16 files changed, 384 insertions, 63 deletions

diff --git a/include/net/9p/9p.h b/include/net/9p/9p.h
index 585eb4496990..b3d3e27c6299 100644
--- a/include/net/9p/9p.h
+++ b/include/net/9p/9p.h
@@ -29,14 +29,31 @@
 
 #ifdef CONFIG_NET_9P_DEBUG
 
-#define P9_DEBUG_ERROR          (1<<0)
-#define P9_DEBUG_9P             (1<<2)
-#define P9_DEBUG_VFS            (1<<3)
-#define P9_DEBUG_CONV           (1<<4)
-#define P9_DEBUG_MUX            (1<<5)
-#define P9_DEBUG_TRANS          (1<<6)
-#define P9_DEBUG_SLABS          (1<<7)
-#define P9_DEBUG_FCALL          (1<<8)
+/**
+ * enum p9_debug_flags - bits for mount time debug parameter
+ * @P9_DEBUG_ERROR: more verbose error messages including original error string
+ * @P9_DEBUG_9P: 9P protocol tracing
+ * @P9_DEBUG_VFS: VFS API tracing
+ * @P9_DEBUG_CONV: protocol conversion tracing
+ * @P9_DEBUG_MUX: trace management of concurrent transactions
+ * @P9_DEBUG_TRANS: transport tracing
+ * @P9_DEBUG_SLABS: memory management tracing
+ * @P9_DEBUG_FCALL: verbose dump of protocol messages
+ *
+ * These flags are passed at mount time to turn on various levels of
+ * verbosity and tracing which will be output to the system logs.
+ */
+
+enum p9_debug_flags {
+        P9_DEBUG_ERROR =        (1<<0),
+        P9_DEBUG_9P =           (1<<2),
+        P9_DEBUG_VFS =          (1<<3),
+        P9_DEBUG_CONV =         (1<<4),
+        P9_DEBUG_MUX =          (1<<5),
+        P9_DEBUG_TRANS =        (1<<6),
+        P9_DEBUG_SLABS =        (1<<7),
+        P9_DEBUG_FCALL =        (1<<8),
+};
 
 extern unsigned int p9_debug_level;
 
@@ -62,9 +79,47 @@ do { \
                 format , __FUNCTION__, task_pid_nr(current), ## arg); \
 } while (0)
 
+/**
+ * enum p9_msg_t - 9P message types
+ * @P9_TVERSION: version handshake request
+ * @P9_RVERSION: version handshake response
+ * @P9_TAUTH: request to establish authentication channel
+ * @P9_RAUTH: response with authentication information
+ * @P9_TATTACH: establish user access to file service
+ * @P9_RATTACH: response with top level handle to file hierarchy
+ * @P9_TERROR: not used
+ * @P9_RERROR: response for any failed request
+ * @P9_TFLUSH: request to abort a previous request
+ * @P9_RFLUSH: response when previous request has been cancelled
+ * @P9_TWALK: descend a directory hierarchy
+ * @P9_RWALK: response with new handle for position within hierarchy
+ * @P9_TOPEN: prepare a handle for I/O on an existing file
+ * @P9_ROPEN: response with file access information
+ * @P9_TCREATE: prepare a handle for I/O on a new file
+ * @P9_RCREATE: response with file access information
+ * @P9_TREAD: request to transfer data from a file or directory
+ * @P9_RREAD: response with data requested
+ * @P9_TWRITE: reuqest to transfer data to a file
+ * @P9_RWRITE: response with out much data was transfered to file
+ * @P9_TCLUNK: forget about a handle to an entity within the file system
+ * @P9_RCLUNK: response when server has forgotten about the handle
+ * @P9_TREMOVE: request to remove an entity from the hierarchy
+ * @P9_RREMOVE: response when server has removed the entity
+ * @P9_TSTAT: request file entity attributes
+ * @P9_RSTAT: response with file entity attributes
+ * @P9_TWSTAT: request to update file entity attributes
+ * @P9_RWSTAT: response when file entity attributes are updated
+ *
+ * There are 14 basic operations in 9P2000, paired as
+ * requests and responses.  The one special case is ERROR
+ * as there is no @P9_TERROR request for clients to transmit to
+ * the server, but the server may respond to any other request
+ * with an @P9_RERROR.
+ *
+ * See Also: http://plan9.bell-labs.com/sys/man/5/INDEX.html
+ */
 
-/* Message Types */
-enum {
+enum p9_msg_t {
         P9_TVERSION = 100,
         P9_RVERSION,
         P9_TAUTH = 102,
@@ -95,30 +150,71 @@ enum {
         P9_RWSTAT,
 };
 
-/* open modes */
-enum {
+/**
+ * enum p9_open_mode_t - 9P open modes
+ * @P9_OREAD: open file for reading only
+ * @P9_OWRITE: open file for writing only
+ * @P9_ORDWR: open file for reading or writing
+ * @P9_OEXEC: open file for execution
+ * @P9_OTRUNC: truncate file to zero-length before opening it
+ * @P9_OREXEC: close the file when an exec(2) system call is made
+ * @P9_ORCLOSE: remove the file when the file is closed
+ * @P9_OAPPEND: open the file and seek to the end
+ * @P9_OEXCL: only create a file, do not open it
+ *
+ * 9P open modes differ slightly from Posix standard modes.
+ * In particular, there are extra modes which specify different
+ * semantic behaviors than may be available on standard Posix
+ * systems.  For example, @P9_OREXEC and @P9_ORCLOSE are modes that
+ * most likely will not be issued from the Linux VFS client, but may
+ * be supported by servers.
+ *
+ * See Also: http://plan9.bell-labs.com/magic/man2html/2/open
+ */
+
+enum p9_open_mode_t {
         P9_OREAD = 0x00,
         P9_OWRITE = 0x01,
         P9_ORDWR = 0x02,
         P9_OEXEC = 0x03,
-        P9_OEXCL = 0x04,
         P9_OTRUNC = 0x10,
         P9_OREXEC = 0x20,
         P9_ORCLOSE = 0x40,
         P9_OAPPEND = 0x80,
-};
-
-/* permissions */
-enum {
+        P9_OEXCL = 0x1000,
+};
+
+/**
+ * enum p9_perm_t - 9P permissions
+ * @P9_DMDIR: mode bite for directories
+ * @P9_DMAPPEND: mode bit for is append-only
+ * @P9_DMEXCL: mode bit for excluse use (only one open handle allowed)
+ * @P9_DMMOUNT: mode bite for mount points
+ * @P9_DMAUTH: mode bit for authentication file
+ * @P9_DMTMP: mode bit for non-backed-up files
+ * @P9_DMSYMLINK: mode bit for symbolic links (9P2000.u)
+ * @P9_DMLINK: mode bit for hard-link (9P2000.u)
+ * @P9_DMDEVICE: mode bit for device files (9P2000.u)
+ * @P9_DMNAMEDPIPE: mode bit for named pipe (9P2000.u)
+ * @P9_DMSOCKET: mode bit for socket (9P2000.u)
+ * @P9_DMSETUID: mode bit for setuid (9P2000.u)
+ * @P9_DMSETGID: mode bit for setgid (9P2000.u)
+ * @P9_DMSETVTX: mode bit for sticky bit (9P2000.u)
+ *
+ * 9P permissions differ slightly from Posix standard modes.
+ *
+ * See Also: http://plan9.bell-labs.com/magic/man2html/2/stat
+ */
+enum p9_perm_t {
         P9_DMDIR = 0x80000000,
         P9_DMAPPEND = 0x40000000,
         P9_DMEXCL = 0x20000000,
         P9_DMMOUNT = 0x10000000,
         P9_DMAUTH = 0x08000000,
         P9_DMTMP = 0x04000000,
+/* 9P2000.u extensions */
         P9_DMSYMLINK = 0x02000000,
         P9_DMLINK = 0x01000000,
-        /* 9P2000.u extensions */
         P9_DMDEVICE = 0x00800000,
         P9_DMNAMEDPIPE = 0x00200000,
         P9_DMSOCKET = 0x00100000,
@@ -127,8 +223,26 @@ enum {
         P9_DMSETVTX = 0x00010000,
 };
 
-/* qid.types */
-enum {
+/**
+ * enum p9_qid_t - QID types
+ * @P9_QTDIR: directory
+ * @P9_QTAPPEND: append-only
+ * @P9_QTEXCL: excluse use (only one open handle allowed)
+ * @P9_QTMOUNT: mount points
+ * @P9_QTAUTH: authentication file
+ * @P9_QTTMP: non-backed-up files
+ * @P9_QTSYMLINK: symbolic links (9P2000.u)
+ * @P9_QTLINK: hard-link (9P2000.u)
+ * @P9_QTFILE: normal files
+ *
+ * QID types are a subset of permissions - they are primarily
+ * used to differentiate semantics for a file system entity via
+ * a jump-table.  Their value is also the most signifigant 16 bits
+ * of the permission_t
+ *
+ * See Also: http://plan9.bell-labs.com/magic/man2html/2/stat
+ */
+enum p9_qid_t {
         P9_QTDIR = 0x80,
         P9_QTAPPEND = 0x40,
         P9_QTEXCL = 0x20,
@@ -140,6 +254,7 @@ enum {
         P9_QTFILE = 0x00,
 };
 
+/* 9P Magic Numbers */
 #define P9_NOTAG        (u16)(~0)
 #define P9_NOFID        (u32)(~0)
 #define P9_MAXWELEM     16
@@ -147,19 +262,69 @@ enum {
 /* ample room for Twrite/Rread header */
 #define P9_IOHDRSZ      24
 
+/**
+ * struct p9_str - length prefixed string type
+ * @len: length of the string
+ * @str: the string
+ *
+ * The protocol uses length prefixed strings for all
+ * string data, so we replicate that for our internal
+ * string members.
+ */
+
 struct p9_str {
         u16 len;
         char *str;
 };
 
-/* qids are the unique ID for a file (like an inode */
+/**
+ * struct p9_qid - file system entity information
+ * @type: 8-bit type &p9_qid_t
+ * @version: 16-bit monotonically incrementing version number
+ * @path: 64-bit per-server-unique ID for a file system element
+ *
+ * qids are identifiers used by 9P servers to track file system
+ * entities.  The type is used to differentiate semantics for operations
+ * on the entity (ie. read means something different on a directory than
+ * on a file).  The path provides a server unique index for an entity
+ * (roughly analogous to an inode number), while the version is updated
+ * every time a file is modified and can be used to maintain cache
+ * coherency between clients and serves.
+ * Servers will often differentiate purely synthetic entities by setting
+ * their version to 0, signaling that they should never be cached and
+ * should be accessed synchronously.
+ *
+ * See Also://plan9.bell-labs.com/magic/man2html/2/stat
+ */
+
 struct p9_qid {
         u8 type;
         u32 version;
         u64 path;
 };
 
-/* Plan 9 file metadata (stat) structure */
+/**
+ * struct p9_stat - file system metadata information
+ * @size: length prefix for this stat structure instance
+ * @type: the type of the server (equivilent to a major number)
+ * @dev: the sub-type of the server (equivilent to a minor number)
+ * @qid: unique id from the server of type &p9_qid
+ * @mode: Plan 9 format permissions of type &p9_perm_t
+ * @atime: Last access/read time
+ * @mtime: Last modify/write time
+ * @length: file length
+ * @name: last element of path (aka filename) in type &p9_str
+ * @uid: owner name in type &p9_str
+ * @gid: group owner in type &p9_str
+ * @muid: last modifier in type &p9_str
+ * @extension: area used to encode extended UNIX support in type &p9_str
+ * @n_uid: numeric user id of owner (part of 9p2000.u extension)
+ * @n_gid: numeric group id (part of 9p2000.u extension)
+ * @n_muid: numeric user id of laster modifier (part of 9p2000.u extension)
+ *
+ * See Also: http://plan9.bell-labs.com/magic/man2html/2/stat
+ */
+
 struct p9_stat {
         u16 size;
         u16 type;
@@ -179,10 +344,14 @@ struct p9_stat {
         u32 n_muid;                     /* 9p2000.u extensions */
 };
 
-/* file metadata (stat) structure used to create Twstat message
-   The is similar to p9_stat, but the strings don't point to
-   the same memory block and should be freed separately
-*/
+/*
+ * file metadata (stat) structure used to create Twstat message
+ * The is identical to &p9_stat, but the strings don't point to
+ * the same memory block and should be freed separately
+ *
+ * See Also: http://plan9.bell-labs.com/magic/man2html/2/stat
+ */
+
 struct p9_wstat {
         u16 size;
         u16 type;
@@ -335,10 +504,20 @@ struct p9_twstat {
 struct p9_rwstat {
 };
 
-/*
-  * fcall is the primary packet structure
-  *
-  */
+/**
+ * struct p9_fcall - primary packet structure
+ * @size: prefixed length of the structure
+ * @id: protocol operating identifier of type &p9_msg_t
+ * @tag: transaction id of the request
+ * @sdata: payload
+ * @params: per-operation parameters
+ *
+ * &p9_fcall represents the structure for all 9P RPC
+ * transactions.  Requests are packaged into fcalls, and reponses
+ * must be extracted from them.
+ *
+ * See Also: http://plan9.bell-labs.com/magic/man2html/2/fcall
+ */
 
 struct p9_fcall {
         u32 size;
@@ -416,4 +595,5 @@ int p9_idpool_check(int id, struct p9_idpool *p);
 
 int p9_error_init(void);
 int p9_errstr2errno(char *, int);
+int p9_trans_fd_init(void);
 #endif /* NET_9P_H */
diff --git a/include/net/9p/client.h b/include/net/9p/client.h
index e52f93d9ac5f..c936dd14de41 100644
--- a/include/net/9p/client.h
+++ b/include/net/9p/client.h
@@ -26,6 +26,23 @@
 #ifndef NET_9P_CLIENT_H
 #define NET_9P_CLIENT_H
 
+/**
+ * struct p9_client - per client instance state
+ * @lock: protect @fidlist
+ * @msize: maximum data size negotiated by protocol
+ * @dotu: extension flags negotiated by protocol
+ * @trans_mod: module API instantiated with this client
+ * @trans: tranport instance state and API
+ * @conn: connection state information used by trans_fd
+ * @fidpool: fid handle accounting for session
+ * @fidlist: List of active fid handles
+ *
+ * The client structure is used to keep track of various per-client
+ * state that has been instantiated.
+ *
+ * Bugs: duplicated data and potentially unnecessary elements.
+ */
+
 struct p9_client {
         spinlock_t lock; /* protect client structure */
         int msize;
@@ -38,6 +55,24 @@ struct p9_client {
         struct list_head fidlist;
 };
 
+/**
+ * struct p9_fid - file system entity handle
+ * @clnt: back pointer to instantiating &p9_client
+ * @fid: numeric identifier for this handle
+ * @mode: current mode of this fid (enum?)
+ * @qid: the &p9_qid server identifier this handle points to
+ * @iounit: the server reported maximum transaction size for this file
+ * @uid: the numeric uid of the local user who owns this handle
+ * @aux: transport specific information (unused?)
+ * @rdir_fpos: tracks offset of file position when reading directory contents
+ * @rdir_pos: (unused?)
+ * @rdir_fcall: holds response of last directory read request
+ * @flist: per-client-instance fid tracking
+ * @dlist: per-dentry fid tracking
+ *
+ * TODO: This needs lots of explanation.
+ */
+
 struct p9_fid {
         struct p9_client *clnt;
         u32 fid;
diff --git a/include/net/9p/transport.h b/include/net/9p/transport.h
index d2209ae9d18b..0db3a4038dc0 100644
--- a/include/net/9p/transport.h
+++ b/include/net/9p/transport.h
@@ -26,12 +26,40 @@
 #ifndef NET_9P_TRANSPORT_H
 #define NET_9P_TRANSPORT_H
 
+/**
+ * enum p9_trans_status - different states of underlying transports
+ * @Connected: transport is connected and healthy
+ * @Disconnected: transport has been disconnected
+ * @Hung: transport is connected by wedged
+ *
+ * This enumeration details the various states a transport
+ * instatiation can be in.
+ */
+
 enum p9_trans_status {
         Connected,
         Disconnected,
         Hung,
 };
 
+/**
+ * struct p9_trans - per-transport state and API
+ * @status: transport &p9_trans_status
+ * @msize: negotiated maximum packet size (duplicate from client)
+ * @extended: negotiated protocol extensions (duplicate from client)
+ * @priv: transport private data
+ * @close: member function to disconnect and close the transport
+ * @rpc: member function to issue a request to the transport
+ *
+ * This is the basic API for a transport instance.  It is used as
+ * a handle by the client to issue requests.  This interface is currently
+ * in flux during reorganization.
+ *
+ * Bugs: there is lots of duplicated data here and its not clear that
+ * the member functions need to be per-instance versus per transport
+ * module.
+ */
+
 struct p9_trans {
         enum p9_trans_status status;
         int msize;
@@ -42,6 +70,21 @@ struct p9_trans {
                                                         struct p9_fcall **rc);
 };
 
+/**
+ * struct p9_trans_module - transport module interface
+ * @list: used to maintain a list of currently available transports
+ * @name: the human-readable name of the transport
+ * @maxsize: transport provided maximum packet size
+ * @def: set if this transport should be considered the default
+ * @create: member function to create a new connection on this transport
+ *
+ * This is the basic API for a transport module which is registered by the
+ * transport module with the 9P core network module and used by the client
+ * to instantiate a new connection on a transport.
+ *
+ * Bugs: the transport module list isn't protected.
+ */
+
 struct p9_trans_module {
         struct list_head list;
         char *name;             /* name of transport */
@@ -53,5 +96,4 @@ struct p9_trans_module {
 void v9fs_register_trans(struct p9_trans_module *m);
 struct p9_trans_module *v9fs_match_trans(const substring_t *name);
 struct p9_trans_module *v9fs_default_trans(void);
-
 #endif /* NET_9P_TRANSPORT_H */
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 0a2f0372df31..bbd3d583c6e6 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -94,6 +94,28 @@ extern void			addrconf_join_solict(struct net_device *dev,
 extern void                     addrconf_leave_solict(struct inet6_dev *idev,
                                         struct in6_addr *addr);
 
+static inline unsigned long addrconf_timeout_fixup(u32 timeout,
+                                                    unsigned unit)
+{
+        if (timeout == 0xffffffff)
+                return ~0UL;
+
+        /*
+         * Avoid arithmetic overflow.
+         * Assuming unit is constant and non-zero, this "if" statement
+         * will go away on 64bit archs.
+         */
+        if (0xfffffffe > LONG_MAX / unit && timeout > LONG_MAX / unit)
+                return LONG_MAX / unit;
+
+        return timeout;
+}
+
+static inline int addrconf_finite_timeout(unsigned long timeout)
+{
+        return ~timeout;
+}
+
 /*
  *      IPv6 Address Label subsystem (addrlabel.c)
  */
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index decdda546829..747c255d1df0 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -162,9 +162,9 @@ static inline int genlmsg_end(struct sk_buff *skb, void *hdr)
  * @skb: socket buffer the message is stored in
  * @hdr: generic netlink message header
  */
-static inline int genlmsg_cancel(struct sk_buff *skb, void *hdr)
+static inline void genlmsg_cancel(struct sk_buff *skb, void *hdr)
 {
-        return nlmsg_cancel(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
+        nlmsg_cancel(skb, hdr - GENL_HDRLEN - NLMSG_HDRLEN);
 }
 
 /**
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index a42cd63d241a..9fabe5b38912 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -197,4 +197,14 @@ static inline int inet_iif(const struct sk_buff *skb)
         return skb->rtable->rt_iif;
 }
 
+static inline struct request_sock *inet_reqsk_alloc(struct request_sock_ops *ops)
+{
+        struct request_sock *req = reqsk_alloc(ops);
+
+        if (req != NULL)
+                inet_rsk(req)->opt = NULL;
+
+        return req;
+}
+
 #endif  /* _INET_SOCK_H */
diff --git a/include/net/irda/discovery.h b/include/net/irda/discovery.h
index e4efad1f9eff..0ce93398720d 100644
--- a/include/net/irda/discovery.h
+++ b/include/net/irda/discovery.h
@@ -57,9 +57,6 @@ typedef union {
         __u8  byte[2];
 } __u16_host_order;
 
-/* Same purpose, different application */
-#define u16ho(array) (* ((__u16 *) array))
-
 /* Types of discovery */
 typedef enum {
         DISCOVERY_LOG,          /* What's in our discovery log */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 4a80d74975e8..dae3f9ec1154 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1594,13 +1594,16 @@ void ieee80211_wake_queues(struct ieee80211_hw *hw);
 void ieee80211_scan_completed(struct ieee80211_hw *hw);
 
 /**
- * ieee80211_iterate_active_interfaces - iterate active interfaces
+ * ieee80211_iterate_active_interfaces- iterate active interfaces
  *
  * This function iterates over the interfaces associated with a given
  * hardware that are currently active and calls the callback for them.
+ * This function allows the iterator function to sleep, when the iterator
+ * function is atomic @ieee80211_iterate_active_interfaces_atomic can
+ * be used.
  *
  * @hw: the hardware struct of which the interfaces should be iterated over
- * @iterator: the iterator function to call, cannot sleep
+ * @iterator: the iterator function to call
  * @data: first argument of the iterator function
  */
 void ieee80211_iterate_active_interfaces(struct ieee80211_hw *hw,
@@ -1609,6 +1612,24 @@ void ieee80211_iterate_active_interfaces(struct ieee80211_hw *hw,
                                          void *data);
 
 /**
+ * ieee80211_iterate_active_interfaces_atomic - iterate active interfaces
+ *
+ * This function iterates over the interfaces associated with a given
+ * hardware that are currently active and calls the callback for them.
+ * This function requires the iterator callback function to be atomic,
+ * if that is not desired, use @ieee80211_iterate_active_interfaces instead.
+ *
+ * @hw: the hardware struct of which the interfaces should be iterated over
+ * @iterator: the iterator function to call, cannot sleep
+ * @data: first argument of the iterator function
+ */
+void ieee80211_iterate_active_interfaces_atomic(struct ieee80211_hw *hw,
+                                                void (*iterator)(void *data,
+                                                    u8 *mac,
+                                                    struct ieee80211_vif *vif),
+                                                void *data);
+
+/**
  * ieee80211_start_tx_ba_session - Start a tx Block Ack session.
  * @hw: pointer as obtained from ieee80211_alloc_hw().
  * @ra: receiver address of the BA session recipient
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index 9c451ff2f4f4..a01b7c4dc763 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -129,6 +129,10 @@ extern int 			ndisc_ifinfo_sysctl_change(struct ctl_table *ctl,
                                                            void __user *buffer,
                                                            size_t *lenp,
                                                            loff_t *ppos);
+int ndisc_ifinfo_sysctl_strategy(ctl_table *ctl, int __user *name,
+                                 int nlen, void __user *oldval,
+                                 size_t __user *oldlenp,
+                                 void __user *newval, size_t newlen);
 #endif
 
 extern void                     inet6_ifinfo_notify(int event,
diff --git a/include/net/netlink.h b/include/net/netlink.h
index a5506c42f03c..dfc3701dfcc3 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -556,14 +556,12 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb)
  * @skb: socket buffer the message is stored in
  * @mark: mark to trim to
  *
- * Trims the message to the provided mark. Returns -1.
+ * Trims the message to the provided mark.
  */
-static inline int nlmsg_trim(struct sk_buff *skb, const void *mark)
+static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
 {
         if (mark)
                 skb_trim(skb, (unsigned char *) mark - skb->data);
-
-        return -1;
 }
 
 /**
@@ -572,11 +570,11 @@ static inline int nlmsg_trim(struct sk_buff *skb, const void *mark)
  * @nlh: netlink message header
  *
  * Removes the complete netlink message including all
- * attributes from the socket buffer again. Returns -1.
+ * attributes from the socket buffer again.
  */
-static inline int nlmsg_cancel(struct sk_buff *skb, struct nlmsghdr *nlh)
+static inline void nlmsg_cancel(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
-        return nlmsg_trim(skb, nlh);
+        nlmsg_trim(skb, nlh);
 }
 
 /**
@@ -772,12 +770,13 @@ static inline int __nla_parse_nested_compat(struct nlattr *tb[], int maxtype,
                                             const struct nla_policy *policy,
                                             int len)
 {
-        if (nla_len(nla) < len)
-                return -1;
-        if (nla_len(nla) >= NLA_ALIGN(len) + sizeof(struct nlattr))
-                return nla_parse_nested(tb, maxtype,
-                                        nla_data(nla) + NLA_ALIGN(len),
-                                        policy);
+        int nested_len = nla_len(nla) - NLA_ALIGN(len);
+
+        if (nested_len < 0)
+                return -EINVAL;
+        if (nested_len >= nla_attr_size(0))
+                return nla_parse(tb, maxtype, nla_data(nla) + NLA_ALIGN(len),
+                                 nested_len, policy);
         memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1));
         return 0;
 }
@@ -1079,11 +1078,11 @@ static inline int nla_nest_compat_end(struct sk_buff *skb, struct nlattr *start)
  * @start: container attribute
  *
  * Removes the container attribute and including all nested
- * attributes. Returns -1.
+ * attributes. Returns -EMSGSIZE
  */
-static inline int nla_nest_cancel(struct sk_buff *skb, struct nlattr *start)
+static inline void nla_nest_cancel(struct sk_buff *skb, struct nlattr *start)
 {
-        return nlmsg_trim(skb, start);
+        nlmsg_trim(skb, start);
 }
 
 /**
diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index b220b5f624de..0c96e7bed5db 100644
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -115,8 +115,8 @@ struct request_sock_queue {
         struct request_sock     *rskq_accept_head;
         struct request_sock     *rskq_accept_tail;
         rwlock_t                syn_wait_lock;
-        u16                     rskq_defer_accept;
-        /* 2 bytes hole, try to pack */
+        u8                      rskq_defer_accept;
+        /* 3 bytes hole, try to pack */
         struct listen_sock      *listen_opt;
 };
 
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 0ce0443c5b79..7f25195f9855 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -548,7 +548,8 @@ struct sctp_af {
         struct dst_entry *(*get_dst)    (struct sctp_association *asoc,
                                          union sctp_addr *daddr,
                                          union sctp_addr *saddr);
-        void            (*get_saddr)    (struct sctp_association *asoc,
+        void            (*get_saddr)    (struct sctp_sock *sk,
+                                         struct sctp_association *asoc,
                                          struct dst_entry *dst,
                                          union sctp_addr *daddr,
                                          union sctp_addr *saddr);
@@ -587,6 +588,7 @@ struct sctp_af {
         int             (*is_ce)        (const struct sk_buff *sk);
         void            (*seq_dump_addr)(struct seq_file *seq,
                                          union sctp_addr *addr);
+        void            (*ecn_capable)(struct sock *sk);
         __u16           net_header_len;
         int             sockaddr_len;
         sa_family_t     sa_family;
@@ -901,7 +903,10 @@ struct sctp_transport {
          *              calculation completes (i.e. the DATA chunk
          *              is SACK'd) clear this flag.
          */
-        int rto_pending;
+        __u8 rto_pending;
+
+        /* Flag to track the current fast recovery state */
+        __u8 fast_recovery;
 
         /*
          * These are the congestion stats.
@@ -920,6 +925,9 @@ struct sctp_transport {
         /* Data that has been sent, but not acknowledged. */
         __u32 flight_size;
 
+        /* TSN marking the fast recovery exit point */
+        __u32 fast_recovery_exit;
+
         /* Destination */
         struct dst_entry *dst;
         /* Source address. */
@@ -1044,7 +1052,7 @@ void sctp_transport_route(struct sctp_transport *, union sctp_addr *,
                           struct sctp_sock *);
 void sctp_transport_pmtu(struct sctp_transport *);
 void sctp_transport_free(struct sctp_transport *);
-void sctp_transport_reset_timers(struct sctp_transport *);
+void sctp_transport_reset_timers(struct sctp_transport *, int);
 void sctp_transport_hold(struct sctp_transport *);
 void sctp_transport_put(struct sctp_transport *);
 void sctp_transport_update_rto(struct sctp_transport *, __u32);
@@ -1134,6 +1142,9 @@ struct sctp_outq {
         /* How many unackd bytes do we have in-flight?  */
         __u32 outstanding_bytes;
 
+        /* Are we doing fast-rtx on this queue */
+        char fast_rtx;
+
         /* Corked? */
         char cork;
 
diff --git a/include/net/syncppp.h b/include/net/syncppp.h
index 877efa434700..e43f4070d892 100644
--- a/include/net/syncppp.h
+++ b/include/net/syncppp.h
@@ -59,7 +59,7 @@ struct ppp_device
 
 static inline struct sppp *sppp_of(struct net_device *dev) 
 {
-        struct ppp_device **ppp = dev->priv;
+        struct ppp_device **ppp = dev->ml_priv;
         BUG_ON((*ppp)->dev != dev);
         return &(*ppp)->sppp;
 }
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 633147cb6bbc..cf54034019d9 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -139,7 +139,6 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 #define MAX_TCP_KEEPINTVL       32767
 #define MAX_TCP_KEEPCNT         127
 #define MAX_TCP_SYNCNT          127
-#define MAX_TCP_ACCEPT_DEFERRED 65535
 
 #define TCP_SYNQ_INTERVAL       (HZ/5)  /* Period of SYNACK timer */
 
@@ -433,7 +432,6 @@ extern struct sk_buff *		tcp_make_synack(struct sock *sk,
 
 extern int                      tcp_disconnect(struct sock *sk, int flags);
 
-extern void                     tcp_unhash(struct sock *sk);
 
 /* From syncookies.c */
 extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];
diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
index 27394e0447d8..112934a3288d 100644
--- a/include/net/transp_v6.h
+++ b/include/net/transp_v6.h
@@ -40,7 +40,8 @@ extern int			datagram_recv_ctl(struct sock *sk,
                                                   struct msghdr *msg,
                                                   struct sk_buff *skb);
 
-extern int                      datagram_send_ctl(struct msghdr *msg,
+extern int                      datagram_send_ctl(struct net *net,
+                                                  struct msghdr *msg,
                                                   struct flowi *fl,
                                                   struct ipv6_txoptions *opt,
                                                   int *hlimit, int *tclass);
diff --git a/include/net/udp.h b/include/net/udp.h
index 3e55a99b0ba3..ccce83707046 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -135,6 +135,7 @@ extern void	udp_err(struct sk_buff *, u32);
 
 extern int      udp_sendmsg(struct kiocb *iocb, struct sock *sk,
                             struct msghdr *msg, size_t len);
+extern void     udp_flush_pending_frames(struct sock *sk);
 
 extern int      udp_rcv(struct sk_buff *skb);
 extern int      udp_ioctl(struct sock *sk, int cmd, unsigned long arg);