32 files changed, 161 insertions, 58 deletions

diff --git a/include/net/9p/9p.h b/include/net/9p/9p.h
index 6b75a6971346..d2df55b0c213 100644
--- a/include/net/9p/9p.h
+++ b/include/net/9p/9p.h
@@ -119,7 +119,7 @@ do { \
  * @P9_TREAD: request to transfer data from a file or directory
  * @P9_RREAD: response with data requested
  * @P9_TWRITE: reuqest to transfer data to a file
- * @P9_RWRITE: response with out much data was transfered to file
+ * @P9_RWRITE: response with out much data was transferred to file
  * @P9_TCLUNK: forget about a handle to an entity within the file system
  * @P9_RCLUNK: response when server has forgotten about the handle
  * @P9_TREMOVE: request to remove an entity from the hierarchy
@@ -139,8 +139,6 @@ do { \
  */
 
 enum p9_msg_t {
-        P9_TSYNCFS = 0,
-        P9_RSYNCFS,
         P9_TLERROR = 6,
         P9_RLERROR,
         P9_TSTATFS = 8,
@@ -294,7 +292,7 @@ enum p9_perm_t {
  *
  * QID types are a subset of permissions - they are primarily
  * used to differentiate semantics for a file system entity via
- * a jump-table.  Their value is also the most signifigant 16 bits
+ * a jump-table.  Their value is also the most significant 16 bits
  * of the permission_t
  *
  * See Also: http://plan9.bell-labs.com/magic/man2html/2/stat
@@ -366,8 +364,8 @@ struct p9_qid {
 /**
  * struct p9_stat - file system metadata information
  * @size: length prefix for this stat structure instance
- * @type: the type of the server (equivilent to a major number)
- * @dev: the sub-type of the server (equivilent to a minor number)
+ * @type: the type of the server (equivalent to a major number)
+ * @dev: the sub-type of the server (equivalent to a minor number)
  * @qid: unique id from the server of type &p9_qid
  * @mode: Plan 9 format permissions of type &p9_perm_t
  * @atime: Last access/read time
diff --git a/include/net/9p/client.h b/include/net/9p/client.h
index 0a30977e3c1f..051a99f79769 100644
--- a/include/net/9p/client.h
+++ b/include/net/9p/client.h
@@ -101,7 +101,7 @@ enum p9_req_status_t {
  * Transport use an array to track outstanding requests
  * instead of a list.  While this may incurr overhead during initial
  * allocation or expansion, it makes request lookup much easier as the
- * tag id is a index into an array.  (We use tag+1 so that we can accomodate
+ * tag id is a index into an array.  (We use tag+1 so that we can accommodate
  * the -1 tag for the T_VERSION request).
  * This also has the nice effect of only having to allocate wait_queues
  * once, instead of constantly allocating and freeing them.  Its possible
@@ -218,8 +218,8 @@ void p9_client_disconnect(struct p9_client *clnt);
 void p9_client_begin_disconnect(struct p9_client *clnt);
 struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
                                         char *uname, u32 n_uname, char *aname);
-struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
-                                                                int clone);
+struct p9_fid *p9_client_walk(struct p9_fid *oldfid, uint16_t nwname,
+                char **wnames, int clone);
 int p9_client_open(struct p9_fid *fid, int mode);
 int p9_client_fcreate(struct p9_fid *fid, char *name, u32 perm, int mode,
                                                         char *extension);
@@ -230,7 +230,6 @@ int p9_client_create_dotl(struct p9_fid *ofid, char *name, u32 flags, u32 mode,
                 gid_t gid, struct p9_qid *qid);
 int p9_client_clunk(struct p9_fid *fid);
 int p9_client_fsync(struct p9_fid *fid, int datasync);
-int p9_client_sync_fs(struct p9_fid *fid);
 int p9_client_remove(struct p9_fid *fid);
 int p9_client_read(struct p9_fid *fid, char *data, char __user *udata,
                                                         u64 offset, u32 count);
diff --git a/include/net/9p/transport.h b/include/net/9p/transport.h
index 82868f18c573..8f08c736c4c3 100644
--- a/include/net/9p/transport.h
+++ b/include/net/9p/transport.h
@@ -30,7 +30,7 @@
 
 /* Default. Add Payload to PDU before sending it down to transport layer */
 #define P9_TRANS_PREF_PAYLOAD_DEF  0x0
-/* Send pay load seperately to transport layer along with PDU.*/
+/* Send pay load separately to transport layer along with PDU.*/
 #define P9_TRANS_PREF_PAYLOAD_SEP  0x1
 
 /**
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index ec6acf2f1c0b..2c0d309c7381 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -84,6 +84,8 @@ enum {
         HCI_SERVICE_CACHE,
         HCI_LINK_KEYS,
         HCI_DEBUG_KEYS,
+
+        HCI_RESET,
 };
 
 /* HCI ioctl defines */
diff --git a/include/net/caif/cfcnfg.h b/include/net/caif/cfcnfg.h
index f688478bfb84..f33d36341132 100644
--- a/include/net/caif/cfcnfg.h
+++ b/include/net/caif/cfcnfg.h
@@ -69,7 +69,7 @@ void cfcnfg_remove(struct cfcnfg *cfg);
  *              cfcnfg_add_adapt_layer to specify PHY for the link.
  * @pref:       The phy (link layer) preference.
  * @fcs:        Specify if checksum is used in CAIF Framing Layer.
- * @stx:        Specify if Start Of Frame eXtention is used.
+ * @stx:        Specify if Start Of Frame extension is used.
  */
 
 void
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 60f7876b6da8..b2b9d28cb4ab 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -486,7 +486,8 @@ struct rate_info {
  * @plink_state: mesh peer link state
  * @signal: signal strength of last received packet in dBm
  * @signal_avg: signal strength average in dBm
- * @txrate: current unicast bitrate to this station
+ * @txrate: current unicast bitrate from this station
+ * @rxrate: current unicast bitrate to this station
  * @rx_packets: packets received from this station
  * @tx_packets: packets transmitted to this station
  * @tx_retries: cumulative retry counts
diff --git a/include/net/dst.h b/include/net/dst.h
index 2a46cbaef92d..75b95df4afe7 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -345,7 +345,7 @@ static inline void skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
 
 static inline struct dst_entry *skb_dst_pop(struct sk_buff *skb)
 {
-        struct dst_entry *child = skb_dst(skb)->child;
+        struct dst_entry *child = dst_clone(skb_dst(skb)->child);
 
         skb_dst_drop(skb);
         return child;
diff --git a/include/net/gen_stats.h b/include/net/gen_stats.h
index fa157712e982..a79b6cfb02a8 100644
--- a/include/net/gen_stats.h
+++ b/include/net/gen_stats.h
@@ -11,7 +11,7 @@ struct gnet_dump {
         struct sk_buff *  skb;
         struct nlattr *   tail;
 
-        /* Backward compatability */
+        /* Backward compatibility */
         int               compat_tc_stats;
         int               compat_xstats;
         void *            xstats;
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 04977eefb0ee..fccc2180c61b 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -286,5 +286,21 @@ static inline void ipv6_ib_mc_map(const struct in6_addr *addr,
         buf[9]  = broadcast[9];
         memcpy(buf + 10, addr->s6_addr + 6, 10);
 }
+
+static inline int ipv6_ipgre_mc_map(const struct in6_addr *addr,
+                                    const unsigned char *broadcast, char *buf)
+{
+        if ((broadcast[0] | broadcast[1] | broadcast[2] | broadcast[3]) != 0) {
+                memcpy(buf, broadcast, 4);
+        } else {
+                /* v4mapped? */
+                if ((addr->s6_addr32[0] | addr->s6_addr32[1] |
+                     (addr->s6_addr32[2] ^ htonl(0x0000ffff))) != 0)
+                        return -EINVAL;
+                memcpy(buf, &addr->s6_addr32[3], 4);
+        }
+        return 0;
+}
+
 #endif
 #endif
diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
index 88bdd010d65d..2fa8d1341a0a 100644
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -38,9 +38,19 @@ static inline __u8 INET_ECN_encapsulate(__u8 outer, __u8 inner)
         return outer;
 }
 
-#define INET_ECN_xmit(sk) do { inet_sk(sk)->tos |= INET_ECN_ECT_0; } while (0)
-#define INET_ECN_dontxmit(sk) \
-        do { inet_sk(sk)->tos &= ~INET_ECN_MASK; } while (0)
+static inline void INET_ECN_xmit(struct sock *sk)
+{
+        inet_sk(sk)->tos |= INET_ECN_ECT_0;
+        if (inet6_sk(sk) != NULL)
+                inet6_sk(sk)->tclass |= INET_ECN_ECT_0;
+}
+
+static inline void INET_ECN_dontxmit(struct sock *sk)
+{
+        inet_sk(sk)->tos &= ~INET_ECN_MASK;
+        if (inet6_sk(sk) != NULL)
+                inet6_sk(sk)->tclass &= ~INET_ECN_MASK;
+}
 
 #define IP6_ECN_flow_init(label) do {           \
       (label) &= ~htonl(INET_ECN_MASK << 20);   \
diff --git a/include/net/ip.h b/include/net/ip.h
index a4f631108c54..7c416583b710 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -339,6 +339,14 @@ static inline void ip_ib_mc_map(__be32 naddr, const unsigned char *broadcast, ch
         buf[16] = addr & 0x0f;
 }
 
+static inline void ip_ipgre_mc_map(__be32 naddr, const unsigned char *broadcast, char *buf)
+{
+        if ((broadcast[0] | broadcast[1] | broadcast[2] | broadcast[3]) != 0)
+                memcpy(buf, broadcast, 4);
+        else
+                memcpy(buf, &naddr, sizeof(naddr));
+}
+
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 #include <linux/ipv6.h>
 #endif
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 642a80bb42cf..c850e5fb967c 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -70,7 +70,7 @@ static inline struct inet_peer *rt6_get_peer(struct rt6_info *rt)
 extern void                     ip6_route_input(struct sk_buff *skb);
 
 extern struct dst_entry *       ip6_route_output(struct net *net,
-                                                 struct sock *sk,
+                                                 const struct sock *sk,
                                                  struct flowi6 *fl6);
 
 extern int                      ip6_route_init(void);
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index a1a858035913..e5d66ec88cf6 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -51,7 +51,6 @@ struct fib_nh {
         struct fib_info         *nh_parent;
         unsigned                nh_flags;
         unsigned char           nh_scope;
-        unsigned char           nh_cfg_scope;
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
         int                     nh_weight;
         int                     nh_power;
@@ -62,6 +61,7 @@ struct fib_nh {
         int                     nh_oif;
         __be32                  nh_gw;
         __be32                  nh_saddr;
+        int                     nh_saddr_genid;
 };
 
 /*
@@ -74,9 +74,10 @@ struct fib_info {
         struct net              *fib_net;
         int                     fib_treeref;
         atomic_t                fib_clntref;
-        int                     fib_dead;
         unsigned                fib_flags;
-        int                     fib_protocol;
+        unsigned char           fib_dead;
+        unsigned char           fib_protocol;
+        unsigned char           fib_scope;
         __be32                  fib_prefsrc;
         u32                     fib_priority;
         u32                     *fib_metrics;
@@ -141,12 +142,19 @@ struct fib_result_nl {
 
 #endif /* CONFIG_IP_ROUTE_MULTIPATH */
 
-#define FIB_RES_SADDR(res)              (FIB_RES_NH(res).nh_saddr)
+extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
+
+#define FIB_RES_SADDR(net, res)                         \
+        ((FIB_RES_NH(res).nh_saddr_genid ==             \
+          atomic_read(&(net)->ipv4.dev_addr_genid)) ?   \
+         FIB_RES_NH(res).nh_saddr :                     \
+         fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
 #define FIB_RES_GW(res)                 (FIB_RES_NH(res).nh_gw)
 #define FIB_RES_DEV(res)                (FIB_RES_NH(res).nh_dev)
 #define FIB_RES_OIF(res)                (FIB_RES_NH(res).nh_oif)
 
-#define FIB_RES_PREFSRC(res)            ((res).fi->fib_prefsrc ? : FIB_RES_SADDR(res))
+#define FIB_RES_PREFSRC(net, res)       ((res).fi->fib_prefsrc ? : \
+                                         FIB_RES_SADDR(net, res))
 
 struct fib_table {
         struct hlist_node tb_hlist;
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 272f59336b73..86aefed6140b 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -52,7 +52,7 @@ static inline struct net *skb_net(const struct sk_buff *skb)
          */
         if (likely(skb->dev && skb->dev->nd_net))
                 return dev_net(skb->dev);
-        if (skb_dst(skb)->dev)
+        if (skb_dst(skb) && skb_dst(skb)->dev)
                 return dev_net(skb_dst(skb)->dev);
         WARN(skb->sk, "Maybe skb_sknet should be used in %s() at line:%d\n",
                       __func__, __LINE__);
@@ -92,7 +92,7 @@ static inline struct net *skb_sknet(const struct sk_buff *skb)
 }
 /*
  * This one needed for single_open_net since net is stored directly in
- * private not as a struct i.e. seq_file_net cant be used.
+ * private not as a struct i.e. seq_file_net can't be used.
  */
 static inline struct net *seq_file_single_net(struct seq_file *seq)
 {
@@ -791,6 +791,7 @@ struct ip_vs_app {
 /* IPVS in network namespace */
 struct netns_ipvs {
         int                     gen;            /* Generation */
+        int                     enable;         /* enable like nf_hooks do */
         /*
          *      Hash table: for real service lookups
          */
@@ -801,8 +802,6 @@ struct netns_ipvs {
         struct list_head        rs_table[IP_VS_RTAB_SIZE];
         /* ip_vs_app */
         struct list_head        app_list;
-        struct mutex            app_mutex;
-        struct lock_class_key   app_key;        /* mutex debuging */
 
         /* ip_vs_proto */
         #define IP_VS_PROTO_TAB_SIZE    32      /* must be power of 2 */
@@ -1091,6 +1090,22 @@ ip_vs_control_add(struct ip_vs_conn *cp, struct ip_vs_conn *ctl_cp)
         atomic_inc(&ctl_cp->n_control);
 }
 
+/*
+ * IPVS netns init & cleanup functions
+ */
+extern int __ip_vs_estimator_init(struct net *net);
+extern int __ip_vs_control_init(struct net *net);
+extern int __ip_vs_protocol_init(struct net *net);
+extern int __ip_vs_app_init(struct net *net);
+extern int __ip_vs_conn_init(struct net *net);
+extern int __ip_vs_sync_init(struct net *net);
+extern void __ip_vs_conn_cleanup(struct net *net);
+extern void __ip_vs_app_cleanup(struct net *net);
+extern void __ip_vs_protocol_cleanup(struct net *net);
+extern void __ip_vs_control_cleanup(struct net *net);
+extern void __ip_vs_estimator_cleanup(struct net *net);
+extern void __ip_vs_sync_cleanup(struct net *net);
+extern void __ip_vs_service_cleanup(struct net *net);
 
 /*
  *      IPVS application functions
diff --git a/include/net/irda/irlap.h b/include/net/irda/irlap.h
index 17fcd964f9d9..fb4b76d5d7f1 100644
--- a/include/net/irda/irlap.h
+++ b/include/net/irda/irlap.h
@@ -204,7 +204,7 @@ struct irlap_cb {
 
         notify_t notify; /* Callbacks to IrLMP */
 
-        int    mtt_required;  /* Minumum turnaround time required */
+        int    mtt_required;  /* Minimum turnaround time required */
         int    xbofs_delay;   /* Nr of XBOF's used to MTT */
         int    bofs_count;    /* Negotiated extra BOFs */
         int    next_bofs;     /* Negotiated extra BOFs after next frame */
diff --git a/include/net/irda/wrapper.h b/include/net/irda/wrapper.h
index 2942ad6ab932..eef53ebe3d76 100644
--- a/include/net/irda/wrapper.h
+++ b/include/net/irda/wrapper.h
@@ -42,7 +42,7 @@
 
 #define IRDA_TRANS 0x20    /* Asynchronous transparency modifier */       
 
-/* States for receving a frame in async mode */
+/* States for receiving a frame in async mode */
 enum {
         OUTSIDE_FRAME, 
         BEGIN_FRAME, 
diff --git a/include/net/iucv/iucv.h b/include/net/iucv/iucv.h
index 205a3360156e..1121baa9f695 100644
--- a/include/net/iucv/iucv.h
+++ b/include/net/iucv/iucv.h
@@ -173,7 +173,7 @@ struct iucv_handler {
         /*
          * The message_pending function is called after an icuv interrupt
          * type 0x06 or type 0x07 has been received. A new message is
-         * availabe and can be received with iucv_message_receive.
+         * available and can be received with iucv_message_receive.
          */
         void (*message_pending)(struct iucv_path *, struct iucv_message *);
         /*
diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h
index 3afdb21cc31d..5d5a6a4732ef 100644
--- a/include/net/iw_handler.h
+++ b/include/net/iw_handler.h
@@ -91,7 +91,7 @@
  * --------------------
  * The implementation goals were as follow :
  *      o Obvious : you should not need a PhD to understand what's happening,
- *              the benefit is easier maintainance.
+ *              the benefit is easier maintenance.
  *      o Flexible : it should accommodate a wide variety of driver
  *              implementations and be as flexible as the old API.
  *      o Lean : it should be efficient memory wise to minimise the impact
@@ -129,7 +129,7 @@
  *
  * Functions prototype uses union iwreq_data
  * -----------------------------------------
- * Some would have prefered functions defined this way :
+ * Some would have preferred functions defined this way :
  *      static int mydriver_ioctl_setrate(struct net_device *dev, 
  *                                        long rate, int auto)
  * 1) The kernel code doesn't "validate" the content of iwreq_data, and
diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h
index 75b8e2968c9b..f57e7d46a453 100644
--- a/include/net/llc_pdu.h
+++ b/include/net/llc_pdu.h
@@ -199,7 +199,7 @@ struct llc_pdu_sn {
         u8 ssap;
         u8 ctrl_1;
         u8 ctrl_2;
-};
+} __packed;
 
 static inline struct llc_pdu_sn *llc_pdu_sn_hdr(struct sk_buff *skb)
 {
@@ -211,7 +211,7 @@ struct llc_pdu_un {
         u8 dsap;
         u8 ssap;
         u8 ctrl_1;
-};
+} __packed;
 
 static inline struct llc_pdu_un *llc_pdu_un_hdr(struct sk_buff *skb)
 {
@@ -359,7 +359,7 @@ struct llc_xid_info {
         u8 fmt_id;      /* always 0x81 for LLC */
         u8 type;        /* different if NULL/non-NULL LSAP */
         u8 rw;          /* sender receive window */
-};
+} __packed;
 
 /**
  *      llc_pdu_init_as_xid_cmd - sets bytes 3, 4 & 5 of LLC header as XID
@@ -415,7 +415,7 @@ struct llc_frmr_info {
         u8  curr_ssv;           /* current send state variable val */
         u8  curr_rsv;           /* current receive state variable */
         u8  ind_bits;           /* indicator bits set with macro */
-};
+} __packed;
 
 extern void llc_pdu_set_cmd_rsp(struct sk_buff *skb, u8 type);
 extern void llc_pdu_set_pf_bit(struct sk_buff *skb, u8 bit_value);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 8650e7bf2ed0..025d4cc7bbf8 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1160,7 +1160,7 @@ enum ieee80211_hw_flags {
  * @napi_weight: weight used for NAPI polling.  You must specify an
  *      appropriate value here if a napi_poll operation is provided
  *      by your driver.
-
+ *
  * @max_rx_aggregation_subframes: maximum buffer size (number of
  *      sub-frames) to be used for A-MPDU block ack receiver
  *      aggregation.
@@ -1294,7 +1294,7 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  * acceleration (i.e. iwlwifi). Those drivers should provide update_tkip_key
  * handler.
  * The update_tkip_key() call updates the driver with the new phase 1 key.
- * This happens everytime the iv16 wraps around (every 65536 packets). The
+ * This happens every time the iv16 wraps around (every 65536 packets). The
  * set_key() call will happen only once for each key (unless the AP did
  * rekeying), it will not include a valid phase 1 key. The valid phase 1 key is
  * provided by update_tkip_key only. The trigger that makes mac80211 call this
@@ -1753,8 +1753,19 @@ enum ieee80211_ampdu_mlme_action {
  *      that TX/RX_STOP can pass NULL for this parameter.
  *      The @buf_size parameter is only valid when the action is set to
  *      %IEEE80211_AMPDU_TX_OPERATIONAL and indicates the peer's reorder
- *      buffer size (number of subframes) for this session -- aggregates
- *      containing more subframes than this may not be transmitted to the peer.
+ *      buffer size (number of subframes) for this session -- the driver
+ *      may neither send aggregates containing more subframes than this
+ *      nor send aggregates in a way that lost frames would exceed the
+ *      buffer size. If just limiting the aggregate size, this would be
+ *      possible with a buf_size of 8:
+ *       - TX: 1.....7
+ *       - RX:  2....7 (lost frame #1)
+ *       - TX:        8..1...
+ *      which is invalid since #1 was now re-transmitted well past the
+ *      buffer size of 8. Correct ways to retransmit #1 would be:
+ *       - TX:       1 or 18 or 81
+ *      Even "189" would be wrong since 1 could be lost again.
+ *
  *      Returns a negative error code on failure.
  *      The callback can sleep.
  *
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index e2e2ef57eca2..542195d9469e 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -55,6 +55,7 @@ struct netns_ipv4 {
         int current_rt_cache_rebuild_count;
 
         atomic_t rt_genid;
+        atomic_t dev_addr_genid;
 
 #ifdef CONFIG_IP_MROUTE
 #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index d9549af6929a..65afc4966204 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -32,7 +32,7 @@ static inline void *qdisc_priv(struct Qdisc *q)
    
    The result: [34]86 is not good choice for QoS router :-(
 
-   The things are not so bad, because we may use artifical
+   The things are not so bad, because we may use artificial
    clock evaluated by integration of network data flow
    in the most critical places.
  */
diff --git a/include/net/rose.h b/include/net/rose.h
index 5ba9f02731eb..555dd198aab7 100644
--- a/include/net/rose.h
+++ b/include/net/rose.h
@@ -14,6 +14,12 @@
 
 #define ROSE_MIN_LEN                    3
 
+#define ROSE_CALL_REQ_ADDR_LEN_OFF      3
+#define ROSE_CALL_REQ_ADDR_LEN_VAL      0xAA    /* each address is 10 digits */
+#define ROSE_CALL_REQ_DEST_ADDR_OFF     4
+#define ROSE_CALL_REQ_SRC_ADDR_OFF      9
+#define ROSE_CALL_REQ_FACILITIES_OFF    14
+
 #define ROSE_GFI                        0x10
 #define ROSE_Q_BIT                      0x80
 #define ROSE_D_BIT                      0x40
@@ -214,7 +220,7 @@ extern void rose_requeue_frames(struct sock *);
 extern int  rose_validate_nr(struct sock *, unsigned short);
 extern void rose_write_internal(struct sock *, int);
 extern int  rose_decode(struct sk_buff *, int *, int *, int *, int *, int *);
-extern int  rose_parse_facilities(unsigned char *, struct rose_facilities_struct *);
+extern int  rose_parse_facilities(unsigned char *, unsigned int, struct rose_facilities_struct *);
 extern void rose_disconnect(struct sock *, int, int, int);
 
 /* rose_timer.c */
diff --git a/include/net/route.h b/include/net/route.h
index 30d6cae3841a..8fce0621cad1 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -64,6 +64,7 @@ struct rtable {
 
         __be32                  rt_dst; /* Path destination     */
         __be32                  rt_src; /* Path source          */
+        int                     rt_route_iif;
         int                     rt_iif;
         int                     rt_oif;
         __u32                   rt_mark;
@@ -80,12 +81,12 @@ struct rtable {
 
 static inline bool rt_is_input_route(struct rtable *rt)
 {
-        return rt->rt_iif != 0;
+        return rt->rt_route_iif != 0;
 }
 
 static inline bool rt_is_output_route(struct rtable *rt)
 {
-        return rt->rt_iif == 0;
+        return rt->rt_route_iif == 0;
 }
 
 struct ip_rt_acct {
@@ -207,6 +208,7 @@ extern int		ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb);
 
 struct in_ifaddr;
 extern void fib_add_ifaddr(struct in_ifaddr *);
+extern void fib_del_ifaddr(struct in_ifaddr *, struct in_ifaddr *);
 
 static inline void ip_rt_put(struct rtable * rt)
 {
@@ -269,8 +271,8 @@ static inline struct rtable *ip_route_newports(struct rtable *rt,
                 struct flowi4 fl4 = {
                         .flowi4_oif = rt->rt_oif,
                         .flowi4_mark = rt->rt_mark,
-                        .daddr = rt->rt_key_dst,
-                        .saddr = rt->rt_key_src,
+                        .daddr = rt->rt_dst,
+                        .saddr = rt->rt_src,
                         .flowi4_tos = rt->rt_tos,
                         .flowi4_proto = protocol,
                         .fl4_sport = sport,
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index a9505b6a18e3..b931f021d7ab 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -25,6 +25,7 @@ struct qdisc_rate_table {
 enum qdisc_state_t {
         __QDISC_STATE_SCHED,
         __QDISC_STATE_DEACTIVATED,
+        __QDISC_STATE_THROTTLED,
 };
 
 /*
@@ -32,7 +33,6 @@ enum qdisc_state_t {
  */
 enum qdisc___state_t {
         __QDISC___STATE_RUNNING = 1,
-        __QDISC___STATE_THROTTLED = 2,
 };
 
 struct qdisc_size_table {
@@ -106,17 +106,17 @@ static inline void qdisc_run_end(struct Qdisc *qdisc)
 
 static inline bool qdisc_is_throttled(const struct Qdisc *qdisc)
 {
-        return (qdisc->__state & __QDISC___STATE_THROTTLED) ? true : false;
+        return test_bit(__QDISC_STATE_THROTTLED, &qdisc->state) ? true : false;
 }
 
 static inline void qdisc_throttled(struct Qdisc *qdisc)
 {
-        qdisc->__state |= __QDISC___STATE_THROTTLED;
+        set_bit(__QDISC_STATE_THROTTLED, &qdisc->state);
 }
 
 static inline void qdisc_unthrottled(struct Qdisc *qdisc)
 {
-        qdisc->__state &= ~__QDISC___STATE_THROTTLED;
+        clear_bit(__QDISC_STATE_THROTTLED, &qdisc->state);
 }
 
 struct Qdisc_class_ops {
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index cc9185ca8fd1..0f6e60a9c308 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -422,7 +422,7 @@ struct sctp_cookie {
         __u32 adaptation_ind;
 
         __u8 auth_random[sizeof(sctp_paramhdr_t) + SCTP_AUTH_RANDOM_LENGTH];
-        __u8 auth_hmacs[SCTP_AUTH_NUM_HMACS + 2];
+        __u8 auth_hmacs[SCTP_AUTH_NUM_HMACS * sizeof(__u16) + 2];
         __u8 auth_chunks[sizeof(sctp_paramhdr_t) + SCTP_AUTH_MAX_CHUNKS];
 
         /* This is a shim for my peer's INIT packet, followed by
diff --git a/include/net/snmp.h b/include/net/snmp.h
index 762e2abce889..27461d6dd46f 100644
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -150,7 +150,7 @@ struct linux_xfrm_mib {
 #define SNMP_UPD_PO_STATS_BH(mib, basefield, addend)    \
         do { \
                 __typeof__(*mib[0]) *ptr = \
-                        __this_cpu_ptr((mib)[!in_softirq()]); \
+                        __this_cpu_ptr((mib)[0]); \
                 ptr->mibs[basefield##PKTS]++; \
                 ptr->mibs[basefield##OCTETS] += addend;\
         } while (0)
@@ -202,7 +202,7 @@ struct linux_xfrm_mib {
 #define SNMP_UPD_PO_STATS64_BH(mib, basefield, addend)                  \
         do {                                                            \
                 __typeof__(*mib[0]) *ptr;                               \
-                ptr = __this_cpu_ptr((mib)[!in_softirq()]);             \
+                ptr = __this_cpu_ptr((mib)[0]);                         \
                 u64_stats_update_begin(&ptr->syncp);                    \
                 ptr->mibs[basefield##PKTS]++;                           \
                 ptr->mibs[basefield##OCTETS] += addend;                 \
diff --git a/include/net/sock.h b/include/net/sock.h
index da0534d3401c..01810a3f19df 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1749,7 +1749,7 @@ void sock_net_set(struct sock *sk, struct net *net)
 
 /*
  * Kernel sockets, f.e. rtnl or icmp_socket, are a part of a namespace.
- * They should not hold a referrence to a namespace in order to allow
+ * They should not hold a reference to a namespace in order to allow
  * to stop it.
  * Sockets after sk_change_net should be released using sk_release_kernel
  */
diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
index eeb077dd735f..a8122dc56410 100644
--- a/include/net/transp_v6.h
+++ b/include/net/transp_v6.h
@@ -16,7 +16,7 @@ extern struct proto tcpv6_prot;
 
 struct flowi6;
 
-/* extention headers */
+/* extension headers */
 extern int                              ipv6_exthdrs_init(void);
 extern void                             ipv6_exthdrs_exit(void);
 extern int                              ipv6_frag_init(void);
diff --git a/include/net/wimax.h b/include/net/wimax.h
index 3461aa1df1e0..c799ba7b708b 100644
--- a/include/net/wimax.h
+++ b/include/net/wimax.h
@@ -286,7 +286,7 @@ struct wimax_dev;
  *     does not disconnect the device from the bus and return 0.
  *     If that fails, it should resort to some sort of cold or bus
  *     reset (even if it implies a bus disconnection and device
- *     dissapearance). In that case, -ENODEV should be returned to
+ *     disappearance). In that case, -ENODEV should be returned to
  *     indicate the device is gone.
  *     This operation has to be synchronous, and return only when the
  *     reset is complete. In case of having had to resort to bus/cold
diff --git a/include/net/wpan-phy.h b/include/net/wpan-phy.h
index 85926231c07a..d86fffd3c03c 100644
--- a/include/net/wpan-phy.h
+++ b/include/net/wpan-phy.h
@@ -28,7 +28,7 @@ struct wpan_phy {
         struct mutex pib_lock;
 
         /*
-         * This is a PIB acording to 802.15.4-2006.
+         * This is a PIB according to 802.15.4-2006.
          * We do not provide timing-related variables, as they
          * aren't used outside of driver
          */
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 42a8c32a10e2..20afeaa39395 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -324,6 +324,7 @@ struct xfrm_state_afinfo {
         int                     (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
         int                     (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
         int                     (*output)(struct sk_buff *skb);
+        int                     (*output_finish)(struct sk_buff *skb);
         int                     (*extract_input)(struct xfrm_state *x,
                                                  struct sk_buff *skb);
         int                     (*extract_output)(struct xfrm_state *x,
@@ -1430,6 +1431,7 @@ extern void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
 extern u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
 extern int xfrm_init_replay(struct xfrm_state *x);
 extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
+extern int __xfrm_init_state(struct xfrm_state *x, bool init_replay);
 extern int xfrm_init_state(struct xfrm_state *x);
 extern int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi,
@@ -1453,6 +1455,7 @@ static inline int xfrm4_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
 extern int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm4_output(struct sk_buff *skb);
+extern int xfrm4_output_finish(struct sk_buff *skb);
 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
 extern int xfrm6_extract_header(struct sk_buff *skb);
@@ -1469,6 +1472,7 @@ extern __be32 xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr);
 extern int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb);
 extern int xfrm6_output(struct sk_buff *skb);
+extern int xfrm6_output_finish(struct sk_buff *skb);
 extern int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
                                  u8 **prevhdr);
 
@@ -1600,6 +1604,28 @@ static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay
 }
 
 #ifdef CONFIG_XFRM_MIGRATE
+static inline int xfrm_replay_clone(struct xfrm_state *x,
+                                     struct xfrm_state *orig)
+{
+        x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
+                                GFP_KERNEL);
+        if (!x->replay_esn)
+                return -ENOMEM;
+
+        x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
+        x->replay_esn->replay_window = orig->replay_esn->replay_window;
+
+        x->preplay_esn = kmemdup(x->replay_esn,
+                                 xfrm_replay_state_esn_len(x->replay_esn),
+                                 GFP_KERNEL);
+        if (!x->preplay_esn) {
+                kfree(x->replay_esn);
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+
 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
 {
         return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);