt_stp.c
new file mode 100644
index 000000000000..8be478935ba8
--- /dev/null
+++ b/net/bridge/netfilter/ebt_stp.c
@@ -0,0 +1,190 @@
+/*
+ *  ebt_stp
+ *
+ *	Authors:
+ *	Bart De Schuymer <bdschuym@pandora.be>
+ *	Stephen Hemminger <shemminger@osdl.org>
+ *
+ *  July, 2003
+ */
+
+#include <linux/netfilter_bridge/ebtables.h>
+#include <linux/netfilter_bridge/ebt_stp.h>
+#include <linux/module.h>
+
+#define BPDU_TYPE_CONFIG 0
+#define BPDU_TYPE_TCN 0x80
+
+struct stp_header {
+	uint8_t dsap;
+	uint8_t ssap;
+	uint8_t ctrl;
+	uint8_t pid;
+	uint8_t vers;
+	uint8_t type;
+};
+
+struct stp_config_pdu {
+	uint8_t flags;
+	uint8_t root[8];
+	uint8_t root_cost[4];
+	uint8_t sender[8];
+	uint8_t port[2];
+	uint8_t msg_age[2];
+	uint8_t max_age[2];
+	uint8_t hello_time[2];
+	uint8_t forward_delay[2];
+};
+
+#define NR16(p) (p[0] << 8 | p[1])
+#define NR32(p) ((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3])
+
+static int ebt_filter_config(struct ebt_stp_info *info,
+   struct stp_config_pdu *stpc)
+{
+	struct ebt_stp_config_info *c;
+	uint16_t v16;
+	uint32_t v32;
+	int verdict, i;
+
+	c = &info->config;
+	if ((info->bitmask & EBT_STP_FLAGS) &&
+	    FWINV(c->flags != stpc->flags, EBT_STP_FLAGS))
+		return EBT_NOMATCH;
+	if (info->bitmask & EBT_STP_ROOTPRIO) {
+		v16 = NR16(stpc->root);
+		if (FWINV(v16 < c->root_priol ||
+		    v16 > c->root_priou, EBT_STP_ROOTPRIO))
+			return EBT_NOMATCH;
+	}
+	if (info->bitmask & EBT_STP_ROOTADDR) {
+		verdict = 0;
+		for (i = 0; i < 6; i++)
+			verdict |= (stpc->root[2+i] ^ c->root_addr[i]) &
+			           c->root_addrmsk[i];
+		if (FWINV(verdict != 0, EBT_STP_ROOTADDR))
+			return EBT_NOMATCH;
+	}
+	if (info->bitmask & EBT_STP_ROOTCOST) {
+		v32 = NR32(stpc->root_cost);
+		if (FWINV(v32 < c->root_costl ||
+		    v32 > c->root_costu, EBT_STP_ROOTCOST))
+			return EBT_NOMATCH;
+	}
+	if (info->bitmask & EBT_STP_SENDERPRIO) {
+		v16 = NR16(stpc->sender);
+		if (FWINV(v16 < c->sender_priol ||
+		    v16 > c->sender_priou, EBT_STP_SENDERPRIO))
+			return EBT_NOMATCH;
+	}
+	if (info->bitmask & EBT_STP_SENDERADDR) {
+		verdict = 0;
+		for (i = 0; i < 6; i++)
+			verdict |= (stpc->sender[2+i] ^ c->sender_addr[i]) &
+			           c->sender_addrmsk[i];
+		if (FWINV(verdict != 0, EBT_STP_SENDERADDR))
+			return EBT_NOMATCH;
+	}
+	if (info->bitmask & EBT_STP_PORT) {
+		v16 = NR16(stpc->port);
+		if (FWINV(v16 < c->portl ||
+		    v16 > c->portu, EBT_STP_PORT))
+			return EBT_NOMATCH;
+	}
+	if (info->bitmask & EBT_STP_MSGAGE) {
+		v16 = NR16(stpc->msg_age);
+		if (FWINV(v16 < c->msg_agel ||
+		    v16 > c->msg_ageu, EBT_STP_MSGAGE))
+			return EBT_NOMATCH;
+	}
+	if (info->bitmask & EBT_STP_MAXAGE) {
+		v16 = NR16(stpc->max_age);
+		if (FWINV(v16 < c->max_agel ||
+		    v16 > c->max_ageu, EBT_STP_MAXAGE))
+			return EBT_NOMATCH;
+	}
+	if (info->bitmask & EBT_STP_HELLOTIME) {
+		v16 = NR16(stpc->hello_time);
+		if (FWINV(v16 < c->hello_timel ||
+		    v16 > c->hello_timeu, EBT_STP_HELLOTIME))
+			return EBT_NOMATCH;
+	}
+	if (info->bitmask & EBT_STP_FWDD) {
+		v16 = NR16(stpc->forward_delay);
+		if (FWINV(v16 < c->forward_delayl ||
+		    v16 > c->forward_delayu, EBT_STP_FWDD))
+			return EBT_NOMATCH;
+	}
+	return EBT_MATCH;
+}
+
+static int ebt_filter_stp(const struct sk_buff *skb, const struct net_device *in,
+   const struct net_device *out, const void *data, unsigned int datalen)
+{
+	struct ebt_stp_info *info = (struct ebt_stp_info *)data;
+	struct stp_header stph;
+	uint8_t header[6] = {0x42, 0x42, 0x03, 0x00, 0x00, 0x00};
+	if (skb_copy_bits(skb, 0, &stph, sizeof(stph)))
+		return EBT_NOMATCH;
+
+	/* The stp code only considers these */
+	if (memcmp(&stph, header, sizeof(header)))
+		return EBT_NOMATCH;
+
+	if (info->bitmask & EBT_STP_TYPE
+	    && FWINV(info->type != stph.type, EBT_STP_TYPE))
+		return EBT_NOMATCH;
+
+	if (stph.type == BPDU_TYPE_CONFIG &&
+	    info->bitmask & EBT_STP_CONFIG_MASK) {
+		struct stp_config_pdu stpc;
+
+		if (skb_copy_bits(skb, sizeof(stph), &stpc, sizeof(stpc)))
+		    return EBT_NOMATCH;
+		return ebt_filter_config(info, &stpc);
+	}
+	return EBT_MATCH;
+}
+
+static int ebt_stp_check(const char *tablename, unsigned int hookmask,
+   const struct ebt_entry *e, void *data, unsigned int datalen)
+{
+	struct ebt_stp_info *info = (struct ebt_stp_info *)data;
+	int len = sizeof(struct ebt_stp_info);
+	uint8_t bridge_ula[6] = { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x00 };
+	uint8_t msk[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+
+	if (info->bitmask & ~EBT_STP_MASK || info->invflags & ~EBT_STP_MASK ||
+	    !(info->bitmask & EBT_STP_MASK))
+		return -EINVAL;
+	if (datalen != len)
+		return -EINVAL;
+	/* Make sure the match only receives stp frames */
+	if (memcmp(e->destmac, bridge_ula, ETH_ALEN) ||
+	    memcmp(e->destmsk, msk, ETH_ALEN) || !(e->bitmask & EBT_DESTMAC))
+		return -EINVAL;
+
+	return 0;
+}
+
+static struct ebt_match filter_stp =
+{
+	.name		= EBT_STP_MATCH,
+	.match		= ebt_filter_stp,
+	.check		= ebt_stp_check,
+	.me		= THIS_MODULE,
+};
+
+static int __init init(void)
+{
+	return ebt_register_match(&filter_stp);
+}
+
+static void __exit fini(void)
+{
+	ebt_unregister_match(&filter_stp);
+}
+
+module_init(init);
+module_exit(fini);
+MODULE_LICENSE("GPL");
diff --git a/net/core/Makefile b/net/core/Makefile
index dc05b5f08a5a..bbefeba45a0b 100644
--- a/net/core/Makefile
+++ b/net/core/Makefile
@@ -4,14 +4,10 @@
 
 obj-y := sock.o skbuff.o iovec.o datagram.o scm.o
 
-ifeq ($(CONFIG_SYSCTL),y)
-ifeq ($(CONFIG_NET),y)
-obj-y += sysctl_net_core.o
-endif
-endif
+obj-$(CONFIG_SYSCTL) += sysctl_net_core.o
 
-obj-$(CONFIG_NET) += flow.o dev.o net-sysfs.o dev_mcast.o dst.o neighbour.o \
-		     rtnetlink.o utils.o link_watch.o filter.o
+obj-y		     += flow.o dev.o net-sysfs.o dev_mcast.o dst.o neighbour.o \
+			rtnetlink.o utils.o link_watch.o filter.o
 
 obj-$(CONFIG_NETFILTER) += netfilter.o
 obj-$(CONFIG_NET_DIVERT) += dv.o
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index ab73a55fdceb..030bc3605b99 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -232,7 +232,7 @@ void ah4_err(struct sk_buff *skb, u32 info)
 	x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET);
 	if (!x)
 		return;
-	printk(KERN_DEBUG "pmtu discvovery on SA AH/%08x/%08x\n",
+	printk(KERN_DEBUG "pmtu discovery on SA AH/%08x/%08x\n",
 	       ntohl(ah->spi), ntohl(iph->daddr));
 	xfrm_state_put(x);
 }
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 903de673e696..93289a96545a 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -425,7 +425,7 @@ void esp4_err(struct sk_buff *skb, u32 info)
 	x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET);
 	if (!x)
 		return;
-	printk(KERN_DEBUG "pmtu discvovery on SA ESP/%08x/%08x\n",
+	printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%08x\n",
 	       ntohl(esph->spi), ntohl(iph->daddr));
 	xfrm_state_put(x);
 }
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 90c03ea67e05..f3356664be06 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -256,7 +256,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
 	                      spi, IPPROTO_COMP, AF_INET);
 	if (!x)
 		return;
-	printk(KERN_DEBUG "pmtu discvovery on SA IPCOMP/%08x/%u.%u.%u.%u\n",
+	printk(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/%u.%u.%u.%u\n",
 	       spi, NIPQUAD(iph->daddr));
 	xfrm_state_put(x);
 }
diff --git a/net/ipv4/ipvs/ip_vs_conn.c b/net/ipv4/ipvs/ip_vs_conn.c
index 89752d03f017..5f0365b16b34 100644
--- a/net/ipv4/ipvs/ip_vs_conn.c
+++ b/net/ipv4/ipvs/ip_vs_conn.c
@@ -507,6 +507,10 @@ static void ip_vs_conn_expire(unsigned long data)
 	 *	refcnt==1 implies I'm the only one referrer
 	 */
 	if (likely(atomic_read(&cp->refcnt) == 1)) {
+		/* delete the timer if it is activated by other users */
+		if (timer_pending(&cp->timer))
+			del_timer(&cp->timer);
+
 		/* does anybody control me? */
 		if (cp->control)
 			ip_vs_control_del(cp);
diff --git a/net/ipv4/netfilter/ip_nat_helper.c b/net/ipv4/netfilter/ip_nat_helper.c
index bea707e946e3..6721c9bfd180 100644
--- a/net/ipv4/netfilter/ip_nat_helper.c
+++ b/net/ipv4/netfilter/ip_nat_helper.c
@@ -191,7 +191,7 @@ ip_nat_mangle_tcp_packet(struct sk_buff **pskb,
 				   csum_partial((char *)tcph, tcph->doff*4,
 						(*pskb)->csum));
 	adjust_tcp_sequence(ntohl(tcph->seq),
-			    (int)match_len - (int)rep_len,
+			    (int)rep_len - (int)match_len,
 			    ct, ctinfo);
 	return 1;
 }
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 5d51b9daa0d5..cd78fa0d6b88 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -58,7 +58,7 @@ __xfrm4_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto)
 }
 
 static struct xfrm_state *
-__xfrm4_find_acq(u8 mode, u16 reqid, u8 proto, 
+__xfrm4_find_acq(u8 mode, u32 reqid, u8 proto, 
 		 xfrm_address_t *daddr, xfrm_address_t *saddr, 
 		 int create)
 {
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index b0c186efccd3..649df9f76068 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -209,15 +209,8 @@ int ipv6_addr_type(const struct in6_addr *addr)
 		};
 		return type;
 	}
-	/* check for reserved anycast addresses */
-	
-	if ((st & htonl(0xE0000000)) &&
-	    ((addr->s6_addr32[2] == htonl(0xFDFFFFFF) &&
-	    (addr->s6_addr32[3] | htonl(0x7F)) == (u32)~0) ||
-	    (addr->s6_addr32[2] == 0 && addr->s6_addr32[3] == 0)))
-		type = IPV6_ADDR_ANYCAST;
-	else
-		type = IPV6_ADDR_UNICAST;
+
+	type = IPV6_ADDR_UNICAST;
 
 	/* Consider all addresses with the first three bits different of
 	   000 and 111 as finished.
@@ -2552,7 +2545,7 @@ static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 
 	switch (event) {
 	case RTM_NEWADDR:
-		ip6_rt_addr_add(&ifp->addr, ifp->idev->dev);
+		ip6_rt_addr_add(&ifp->addr, ifp->idev->dev, 0);
 		break;
 	case RTM_DELADDR:
 		addrconf_leave_solict(ifp->idev->dev, &ifp->addr);
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 7787db813f7c..6696e519f134 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -364,7 +364,7 @@ void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	if (!x)
 		return;
 
-	printk(KERN_DEBUG "pmtu discvovery on SA AH/%08x/"
+	printk(KERN_DEBUG "pmtu discovery on SA AH/%08x/"
 			"%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x\n",
 	       ntohl(ah->spi), NIP6(iph->daddr));
 
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 1dc5b9da2e2b..f36fee99a37c 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -96,7 +96,6 @@ ip6_onlink(struct in6_addr *addr, struct net_device *dev)
 	return onlink;
 }
 
-
 /*
  *	socket join an anycast group
  */
@@ -110,8 +109,12 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, struct in6_addr *addr)
 	int	ishost = !ipv6_devconf.forwarding;
 	int	err = 0;
 
+	if (!capable(CAP_NET_ADMIN))
+		return -EPERM;
 	if (ipv6_addr_type(addr) & IPV6_ADDR_MULTICAST)
 		return -EINVAL;
+	if (ipv6_chk_addr(addr, NULL))
+		return -EINVAL;
 
 	pac = sock_kmalloc(sk, sizeof(struct ipv6_ac_socklist), GFP_KERNEL);
 	if (pac == NULL)
@@ -161,21 +164,12 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, struct in6_addr *addr)
 	 * For hosts, allow link-local or matching prefix anycasts.
 	 * This obviates the need for propagating anycast routes while
 	 * still allowing some non-router anycast participation.
-	 *
-	 * allow anyone to join anycasts that don't require a special route
-	 * and can't be spoofs of unicast addresses (reserved anycast only)
 	 */
 	if (!ip6_onlink(addr, dev)) {
 		if (ishost)
 			err = -EADDRNOTAVAIL;
-		else if (!capable(CAP_NET_ADMIN))
-			err = -EPERM;
 		if (err)
 			goto out_dev_put;
-	} else if (!(ipv6_addr_type(addr) & IPV6_ADDR_ANYCAST) &&
-		   !capable(CAP_NET_ADMIN)) {
-		err = -EPERM;
-		goto out_dev_put;
 	}
 
 	err = ipv6_dev_ac_inc(dev, addr);
@@ -266,6 +260,13 @@ void ipv6_sock_ac_close(struct sock *sk)
 		dev_put(dev);
 }
 
+#if 0
+/* The function is not used, which is funny. Apparently, author
+ * supposed to use it to filter out datagrams inside udp/raw but forgot.
+ *
+ * It is OK, anycasts are not special comparing to delivery to unicasts.
+ */
+
 int inet6_ac_check(struct sock *sk, struct in6_addr *addr, int ifindex)
 {
 	struct ipv6_ac_socklist *pac;
@@ -286,6 +287,8 @@ int inet6_ac_check(struct sock *sk, struct in6_addr *addr, int ifindex)
 	return found;
 }
 
+#endif
+
 static void aca_put(struct ifacaddr6 *ac)
 {
 	if (atomic_dec_and_test(&ac->aca_refcnt)) {
@@ -347,7 +350,7 @@ int ipv6_dev_ac_inc(struct net_device *dev, struct in6_addr *addr)
 	idev->ac_list = aca;
 	write_unlock_bh(&idev->lock);
 
-	ip6_rt_addr_add(&aca->aca_addr, dev);
+	ip6_rt_addr_add(&aca->aca_addr, dev, 1);
 
 	addrconf_join_solict(dev, &aca->aca_addr);
 
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index b620afde1116..a9a384465160 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -317,7 +317,7 @@ void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET6);
 	if (!x)
 		return;
-	printk(KERN_DEBUG "pmtu discvovery on SA ESP/%08x/"
+	printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/"
 			"%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x\n", 
 			ntohl(esph->spi), NIP6(iph->daddr));
 	xfrm_state_put(x);
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 5cfc70535e35..727b681325aa 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -415,8 +415,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
 
 	saddr = &skb->nh.ipv6h->daddr;
 
-	if (ipv6_addr_type(saddr) & IPV6_ADDR_MULTICAST ||
-	    ipv6_chk_acast_addr(0, saddr)) 
+	if (!ipv6_unicast_destination(skb))
 		saddr = NULL;
 
 	memcpy(&tmp_hdr, icmph, sizeof(tmp_hdr));
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index b5590ef99281..307439f2a7c6 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -248,7 +248,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	if (!x)
 		return;
 
-	printk(KERN_DEBUG "pmtu discvovery on SA IPCOMP/%08x/"
+	printk(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/"
 			"%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x\n",
 			spi, NIP6(iph->daddr));
 	xfrm_state_put(x);
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 75a9eeaa05d0..95772c3e915a 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -785,8 +785,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
 			ipv6_addr_all_nodes(&maddr);
 			ndisc_send_na(dev, NULL, &maddr, &ifp->addr, 
 				      ifp->idev->cnf.forwarding, 0, 
-				      ipv6_addr_type(&ifp->addr)&IPV6_ADDR_ANYCAST ? 0 : 1, 
-				      1);
+				      1, 1);
 			in6_ifa_put(ifp);
 			return;
 		}
@@ -809,8 +808,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
 			if (neigh || !dev->hard_header) {
 				ndisc_send_na(dev, neigh, saddr, &ifp->addr, 
 					      ifp->idev->cnf.forwarding, 1, 
-					      ipv6_addr_type(&ifp->addr)&IPV6_ADDR_ANYCAST ? 0 : 1, 
-					      1);
+					      1, 1);
 				if (neigh)
 					neigh_release(neigh);
 			}
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index ac76e702faa2..69d7791712f8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1261,7 +1261,7 @@ int ip6_pkt_discard(struct sk_buff *skb)
  *	Add address
  */
 
-int ip6_rt_addr_add(struct in6_addr *addr, struct net_device *dev)
+int ip6_rt_addr_add(struct in6_addr *addr, struct net_device *dev, int anycast)
 {
 	struct rt6_info *rt = ip6_dst_alloc();
 
@@ -1280,6 +1280,8 @@ int ip6_rt_addr_add(struct in6_addr *addr, struct net_device *dev)
 	rt->u.dst.obsolete = -1;
 
 	rt->rt6i_flags = RTF_UP | RTF_NONEXTHOP;
+	if (!anycast)
+		rt->rt6i_flags |= RTF_LOCAL;
 	rt->rt6i_nexthop = ndisc_get_neigh(rt->rt6i_dev, &rt->rt6i_gateway);
 	if (rt->rt6i_nexthop == NULL) {
 		dst_free((struct dst_entry *) rt);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 3e012e229b92..e5cd4c372577 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -579,7 +579,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 
 	addr_type = ipv6_addr_type(&usin->sin6_addr);
 
-	if (addr_type & (IPV6_ADDR_ANYCAST | IPV6_ADDR_MULTICAST))
+	if(addr_type & IPV6_ADDR_MULTICAST)
 		return -ENETUNREACH;
 
 	if (addr_type&IPV6_ADDR_LINKLOCAL) {
@@ -967,14 +967,12 @@ static void tcp_v6_send_reset(struct sk_buff *skb)
 	struct tcphdr *th = skb->h.th, *t1; 
 	struct sk_buff *buff;
 	struct flowi fl;
-	int daddr_type;
 
 	if (th->rst)
 		return;
 
-	daddr_type = ipv6_addr_type(&skb->nh.ipv6h->daddr);
-	if (daddr_type & (IPV6_ADDR_ANYCAST | IPV6_ADDR_MULTICAST))
-		return;
+	if (!ipv6_unicast_destination(skb))
+		return; 
 
 	/*
 	 * We need to grab some memory, and put together an RST,
@@ -1173,14 +1171,12 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 	struct tcp_opt tmptp, *tp = tcp_sk(sk);
 	struct open_request *req = NULL;
 	__u32 isn = TCP_SKB_CB(skb)->when;
-	int daddr_type;
 
 	if (skb->protocol == htons(ETH_P_IP))
 		return tcp_v4_conn_request(sk, skb);
 
-	daddr_type = ipv6_addr_type(&skb->nh.ipv6h->daddr);
-	if (daddr_type & (IPV6_ADDR_ANYCAST | IPV6_ADDR_MULTICAST))
-		goto drop;
+	if (!ipv6_unicast_destination(skb))
+		goto drop; 
 
 	/*
 	 *	There are no SYN attacks on IPv6, yet...	
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index cd1ef86b57f5..c00c8ef25d83 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -65,7 +65,7 @@ __xfrm6_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto)
 }
 
 static struct xfrm_state *
-__xfrm6_find_acq(u8 mode, u16 reqid, u8 proto, 
+__xfrm6_find_acq(u8 mode, u32 reqid, u8 proto, 
 		 xfrm_address_t *daddr, xfrm_address_t *saddr, 
 		 int create)
 {
diff --git a/net/key/af_key.c b/net/key/af_key.c
index a6e913e5f11d..f481a136dad4 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1099,7 +1099,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
 	struct sadb_msg *out_hdr;
 	struct xfrm_state *x = NULL;
 	u8 mode;
-	u16 reqid;
+	u32 reqid;
 	u8 proto;
 	unsigned short family;
 	xfrm_address_t *xsaddr = NULL, *xdaddr = NULL;
@@ -1496,7 +1496,7 @@ static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, struct sadb_msg *
 static int check_reqid(struct xfrm_policy *xp, int dir, int count, void *ptr)
 {
 	int i;
-	u16 reqid = *(u16*)ptr;
+	u32 reqid = *(u32*)ptr;
 
 	for (i=0; i<xp->xfrm_nr; i++) {
 		if (xp->xfrm_vec[i].reqid == reqid)
@@ -1505,10 +1505,10 @@ static int check_reqid(struct xfrm_policy *xp, int dir, int count, void *ptr)
 	return 0;
 }
 
-static u16 gen_reqid(void)
+static u32 gen_reqid(void)
 {
-	u16 start;
-	static u16 reqid = IPSEC_MANUAL_REQID_MAX;
+	u32 start;
+	static u32 reqid = IPSEC_MANUAL_REQID_MAX;
 
 	start = reqid;
 	do {
@@ -1771,6 +1771,7 @@ static void pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, i
 			size -= 2*socklen;
 		rq = (void*)skb_put(skb, req_size);
 		pol->sadb_x_policy_len += req_size/8;
+		memset(rq, 0, sizeof(*rq));
 		rq->sadb_x_ipsecrequest_len = req_size;
 		rq->sadb_x_ipsecrequest_proto = t->id.proto;
 		rq->sadb_x_ipsecrequest_mode = t->mode+1;
diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
index cb3f7ecded46..fbb552adc243 100644
--- a/net/lapb/lapb_iface.c
+++ b/net/lapb/lapb_iface.c
@@ -43,13 +43,11 @@ static struct list_head lapb_list = LIST_HEAD_INIT(lapb_list);
 static rwlock_t lapb_list_lock = RW_LOCK_UNLOCKED;
 
 /*
- *	Free an allocated lapb control block. This is done to centralise
- *	the MOD count code.
+ *	Free an allocated lapb control block. 
  */
 static void lapb_free_cb(struct lapb_cb *lapb)
 {
 	kfree(lapb);
-	MOD_DEC_USE_COUNT;
 }
 
 static __inline__ void lapb_hold(struct lapb_cb *lapb)
@@ -127,8 +125,6 @@ static struct lapb_cb *lapb_create_cb(void)
 	if (!lapb)
 		goto out;
 
-	MOD_INC_USE_COUNT;
-
 	memset(lapb, 0x00, sizeof(*lapb));
 
 	skb_queue_head_init(&lapb->write_queue);
@@ -447,8 +443,14 @@ static int __init lapb_init(void)
 	return 0;
 }
 
+static void __exit lapb_exit(void)
+{
+	WARN_ON(!list_empty(&lapb_list));
+}
+
 MODULE_AUTHOR("Jonathan Naylor <g4klx@g4klx.demon.co.uk>");
 MODULE_DESCRIPTION("The X.25 Link Access Procedure B link layer protocol");
 MODULE_LICENSE("GPL");
 
 module_init(lapb_init);
+module_exit(lapb_exit);
diff --git a/net/rxrpc/Makefile b/net/rxrpc/Makefile
index 18403fe87c15..01ff446eae18 100644
--- a/net/rxrpc/Makefile
+++ b/net/rxrpc/Makefile
@@ -2,7 +2,7 @@
 # Makefile for Linux kernel Rx RPC
 #
 
-rxrpc-objs := \
+rxrpc-y := \
 	call.o \
 	connection.o \
 	krxiod.o \
@@ -13,11 +13,7 @@ rxrpc-objs := \
 	rxrpc_syms.o \
 	transport.o
 
-ifeq ($(CONFIG_PROC_FS),y)
-rxrpc-objs += proc.o
-endif
-ifeq ($(CONFIG_SYSCTL),y)
-rxrpc-objs += sysctl.o
-endif
+rxrpc-$(CONFIG_PROC_FS) += proc.o
+rxrpc-$(CONFIG_SYSCTL)  += sysctl.o
 
 obj-$(CONFIG_RXRPC) := rxrpc.o
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index aabeeae601a0..fa9ecdd2d856 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -556,12 +556,12 @@ void sctp_assoc_control_transport(struct sctp_association *asoc,
 	switch (command) {
 	case SCTP_TRANSPORT_UP:
 		transport->active = SCTP_ACTIVE;
-		spc_state = ADDRESS_AVAILABLE;
+		spc_state = SCTP_ADDR_REACHABLE;
 		break;
 
 	case SCTP_TRANSPORT_DOWN:
 		transport->active = SCTP_INACTIVE;
-		spc_state = ADDRESS_UNREACHABLE;
+		spc_state = SCTP_ADDR_UNREACHABLE;
 		break;
 
 	default:
@@ -877,7 +877,7 @@ void sctp_assoc_migrate(struct sctp_association *assoc, struct sock *newsk)
 	/* Delete the association from the old endpoint's list of
 	 * associations.
 	 */
-	list_del(&assoc->asocs);
+	list_del_init(&assoc->asocs);
 
 	/* Decrement the backlog value for a TCP-style socket. */
 	if (sctp_style(oldsk, TCP))
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 421561cabe4f..8e23ef559fad 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -85,7 +85,7 @@ static void sctp_datamsg_destroy(struct sctp_datamsg *msg)
 
 	/* Release all references. */
 	list_for_each_safe(pos, temp, &msg->chunks) {
-		list_del(pos);
+		list_del_init(pos);
 		chunk = list_entry(pos, struct sctp_chunk, frag_list);
 		/* Check whether we _really_ need to notify. */
 		if (notify < 0) {
@@ -294,7 +294,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
 
 errout:
 	list_for_each_safe(pos, temp, &msg->chunks) {
-		list_del(pos);
+		list_del_init(pos);
 		chunk = list_entry(pos, struct sctp_chunk, frag_list);
 		sctp_chunk_free(chunk);
 	}
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 8c4cc2c233a6..014327be95d1 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -150,7 +150,7 @@ int sctp_rcv(struct sk_buff *skb)
 	 * IP broadcast addresses cannot be used in an SCTP transport
 	 * address."
 	 */
-	if (!af->addr_valid(&src) || !af->addr_valid(&dest))
+	if (!af->addr_valid(&src, NULL) || !af->addr_valid(&dest, NULL))
 		goto discard_it;
 
 	asoc = __sctp_rcv_lookup(skb, &src, &dest, &transport);
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 858f3b922ad3..3bce456b895f 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -2,6 +2,7 @@
  * Copyright (c) 2001 Nokia, Inc.
  * Copyright (c) 2001 La Monte H.P. Yarroll
  * Copyright (c) 2002-2003 International Business Machines, Corp.
+ * Copyright (c) 2002-2003 Intel Corp.
  *
  * This file is part of the SCTP kernel reference Implementation
  *
@@ -15,7 +16,7 @@
  *
  * The SCTP reference implementation is distributed in the hope that it
  * will be useful, but WITHOUT ANY WARRANTY; without even the implied
- *                 ************************
+ *		   ************************
  * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
  * See the GNU General Public License for more details.
  *
@@ -32,14 +33,15 @@
  *    http://www.sf.net/projects/lksctp
  *
  * Written or modified by:
- *    Le Yanqun             <yanqun.le@nokia.com>
+ *    Le Yanqun		    <yanqun.le@nokia.com>
  *    Hui Huang		    <hui.huang@nokia.com>
  *    La Monte H.P. Yarroll <piggy@acm.org>
  *    Sridhar Samudrala	    <sri@us.ibm.com>
- *    Jon Grimm             <jgrimm@us.ibm.com>
+ *    Jon Grimm		    <jgrimm@us.ibm.com>
+ *    Ardelle Fan	    <ardelle.fan@intel.com>
  *
  * Based on:
- *      linux/net/ipv6/tcp_ipv6.c
+ *	linux/net/ipv6/tcp_ipv6.c
  *
  * Any bugs reported given to us we will try to fix... any fixes shared will
  * be incorporated into the next SCTP release.
@@ -172,7 +174,7 @@ static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport,
 	SCTP_DEBUG_PRINTK("%s: skb:%p, len:%d, "
 			  "src:%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x "
 			  "dst:%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x\n",
-			  __FUNCTION__, skb, skb->len, 
+			  __FUNCTION__, skb, skb->len,
 			  NIP6(fl.fl6_src), NIP6(fl.fl6_dst));
 
 	SCTP_INC_STATS(SctpOutSCTPPacks);
@@ -192,6 +194,9 @@ struct dst_entry *sctp_v6_get_dst(struct sctp_association *asoc,
 
 	memset(&fl, 0, sizeof(fl));
 	ipv6_addr_copy(&fl.fl6_dst, &daddr->v6.sin6_addr);
+	if (ipv6_addr_type(&daddr->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL)
+		fl.oif = daddr->v6.sin6_scope_id;
+	
 
 	SCTP_DEBUG_PRINTK("%s: DST=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ",
 			  __FUNCTION__, NIP6(fl.fl6_dst));
@@ -370,13 +375,28 @@ static void sctp_v6_from_sk(union sctp_addr *addr, struct sock *sk)
 /* Initialize sk->sk_rcv_saddr from sctp_addr. */
 static void sctp_v6_to_sk_saddr(union sctp_addr *addr, struct sock *sk)
 {
-	inet6_sk(sk)->rcv_saddr = addr->v6.sin6_addr;
+	if (addr->sa.sa_family == AF_INET && sctp_sk(sk)->v4mapped) {
+		inet6_sk(sk)->rcv_saddr.s6_addr32[0] = 0;
+		inet6_sk(sk)->rcv_saddr.s6_addr32[1] = 0;
+		inet6_sk(sk)->rcv_saddr.s6_addr32[2] = htonl(0x0000ffff);
+		inet6_sk(sk)->rcv_saddr.s6_addr32[3] =
+			addr->v4.sin_addr.s_addr;
+	} else {
+		inet6_sk(sk)->rcv_saddr = addr->v6.sin6_addr;
+	}
 }
 
 /* Initialize sk->sk_daddr from sctp_addr. */
 static void sctp_v6_to_sk_daddr(union sctp_addr *addr, struct sock *sk)
 {
-	inet6_sk(sk)->daddr = addr->v6.sin6_addr;
+	if (addr->sa.sa_family == AF_INET && sctp_sk(sk)->v4mapped) {
+		inet6_sk(sk)->daddr.s6_addr32[0] = 0;
+		inet6_sk(sk)->daddr.s6_addr32[1] = 0;
+		inet6_sk(sk)->daddr.s6_addr32[2] = htonl(0x0000ffff);
+		inet6_sk(sk)->daddr.s6_addr32[3] = addr->v4.sin_addr.s_addr;
+	} else {
+		inet6_sk(sk)->daddr = addr->v6.sin6_addr;
+	}
 }
 
 /* Initialize a sctp_addr from a dst_entry. */
@@ -390,13 +410,30 @@ static void sctp_v6_dst_saddr(union sctp_addr *addr, struct dst_entry *dst,
 }
 
 /* Compare addresses exactly.
- * FIXME: v4-mapped-v6.
+ * v4-mapped-v6 is also in consideration.
  */
 static int sctp_v6_cmp_addr(const union sctp_addr *addr1,
 			    const union sctp_addr *addr2)
 {
-	if (addr1->sa.sa_family != addr2->sa.sa_family)
+	if (addr1->sa.sa_family != addr2->sa.sa_family) {
+		if (addr1->sa.sa_family == AF_INET &&
+		    addr2->sa.sa_family == AF_INET6 &&
+		    IPV6_ADDR_MAPPED == ipv6_addr_type(&addr2->v6.sin6_addr)) {
+			if (addr2->v6.sin6_port == addr1->v4.sin_port &&
+			    addr2->v6.sin6_addr.s6_addr32[3] ==
+			    addr1->v4.sin_addr.s_addr)
+				return 1;
+		}
+		if (addr2->sa.sa_family == AF_INET &&
+		    addr1->sa.sa_family == AF_INET6 &&
+		    IPV6_ADDR_MAPPED == ipv6_addr_type(&addr1->v6.sin6_addr)) {
+			if (addr1->v6.sin6_port == addr2->v4.sin_port &&
+			    addr1->v6.sin6_addr.s6_addr32[3] ==
+			    addr2->v4.sin_addr.s_addr)
+				return 1;
+		}
 		return 0;
+	}
 	if (ipv6_addr_cmp(&addr1->v6.sin6_addr, &addr2->v6.sin6_addr))
 		return 0;
 	/* If this is a linklocal address, compare the scope_id. */
@@ -427,7 +464,7 @@ static int sctp_v6_is_any(const union sctp_addr *addr)
 }
 
 /* Should this be available for binding?   */
-static int sctp_v6_available(const union sctp_addr *addr)
+static int sctp_v6_available(union sctp_addr *addr, struct sctp_opt *sp)
 {
 	int type;
 	struct in6_addr *in6 = (struct in6_addr *)&addr->v6.sin6_addr;
@@ -435,6 +472,14 @@ static int sctp_v6_available(const union sctp_addr *addr)
 	type = ipv6_addr_type(in6);
 	if (IPV6_ADDR_ANY == type)
 		return 1;
+	if (type == IPV6_ADDR_MAPPED) {
+		if (sp && !sp->v4mapped)
+			return 0;
+		if (sp && ipv6_only_sock(sctp_opt2sk(sp)))
+			return 0;
+		sctp_v6_map_v4(addr);
+		return sctp_get_af_specific(AF_INET)->available(addr, sp);
+	}
 	if (!(type & IPV6_ADDR_UNICAST))
 		return 0;
 
@@ -448,11 +493,22 @@ static int sctp_v6_available(const union sctp_addr *addr)
  * Return 0 - If the address is a non-unicast or an illegal address.
  * Return 1 - If the address is a unicast.
  */
-static int sctp_v6_addr_valid(union sctp_addr *addr)
+static int sctp_v6_addr_valid(union sctp_addr *addr, struct sctp_opt *sp)
 {
 	int ret = ipv6_addr_type(&addr->v6.sin6_addr);
 
-	/* FIXME:  v4-mapped-v6 address support. */
+	/* Support v4-mapped-v6 address. */
+	if (ret == IPV6_ADDR_MAPPED) {
+		/* Note: This routine is used in input, so v4-mapped-v6
+		 * are disallowed here when there is no sctp_opt.
+		 */
+		if (!sp || !sp->v4mapped)
+			return 0;
+		if (sp && ipv6_only_sock(sctp_opt2sk(sp)))
+			return 0;
+		sctp_v6_map_v4(addr);
+		return sctp_get_af_specific(AF_INET)->addr_valid(addr, sp);
+	}
 
 	/* Is this a non-unicast address */
 	if (!(ret & IPV6_ADDR_UNICAST))
@@ -536,7 +592,7 @@ struct sock *sctp_v6_create_accept_sk(struct sock *sk,
 	newnp->saddr = np->saddr;
 	newnp->rcv_saddr = np->rcv_saddr;
 	newinet->dport = htons(asoc->peer.port);
-	newnp->daddr =  asoc->peer.primary_addr.v6.sin6_addr;
+	sctp_v6_to_sk_daddr(&asoc->peer.primary_addr, newsk);
 
 	/* Init the ipv4 part of the socket since we can have sockets
 	 * using v6 API for ipv4.
@@ -566,6 +622,13 @@ out:
 	return newsk;
 }
 
+/* Map v4 address to mapped v6 address */
+static void sctp_v6_addr_v4map(struct sctp_opt *sp, union sctp_addr *addr)
+{
+	if (sp->v4mapped && AF_INET == addr->sa.sa_family)
+		sctp_v4_map_v6(addr);
+}
+
 /* Where did this skb come from?  */
 static int sctp_v6_skb_iif(const struct sk_buff *skb)
 {
@@ -606,25 +669,28 @@ static void sctp_inet6_event_msgname(struct sctp_ulpevent *event,
 
 	if (msgname) {
 		union sctp_addr *addr;
+		struct sctp_association *asoc;
 
+		asoc = event->sndrcvinfo.sinfo_assoc_id;
 		sctp_inet6_msgname(msgname, addrlen);
 		sin6 = (struct sockaddr_in6 *)msgname;
-		sin6->sin6_port = htons(event->asoc->peer.port);
-		addr = &event->asoc->peer.primary_addr;
+		sin6->sin6_port = htons(asoc->peer.port);
+		addr = &asoc->peer.primary_addr;
 
 		/* Note: If we go to a common v6 format, this code
 		 * will change.
 		 */
 
 		/* Map ipv4 address into v4-mapped-on-v6 address.  */
-		if (AF_INET == addr->sa.sa_family) {
-			/* FIXME: Easy, but there was no way to test this
-			 * yet.
-			 */
+		if (sctp_sk(asoc->base.sk)->v4mapped &&
+		    AF_INET == addr->sa.sa_family) {
+			sctp_v4_map_v6((union sctp_addr *)sin6);
+			sin6->sin6_addr.s6_addr32[3] =
+				addr->v4.sin_addr.s_addr;
 			return;
 		}
 
-		sin6from = &event->asoc->peer.primary_addr.v6;
+		sin6from = &asoc->peer.primary_addr.v6;
 		ipv6_addr_copy(&sin6->sin6_addr, &sin6from->sin6_addr);
 		if (ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL)
 			sin6->sin6_scope_id = sin6from->sin6_scope_id;
@@ -644,16 +710,15 @@ static void sctp_inet6_skb_msgname(struct sk_buff *skb, char *msgname,
 		sh = (struct sctphdr *)skb->h.raw;
 		sin6->sin6_port = sh->source;
 
-		/* FIXME: Map ipv4 address into v4-mapped-on-v6 address. */
-		if (__constant_htons(ETH_P_IP) == skb->protocol) {
-			/* FIXME:  The latest I-D added options for two
-			 * behaviors.
-			 */
+		/* Map ipv4 address into v4-mapped-on-v6 address. */
+		if (sctp_sk(skb->sk)->v4mapped &&
+		    skb->nh.iph->version == 4) {
+			sctp_v4_map_v6((union sctp_addr *)sin6);
+			sin6->sin6_addr.s6_addr32[3] = skb->nh.iph->saddr;
 			return;
 		}
 
 		/* Otherwise, just copy the v6 address. */
-
 		ipv6_addr_copy(&sin6->sin6_addr, &skb->nh.ipv6h->saddr);
 		if (ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL) {
 			struct sctp_ulpevent *ev = sctp_skb2event(skb);
@@ -663,16 +728,15 @@ static void sctp_inet6_skb_msgname(struct sk_buff *skb, char *msgname,
 }
 
 /* Do we support this AF? */
-static int sctp_inet6_af_supported(sa_family_t family)
+static int sctp_inet6_af_supported(sa_family_t family, struct sctp_opt *sp)
 {
-	/* FIXME:  v4-mapped-v6 addresses.  The I-D is still waffling
-	 * on what to do with sockaddr formats for PF_INET6 sockets.
-	 * For now assume we'll support both.
-	 */
 	switch (family) {
 	case AF_INET6:
-	case AF_INET:
 		return 1;
+	/* v4-mapped-v6 addresses */
+	case AF_INET:
+		if (!__ipv6_only_sock(sctp_opt2sk(sp)) && sp->v4mapped)
+			return 1;
 	default:
 		return 0;
 	}
@@ -716,7 +780,7 @@ static int sctp_inet6_bind_verify(struct sctp_opt *opt, union sctp_addr *addr)
 	else {
 		struct sock *sk;
 		int type = ipv6_addr_type(&addr->v6.sin6_addr);
-		sk = &container_of(opt, struct sctp6_sock, sctp)->sk;
+		sk = sctp_opt2sk(opt);
 		if (type & IPV6_ADDR_LINKLOCAL) {
 			/* Note: Behavior similar to af_inet6.c:
 			 *  1) Overrides previous bound_dev_if
@@ -730,7 +794,7 @@ static int sctp_inet6_bind_verify(struct sctp_opt *opt, union sctp_addr *addr)
 		}
 		af = opt->pf->af;
 	}
-	return af->available(addr);
+	return af->available(addr, opt);
 }
 
 /* Verify that the provided sockaddr looks bindable.   Common verification,
@@ -746,7 +810,7 @@ static int sctp_inet6_send_verify(struct sctp_opt *opt, union sctp_addr *addr)
 	else {
 		struct sock *sk;
 		int type = ipv6_addr_type(&addr->v6.sin6_addr);
-		sk = &container_of(opt, struct sctp6_sock, sctp)->sk;
+		sk = sctp_opt2sk(opt);
 		if (type & IPV6_ADDR_LINKLOCAL) {
 			/* Note: Behavior similar to af_inet6.c:
 			 *  1) Overrides previous bound_dev_if
@@ -863,6 +927,7 @@ static struct sctp_pf sctp_pf_inet6_specific = {
 	.send_verify   = sctp_inet6_send_verify,
 	.supported_addrs = sctp_inet6_supported_addrs,
 	.create_accept_sk = sctp_v6_create_accept_sk,
+	.addr_v4map    = sctp_v6_addr_v4map,
 	.af            = &sctp_ipv6_specific,
 };
 
diff --git a/net/sctp/output.c b/net/sctp/output.c
index bc321f6019fd..262a6aa06b49 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -97,6 +97,7 @@ struct sctp_packet *sctp_packet_init(struct sctp_packet *packet,
 	packet->source_port = sport;
 	packet->destination_port = dport;
 	skb_queue_head_init(&packet->chunks);
+	packet->size = SCTP_IP_OVERHEAD;
 	packet->vtag = 0;
 	packet->ecn_capable = 0;
 	packet->get_prepend_chunk = NULL;
@@ -219,9 +220,8 @@ sctp_xmit_t sctp_packet_append_chunk(struct sctp_packet *packet,
 		/* Both control chunks and data chunks with TSNs are
 		 * non-fragmentable.
 		 */
-		if (packet_empty) {
-
-			/* We no longer do refragmentation at all.
+		if (packet_empty || !sctp_chunk_is_data(chunk)) {
+			/* We no longer do re-fragmentation.
 			 * Just fragment at the IP layer, if we
 			 * actually hit this condition
 			 */
@@ -229,7 +229,7 @@ sctp_xmit_t sctp_packet_append_chunk(struct sctp_packet *packet,
 			packet->ipfragok = 1;
 			goto append;
 
-		} else { /* !packet_empty */
+		} else {
 			retval = SCTP_XMIT_PMTU_FULL;
 			goto finish;
 		}
@@ -283,20 +283,18 @@ int sctp_packet_transmit(struct sctp_packet *packet)
 	__u8 has_data = 0;
 	struct dst_entry *dst;
 
-	/* Do NOT generate a chunkless packet... */
-	if (skb_queue_empty(&packet->chunks))
+	/* Do NOT generate a chunkless packet. */
+	chunk = (struct sctp_chunk *)skb_peek(&packet->chunks);
+	if (unlikely(!chunk))
 		return err;
 
 	/* Set up convenience variables... */
-	chunk = (struct sctp_chunk *) (packet->chunks.next);
 	sk = chunk->skb->sk;
 
 	/* Allocate the new skb.  */
 	nskb = dev_alloc_skb(packet->size);
-	if (!nskb) {
-		err = -ENOMEM;
-		goto out;
-	}
+	if (!nskb)
+		goto nomem;
 
 	/* Make sure the outbound skb has enough header room reserved. */
 	skb_reserve(nskb, SCTP_IP_OVERHEAD);
@@ -468,9 +466,11 @@ int sctp_packet_transmit(struct sctp_packet *packet)
 	if (!nskb->dst)
 		goto no_route;
 
-	SCTP_DEBUG_PRINTK("***sctp_transmit_packet*** skb length %d\n",
+	SCTP_DEBUG_PRINTK("***sctp_transmit_packet*** skb len %d\n",
 			  nskb->len);
+
 	(*tp->af_specific->sctp_xmit)(nskb, tp, packet->ipfragok);
+
 out:
 	packet->size = SCTP_IP_OVERHEAD;
 	return err;
@@ -486,7 +486,20 @@ no_route:
 	 * required.
 	 */
 	 /* err = -EHOSTUNREACH; */
+err:
+	/* Control chunks are unreliable so just drop them.  DATA chunks
+	 * will get resent or dropped later.
+	 */
+
+	while ((chunk = (struct sctp_chunk *)__skb_dequeue(&packet->chunks))) {
+		if (!sctp_chunk_is_data(chunk))
+    			sctp_chunk_free(chunk);
+	}
 	goto out;
+nomem:
+	err = -ENOMEM;
+	printk("%s alloc_skb failed.\n", __FUNCTION__);
+	goto err;
 }
 
 /********************************************************************
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index b7bd2bf6e6a2..d26292af9ff1 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -258,7 +258,7 @@ void sctp_outq_teardown(struct sctp_outq *q)
 
 	/* Throw away chunks that have been gap ACKed.  */
 	list_for_each_safe(lchunk, temp, &q->sacked) {
-		list_del(lchunk);
+		list_del_init(lchunk);
 		chunk = list_entry(lchunk, struct sctp_chunk,
 				   transmitted_list);
 		sctp_datamsg_fail(chunk, q->error);
@@ -267,7 +267,7 @@ void sctp_outq_teardown(struct sctp_outq *q)
 
 	/* Throw away any chunks in the retransmit queue. */
 	list_for_each_safe(lchunk, temp, &q->retransmit) {
-		list_del(lchunk);
+		list_del_init(lchunk);
 		chunk = list_entry(lchunk, struct sctp_chunk,
 				   transmitted_list);
 		sctp_datamsg_fail(chunk, q->error);
@@ -445,7 +445,7 @@ void sctp_retransmit_mark(struct sctp_outq *q,
 			/* Move the chunk to the retransmit queue. The chunks
 			 * on the retransmit queue is always kept in order.
 			 */
-			list_del(lchunk);
+			list_del_init(lchunk);
 			sctp_retransmit_insert(lchunk, q);
 		}
 	}
@@ -1007,7 +1007,7 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_sackhdr *sack)
 	struct sctp_association *asoc = q->asoc;
 	struct sctp_transport *transport;
 	struct sctp_chunk *tchunk;
-	struct list_head *lchunk, *transport_list, *pos;
+	struct list_head *lchunk, *transport_list, *pos, *temp;
 	sctp_sack_variable_t *frags = sack->variable;
 	__u32 sack_ctsn, ctsn, tsn;
 	__u32 highest_tsn, highest_new_tsn;
@@ -1115,14 +1115,12 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_sackhdr *sack)
 			  "%p is 0x%x.\n", __FUNCTION__, asoc, ctsn);
 
 	/* Throw away stuff rotting on the sack queue.  */
-	list_for_each(lchunk, &q->sacked) {
+	list_for_each_safe(lchunk, temp, &q->sacked) {
 		tchunk = list_entry(lchunk, struct sctp_chunk,
 				    transmitted_list);
 		tsn = ntohl(tchunk->subh.data_hdr->tsn);
-		if (TSN_lte(tsn, ctsn)) {
-			lchunk = lchunk->prev;
+		if (TSN_lte(tsn, ctsn))
 			sctp_chunk_free(tchunk);
-		}
 	}
 
 	/* ii) Set rwnd equal to the newly received a_rwnd minus the
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 604215bd21d4..5e0c6aa9d100 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -340,7 +340,7 @@ static int sctp_v4_is_any(const union sctp_addr *addr)
  * Return 0 - If the address is a non-unicast or an illegal address.
  * Return 1 - If the address is a unicast.
  */
-static int sctp_v4_addr_valid(union sctp_addr *addr)
+static int sctp_v4_addr_valid(union sctp_addr *addr, struct sctp_opt *sp)
 {
 	/* Is this a non-unicast address or a unusable SCTP address? */
 	if (IS_IPV4_UNUSABLE_ADDRESS(&addr->v4.sin_addr.s_addr))
@@ -350,7 +350,7 @@ static int sctp_v4_addr_valid(union sctp_addr *addr)
 }
 
 /* Should this be available for binding?   */
-static int sctp_v4_available(const union sctp_addr *addr)
+static int sctp_v4_available(union sctp_addr *addr, struct sctp_opt *sp)
 {
 	int ret = inet_addr_type(addr->v4.sin_addr.s_addr);
 
@@ -580,6 +580,12 @@ out:
 	return newsk;
 }
 
+/* Map address, empty for v4 family */
+static void sctp_v4_addr_v4map(struct sctp_opt *sp, union sctp_addr *addr)
+{
+	/* Empty */
+}
+
 /* Dump the v4 addr to the seq file. */
 static void sctp_v4_seq_dump_addr(struct seq_file *seq, union sctp_addr *addr)
 {
@@ -685,10 +691,13 @@ static void sctp_inet_event_msgname(struct sctp_ulpevent *event, char *msgname,
 	struct sockaddr_in *sin, *sinfrom;
 
 	if (msgname) {
+		struct sctp_association *asoc;
+
+		asoc = event->sndrcvinfo.sinfo_assoc_id;
 		sctp_inet_msgname(msgname, addr_len);
 		sin = (struct sockaddr_in *)msgname;
-		sinfrom = &event->asoc->peer.primary_addr.v4;
-		sin->sin_port = htons(event->asoc->peer.port);
+		sinfrom = &asoc->peer.primary_addr.v4;
+		sin->sin_port = htons(asoc->peer.port);
 		sin->sin_addr.s_addr = sinfrom->sin_addr.s_addr;
 	}
 }
@@ -709,7 +718,7 @@ static void sctp_inet_skb_msgname(struct sk_buff *skb, char *msgname, int *len)
 }
 
 /* Do we support this AF? */
-static int sctp_inet_af_supported(sa_family_t family)
+static int sctp_inet_af_supported(sa_family_t family, struct sctp_opt *sp)
 {
 	/* PF_INET only supports AF_INET addresses. */
 	return (AF_INET == family);
@@ -737,7 +746,7 @@ static int sctp_inet_cmp_addr(const union sctp_addr *addr1,
  */
 static int sctp_inet_bind_verify(struct sctp_opt *opt, union sctp_addr *addr)
 {
-	return sctp_v4_available(addr);
+	return sctp_v4_available(addr, opt);
 }
 
 /* Verify that sockaddr looks sendable.  Common verification has already
@@ -783,6 +792,7 @@ static struct sctp_pf sctp_pf_inet = {
 	.send_verify   = sctp_inet_send_verify,
 	.supported_addrs = sctp_inet_supported_addrs,
 	.create_accept_sk = sctp_v4_create_accept_sk,
+	.addr_v4map	= sctp_v4_addr_v4map,
 	.af            = &sctp_ipv4_specific,
 };
 
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 2408465dda8a..655c895b7ad8 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -667,7 +667,8 @@ nodata:
 }
 
 /* Make a SHUTDOWN chunk. */
-struct sctp_chunk *sctp_make_shutdown(const struct sctp_association *asoc)
+struct sctp_chunk *sctp_make_shutdown(const struct sctp_association *asoc,
+				      const struct sctp_chunk *chunk)
 {
 	struct sctp_chunk *retval;
 	sctp_shutdownhdr_t shut;
@@ -683,6 +684,9 @@ struct sctp_chunk *sctp_make_shutdown(const struct sctp_association *asoc)
 
 	retval->subh.shutdown_hdr =
 		sctp_addto_chunk(retval, sizeof(shut), &shut);
+
+	if (chunk)
+		retval->transport = chunk->transport;
 nodata:
 	return retval;
 }
@@ -1089,7 +1093,7 @@ void sctp_chunk_free(struct sctp_chunk *chunk)
 {
 	/* Make sure that we are not on any list.  */
 	skb_unlink((struct sk_buff *) chunk);
-	list_del(&chunk->transmitted_list);
+	list_del_init(&chunk->transmitted_list);
 
 	/* Release our reference on the message tracker. */
 	if (chunk->msg)
@@ -1850,7 +1854,7 @@ clean_up:
 	/* Release the transport structures. */
 	list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
 		transport = list_entry(pos, struct sctp_transport, transports);
-		list_del(pos);
+		list_del_init(pos);
 		sctp_transport_free(transport);
 	}
 nomem:
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index b320c1c5e670..9a99495265f8 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -962,7 +962,7 @@ int sctp_cmd_interpreter(sctp_event_t event_type, sctp_subtype_t subtype,
 			asoc->overall_error_count = 0;
 
 			/* Generate a SHUTDOWN chunk.  */
-			new_obj = sctp_make_shutdown(asoc);
+			new_obj = sctp_make_shutdown(asoc, chunk);
 			if (!new_obj)
 				goto nomem;
 			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 0e3f27b90020..7a20e554de4d 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3862,7 +3862,7 @@ sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
 	 * in the Cumulative TSN Ack field the last sequential TSN it
 	 * has received from the peer.
 	 */
-	reply = sctp_make_shutdown(asoc);
+	reply = sctp_make_shutdown(asoc, NULL);
 	if (!reply)
 		goto nomem;
 
@@ -4179,7 +4179,7 @@ sctp_disposition_t sctp_sf_t2_timer_expire(const struct sctp_endpoint *ep,
 
 	switch (asoc->state) {
 	case SCTP_STATE_SHUTDOWN_SENT:
-		reply = sctp_make_shutdown(asoc);
+		reply = sctp_make_shutdown(asoc, NULL);
 		break;
 
 	case SCTP_STATE_SHUTDOWN_ACK_SENT:
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 72029eb799eb..962699973875 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -156,6 +156,9 @@ struct sctp_transport *sctp_addr_id2transport(struct sock *sk,
 	if (id_asoc && (id_asoc != addr_asoc))
 		return NULL;
 
+	sctp_get_pf_specific(sk->sk_family)->addr_v4map(sctp_sk(sk),
+						(union sctp_addr *)addr);
+
 	return transport;
 }
 
@@ -206,7 +209,7 @@ static struct sctp_af *sctp_sockaddr_af(struct sctp_opt *opt,
 		return NULL;
 
 	/* Does this PF support this AF? */
-	if (!opt->pf->af_supported(addr->sa.sa_family))
+	if (!opt->pf->af_supported(addr->sa.sa_family, opt))
 		return NULL;
 
 	/* If we get this far, af is valid. */
@@ -365,15 +368,15 @@ static int __sctp_bindx(struct sock *sk, struct sockaddr_storage *addrs,
 
 	SCTP_DEBUG_PRINTK("__sctp_bindx(sk: %p, addrs: %p, addrcnt: %d, "
 			  "flags: %s)\n", sk, addrs, addrcnt,
-			  (BINDX_ADD_ADDR == flags) ? "ADD" :
-			  ((BINDX_REM_ADDR == flags) ? "REM" : "BOGUS"));
+			  (SCTP_BINDX_ADD_ADDR == flags) ? "ADD" :
+			  ((SCTP_BINDX_REM_ADDR == flags) ? "REM" : "BOGUS"));
 
 	switch (flags) {
-	case BINDX_ADD_ADDR:
+	case SCTP_BINDX_ADD_ADDR:
 		retval = sctp_bindx_add(sk, addrs, addrcnt);
 		break;
 
-	case BINDX_REM_ADDR:
+	case SCTP_BINDX_REM_ADDR:
 		retval = sctp_bindx_rem(sk, addrs, addrcnt);
 		break;
 
@@ -768,8 +771,8 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
 	}
 
 	/* Clean up any skbs sitting on the receive queue.  */
-	skb_queue_purge(&sk->sk_receive_queue);
-	skb_queue_purge(&sctp_sk(sk)->pd_lobby);
+	sctp_queue_purge_ulpevents(&sk->sk_receive_queue);
+	sctp_queue_purge_ulpevents(&sctp_sk(sk)->pd_lobby);
 
 	/* On a TCP-style socket, block for at most linger_time if set. */
 	if (sctp_style(sk, TCP) && timeout)
@@ -1342,10 +1345,10 @@ SCTP_STATIC int sctp_recvmsg(struct kiocb *iocb, struct sock *sk,
 
 		/* When only partial message is copied to the user, increase
 		 * rwnd by that amount. If all the data in the skb is read,
-		 * rwnd is updated when the skb's destructor is called via
-		 * sctp_ulpevent_free().
+		 * rwnd is updated when the event is freed.
 		 */
-		sctp_assoc_rwnd_increase(event->asoc, copied);
+		sctp_assoc_rwnd_increase(event->sndrcvinfo.sinfo_assoc_id,
+					 copied);
 		goto out;
 	} else if ((event->msg_flags & MSG_NOTIFICATION) ||
 		   (event->msg_flags & MSG_EOR))
@@ -1354,7 +1357,18 @@ SCTP_STATIC int sctp_recvmsg(struct kiocb *iocb, struct sock *sk,
 		msg->msg_flags &= ~MSG_EOR;
 
 out_free:
-	sctp_ulpevent_free(event); /* Free the skb. */
+	if (flags & MSG_PEEK) {
+		/* Release the skb reference acquired after peeking the skb in
+		 * sctp_skb_recv_datagram().
+		 */
+		kfree_skb(skb);
+	} else {
+		/* Free the event which includes releasing the reference to
+		 * the owner of the skb, freeing the skb and updating the
+		 * rwnd.
+		 */
+		sctp_ulpevent_free(event);
+	}
 out:
 	sctp_release_sock(sk);
 	return err;
@@ -1421,7 +1435,7 @@ static int sctp_setsockopt_autoclose(struct sock *sk, char *optval,
 	return 0;
 }
 
-/* 7.1.13 Peer Address Parameters (SCTP_SET_PEER_ADDR_PARAMS)
+/* 7.1.13 Peer Address Parameters (SCTP_PEER_ADDR_PARAMS)
  *
  * Applications can enable or disable heartbeats for any peer address of
  * an association, modify an address's heartbeat interval, force a
@@ -1571,24 +1585,25 @@ static int sctp_setsockopt_default_send_param(struct sock *sk,
 	return 0;
 }
 
-/* 7.1.10 Set Peer Primary Address (SCTP_SET_PEER_PRIMARY_ADDR)
+/* 7.1.10 Set Peer Primary Address (SCTP_PRIMARY_ADDR)
  *
  * Requests that the local SCTP stack use the enclosed peer address as
  * the association primary.  The enclosed address must be one of the
  * association peer's addresses.
  */
-static int sctp_setsockopt_peer_prim(struct sock *sk, char *optval, int optlen)
+static int sctp_setsockopt_primary_addr(struct sock *sk, char *optval,
+					int optlen)
 {
-	struct sctp_setpeerprim prim;
+	struct sctp_prim prim;
 	struct sctp_transport *trans;
 
-	if (optlen != sizeof(struct sctp_setpeerprim))
+	if (optlen != sizeof(struct sctp_prim))
 		return -EINVAL;
 
-	if (copy_from_user(&prim, optval, sizeof(struct sctp_setpeerprim)))
+	if (copy_from_user(&prim, optval, sizeof(struct sctp_prim)))
 		return -EFAULT;
 
-	trans = sctp_addr_id2transport(sk, &prim.sspp_addr, prim.sspp_assoc_id);
+	trans = sctp_addr_id2transport(sk, &prim.ssp_addr, prim.ssp_assoc_id);
 	if (!trans)
 		return -EINVAL;
 
@@ -1682,8 +1697,8 @@ static int sctp_setsockopt_rtoinfo(struct sock *sk, char *optval, int optlen) {
  * See [SCTP] for more information.
  *
  */
-static int sctp_setsockopt_assocrtx(struct sock *sk, char *optval,
-				int optlen) {
+static int sctp_setsockopt_associnfo(struct sock *sk, char *optval, int optlen)
+{
 
 	struct sctp_assocparams assocparams;
 	struct sctp_association *asoc;
@@ -1736,14 +1751,18 @@ static int sctp_setsockopt_assocrtx(struct sock *sk, char *optval,
 static int sctp_setsockopt_mappedv4(struct sock *sk, char *optval, int optlen)
 {
 	int val;
+	struct sctp_opt *sp = sctp_sk(sk);
 
 	if (optlen < sizeof(int))
 		return -EINVAL;
 	if (get_user(val, (int *)optval))
 		return -EFAULT;
-	/* FIXME: Put real support here. */
+	if (val)
+		sp->v4mapped = 1;
+	else
+		sp->v4mapped = 0;
 
-	return -ENOPROTOOPT;
+	return 0;
 }
 
 /*
@@ -1794,7 +1813,6 @@ SCTP_STATIC int sctp_setsockopt(struct sock *sk, int level, int optname,
 				char *optval, int optlen)
 {
 	int retval = 0;
-	char *tmp;
 
 	SCTP_DEBUG_PRINTK("sctp_setsockopt(sk: %p... optname: %d)\n",
 			  sk, optname);
@@ -1814,38 +1832,25 @@ SCTP_STATIC int sctp_setsockopt(struct sock *sk, int level, int optname,
 	sctp_lock_sock(sk);
 
 	switch (optname) {
-	case SCTP_SOCKOPT_DEBUG_NAME:
-		/* BUG! we don't ever seem to free this memory. --jgrimm */
-		if (NULL == (tmp = kmalloc(optlen + 1, GFP_KERNEL))) {
-			retval = -ENOMEM;
-			goto out_unlock;
-		}
-
-		if (copy_from_user(tmp, optval, optlen)) {
-			retval = -EFAULT;
-			goto out_unlock;
-		}
-		tmp[optlen] = '\000';
-		sctp_sk(sk)->ep->debug_name = tmp;
-		break;
-
 	case SCTP_SOCKOPT_BINDX_ADD:
 		/* 'optlen' is the size of the addresses buffer. */
 		retval = sctp_setsockopt_bindx(sk, (struct sockaddr_storage *)
-					       optval, optlen, BINDX_ADD_ADDR);
+					       optval, optlen,
+					       SCTP_BINDX_ADD_ADDR);
 		break;
 
 	case SCTP_SOCKOPT_BINDX_REM:
 		/* 'optlen' is the size of the addresses buffer. */
 		retval = sctp_setsockopt_bindx(sk, (struct sockaddr_storage *)
-					       optval, optlen, BINDX_REM_ADDR);
+					       optval, optlen,
+					       SCTP_BINDX_REM_ADDR);
 		break;
 
 	case SCTP_DISABLE_FRAGMENTS:
 		retval = sctp_setsockopt_disable_fragments(sk, optval, optlen);
 		break;
 
-	case SCTP_SET_EVENTS:
+	case SCTP_EVENTS:
 		retval = sctp_setsockopt_events(sk, optval, optlen);
 		break;
 
@@ -1853,19 +1858,19 @@ SCTP_STATIC int sctp_setsockopt(struct sock *sk, int level, int optname,
 		retval = sctp_setsockopt_autoclose(sk, optval, optlen);
 		break;
 
-	case SCTP_SET_PEER_ADDR_PARAMS:
+	case SCTP_PEER_ADDR_PARAMS:
 		retval = sctp_setsockopt_peer_addr_params(sk, optval, optlen);
 		break;
 
 	case SCTP_INITMSG:
 		retval = sctp_setsockopt_initmsg(sk, optval, optlen);
 		break;
-	case SCTP_SET_DEFAULT_SEND_PARAM:
+	case SCTP_DEFAULT_SEND_PARAM:
 		retval = sctp_setsockopt_default_send_param(sk, optval,
 							    optlen);
 		break;
-	case SCTP_SET_PEER_PRIMARY_ADDR:
-		retval = sctp_setsockopt_peer_prim(sk, optval, optlen);
+	case SCTP_PRIMARY_ADDR:
+		retval = sctp_setsockopt_primary_addr(sk, optval, optlen);
 		break;
 	case SCTP_NODELAY:
 		retval = sctp_setsockopt_nodelay(sk, optval, optlen);
@@ -1873,8 +1878,8 @@ SCTP_STATIC int sctp_setsockopt(struct sock *sk, int level, int optname,
 	case SCTP_RTOINFO:
 		retval = sctp_setsockopt_rtoinfo(sk, optval, optlen);
 		break;
-	case SCTP_ASSOCRTXINFO:
-		retval = sctp_setsockopt_assocrtx(sk, optval, optlen);
+	case SCTP_ASSOCINFO:
+		retval = sctp_setsockopt_associnfo(sk, optval, optlen);
 		break;
 	case SCTP_I_WANT_MAPPED_V4_ADDR:
 		retval = sctp_setsockopt_mappedv4(sk, optval, optlen);
@@ -1887,7 +1892,6 @@ SCTP_STATIC int sctp_setsockopt(struct sock *sk, int level, int optname,
 		break;
 	};
 
-out_unlock:
 	sctp_release_sock(sk);
 
 out_nounlock:
@@ -2163,7 +2167,7 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
 	}
 
 	/* Default Peer Address Parameters.  These defaults can
-	 * be modified via SCTP_SET_PEER_ADDR_PARAMS
+	 * be modified via SCTP_PEER_ADDR_PARAMS
 	 */
 	sp->paddrparam.spp_hbinterval = (sctp_hb_interval / HZ) * 1000;
 	sp->paddrparam.spp_pathmaxrxt = sctp_max_retrans_path;
@@ -2309,6 +2313,9 @@ static int sctp_getsockopt_sctp_status(struct sock *sk, int len, char *optval,
 	status.sstat_primary.spinfo_assoc_id = sctp_assoc2id(transport->asoc);
 	memcpy(&status.sstat_primary.spinfo_address,
 	       &(transport->ipaddr), sizeof(union sctp_addr));
+	/* Map ipv4 address into v4-mapped-on-v6 address.  */
+	sctp_get_pf_specific(sk->sk_family)->addr_v4map(sctp_sk(sk),
+		(union sctp_addr *)&status.sstat_primary.spinfo_address);
 	status.sstat_primary.spinfo_state = transport->active;
 	status.sstat_primary.spinfo_cwnd = transport->cwnd;
 	status.sstat_primary.spinfo_srtt = transport->srtt;
@@ -2408,12 +2415,13 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
 	return 0;
 }
 
-/* 7.1.15 Set notification and ancillary events (SCTP_SET_EVENTS)
+/* 7.1.15 Set notification and ancillary events (SCTP_EVENTS)
  *
  * This socket option is used to specify various notifications and
  * ancillary data the user wishes to receive.
  */
-static int sctp_getsockopt_set_events(struct sock *sk, int len, char *optval, int *optlen)
+static int sctp_getsockopt_events(struct sock *sk, int len, char *optval,
+				  int *optlen)
 {
 	if (len != sizeof(struct sctp_event_subscribe))
 		return -EINVAL;
@@ -2516,7 +2524,7 @@ out:
 	return retval;
 }
 
-/* 7.1.13 Peer Address Parameters (SCTP_SET_PEER_ADDR_PARAMS)
+/* 7.1.13 Peer Address Parameters (SCTP_PEER_ADDR_PARAMS)
  *
  * Applications can enable or disable heartbeats for any peer address of
  * an association, modify an address's heartbeat interval, force a
@@ -2645,6 +2653,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
 	struct sctp_getaddrs getaddrs;
 	struct sctp_transport *from;
 	struct sockaddr_storage *to;
+	union sctp_addr temp;
+	struct sctp_opt *sp = sctp_sk(sk);
 
 	if (len != sizeof(struct sctp_getaddrs))
 		return -EINVAL;
@@ -2663,7 +2673,9 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
 	to = getaddrs.addrs;
 	list_for_each(pos, &asoc->peer.transport_addr_list) {
 		from = list_entry(pos, struct sctp_transport, transports);
-		if (copy_to_user(to, &from->ipaddr, sizeof(from->ipaddr)))
+		memcpy(&temp, &from->ipaddr, sizeof(temp));
+		sctp_get_pf_specific(sk->sk_family)->addr_v4map(sp, &temp);
+		if (copy_to_user(to, &temp, sizeof(temp)))
 			return -EFAULT;
 		to ++;
 		cnt ++;
@@ -2725,6 +2737,8 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
 	struct sctp_getaddrs getaddrs;
 	struct sctp_sockaddr_entry *from;
 	struct sockaddr_storage *to;
+	union sctp_addr temp;
+	struct sctp_opt *sp = sctp_sk(sk);
 
 	if (len != sizeof(struct sctp_getaddrs))
 		return -EINVAL;
@@ -2753,7 +2767,9 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
 		from = list_entry(pos,
 				struct sctp_sockaddr_entry,
 				list);
-		if (copy_to_user(to, &from->a, sizeof(from->a)))
+		memcpy(&temp, &from->a, sizeof(temp));
+		sctp_get_pf_specific(sk->sk_family)->addr_v4map(sp, &temp);
+		if (copy_to_user(to, &temp, sizeof(temp)))
 			return -EFAULT;
 		to ++;
 		cnt ++;
@@ -2766,35 +2782,39 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
 	return 0;
 }
 
-/* 7.1.10 Set Peer Primary Address (SCTP_SET_PEER_PRIMARY_ADDR)
+/* 7.1.10 Set Primary Address (SCTP_PRIMARY_ADDR)
  *
  * Requests that the local SCTP stack use the enclosed peer address as
  * the association primary.  The enclosed address must be one of the
  * association peer's addresses.
  */
-static int sctp_getsockopt_peer_prim(struct sock *sk, int len,
-				char *optval, int *optlen)
+static int sctp_getsockopt_primary_addr(struct sock *sk, int len,
+					char *optval, int *optlen)
 {
-	struct sctp_setpeerprim prim;
+	struct sctp_prim prim;
 	struct sctp_association *asoc;
+	struct sctp_opt *sp = sctp_sk(sk);
 
-	if (len != sizeof(struct sctp_setpeerprim))
+	if (len != sizeof(struct sctp_prim))
 		return -EINVAL;
 
-	if (copy_from_user(&prim, optval, sizeof(struct sctp_setpeerprim)))
+	if (copy_from_user(&prim, optval, sizeof(struct sctp_prim)))
 		return -EFAULT;
 
-	asoc = sctp_id2assoc(sk, prim.sspp_assoc_id);
+	asoc = sctp_id2assoc(sk, prim.ssp_assoc_id);
 	if (!asoc)
 		return -EINVAL;
 
 	if (!asoc->peer.primary_path)
 		return -ENOTCONN;
 
-	memcpy(&prim.sspp_addr, &asoc->peer.primary_path->ipaddr,
+	memcpy(&prim.ssp_addr, &asoc->peer.primary_path->ipaddr,
 	       sizeof(union sctp_addr));
 
-	if (copy_to_user(optval, &prim, sizeof(struct sctp_setpeerprim)))
+	sctp_get_pf_specific(sk->sk_family)->addr_v4map(sp,
+			(union sctp_addr *)&prim.ssp_addr);
+
+	if (copy_to_user(optval, &prim, sizeof(struct sctp_prim)))
 		return -EFAULT;
 
 	return 0;
@@ -2808,6 +2828,8 @@ static int sctp_getsockopt_peer_prim(struct sock *sk, int len,
  *   specify a default set of parameters that would normally be supplied
  *   through the inclusion of ancillary data.  This socket option allows
  *   such an application to set the default sctp_sndrcvinfo structure.
+
+
  *   The application that wishes to use this socket option simply passes
  *   in to this call the sctp_sndrcvinfo structure defined in Section
  *   5.2.2) The input parameters accepted by this call include
@@ -2942,8 +2964,9 @@ static int sctp_getsockopt_rtoinfo(struct sock *sk, int len, char *optval,
  * See [SCTP] for more information.
  *
  */
-static int sctp_getsockopt_assocrtx(struct sock *sk, int len, char *optval,
-				int *optlen) {
+static int sctp_getsockopt_associnfo(struct sock *sk, int len, char *optval,
+				     int *optlen)
+{
 
 	struct sctp_assocparams assocparams;
 	struct sctp_association *asoc;
@@ -3014,12 +3037,13 @@ static int sctp_getsockopt_mappedv4(struct sock *sk, int len,
 				    char *optval, int *optlen)
 {
 	int val;
+	struct sctp_opt *sp = sctp_sk(sk);
+
 	if (len < sizeof(int))
 		return -EINVAL;
 
 	len = sizeof(int);
-	/* FIXME: Until we have support, return disabled. */
-	val = 0;
+	val = sp->v4mapped;
 	if (put_user(len, optlen))
 		return -EFAULT;
 	if (copy_to_user(optval, &val, len))
@@ -3091,8 +3115,8 @@ SCTP_STATIC int sctp_getsockopt(struct sock *sk, int level, int optname,
 		retval = sctp_getsockopt_disable_fragments(sk, len, optval,
 							   optlen);
 		break;
-	case SCTP_SET_EVENTS:
-		retval = sctp_getsockopt_set_events(sk, len, optval, optlen);
+	case SCTP_EVENTS:
+		retval = sctp_getsockopt_events(sk, len, optval, optlen);
 		break;
 	case SCTP_AUTOCLOSE:
 		retval = sctp_getsockopt_autoclose(sk, len, optval, optlen);
@@ -3100,7 +3124,7 @@ SCTP_STATIC int sctp_getsockopt(struct sock *sk, int level, int optname,
 	case SCTP_SOCKOPT_PEELOFF:
 		retval = sctp_getsockopt_peeloff(sk, len, optval, optlen);
 		break;
-	case SCTP_GET_PEER_ADDR_PARAMS:
+	case SCTP_PEER_ADDR_PARAMS:
 		retval = sctp_getsockopt_peer_addr_params(sk, len, optval,
 							  optlen);
 		break;
@@ -3123,12 +3147,12 @@ SCTP_STATIC int sctp_getsockopt(struct sock *sk, int level, int optname,
 		retval = sctp_getsockopt_local_addrs(sk, len, optval,
 						     optlen);
 		break;
-	case SCTP_SET_DEFAULT_SEND_PARAM:
+	case SCTP_DEFAULT_SEND_PARAM:
 		retval = sctp_getsockopt_default_send_param(sk, len,
 							    optval, optlen);
 		break;
-	case SCTP_SET_PEER_PRIMARY_ADDR:
-		retval = sctp_getsockopt_peer_prim(sk, len, optval, optlen);
+	case SCTP_PRIMARY_ADDR:
+		retval = sctp_getsockopt_primary_addr(sk, len, optval, optlen);
 		break;
 	case SCTP_NODELAY:
 		retval = sctp_getsockopt_nodelay(sk, len, optval, optlen);
@@ -3136,8 +3160,8 @@ SCTP_STATIC int sctp_getsockopt(struct sock *sk, int level, int optname,
 	case SCTP_RTOINFO:
 		retval = sctp_getsockopt_rtoinfo(sk, len, optval, optlen);
 		break;
-	case SCTP_ASSOCRTXINFO:
-		retval = sctp_getsockopt_assocrtx(sk, len, optval, optlen);
+	case SCTP_ASSOCINFO:
+		retval = sctp_getsockopt_associnfo(sk, len, optval, optlen);
 		break;
 	case SCTP_I_WANT_MAPPED_V4_ADDR:
 		retval = sctp_getsockopt_mappedv4(sk, len, optval, optlen);
@@ -3865,7 +3889,7 @@ static inline int sctp_verify_addr(struct sock *sk, union sctp_addr *addr,
 		return -EINVAL;
 
 	/* Is this a valid SCTP address?  */
-	if (!af->addr_valid(addr))
+	if (!af->addr_valid(addr, sctp_sk(sk)))
 		return -EINVAL;
 
 	if (!sctp_sk(sk)->pf->send_verify(sctp_sk(sk), (addr)))
@@ -4210,7 +4234,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
 	 */
 	sctp_skb_for_each(skb, &oldsk->sk_receive_queue, tmp) {
 		event = sctp_skb2event(skb);
-		if (event->asoc == assoc) {
+		if (event->sndrcvinfo.sinfo_assoc_id == assoc) {
 			__skb_unlink(skb, skb->list);
 			__skb_queue_tail(&newsk->sk_receive_queue, skb);
 		}
@@ -4239,7 +4263,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
 		 */
 		sctp_skb_for_each(skb, &oldsp->pd_lobby, tmp) {
 			event = sctp_skb2event(skb);
-			if (event->asoc == assoc) {
+			if (event->sndrcvinfo.sinfo_assoc_id == assoc) {
 				__skb_unlink(skb, skb->list);
 				__skb_queue_tail(queue, skb);
 			}
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 9728fc5b7bf2..485d77015399 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -117,6 +117,7 @@ struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
 	INIT_LIST_HEAD(&peer->transmitted);
 	INIT_LIST_HEAD(&peer->send_ready);
 	INIT_LIST_HEAD(&peer->transports);
+	sctp_packet_init(&peer->packet, peer, 0, 0);
 
 	/* Set up the retransmission timer.  */
 	init_timer(&peer->T3_rtx_timer);
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 4a9d9d2b5a5e..e56e1fdb156c 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -35,6 +35,8 @@
  * Written or modified by:
  *    Jon Grimm             <jgrimm@us.ibm.com>
  *    La Monte H.P. Yarroll <piggy@acm.org>
+ *    Ardelle Fan	    <ardelle.fan@intel.com>
+ *    Sridhar Samudrala     <sri@us.ibm.com>
  *
  * Any bugs reported given to us we will try to fix... any fixes shared will
  * be incorporated into the next SCTP release.
@@ -46,10 +48,12 @@
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
 
-static void sctp_ulpevent_set_owner_r(struct sk_buff *skb,
-				      struct sctp_association *asoc);
-static void sctp_ulpevent_set_owner(struct sk_buff *skb,
-				    const struct sctp_association *asoc);
+static inline void sctp_ulpevent_set_owner(struct sctp_ulpevent *event,
+					   const struct sctp_association *asoc);
+static inline void sctp_ulpevent_release_owner(struct sctp_ulpevent *event);
+static void sctp_ulpevent_receive_data(struct sctp_ulpevent *event,
+				       struct sctp_association *asoc);
+static void sctp_ulpevent_release_data(struct sctp_ulpevent *event);
 
 /* Create a new sctp_ulpevent.  */
 struct sctp_ulpevent *sctp_ulpevent_new(int size, int msg_flags, int gfp)
@@ -62,30 +66,19 @@ struct sctp_ulpevent *sctp_ulpevent_new(int size, int msg_flags, int gfp)
 		goto fail;
 
 	event = sctp_skb2event(skb);
-	event = sctp_ulpevent_init(event, msg_flags);
-	if (!event)
-		goto fail_init;
+	sctp_ulpevent_init(event, msg_flags);
+
 	return event;
 
-fail_init:
-	kfree_skb(skb);
 fail:
 	return NULL;
 }
 
 /* Initialize an ULP event from an given skb.  */
-struct sctp_ulpevent *sctp_ulpevent_init(struct sctp_ulpevent *event,
-					 int msg_flags)
+void sctp_ulpevent_init(struct sctp_ulpevent *event, int msg_flags)
 {
 	memset(event, sizeof(struct sctp_ulpevent), 0x00);
 	event->msg_flags = msg_flags;
-	return event;
-}
-
-/* Dispose of an event.  */
-void sctp_ulpevent_free(struct sctp_ulpevent *event)
-{
-	kfree_skb(sctp_event2skb(event));
 }
 
 /* Is this a MSG_NOTIFICATION?  */
@@ -189,7 +182,7 @@ struct sctp_ulpevent  *sctp_ulpevent_make_assoc_change(
 	 * All notifications for a given association have the same association
 	 * identifier.  For TCP style socket, this field is ignored.
 	 */
-	sctp_ulpevent_set_owner(skb, asoc);
+	sctp_ulpevent_set_owner(event, asoc);
 	sac->sac_assoc_id = sctp_assoc2id(asoc);
 
 	return event;
@@ -281,7 +274,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_peer_addr_change(
 	 * All notifications for a given association have the same association
 	 * identifier.  For TCP style socket, this field is ignored.
 	 */
-	sctp_ulpevent_set_owner(skb, asoc);
+	sctp_ulpevent_set_owner(event, asoc);
 	spc->spc_assoc_id = sctp_assoc2id(asoc);
 
 	/* Sockets API Extensions for SCTP
@@ -294,6 +287,11 @@ struct sctp_ulpevent *sctp_ulpevent_make_peer_addr_change(
 	 */
 	memcpy(&spc->spc_aaddr, aaddr, sizeof(struct sockaddr_storage));
 
+	/* Map ipv4 address into v4-mapped-on-v6 address.  */
+	sctp_get_pf_specific(asoc->base.sk->sk_family)->addr_v4map(
+					sctp_sk(asoc->base.sk),
+					(union sctp_addr *)&spc->spc_aaddr);
+
 	return event;
 
 fail:
@@ -336,7 +334,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_remote_error(
 	/* Copy the skb to a new skb with room for us to prepend
 	 * notification with.
 	 */
-	skb = skb_copy_expand(chunk->skb, sizeof(struct sctp_remote_error), 
+	skb = skb_copy_expand(chunk->skb, sizeof(struct sctp_remote_error),
 			      0, gfp);
 
 	/* Pull off the rest of the cause TLV from the chunk.  */
@@ -346,10 +344,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_remote_error(
 
 	/* Embed the event fields inside the cloned skb.  */
 	event = sctp_skb2event(skb);
-	event = sctp_ulpevent_init(event, MSG_NOTIFICATION);
-
-	if (!event)
-		goto fail;
+	sctp_ulpevent_init(event, MSG_NOTIFICATION);
 
 	sre = (struct sctp_remote_error *)
 		skb_push(skb, sizeof(struct sctp_remote_error));
@@ -402,8 +397,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_remote_error(
 	 * All notifications for a given association have the same association
 	 * identifier.  For TCP style socket, this field is ignored.
 	 */
-	skb = sctp_event2skb(event);
-	sctp_ulpevent_set_owner(skb, asoc);
+	sctp_ulpevent_set_owner(event, asoc);
 	sre->sre_assoc_id = sctp_assoc2id(asoc);
 
 	return event;
@@ -442,9 +436,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_send_failed(
 
 	/* Embed the event fields inside the cloned skb.  */
 	event = sctp_skb2event(skb);
-	event = sctp_ulpevent_init(event, MSG_NOTIFICATION);
-	if (!event)
-		goto fail;
+	sctp_ulpevent_init(event, MSG_NOTIFICATION);
 
 	ssf = (struct sctp_send_failed *)
 		skb_push(skb, sizeof(struct sctp_send_failed));
@@ -502,7 +494,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_send_failed(
 	memcpy(&ssf->ssf_info, &chunk->sinfo, sizeof(struct sctp_sndrcvinfo));
 
 	/* Per TSVWG discussion with Randy. Allow the application to
-	 * ressemble a fragmented message. 
+	 * ressemble a fragmented message.
 	 */
 	ssf->ssf_info.sinfo_flags = chunk->chunk_hdr->flags;
 
@@ -515,8 +507,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_send_failed(
 	 * same association identifier.  For TCP style socket, this field is
 	 * ignored.
 	 */
-	skb = sctp_event2skb(event);
-	sctp_ulpevent_set_owner(skb, asoc);
+	sctp_ulpevent_set_owner(event, asoc);
 	ssf->ssf_assoc_id = sctp_assoc2id(asoc);
 	return event;
 
@@ -579,7 +570,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_shutdown_event(
 	 * All notifications for a given association have the same association
 	 * identifier.  For TCP style socket, this field is ignored.
 	 */
-	sctp_ulpevent_set_owner(skb, asoc);
+	sctp_ulpevent_set_owner(event, asoc);
 	sse->sse_assoc_id = sctp_assoc2id(asoc);
 
 	return event;
@@ -596,12 +587,12 @@ fail:
  * 5.2.2 SCTP Header Information Structure (SCTP_SNDRCV)
  */
 struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
-						struct sctp_chunk *chunk, 
+						struct sctp_chunk *chunk,
 						int gfp)
 {
 	struct sctp_ulpevent *event;
 	struct sctp_sndrcvinfo *info;
-	struct sk_buff *skb, *list;
+	struct sk_buff *skb;
 	size_t padding, len;
 
 	/* Clone the original skb, sharing the data.  */
@@ -627,24 +618,15 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
 	/* Fixup cloned skb with just this chunks data.  */
 	skb_trim(skb, chunk->chunk_end - padding - skb->data);
 
-	/* Set up a destructor to do rwnd accounting.  */
-	sctp_ulpevent_set_owner_r(skb, asoc);
-
 	/* Embed the event fields inside the cloned skb.  */
 	event = sctp_skb2event(skb);
 
 	/* Initialize event with flags 0.  */
-	event = sctp_ulpevent_init(event, 0);
-	if (!event)
-		goto fail_init;
+	sctp_ulpevent_init(event, 0);
 
 	event->iif = sctp_chunk_iif(chunk);
-	/* Note:  Not clearing the entire event struct as
-	 * this is just a fragment of the real event.  However,
-	 * we still need to do rwnd accounting.
-	 */
-	for (list = skb_shinfo(skb)->frag_list; list; list = list->next)
-		sctp_ulpevent_set_owner_r(list, asoc);
+
+	sctp_ulpevent_receive_data(event, asoc);
 
 	info = (struct sctp_sndrcvinfo *) &event->sndrcvinfo;
 
@@ -735,9 +717,6 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
 
 	return event;
 
-fail_init:
-	kfree_skb(skb);
-
 fail:
 	return NULL;
 }
@@ -754,7 +733,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_pdapi(
 	const struct sctp_association *asoc, __u32 indication, int gfp)
 {
 	struct sctp_ulpevent *event;
-	struct sctp_rcv_pdapi_event *pd;
+	struct sctp_pdapi_event *pd;
 	struct sk_buff *skb;
 
 	event = sctp_ulpevent_new(sizeof(struct sctp_assoc_change),
@@ -763,8 +742,8 @@ struct sctp_ulpevent *sctp_ulpevent_make_pdapi(
 		goto fail;
 
 	skb = sctp_event2skb(event);
-	pd = (struct sctp_rcv_pdapi_event *)
-		skb_put(skb, sizeof(struct sctp_rcv_pdapi_event));
+	pd = (struct sctp_pdapi_event *)
+		skb_put(skb, sizeof(struct sctp_pdapi_event));
 
 	/* pdapi_type
 	 *   It should be SCTP_PARTIAL_DELIVERY_EVENT
@@ -779,9 +758,9 @@ struct sctp_ulpevent *sctp_ulpevent_make_pdapi(
 	 *
 	 * This field is the total length of the notification data, including
 	 * the notification header.  It will generally be sizeof (struct
-	 * sctp_rcv_pdapi_event).
+	 * sctp_pdapi_event).
 	 */
-	pd->pdapi_length = sizeof(struct sctp_rcv_pdapi_event);
+	pd->pdapi_length = sizeof(struct sctp_pdapi_event);
 
         /*  pdapi_indication: 32 bits (unsigned integer)
 	 *
@@ -793,6 +772,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_pdapi(
 	 *
 	 * The association id field, holds the identifier for the association.
 	 */
+	sctp_ulpevent_set_owner(event, asoc);
 	pd->pdapi_assoc_id = sctp_assoc2id(asoc);
 
 	return event;
@@ -810,7 +790,7 @@ __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event)
 
 	skb = sctp_event2skb((struct sctp_ulpevent *)event);
 	notification = (union sctp_notification *) skb->data;
-	return notification->h.sn_type;
+	return notification->sn_header.sn_type;
 }
 
 /* Copy out the sndrcvinfo into a msghdr.  */
@@ -824,69 +804,115 @@ void sctp_ulpevent_read_sndrcvinfo(const struct sctp_ulpevent *event,
 	}
 }
 
-/* Do accounting for bytes just read by user.  */
-static void sctp_rcvmsg_rfree(struct sk_buff *skb)
+/* Stub skb destructor.  */
+static void sctp_stub_rfree(struct sk_buff *skb)
 {
-	struct sctp_association *asoc;
-	struct sctp_ulpevent *event;
-
-	/* Current stack structures assume that the rcv buffer is
-	 * per socket.   For UDP style sockets this is not true as
-	 * multiple associations may be on a single UDP-style socket.
-	 * Use the local private area of the skb to track the owning
-	 * association.
-	 */
-	event = sctp_skb2event(skb);
-	asoc = event->asoc;
-	sctp_assoc_rwnd_increase(asoc, skb_headlen(skb));
-	sctp_association_put(asoc);
+/* WARNING:  This function is just a warning not to use the
+ * skb destructor.  If the skb is shared, we may get the destructor
+ * callback on some processor that does not own the sock_lock.  This
+ * was occuring with PACKET socket applications that were monitoring
+ * our skbs.   We can't take the sock_lock, because we can't risk
+ * recursing if we do really own the sock lock.  Instead, do all
+ * of our rwnd manipulation while we own the sock_lock outright.
+ */
 }
 
-/* Charge receive window for bytes received.  */
-static void sctp_ulpevent_set_owner_r(struct sk_buff *skb,
-				      struct sctp_association *asoc)
+/* Hold the association in case the msg_name needs read out of
+ * the association.
+ */
+static inline void sctp_ulpevent_set_owner(struct sctp_ulpevent *event,
+					   const struct sctp_association *asoc)
 {
-	struct sctp_ulpevent *event;
+	struct sk_buff *skb;
 
-	/* The current stack structures assume that the rcv buffer is
-	 * per socket.  For UDP-style sockets this is not true as
-	 * multiple associations may be on a single UDP-style socket.
-	 * We use the local private area of the skb to track the owning
-	 * association.
+	/* Cast away the const, as we are just wanting to
+	 * bump the reference count.
 	 */
-	sctp_association_hold(asoc);
+	sctp_association_hold((struct sctp_association *)asoc);
+	skb = sctp_event2skb(event);
 	skb->sk = asoc->base.sk;
-	event = sctp_skb2event(skb);
-	event->asoc = asoc;
+	event->sndrcvinfo.sinfo_assoc_id = sctp_assoc2id(asoc);
+	skb->destructor = sctp_stub_rfree;
+}
 
-	skb->destructor = sctp_rcvmsg_rfree;
+/* A simple destructor to give up the reference to the association. */
+static inline void sctp_ulpevent_release_owner(struct sctp_ulpevent *event)
+{
+	sctp_association_put(event->sndrcvinfo.sinfo_assoc_id);
+}
 
+/* Do accounting for bytes received and hold a reference to the association
+ * for each skb.
+ */
+static void sctp_ulpevent_receive_data(struct sctp_ulpevent *event,
+				       struct sctp_association *asoc)
+{
+	struct sk_buff *skb, *frag;
+
+	skb = sctp_event2skb(event);
+	/* Set the owner and charge rwnd for bytes received.  */
+	sctp_ulpevent_set_owner(event, asoc);
 	sctp_assoc_rwnd_decrease(asoc, skb_headlen(skb));
+
+	/* Note:  Not clearing the entire event struct as this is just a
+	 * fragment of the real event.  However, we still need to do rwnd
+	 * accounting.
+	 * In general, the skb passed from IP can have only 1 level of
+	 * fragments. But we allow multiple levels of fragments. 
+	 */
+	for (frag = skb_shinfo(skb)->frag_list; frag; frag = frag->next) {
+		sctp_ulpevent_receive_data(sctp_skb2event(frag), asoc);
+	}
 }
 
-/* A simple destructor to give up the reference to the association. */
-static void sctp_ulpevent_rfree(struct sk_buff *skb)
+/* Do accounting for bytes just read by user and release the references to
+ * the association.
+ */ 
+static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
 {
-	struct sctp_ulpevent *event;
+	struct sk_buff *skb, *frag;
 
-	event = sctp_skb2event(skb);
-	sctp_association_put(event->asoc);
+	/* Current stack structures assume that the rcv buffer is
+	 * per socket.   For UDP style sockets this is not true as
+	 * multiple associations may be on a single UDP-style socket.
+	 * Use the local private area of the skb to track the owning
+	 * association.
+	 */
+
+	skb = sctp_event2skb(event);
+	sctp_assoc_rwnd_increase(event->sndrcvinfo.sinfo_assoc_id,
+				 skb_headlen(skb));
+
+	/* Don't forget the fragments. */
+	for (frag = skb_shinfo(skb)->frag_list; frag; frag = frag->next) {
+		/* NOTE:  skb_shinfos are recursive. Although IP returns
+		 * skb's with only 1 level of fragments, SCTP reassembly can
+		 * increase the levels.
+		 */
+		sctp_ulpevent_release_data(sctp_skb2event(frag));
+	}
+	sctp_ulpevent_release_owner(event);
 }
 
-/* Hold the association in case the msg_name needs read out of
- * the association.
+/* Free a ulpevent that has an owner.  It includes releasing the reference
+ * to the owner, updating the rwnd in case of a DATA event and freeing the
+ * skb.
+ * See comments in sctp_stub_rfree().
  */
-static void sctp_ulpevent_set_owner(struct sk_buff *skb,
-				    const struct sctp_association *asoc)
+void sctp_ulpevent_free(struct sctp_ulpevent *event)
 {
-	struct sctp_ulpevent *event;
+	if (sctp_ulpevent_is_notification(event))
+		sctp_ulpevent_release_owner(event);
+	else
+		sctp_ulpevent_release_data(event);
 
-	/* Cast away the const, as we are just wanting to
-	 * bump the reference count.
-	 */
-	sctp_association_hold((struct sctp_association *)asoc);
-	skb->sk = asoc->base.sk;
-	event = sctp_skb2event(skb);
-	event->asoc = (struct sctp_association *)asoc;
-	skb->destructor = sctp_ulpevent_rfree;
+	kfree_skb(sctp_event2skb(event));
+}
+
+/* Purge the skb lists holding ulpevents. */
+void sctp_queue_purge_ulpevents(struct sk_buff_head *list)
+{
+	struct sk_buff *skb;
+	while ((skb = skb_dequeue(list)) != NULL)
+		sctp_ulpevent_free(sctp_skb2event(skb));
 }
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index 8a11bc28bd38..a02b2143239b 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -235,9 +235,9 @@ int sctp_ulpq_tail_event(struct sctp_ulpq *ulpq, struct sctp_ulpevent *event)
 
 out_free:
 	if (sctp_event2skb(event)->list)
-		skb_queue_purge(sctp_event2skb(event)->list);
+		sctp_queue_purge_ulpevents(sctp_event2skb(event)->list);
 	else
-		kfree_skb(sctp_event2skb(event));
+		sctp_ulpevent_free(event);
 	return 0;
 }
 
@@ -289,7 +289,7 @@ static inline void sctp_ulpq_store_reasm(struct sctp_ulpq *ulpq,
  * payload was fragmented on the way and ip had to reassemble them.
  * We add the rest of skb's to the first skb's fraglist.
  */
-static inline struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff *f_frag, struct sk_buff *l_frag)
+static struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff *f_frag, struct sk_buff *l_frag)
 {
 	struct sk_buff *pos;
 	struct sctp_ulpevent *event;
@@ -325,11 +325,10 @@ static inline struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff *
 
 		/* Remove the fragment from the reassembly queue.  */
 		__skb_unlink(pos, pos->list);
-
+	
 		/* Break if we have reached the last fragment.  */
 		if (pos == l_frag)
 			break;
-
 		pos->next = pnext;
 		pos = pnext;
 	};
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index 942f17b86ad1..34091a2f8a3f 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -305,7 +305,6 @@ int register_wan_device(struct wan_device *wandev)
 	wandev->dev  = NULL;
 	wandev->next = wanrouter_router_devlist;
 	wanrouter_router_devlist = wandev;
-        MOD_INC_USE_COUNT;	/* prevent module from unloading */
 	return 0;
 }
 
@@ -350,7 +349,6 @@ int unregister_wan_device(char *name)
 		wanrouter_router_devlist = wandev->next;
 
 	wanrouter_proc_delete(wandev);
-        MOD_DEC_USE_COUNT;
 	return 0;
 }
 
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index aa6bb0eb2e66..86bd26e1cb19 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -554,7 +554,7 @@ xfrm_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto,
 }
 
 struct xfrm_state *
-xfrm_find_acq(u8 mode, u16 reqid, u8 proto, 
+xfrm_find_acq(u8 mode, u32 reqid, u8 proto, 
 	      xfrm_address_t *daddr, xfrm_address_t *saddr, 
 	      int create, unsigned short family)
 {