Merge branch 'master' of /home/trondmy/kernel/linux-2.6/

Conflicts:

	fs/nfs/inode.c
	fs/super.c

Fix conflicts between patch 'NFS: Split fs/nfs/inode.c' and patch
'VFS: Permit filesystem to override root dentry on mount'

25 files changed, 635 insertions, 122 deletions

diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index c304ef1513b9..a48a5d580408 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -229,20 +229,15 @@ int atm_mpoa_delete_qos(struct atm_mpoa_qos *entry)
 /* this is buggered - we need locking for qos_head */
 void atm_mpoa_disp_qos(struct seq_file *m)
 {
-        unsigned char *ip;
-        char ipaddr[16];
         struct atm_mpoa_qos *qos;
 
         qos = qos_head;
         seq_printf(m, "QoS entries for shortcuts:\n");
         seq_printf(m, "IP address\n  TX:max_pcr pcr     min_pcr max_cdv max_sdu\n  RX:max_pcr pcr     min_pcr max_cdv max_sdu\n");
 
-        ipaddr[sizeof(ipaddr)-1] = '\0';
         while (qos != NULL) {
-                ip = (unsigned char *)&qos->ipaddr;
-                sprintf(ipaddr, "%u.%u.%u.%u", NIPQUAD(ip));
                 seq_printf(m, "%u.%u.%u.%u\n     %-7d %-7d %-7d %-7d %-7d\n     %-7d %-7d %-7d %-7d %-7d\n",
-                                NIPQUAD(ipaddr),
+                                NIPQUAD(qos->ipaddr),
                                 qos->qos.txtp.max_pcr, qos->qos.txtp.pcr, qos->qos.txtp.min_pcr, qos->qos.txtp.max_cdv, qos->qos.txtp.max_sdu,
                                 qos->qos.rxtp.max_pcr, qos->qos.rxtp.pcr, qos->qos.rxtp.min_pcr, qos->qos.rxtp.max_cdv, qos->qos.rxtp.max_sdu);
                 qos = qos->next;
@@ -1083,7 +1078,6 @@ static void MPOA_trigger_rcvd(struct k_message *msg, struct mpoa_client *mpc)
 static void check_qos_and_open_shortcut(struct k_message *msg, struct mpoa_client *client, in_cache_entry *entry)
 {
         uint32_t dst_ip = msg->content.in_info.in_dst_ip;
-        unsigned char *ip __attribute__ ((unused)) = (unsigned char *)&dst_ip;
         struct atm_mpoa_qos *qos = atm_mpoa_search_qos(dst_ip);
         eg_cache_entry *eg_entry = client->eg_ops->get_by_src_ip(dst_ip, client);
 
@@ -1097,7 +1091,7 @@ static void check_qos_and_open_shortcut(struct k_message *msg, struct mpoa_clien
                                     entry->shortcut = eg_entry->shortcut;
                 }
                 if(entry->shortcut){
-                        dprintk("mpoa: (%s) using egress SVC to reach %u.%u.%u.%u\n",client->dev->name, NIPQUAD(ip));
+                        dprintk("mpoa: (%s) using egress SVC to reach %u.%u.%u.%u\n",client->dev->name, NIPQUAD(dst_ip));
                         client->eg_ops->put(eg_entry);
                         return;
                 }
@@ -1123,8 +1117,7 @@ static void MPOA_res_reply_rcvd(struct k_message *msg, struct mpoa_client *mpc)
 
         uint32_t dst_ip = msg->content.in_info.in_dst_ip;
         in_cache_entry *entry = mpc->in_ops->get(dst_ip, mpc);
-        ip = (unsigned char *)&dst_ip;
-        dprintk("mpoa: (%s) MPOA_res_reply_rcvd: ip %u.%u.%u.%u\n", mpc->dev->name, NIPQUAD(ip));
+        dprintk("mpoa: (%s) MPOA_res_reply_rcvd: ip %u.%u.%u.%u\n", mpc->dev->name, NIPQUAD(dst_ip));
         ddprintk("mpoa: (%s) MPOA_res_reply_rcvd() entry = %p", mpc->dev->name, entry);
         if(entry == NULL){
                 printk("\nmpoa: (%s) ARGH, received res. reply for an entry that doesn't exist.\n", mpc->dev->name);
diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c
index 64ddebb64060..781ed1b9329d 100644
--- a/net/atm/mpoa_caches.c
+++ b/net/atm/mpoa_caches.c
@@ -223,7 +223,6 @@ static void in_cache_remove_entry(in_cache_entry *entry,
    but an easy one... */
 static void clear_count_and_expired(struct mpoa_client *client)
 {
-        unsigned char *ip;
         in_cache_entry *entry, *next_entry;
         struct timeval now;
 
@@ -236,8 +235,7 @@ static void clear_count_and_expired(struct mpoa_client *client)
                 next_entry = entry->next;
                 if((now.tv_sec - entry->tv.tv_sec)
                    > entry->ctrl_info.holding_time){
-                        ip = (unsigned char*)&entry->ctrl_info.in_dst_ip;
-                        dprintk("mpoa: mpoa_caches.c: holding time expired, ip = %u.%u.%u.%u\n", NIPQUAD(ip));
+                        dprintk("mpoa: mpoa_caches.c: holding time expired, ip = %u.%u.%u.%u\n", NIPQUAD(entry->ctrl_info.in_dst_ip));
                         client->in_ops->remove_entry(entry, client);
                 }
                 entry = next_entry;
@@ -455,7 +453,6 @@ static void eg_cache_remove_entry(eg_cache_entry *entry,
 
 static eg_cache_entry *eg_cache_add_entry(struct k_message *msg, struct mpoa_client *client)
 {
-        unsigned char *ip;
         eg_cache_entry *entry = kmalloc(sizeof(eg_cache_entry), GFP_KERNEL);
 
         if (entry == NULL) {
@@ -463,8 +460,7 @@ static eg_cache_entry *eg_cache_add_entry(struct k_message *msg, struct mpoa_cli
                 return NULL;
         }
 
-        ip = (unsigned char *)&msg->content.eg_info.eg_dst_ip;
-        dprintk("mpoa: mpoa_caches.c: adding an egress entry, ip = %u.%u.%u.%u, this should be our IP\n", NIPQUAD(ip));
+        dprintk("mpoa: mpoa_caches.c: adding an egress entry, ip = %u.%u.%u.%u, this should be our IP\n", NIPQUAD(msg->content.eg_info.eg_dst_ip));
         memset(entry, 0, sizeof(eg_cache_entry));
 
         atomic_set(&entry->use, 1);
@@ -481,8 +477,8 @@ static eg_cache_entry *eg_cache_add_entry(struct k_message *msg, struct mpoa_cli
         do_gettimeofday(&(entry->tv));
         entry->entry_state = EGRESS_RESOLVED;
         dprintk("mpoa: mpoa_caches.c: new_eg_cache_entry cache_id %lu\n", ntohl(entry->ctrl_info.cache_id));
-        ip = (unsigned char *)&entry->ctrl_info.mps_ip;
-        dprintk("mpoa: mpoa_caches.c: mps_ip = %u.%u.%u.%u\n", NIPQUAD(ip));
+        dprintk("mpoa: mpoa_caches.c: mps_ip = %u.%u.%u.%u\n",
+                NIPQUAD(entry->ctrl_info.mps_ip));
         atomic_inc(&entry->use);
 
         write_unlock_irq(&client->egress_lock);
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 0dca027ceb80..8be9f2123e54 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -34,8 +34,8 @@ static inline unsigned packet_length(const struct sk_buff *skb)
 
 int br_dev_queue_push_xmit(struct sk_buff *skb)
 {
-        /* drop mtu oversized packets except tso */
-        if (packet_length(skb) > skb->dev->mtu && !skb_shinfo(skb)->tso_size)
+        /* drop mtu oversized packets except gso */
+        if (packet_length(skb) > skb->dev->mtu && !skb_shinfo(skb)->gso_size)
                 kfree_skb(skb);
         else {
 #ifdef CONFIG_BRIDGE_NETFILTER
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index fdec773f5b52..07956ecf545e 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -376,15 +376,20 @@ void br_features_recompute(struct net_bridge *br)
         features = br->feature_mask & ~NETIF_F_ALL_CSUM;
 
         list_for_each_entry(p, &br->port_list, list) {
-                if (checksum & NETIF_F_NO_CSUM &&
-                    !(p->dev->features & NETIF_F_NO_CSUM))
+                unsigned long feature = p->dev->features;
+
+                if (checksum & NETIF_F_NO_CSUM && !(feature & NETIF_F_NO_CSUM))
                         checksum ^= NETIF_F_NO_CSUM | NETIF_F_HW_CSUM;
-                if (checksum & NETIF_F_HW_CSUM &&
-                    !(p->dev->features & NETIF_F_HW_CSUM))
+                if (checksum & NETIF_F_HW_CSUM && !(feature & NETIF_F_HW_CSUM))
                         checksum ^= NETIF_F_HW_CSUM | NETIF_F_IP_CSUM;
-                if (!(p->dev->features & NETIF_F_IP_CSUM))
+                if (!(feature & NETIF_F_IP_CSUM))
                         checksum = 0;
-                features &= p->dev->features;
+
+                if (feature & NETIF_F_GSO)
+                        feature |= NETIF_F_TSO;
+                feature |= NETIF_F_GSO;
+
+                features &= feature;
         }
 
         br->dev->features = features | checksum | NETIF_F_LLTX;
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 3e41f9d6d51c..8298a5179aef 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -761,7 +761,7 @@ static int br_nf_dev_queue_xmit(struct sk_buff *skb)
 {
         if (skb->protocol == htons(ETH_P_IP) &&
             skb->len > skb->dev->mtu &&
-            !(skb_shinfo(skb)->ufo_size || skb_shinfo(skb)->tso_size))
+            !skb_shinfo(skb)->gso_size)
                 return ip_fragment(skb, br_dev_queue_push_xmit);
         else
                 return br_dev_queue_push_xmit(skb);
diff --git a/net/core/dev.c b/net/core/dev.c
index ab39fe17cb58..ea2469398bd5 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -116,6 +116,7 @@
 #include <asm/current.h>
 #include <linux/audit.h>
 #include <linux/dmaengine.h>
+#include <linux/err.h>
 
 /*
  *      The list of packet types we will receive (as opposed to discard)
@@ -1048,7 +1049,7 @@ static inline void net_timestamp(struct sk_buff *skb)
  *      taps currently in use.
  */
 
-void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
+static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
 {
         struct packet_type *ptype;
 
@@ -1186,6 +1187,40 @@ out:
         return ret;
 }
 
+/**
+ *      skb_gso_segment - Perform segmentation on skb.
+ *      @skb: buffer to segment
+ *      @sg: whether scatter-gather is supported on the target.
+ *
+ *      This function segments the given skb and returns a list of segments.
+ */
+struct sk_buff *skb_gso_segment(struct sk_buff *skb, int sg)
+{
+        struct sk_buff *segs = ERR_PTR(-EPROTONOSUPPORT);
+        struct packet_type *ptype;
+        int type = skb->protocol;
+
+        BUG_ON(skb_shinfo(skb)->frag_list);
+        BUG_ON(skb->ip_summed != CHECKSUM_HW);
+
+        skb->mac.raw = skb->data;
+        skb->mac_len = skb->nh.raw - skb->data;
+        __skb_pull(skb, skb->mac_len);
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(ptype, &ptype_base[ntohs(type) & 15], list) {
+                if (ptype->type == type && !ptype->dev && ptype->gso_segment) {
+                        segs = ptype->gso_segment(skb, sg);
+                        break;
+                }
+        }
+        rcu_read_unlock();
+
+        return segs;
+}
+
+EXPORT_SYMBOL(skb_gso_segment);
+
 /* Take action when hardware reception checksum errors are detected. */
 #ifdef CONFIG_BUG
 void netdev_rx_csum_fault(struct net_device *dev)
@@ -1222,6 +1257,86 @@ static inline int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
 #define illegal_highdma(dev, skb)       (0)
 #endif
 
+struct dev_gso_cb {
+        void (*destructor)(struct sk_buff *skb);
+};
+
+#define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
+
+static void dev_gso_skb_destructor(struct sk_buff *skb)
+{
+        struct dev_gso_cb *cb;
+
+        do {
+                struct sk_buff *nskb = skb->next;
+
+                skb->next = nskb->next;
+                nskb->next = NULL;
+                kfree_skb(nskb);
+        } while (skb->next);
+
+        cb = DEV_GSO_CB(skb);
+        if (cb->destructor)
+                cb->destructor(skb);
+}
+
+/**
+ *      dev_gso_segment - Perform emulated hardware segmentation on skb.
+ *      @skb: buffer to segment
+ *
+ *      This function segments the given skb and stores the list of segments
+ *      in skb->next.
+ */
+static int dev_gso_segment(struct sk_buff *skb)
+{
+        struct net_device *dev = skb->dev;
+        struct sk_buff *segs;
+
+        segs = skb_gso_segment(skb, dev->features & NETIF_F_SG &&
+                                    !illegal_highdma(dev, skb));
+        if (unlikely(IS_ERR(segs)))
+                return PTR_ERR(segs);
+
+        skb->next = segs;
+        DEV_GSO_CB(skb)->destructor = skb->destructor;
+        skb->destructor = dev_gso_skb_destructor;
+
+        return 0;
+}
+
+int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        if (likely(!skb->next)) {
+                if (netdev_nit)
+                        dev_queue_xmit_nit(skb, dev);
+
+                if (!netif_needs_gso(dev, skb))
+                        return dev->hard_start_xmit(skb, dev);
+
+                if (unlikely(dev_gso_segment(skb)))
+                        goto out_kfree_skb;
+        }
+
+        do {
+                struct sk_buff *nskb = skb->next;
+                int rc;
+
+                skb->next = nskb->next;
+                nskb->next = NULL;
+                rc = dev->hard_start_xmit(nskb, dev);
+                if (unlikely(rc)) {
+                        skb->next = nskb;
+                        return rc;
+                }
+        } while (skb->next);
+        
+        skb->destructor = DEV_GSO_CB(skb)->destructor;
+
+out_kfree_skb:
+        kfree_skb(skb);
+        return 0;
+}
+
 #define HARD_TX_LOCK(dev, cpu) {                        \
         if ((dev->features & NETIF_F_LLTX) == 0) {      \
                 netif_tx_lock(dev);                     \
@@ -1266,6 +1381,10 @@ int dev_queue_xmit(struct sk_buff *skb)
         struct Qdisc *q;
         int rc = -ENOMEM;
 
+        /* GSO will handle the following emulations directly. */
+        if (netif_needs_gso(dev, skb))
+                goto gso;
+
         if (skb_shinfo(skb)->frag_list &&
             !(dev->features & NETIF_F_FRAGLIST) &&
             __skb_linearize(skb))
@@ -1290,12 +1409,13 @@ int dev_queue_xmit(struct sk_buff *skb)
                 if (skb_checksum_help(skb, 0))
                         goto out_kfree_skb;
 
+gso:
         spin_lock_prefetch(&dev->queue_lock);
 
         /* Disable soft irqs for various locks below. Also 
          * stops preemption for RCU. 
          */
-        local_bh_disable(); 
+        rcu_read_lock_bh(); 
 
         /* Updates of qdisc are serialized by queue_lock. 
          * The struct Qdisc which is pointed to by qdisc is now a 
@@ -1346,11 +1466,8 @@ int dev_queue_xmit(struct sk_buff *skb)
                         HARD_TX_LOCK(dev, cpu);
 
                         if (!netif_queue_stopped(dev)) {
-                                if (netdev_nit)
-                                        dev_queue_xmit_nit(skb, dev);
-
                                 rc = 0;
-                                if (!dev->hard_start_xmit(skb, dev)) {
+                                if (!dev_hard_start_xmit(skb, dev)) {
                                         HARD_TX_UNLOCK(dev);
                                         goto out;
                                 }
@@ -1369,13 +1486,13 @@ int dev_queue_xmit(struct sk_buff *skb)
         }
 
         rc = -ENETDOWN;
-        local_bh_enable();
+        rcu_read_unlock_bh();
 
 out_kfree_skb:
         kfree_skb(skb);
         return rc;
 out:
-        local_bh_enable();
+        rcu_read_unlock_bh();
         return rc;
 }
 
@@ -2980,7 +3097,7 @@ static void netdev_wait_allrefs(struct net_device *dev)
 static DEFINE_MUTEX(net_todo_run_mutex);
 void netdev_run_todo(void)
 {
-        struct list_head list = LIST_HEAD_INIT(list);
+        struct list_head list;
 
         /* Need to guard against multiple cpu's getting out of order. */
         mutex_lock(&net_todo_run_mutex);
@@ -2995,9 +3112,9 @@ void netdev_run_todo(void)
 
         /* Snapshot list, allow later requests */
         spin_lock(&net_todo_list_lock);
-        list_splice_init(&net_todo_list, &list);
+        list_replace_init(&net_todo_list, &list);
         spin_unlock(&net_todo_list_lock);
-                
+
         while (!list_empty(&list)) {
                 struct net_device *dev
                         = list_entry(list.next, struct net_device, todo_list);
@@ -3301,8 +3418,8 @@ static void net_dma_rebalance(void)
 /**
  * netdev_dma_event - event callback for the net_dma_client
  * @client: should always be net_dma_client
- * @chan:
- * @event:
+ * @chan: DMA channel for the event
+ * @event: event type
  */
 static void netdev_dma_event(struct dma_client *client, struct dma_chan *chan,
         enum dma_event event)
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 33ce7ed6afc6..27ce1683caf5 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -614,6 +614,29 @@ static int ethtool_set_ufo(struct net_device *dev, char __user *useraddr)
         return dev->ethtool_ops->set_ufo(dev, edata.data);
 }
 
+static int ethtool_get_gso(struct net_device *dev, char __user *useraddr)
+{
+        struct ethtool_value edata = { ETHTOOL_GGSO };
+
+        edata.data = dev->features & NETIF_F_GSO;
+        if (copy_to_user(useraddr, &edata, sizeof(edata)))
+                 return -EFAULT;
+        return 0;
+}
+
+static int ethtool_set_gso(struct net_device *dev, char __user *useraddr)
+{
+        struct ethtool_value edata;
+
+        if (copy_from_user(&edata, useraddr, sizeof(edata)))
+                return -EFAULT;
+        if (edata.data)
+                dev->features |= NETIF_F_GSO;
+        else
+                dev->features &= ~NETIF_F_GSO;
+        return 0;
+}
+
 static int ethtool_self_test(struct net_device *dev, char __user *useraddr)
 {
         struct ethtool_test test;
@@ -905,6 +928,12 @@ int dev_ethtool(struct ifreq *ifr)
         case ETHTOOL_SUFO:
                 rc = ethtool_set_ufo(dev, useraddr);
                 break;
+        case ETHTOOL_GGSO:
+                rc = ethtool_get_gso(dev, useraddr);
+                break;
+        case ETHTOOL_SGSO:
+                rc = ethtool_set_gso(dev, useraddr);
+                break;
         default:
                 rc =  -EOPNOTSUPP;
         }
diff --git a/net/core/link_watch.c b/net/core/link_watch.c
index 646937cc2d84..0f37266411b5 100644
--- a/net/core/link_watch.c
+++ b/net/core/link_watch.c
@@ -91,11 +91,10 @@ static void rfc2863_policy(struct net_device *dev)
 /* Must be called with the rtnl semaphore held */
 void linkwatch_run_queue(void)
 {
-        LIST_HEAD(head);
-        struct list_head *n, *next;
+        struct list_head head, *n, *next;
 
         spin_lock_irq(&lweventlist_lock);
-        list_splice_init(&lweventlist, &head);
+        list_replace_init(&lweventlist, &head);
         spin_unlock_irq(&lweventlist_lock);
 
         list_for_each_safe(n, next, &head) {
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index bb7210f4005e..8e5044ba3ab6 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -172,9 +172,9 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
         shinfo = skb_shinfo(skb);
         atomic_set(&shinfo->dataref, 1);
         shinfo->nr_frags  = 0;
-        shinfo->tso_size = 0;
-        shinfo->tso_segs = 0;
-        shinfo->ufo_size = 0;
+        shinfo->gso_size = 0;
+        shinfo->gso_segs = 0;
+        shinfo->gso_type = 0;
         shinfo->ip6_frag_id = 0;
         shinfo->frag_list = NULL;
 
@@ -238,8 +238,9 @@ struct sk_buff *alloc_skb_from_cache(kmem_cache_t *cp,
 
         atomic_set(&(skb_shinfo(skb)->dataref), 1);
         skb_shinfo(skb)->nr_frags  = 0;
-        skb_shinfo(skb)->tso_size = 0;
-        skb_shinfo(skb)->tso_segs = 0;
+        skb_shinfo(skb)->gso_size = 0;
+        skb_shinfo(skb)->gso_segs = 0;
+        skb_shinfo(skb)->gso_type = 0;
         skb_shinfo(skb)->frag_list = NULL;
 out:
         return skb;
@@ -528,8 +529,9 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 #endif
         skb_copy_secmark(new, old);
         atomic_set(&new->users, 1);
-        skb_shinfo(new)->tso_size = skb_shinfo(old)->tso_size;
-        skb_shinfo(new)->tso_segs = skb_shinfo(old)->tso_segs;
+        skb_shinfo(new)->gso_size = skb_shinfo(old)->gso_size;
+        skb_shinfo(new)->gso_segs = skb_shinfo(old)->gso_segs;
+        skb_shinfo(new)->gso_type = skb_shinfo(old)->gso_type;
 }
 
 /**
@@ -781,24 +783,40 @@ struct sk_buff *skb_copy_expand(const struct sk_buff *skb,
  *      filled. Used by network drivers which may DMA or transfer data
  *      beyond the buffer end onto the wire.
  *
- *      May return NULL in out of memory cases.
+ *      May return error in out of memory cases. The skb is freed on error.
  */
  
-struct sk_buff *skb_pad(struct sk_buff *skb, int pad)
+int skb_pad(struct sk_buff *skb, int pad)
 {
-        struct sk_buff *nskb;
+        int err;
+        int ntail;
         
         /* If the skbuff is non linear tailroom is always zero.. */
-        if (skb_tailroom(skb) >= pad) {
+        if (!skb_cloned(skb) && skb_tailroom(skb) >= pad) {
                 memset(skb->data+skb->len, 0, pad);
-                return skb;
+                return 0;
         }
-        
-        nskb = skb_copy_expand(skb, skb_headroom(skb), skb_tailroom(skb) + pad, GFP_ATOMIC);
+
+        ntail = skb->data_len + pad - (skb->end - skb->tail);
+        if (likely(skb_cloned(skb) || ntail > 0)) {
+                err = pskb_expand_head(skb, 0, ntail, GFP_ATOMIC);
+                if (unlikely(err))
+                        goto free_skb;
+        }
+
+        /* FIXME: The use of this function with non-linear skb's really needs
+         * to be audited.
+         */
+        err = skb_linearize(skb);
+        if (unlikely(err))
+                goto free_skb;
+
+        memset(skb->data + skb->len, 0, pad);
+        return 0;
+
+free_skb:
         kfree_skb(skb);
-        if (nskb)
-                memset(nskb->data+nskb->len, 0, pad);
-        return nskb;
+        return err;
 }       
  
 /* Trims skb to length len. It can change skb pointers.
@@ -1824,6 +1842,132 @@ unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len)
 
 EXPORT_SYMBOL_GPL(skb_pull_rcsum);
 
+/**
+ *      skb_segment - Perform protocol segmentation on skb.
+ *      @skb: buffer to segment
+ *      @sg: whether scatter-gather can be used for generated segments
+ *
+ *      This function performs segmentation on the given skb.  It returns
+ *      the segment at the given position.  It returns NULL if there are
+ *      no more segments to generate, or when an error is encountered.
+ */
+struct sk_buff *skb_segment(struct sk_buff *skb, int sg)
+{
+        struct sk_buff *segs = NULL;
+        struct sk_buff *tail = NULL;
+        unsigned int mss = skb_shinfo(skb)->gso_size;
+        unsigned int doffset = skb->data - skb->mac.raw;
+        unsigned int offset = doffset;
+        unsigned int headroom;
+        unsigned int len;
+        int nfrags = skb_shinfo(skb)->nr_frags;
+        int err = -ENOMEM;
+        int i = 0;
+        int pos;
+
+        __skb_push(skb, doffset);
+        headroom = skb_headroom(skb);
+        pos = skb_headlen(skb);
+
+        do {
+                struct sk_buff *nskb;
+                skb_frag_t *frag;
+                int hsize, nsize;
+                int k;
+                int size;
+
+                len = skb->len - offset;
+                if (len > mss)
+                        len = mss;
+
+                hsize = skb_headlen(skb) - offset;
+                if (hsize < 0)
+                        hsize = 0;
+                nsize = hsize + doffset;
+                if (nsize > len + doffset || !sg)
+                        nsize = len + doffset;
+
+                nskb = alloc_skb(nsize + headroom, GFP_ATOMIC);
+                if (unlikely(!nskb))
+                        goto err;
+
+                if (segs)
+                        tail->next = nskb;
+                else
+                        segs = nskb;
+                tail = nskb;
+
+                nskb->dev = skb->dev;
+                nskb->priority = skb->priority;
+                nskb->protocol = skb->protocol;
+                nskb->dst = dst_clone(skb->dst);
+                memcpy(nskb->cb, skb->cb, sizeof(skb->cb));
+                nskb->pkt_type = skb->pkt_type;
+                nskb->mac_len = skb->mac_len;
+
+                skb_reserve(nskb, headroom);
+                nskb->mac.raw = nskb->data;
+                nskb->nh.raw = nskb->data + skb->mac_len;
+                nskb->h.raw = nskb->nh.raw + (skb->h.raw - skb->nh.raw);
+                memcpy(skb_put(nskb, doffset), skb->data, doffset);
+
+                if (!sg) {
+                        nskb->csum = skb_copy_and_csum_bits(skb, offset,
+                                                            skb_put(nskb, len),
+                                                            len, 0);
+                        continue;
+                }
+
+                frag = skb_shinfo(nskb)->frags;
+                k = 0;
+
+                nskb->ip_summed = CHECKSUM_HW;
+                nskb->csum = skb->csum;
+                memcpy(skb_put(nskb, hsize), skb->data + offset, hsize);
+
+                while (pos < offset + len) {
+                        BUG_ON(i >= nfrags);
+
+                        *frag = skb_shinfo(skb)->frags[i];
+                        get_page(frag->page);
+                        size = frag->size;
+
+                        if (pos < offset) {
+                                frag->page_offset += offset - pos;
+                                frag->size -= offset - pos;
+                        }
+
+                        k++;
+
+                        if (pos + size <= offset + len) {
+                                i++;
+                                pos += size;
+                        } else {
+                                frag->size -= pos + size - (offset + len);
+                                break;
+                        }
+
+                        frag++;
+                }
+
+                skb_shinfo(nskb)->nr_frags = k;
+                nskb->data_len = len - hsize;
+                nskb->len += nskb->data_len;
+                nskb->truesize += nskb->data_len;
+        } while ((offset += len) < skb->len);
+
+        return segs;
+
+err:
+        while ((skb = segs)) {
+                segs = skb->next;
+                kfree(skb);
+        }
+        return ERR_PTR(err);
+}
+
+EXPORT_SYMBOL_GPL(skb_segment);
+
 void __init skb_init(void)
 {
         skbuff_head_cache = kmem_cache_create("skbuff_head_cache",
diff --git a/net/dccp/Kconfig b/net/dccp/Kconfig
index 7e096ba8454f..859e3359fcda 100644
--- a/net/dccp/Kconfig
+++ b/net/dccp/Kconfig
@@ -26,7 +26,7 @@ config INET_DCCP_DIAG
 
 config IP_DCCP_ACKVEC
         depends on IP_DCCP
-        def_bool N
+        bool
 
 source "net/dccp/ccids/Kconfig"
 
diff --git a/net/ieee80211/softmac/ieee80211softmac_wx.c b/net/ieee80211/softmac/ieee80211softmac_wx.c
index 22aa6199185b..0e65ff4e33fc 100644
--- a/net/ieee80211/softmac/ieee80211softmac_wx.c
+++ b/net/ieee80211/softmac/ieee80211softmac_wx.c
@@ -388,7 +388,7 @@ ieee80211softmac_wx_set_genie(struct net_device *dev,
                 memcpy(mac->wpa.IE, extra, wrqu->data.length);
                 dprintk(KERN_INFO PFX "generic IE set to ");
                 for (i=0;i<wrqu->data.length;i++)
-                        dprintk("%.2x", mac->wpa.IE[i]);
+                        dprintk("%.2x", (u8)mac->wpa.IE[i]);
                 dprintk("\n");
                 mac->wpa.IElen = wrqu->data.length;
         } else {
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 0a277453526b..461216b47948 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -68,6 +68,7 @@
  */
 
 #include <linux/config.h>
+#include <linux/err.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -1096,6 +1097,54 @@ int inet_sk_rebuild_header(struct sock *sk)
 
 EXPORT_SYMBOL(inet_sk_rebuild_header);
 
+static struct sk_buff *inet_gso_segment(struct sk_buff *skb, int sg)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        struct iphdr *iph;
+        struct net_protocol *ops;
+        int proto;
+        int ihl;
+        int id;
+
+        if (!pskb_may_pull(skb, sizeof(*iph)))
+                goto out;
+
+        iph = skb->nh.iph;
+        ihl = iph->ihl * 4;
+        if (ihl < sizeof(*iph))
+                goto out;
+
+        if (!pskb_may_pull(skb, ihl))
+                goto out;
+
+        skb->h.raw = __skb_pull(skb, ihl);
+        iph = skb->nh.iph;
+        id = ntohs(iph->id);
+        proto = iph->protocol & (MAX_INET_PROTOS - 1);
+        segs = ERR_PTR(-EPROTONOSUPPORT);
+
+        rcu_read_lock();
+        ops = rcu_dereference(inet_protos[proto]);
+        if (ops && ops->gso_segment)
+                segs = ops->gso_segment(skb, sg);
+        rcu_read_unlock();
+
+        if (IS_ERR(segs))
+                goto out;
+
+        skb = segs;
+        do {
+                iph = skb->nh.iph;
+                iph->id = htons(id++);
+                iph->tot_len = htons(skb->len - skb->mac_len);
+                iph->check = 0;
+                iph->check = ip_fast_csum(skb->nh.raw, iph->ihl);
+        } while ((skb = skb->next));
+
+out:
+        return segs;
+}
+
 #ifdef CONFIG_IP_MULTICAST
 static struct net_protocol igmp_protocol = {
         .handler =      igmp_rcv,
@@ -1105,6 +1154,7 @@ static struct net_protocol igmp_protocol = {
 static struct net_protocol tcp_protocol = {
         .handler =      tcp_v4_rcv,
         .err_handler =  tcp_v4_err,
+        .gso_segment =  tcp_tso_segment,
         .no_policy =    1,
 };
 
@@ -1150,6 +1200,7 @@ static int ipv4_proc_init(void);
 static struct packet_type ip_packet_type = {
         .type = __constant_htons(ETH_P_IP),
         .func = ip_rcv,
+        .gso_segment = inet_gso_segment,
 };
 
 static int __init inet_init(void)
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 8538aac3d148..7624fd1d8f9f 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -210,8 +210,7 @@ static inline int ip_finish_output(struct sk_buff *skb)
                 return dst_output(skb);
         }
 #endif
-        if (skb->len > dst_mtu(skb->dst) &&
-            !(skb_shinfo(skb)->ufo_size || skb_shinfo(skb)->tso_size))
+        if (skb->len > dst_mtu(skb->dst) && !skb_shinfo(skb)->gso_size)
                 return ip_fragment(skb, ip_finish_output2);
         else
                 return ip_finish_output2(skb);
@@ -362,7 +361,7 @@ packet_routed:
         }
 
         ip_select_ident_more(iph, &rt->u.dst, sk,
-                             (skb_shinfo(skb)->tso_segs ?: 1) - 1);
+                             (skb_shinfo(skb)->gso_segs ?: 1) - 1);
 
         /* Add an IP checksum. */
         ip_send_check(iph);
@@ -744,7 +743,8 @@ static inline int ip_ufo_append_data(struct sock *sk,
                                (length - transhdrlen));
         if (!err) {
                 /* specify the length of each IP datagram fragment*/
-                skb_shinfo(skb)->ufo_size = (mtu - fragheaderlen);
+                skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
+                skb_shinfo(skb)->gso_type = SKB_GSO_UDPV4;
                 __skb_queue_tail(&sk->sk_write_queue, skb);
 
                 return 0;
@@ -1087,14 +1087,16 @@ ssize_t	ip_append_page(struct sock *sk, struct page *page,
 
         inet->cork.length += size;
         if ((sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->u.dst.dev->features & NETIF_F_UFO))
-                skb_shinfo(skb)->ufo_size = (mtu - fragheaderlen);
+            (rt->u.dst.dev->features & NETIF_F_UFO)) {
+                skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
+                skb_shinfo(skb)->gso_type = SKB_GSO_UDPV4;
+        }
 
 
         while (size > 0) {
                 int i;
 
-                if (skb_shinfo(skb)->ufo_size)
+                if (skb_shinfo(skb)->gso_size)
                         len = size;
                 else {
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 74998f250071..0e029c4e2903 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -258,6 +258,7 @@
 #include <linux/random.h>
 #include <linux/bootmem.h>
 #include <linux/cache.h>
+#include <linux/err.h>
 
 #include <net/icmp.h>
 #include <net/tcp.h>
@@ -571,7 +572,7 @@ new_segment:
                 skb->ip_summed = CHECKSUM_HW;
                 tp->write_seq += copy;
                 TCP_SKB_CB(skb)->end_seq += copy;
-                skb_shinfo(skb)->tso_segs = 0;
+                skb_shinfo(skb)->gso_segs = 0;
 
                 if (!copied)
                         TCP_SKB_CB(skb)->flags &= ~TCPCB_FLAG_PSH;
@@ -818,7 +819,7 @@ new_segment:
 
                         tp->write_seq += copy;
                         TCP_SKB_CB(skb)->end_seq += copy;
-                        skb_shinfo(skb)->tso_segs = 0;
+                        skb_shinfo(skb)->gso_segs = 0;
 
                         from += copy;
                         copied += copy;
@@ -2144,6 +2145,67 @@ int compat_tcp_getsockopt(struct sock *sk, int level, int optname,
 EXPORT_SYMBOL(compat_tcp_getsockopt);
 #endif
 
+struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int sg)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        struct tcphdr *th;
+        unsigned thlen;
+        unsigned int seq;
+        unsigned int delta;
+        unsigned int oldlen;
+        unsigned int len;
+
+        if (!pskb_may_pull(skb, sizeof(*th)))
+                goto out;
+
+        th = skb->h.th;
+        thlen = th->doff * 4;
+        if (thlen < sizeof(*th))
+                goto out;
+
+        if (!pskb_may_pull(skb, thlen))
+                goto out;
+
+        oldlen = ~htonl(skb->len);
+        __skb_pull(skb, thlen);
+
+        segs = skb_segment(skb, sg);
+        if (IS_ERR(segs))
+                goto out;
+
+        len = skb_shinfo(skb)->gso_size;
+        delta = csum_add(oldlen, htonl(thlen + len));
+
+        skb = segs;
+        th = skb->h.th;
+        seq = ntohl(th->seq);
+
+        do {
+                th->fin = th->psh = 0;
+
+                if (skb->ip_summed == CHECKSUM_NONE) {
+                        th->check = csum_fold(csum_partial(
+                                skb->h.raw, thlen, csum_add(skb->csum, delta)));
+                }
+
+                seq += len;
+                skb = skb->next;
+                th = skb->h.th;
+
+                th->seq = htonl(seq);
+                th->cwr = 0;
+        } while (skb->next);
+
+        if (skb->ip_summed == CHECKSUM_NONE) {
+                delta = csum_add(oldlen, htonl(skb->tail - skb->h.raw));
+                th->check = csum_fold(csum_partial(
+                        skb->h.raw, thlen, csum_add(skb->csum, delta)));
+        }
+
+out:
+        return segs;
+}
+
 extern void __skb_cb_too_small_for_tcp(int, int);
 extern struct tcp_congestion_ops tcp_reno;
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index e08245bdda3a..94fe5b1f9dcb 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1073,7 +1073,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                                 else
                                         pkt_len = (end_seq -
                                                    TCP_SKB_CB(skb)->seq);
-                                if (tcp_fragment(sk, skb, pkt_len, skb_shinfo(skb)->tso_size))
+                                if (tcp_fragment(sk, skb, pkt_len, skb_shinfo(skb)->gso_size))
                                         break;
                                 pcount = tcp_skb_pcount(skb);
                         }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 07bb5a2b375e..bdd71db8bf90 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -515,15 +515,17 @@ static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb, unsigned
                 /* Avoid the costly divide in the normal
                  * non-TSO case.
                  */
-                skb_shinfo(skb)->tso_segs = 1;
-                skb_shinfo(skb)->tso_size = 0;
+                skb_shinfo(skb)->gso_segs = 1;
+                skb_shinfo(skb)->gso_size = 0;
+                skb_shinfo(skb)->gso_type = 0;
         } else {
                 unsigned int factor;
 
                 factor = skb->len + (mss_now - 1);
                 factor /= mss_now;
-                skb_shinfo(skb)->tso_segs = factor;
-                skb_shinfo(skb)->tso_size = mss_now;
+                skb_shinfo(skb)->gso_segs = factor;
+                skb_shinfo(skb)->gso_size = mss_now;
+                skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
         }
 }
 
@@ -914,7 +916,7 @@ static int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb, unsigned int
 
         if (!tso_segs ||
             (tso_segs > 1 &&
-             skb_shinfo(skb)->tso_size != mss_now)) {
+             tcp_skb_mss(skb) != mss_now)) {
                 tcp_set_skb_tso_segs(sk, skb, mss_now);
                 tso_segs = tcp_skb_pcount(skb);
         }
@@ -1724,8 +1726,9 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
            tp->snd_una == (TCP_SKB_CB(skb)->end_seq - 1)) {
                 if (!pskb_trim(skb, 0)) {
                         TCP_SKB_CB(skb)->seq = TCP_SKB_CB(skb)->end_seq - 1;
-                        skb_shinfo(skb)->tso_segs = 1;
-                        skb_shinfo(skb)->tso_size = 0;
+                        skb_shinfo(skb)->gso_segs = 1;
+                        skb_shinfo(skb)->gso_size = 0;
+                        skb_shinfo(skb)->gso_type = 0;
                         skb->ip_summed = CHECKSUM_NONE;
                         skb->csum = 0;
                 }
@@ -1930,8 +1933,9 @@ void tcp_send_fin(struct sock *sk)
                 skb->csum = 0;
                 TCP_SKB_CB(skb)->flags = (TCPCB_FLAG_ACK | TCPCB_FLAG_FIN);
                 TCP_SKB_CB(skb)->sacked = 0;
-                skb_shinfo(skb)->tso_segs = 1;
-                skb_shinfo(skb)->tso_size = 0;
+                skb_shinfo(skb)->gso_segs = 1;
+                skb_shinfo(skb)->gso_size = 0;
+                skb_shinfo(skb)->gso_type = 0;
 
                 /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
                 TCP_SKB_CB(skb)->seq = tp->write_seq;
@@ -1963,8 +1967,9 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority)
         skb->csum = 0;
         TCP_SKB_CB(skb)->flags = (TCPCB_FLAG_ACK | TCPCB_FLAG_RST);
         TCP_SKB_CB(skb)->sacked = 0;
-        skb_shinfo(skb)->tso_segs = 1;
-        skb_shinfo(skb)->tso_size = 0;
+        skb_shinfo(skb)->gso_segs = 1;
+        skb_shinfo(skb)->gso_size = 0;
+        skb_shinfo(skb)->gso_type = 0;
 
         /* Send it off. */
         TCP_SKB_CB(skb)->seq = tcp_acceptable_seq(sk, tp);
@@ -2047,8 +2052,9 @@ struct sk_buff * tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         TCP_SKB_CB(skb)->seq = tcp_rsk(req)->snt_isn;
         TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(skb)->seq + 1;
         TCP_SKB_CB(skb)->sacked = 0;
-        skb_shinfo(skb)->tso_segs = 1;
-        skb_shinfo(skb)->tso_size = 0;
+        skb_shinfo(skb)->gso_segs = 1;
+        skb_shinfo(skb)->gso_size = 0;
+        skb_shinfo(skb)->gso_type = 0;
         th->seq = htonl(TCP_SKB_CB(skb)->seq);
         th->ack_seq = htonl(tcp_rsk(req)->rcv_isn + 1);
         if (req->rcv_wnd == 0) { /* ignored for retransmitted syns */
@@ -2152,8 +2158,9 @@ int tcp_connect(struct sock *sk)
         TCP_SKB_CB(buff)->flags = TCPCB_FLAG_SYN;
         TCP_ECN_send_syn(sk, tp, buff);
         TCP_SKB_CB(buff)->sacked = 0;
-        skb_shinfo(buff)->tso_segs = 1;
-        skb_shinfo(buff)->tso_size = 0;
+        skb_shinfo(buff)->gso_segs = 1;
+        skb_shinfo(buff)->gso_size = 0;
+        skb_shinfo(buff)->gso_type = 0;
         buff->csum = 0;
         TCP_SKB_CB(buff)->seq = tp->write_seq++;
         TCP_SKB_CB(buff)->end_seq = tp->write_seq;
@@ -2257,8 +2264,9 @@ void tcp_send_ack(struct sock *sk)
                 buff->csum = 0;
                 TCP_SKB_CB(buff)->flags = TCPCB_FLAG_ACK;
                 TCP_SKB_CB(buff)->sacked = 0;
-                skb_shinfo(buff)->tso_segs = 1;
-                skb_shinfo(buff)->tso_size = 0;
+                skb_shinfo(buff)->gso_segs = 1;
+                skb_shinfo(buff)->gso_size = 0;
+                skb_shinfo(buff)->gso_type = 0;
 
                 /* Send it off, this clears delayed acks for us. */
                 TCP_SKB_CB(buff)->seq = TCP_SKB_CB(buff)->end_seq = tcp_acceptable_seq(sk, tp);
@@ -2293,8 +2301,9 @@ static int tcp_xmit_probe_skb(struct sock *sk, int urgent)
         skb->csum = 0;
         TCP_SKB_CB(skb)->flags = TCPCB_FLAG_ACK;
         TCP_SKB_CB(skb)->sacked = urgent;
-        skb_shinfo(skb)->tso_segs = 1;
-        skb_shinfo(skb)->tso_size = 0;
+        skb_shinfo(skb)->gso_segs = 1;
+        skb_shinfo(skb)->gso_size = 0;
+        skb_shinfo(skb)->gso_type = 0;
 
         /* Use a previous sequence.  This should cause the other
          * end to send an ack.  Don't queue or clone SKB, just
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index ac9d91d4bb05..193363e22932 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -9,6 +9,8 @@
  */
 
 #include <linux/compiler.h>
+#include <linux/if_ether.h>
+#include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
 #include <linux/netfilter_ipv4.h>
@@ -97,16 +99,10 @@ error_nolock:
         goto out_exit;
 }
 
-static int xfrm4_output_finish(struct sk_buff *skb)
+static int xfrm4_output_finish2(struct sk_buff *skb)
 {
         int err;
 
-#ifdef CONFIG_NETFILTER
-        if (!skb->dst->xfrm) {
-                IPCB(skb)->flags |= IPSKB_REROUTED;
-                return dst_output(skb);
-        }
-#endif
         while (likely((err = xfrm4_output_one(skb)) == 0)) {
                 nf_reset(skb);
 
@@ -119,7 +115,7 @@ static int xfrm4_output_finish(struct sk_buff *skb)
                         return dst_output(skb);
 
                 err = nf_hook(PF_INET, NF_IP_POST_ROUTING, &skb, NULL,
-                              skb->dst->dev, xfrm4_output_finish);
+                              skb->dst->dev, xfrm4_output_finish2);
                 if (unlikely(err != 1))
                         break;
         }
@@ -127,6 +123,48 @@ static int xfrm4_output_finish(struct sk_buff *skb)
         return err;
 }
 
+static int xfrm4_output_finish(struct sk_buff *skb)
+{
+        struct sk_buff *segs;
+
+#ifdef CONFIG_NETFILTER
+        if (!skb->dst->xfrm) {
+                IPCB(skb)->flags |= IPSKB_REROUTED;
+                return dst_output(skb);
+        }
+#endif
+
+        if (!skb_shinfo(skb)->gso_size)
+                return xfrm4_output_finish2(skb);
+
+        skb->protocol = htons(ETH_P_IP);
+        segs = skb_gso_segment(skb, 0);
+        kfree_skb(skb);
+        if (unlikely(IS_ERR(segs)))
+                return PTR_ERR(segs);
+
+        do {
+                struct sk_buff *nskb = segs->next;
+                int err;
+
+                segs->next = NULL;
+                err = xfrm4_output_finish2(segs);
+
+                if (unlikely(err)) {
+                        while ((segs = nskb)) {
+                                nskb = segs->next;
+                                segs->next = NULL;
+                                kfree_skb(segs);
+                        }
+                        return err;
+                }
+
+                segs = nskb;
+        } while (segs);
+
+        return 0;
+}
+
 int xfrm4_output(struct sk_buff *skb)
 {
         return NF_HOOK_COND(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dst->dev,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c2c26fa0943d..4da664538f52 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -862,6 +862,8 @@ static int inline ipv6_saddr_label(const struct in6_addr *addr, int type)
   *     2002::/16               2
   *     ::/96                   3
   *     ::ffff:0:0/96           4
+  *     fc00::/7                5
+  *     2001::/32               6
   */
         if (type & IPV6_ADDR_LOOPBACK)
                 return 0;
@@ -869,8 +871,12 @@ static int inline ipv6_saddr_label(const struct in6_addr *addr, int type)
                 return 3;
         else if (type & IPV6_ADDR_MAPPED)
                 return 4;
+        else if (addr->s6_addr32[0] == htonl(0x20010000))
+                return 6;
         else if (addr->s6_addr16[0] == htons(0x2002))
                 return 2;
+        else if ((addr->s6_addr[0] & 0xfe) == 0xfc)
+                return 5;
         return 1;
 }
 
@@ -1069,6 +1075,9 @@ int ipv6_dev_get_saddr(struct net_device *daddr_dev,
                                 if (hiscore.attrs & IPV6_SADDR_SCORE_PRIVACY)
                                         continue;
                         }
+#else
+                        if (hiscore.rule < 7)
+                                hiscore.rule++;
 #endif
                         /* Rule 8: Use longest matching prefix */
                         if (hiscore.rule < 8) {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index d29620f4910e..abb94de33768 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -148,7 +148,7 @@ static int ip6_output2(struct sk_buff *skb)
 
 int ip6_output(struct sk_buff *skb)
 {
-        if ((skb->len > dst_mtu(skb->dst) && !skb_shinfo(skb)->ufo_size) ||
+        if ((skb->len > dst_mtu(skb->dst) && !skb_shinfo(skb)->gso_size) ||
                                 dst_allfrag(skb->dst))
                 return ip6_fragment(skb, ip6_output2);
         else
@@ -833,8 +833,9 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                 struct frag_hdr fhdr;
 
                 /* specify the length of each IP datagram fragment*/
-                skb_shinfo(skb)->ufo_size = (mtu - fragheaderlen) - 
-                                                sizeof(struct frag_hdr);
+                skb_shinfo(skb)->gso_size = mtu - fragheaderlen - 
+                                            sizeof(struct frag_hdr);
+                skb_shinfo(skb)->gso_type = SKB_GSO_UDPV4;
                 ipv6_select_ident(skb, &fhdr);
                 skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
                 __skb_queue_tail(&sk->sk_write_queue, skb);
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 16e84254a252..48fccb1eca08 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -94,7 +94,7 @@ error_nolock:
         goto out_exit;
 }
 
-static int xfrm6_output_finish(struct sk_buff *skb)
+static int xfrm6_output_finish2(struct sk_buff *skb)
 {
         int err;
 
@@ -110,7 +110,7 @@ static int xfrm6_output_finish(struct sk_buff *skb)
                         return dst_output(skb);
 
                 err = nf_hook(PF_INET6, NF_IP6_POST_ROUTING, &skb, NULL,
-                              skb->dst->dev, xfrm6_output_finish);
+                              skb->dst->dev, xfrm6_output_finish2);
                 if (unlikely(err != 1))
                         break;
         }
@@ -118,6 +118,41 @@ static int xfrm6_output_finish(struct sk_buff *skb)
         return err;
 }
 
+static int xfrm6_output_finish(struct sk_buff *skb)
+{
+        struct sk_buff *segs;
+
+        if (!skb_shinfo(skb)->gso_size)
+                return xfrm6_output_finish2(skb);
+
+        skb->protocol = htons(ETH_P_IP);
+        segs = skb_gso_segment(skb, 0);
+        kfree_skb(skb);
+        if (unlikely(IS_ERR(segs)))
+                return PTR_ERR(segs);
+
+        do {
+                struct sk_buff *nskb = segs->next;
+                int err;
+
+                segs->next = NULL;
+                err = xfrm6_output_finish2(segs);
+
+                if (unlikely(err)) {
+                        while ((segs = nskb)) {
+                                nskb = segs->next;
+                                segs->next = NULL;
+                                kfree_skb(segs);
+                        }
+                        return err;
+                }
+
+                segs = nskb;
+        } while (segs);
+
+        return 0;
+}
+
 int xfrm6_output(struct sk_buff *skb)
 {
         return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, skb->dst->dev,
diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c
index b5110e5b54b0..9316c753692f 100644
--- a/net/netfilter/xt_sctp.c
+++ b/net/netfilter/xt_sctp.c
@@ -62,7 +62,7 @@ match_packet(const struct sk_buff *skb,
 
         do {
                 sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch);
-                if (sch == NULL) {
+                if (sch == NULL || sch->length == 0) {
                         duprintf("Dropping invalid SCTP packet.\n");
                         *hotdrop = 1;
                         return 0;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index b1e4c5e20ac7..74d4a1dceeec 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -90,14 +90,17 @@ void qdisc_unlock_tree(struct net_device *dev)
    NOTE: Called under dev->queue_lock with locally disabled BH.
 */
 
-int qdisc_restart(struct net_device *dev)
+static inline int qdisc_restart(struct net_device *dev)
 {
         struct Qdisc *q = dev->qdisc;
         struct sk_buff *skb;
 
         /* Dequeue packet */
-        if ((skb = q->dequeue(q)) != NULL) {
+        if (((skb = dev->gso_skb)) || ((skb = q->dequeue(q)))) {
                 unsigned nolock = (dev->features & NETIF_F_LLTX);
+
+                dev->gso_skb = NULL;
+
                 /*
                  * When the driver has LLTX set it does its own locking
                  * in start_xmit. No need to add additional overhead by
@@ -134,10 +137,8 @@ int qdisc_restart(struct net_device *dev)
 
                         if (!netif_queue_stopped(dev)) {
                                 int ret;
-                                if (netdev_nit)
-                                        dev_queue_xmit_nit(skb, dev);
 
-                                ret = dev->hard_start_xmit(skb, dev);
+                                ret = dev_hard_start_xmit(skb, dev);
                                 if (ret == NETDEV_TX_OK) { 
                                         if (!nolock) {
                                                 netif_tx_unlock(dev);
@@ -171,7 +172,10 @@ int qdisc_restart(struct net_device *dev)
                  */
 
 requeue:
-                q->ops->requeue(skb, q);
+                if (skb->next)
+                        dev->gso_skb = skb;
+                else
+                        q->ops->requeue(skb, q);
                 netif_schedule(dev);
                 return 1;
         }
@@ -179,6 +183,18 @@ requeue:
         return q->q.qlen;
 }
 
+void __qdisc_run(struct net_device *dev)
+{
+        if (unlikely(dev->qdisc == &noop_qdisc))
+                goto out;
+
+        while (qdisc_restart(dev) < 0 && !netif_queue_stopped(dev))
+                /* NOTHING */;
+
+out:
+        clear_bit(__LINK_STATE_QDISC_RUNNING, &dev->state);
+}
+
 static void dev_watchdog(unsigned long arg)
 {
         struct net_device *dev = (struct net_device *)arg;
@@ -575,10 +591,17 @@ void dev_deactivate(struct net_device *dev)
 
         dev_watchdog_down(dev);
 
-        while (test_bit(__LINK_STATE_SCHED, &dev->state))
+        /* Wait for outstanding dev_queue_xmit calls. */
+        synchronize_rcu();
+
+        /* Wait for outstanding qdisc_run calls. */
+        while (test_bit(__LINK_STATE_QDISC_RUNNING, &dev->state))
                 yield();
 
-        spin_unlock_wait(&dev->_xmit_lock);
+        if (dev->gso_skb) {
+                kfree_skb(dev->gso_skb);
+                dev->gso_skb = NULL;
+        }
 }
 
 void dev_init_scheduler(struct net_device *dev)
@@ -620,6 +643,5 @@ EXPORT_SYMBOL(qdisc_create_dflt);
 EXPORT_SYMBOL(qdisc_alloc);
 EXPORT_SYMBOL(qdisc_destroy);
 EXPORT_SYMBOL(qdisc_reset);
-EXPORT_SYMBOL(qdisc_restart);
 EXPORT_SYMBOL(qdisc_lock_tree);
 EXPORT_SYMBOL(qdisc_unlock_tree);
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 5e0de3c0eead..2a8773691695 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1402,14 +1402,14 @@ struct sctp_association *sctp_unpack_cookie(
         sg.length = bodysize;
         key = (char *)ep->secret_key[ep->current_key];
 
-        memset(digest, 0x00, sizeof(digest));
+        memset(digest, 0x00, SCTP_SIGNATURE_SIZE);
         sctp_crypto_hmac(sctp_sk(ep->base.sk)->hmac, key, &keylen, &sg,
                          1, digest);
 
         if (memcmp(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) {
                 /* Try the previous key. */
                 key = (char *)ep->secret_key[ep->last_key];
-                memset(digest, 0x00, sizeof(digest));
+                memset(digest, 0x00, SCTP_SIGNATURE_SIZE);
                 sctp_crypto_hmac(sctp_sk(ep->base.sk)->hmac, key, &keylen,
                                  &sg, 1, digest);
 
diff --git a/net/socket.c b/net/socket.c
index 02948b622bd2..565f5e8d1191 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -335,10 +335,11 @@ static struct super_operations sockfs_ops = {
         .statfs =       simple_statfs,
 };
 
-static struct super_block *sockfs_get_sb(struct file_system_type *fs_type,
-        int flags, const char *dev_name, void *data)
+static int sockfs_get_sb(struct file_system_type *fs_type,
+        int flags, const char *dev_name, void *data, struct vfsmount *mnt)
 {
-        return get_sb_pseudo(fs_type, "socket:", &sockfs_ops, SOCKFS_MAGIC);
+        return get_sb_pseudo(fs_type, "socket:", &sockfs_ops, SOCKFS_MAGIC,
+                             mnt);
 }
 
 static struct vfsmount *sock_mnt __read_mostly;
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index a5226df8ac03..dafe793c774e 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -815,11 +815,11 @@ out:
         return -ENOMEM;
 }
 
-static struct super_block *
+static int
 rpc_get_sb(struct file_system_type *fs_type,
-                int flags, const char *dev_name, void *data)
+                int flags, const char *dev_name, void *data, struct vfsmount *mnt)
 {
-        return get_sb_single(fs_type, flags, data, rpc_fill_super);
+        return get_sb_single(fs_type, flags, data, rpc_fill_super, mnt);
 }
 
 static struct file_system_type rpc_pipe_fs_type = {