Merge /pub/scm/linux/kernel/git/torvalds/linux-2.6

239 files changed, 11435 insertions, 4628 deletions

diff --git a/net/802/fddi.c b/net/802/fddi.c
index ebcf4830d6f1..5ce24c4bb840 100644
--- a/net/802/fddi.c
+++ b/net/802/fddi.c
@@ -122,10 +122,10 @@ static int fddi_rebuild_header(struct sk_buff	*skb)
  * the proper pointer to the start of packet data (skb->data).
  */
  
-unsigned short fddi_type_trans(struct sk_buff *skb, struct net_device *dev)
+__be16 fddi_type_trans(struct sk_buff *skb, struct net_device *dev)
 {
         struct fddihdr *fddi = (struct fddihdr *)skb->data;
-        unsigned short type;
+        __be16 type;
         
         /*
          * Set mac.raw field to point to FC byte, set data field to point
diff --git a/net/8021q/Kconfig b/net/8021q/Kconfig
new file mode 100644
index 000000000000..c4a382e450e2
--- /dev/null
+++ b/net/8021q/Kconfig
@@ -0,0 +1,19 @@
+#
+# Configuration for 802.1Q VLAN support
+#
+
+config VLAN_8021Q
+        tristate "802.1Q VLAN Support"
+        ---help---
+          Select this and you will be able to create 802.1Q VLAN interfaces
+          on your ethernet interfaces.  802.1Q VLAN supports almost
+          everything a regular ethernet interface does, including
+          firewalling, bridging, and of course IP traffic.  You will need
+          the 'vconfig' tool from the VLAN project in order to effectively
+          use VLANs.  See the VLAN web page for more information:
+          <http://www.candelatech.com/~greear/vlan.html>
+
+          To compile this code as a module, choose M here: the module
+          will be called 8021q.
+
+          If unsure, say N.
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 1f6d31670bc7..91e412b0ab00 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -578,6 +578,14 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                         if (!vlandev)
                                 continue;
 
+                        if (netif_carrier_ok(dev)) {
+                                if (!netif_carrier_ok(vlandev))
+                                        netif_carrier_on(vlandev);
+                        } else {
+                                if (netif_carrier_ok(vlandev))
+                                        netif_carrier_off(vlandev);
+                        }
+
                         if ((vlandev->state & VLAN_LINK_STATE_MASK) != flgs) {
                                 vlandev->state = (vlandev->state &~ VLAN_LINK_STATE_MASK) 
                                         | flgs;
diff --git a/net/Kconfig b/net/Kconfig
index 9251b28e8d5d..40a31ba86d2c 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -2,7 +2,7 @@
 # Network configuration
 #
 
-menu "Networking support"
+menu "Networking"
 
 config NET
         bool "Networking support"
@@ -10,7 +10,9 @@ config NET
           Unless you really know what you are doing, you should say Y here.
           The reason is that some programs need kernel networking support even
           when running on a stand-alone machine that isn't connected to any
-          other computer. If you are upgrading from an older kernel, you
+          other computer.
+          
+          If you are upgrading from an older kernel, you
           should consider updating your networking tools too because changes
           in the kernel and the tools often go hand in hand. The tools are
           contained in the package net-tools, the location and version number
@@ -20,57 +22,14 @@ config NET
           recommended to read the NET-HOWTO, available from
           <http://www.tldp.org/docs.html#howto>.
 
-menu "Networking options"
-        depends on NET
-
-config PACKET
-        tristate "Packet socket"
-        ---help---
-          The Packet protocol is used by applications which communicate
-          directly with network devices without an intermediate network
-          protocol implemented in the kernel, e.g. tcpdump.  If you want them
-          to work, choose Y.
+# Make sure that all config symbols are dependent on NET
+if NET
 
-          To compile this driver as a module, choose M here: the module will
-          be called af_packet.
-
-          If unsure, say Y.
-
-config PACKET_MMAP
-        bool "Packet socket: mmapped IO"
-        depends on PACKET
-        help
-          If you say Y here, the Packet protocol driver will use an IO
-          mechanism that results in faster communication.
-
-          If unsure, say N.
-
-config UNIX
-        tristate "Unix domain sockets"
-        ---help---
-          If you say Y here, you will include support for Unix domain sockets;
-          sockets are the standard Unix mechanism for establishing and
-          accessing network connections.  Many commonly used programs such as
-          the X Window system and syslog use these sockets even if your
-          machine is not connected to any network.  Unless you are working on
-          an embedded system or something similar, you therefore definitely
-          want to say Y here.
-
-          To compile this driver as a module, choose M here: the module will be
-          called unix.  Note that several important services won't work
-          correctly if you say M here and then neglect to load the module.
-
-          Say Y unless you know what you are doing.
-
-config NET_KEY
-        tristate "PF_KEY sockets"
-        select XFRM
-        ---help---
-          PF_KEYv2 socket family, compatible to KAME ones.
-          They are required if you are going to use IPsec tools ported
-          from KAME.
+menu "Networking options"
 
-          Say Y unless you know what you are doing.
+source "net/packet/Kconfig"
+source "net/unix/Kconfig"
+source "net/xfrm/Kconfig"
 
 config INET
         bool "TCP/IP networking"
@@ -94,30 +53,12 @@ config INET
 
           Short answer: say Y.
 
+if INET
 source "net/ipv4/Kconfig"
-
-#   IPv6 as module will cause a CRASH if you try to unload it
-config IPV6
-        tristate "The IPv6 protocol"
-        depends on INET
-        default m
-        select CRYPTO if IPV6_PRIVACY
-        select CRYPTO_MD5 if IPV6_PRIVACY
-        ---help---
-          This is complemental support for the IP version 6.
-          You will still be able to do traditional IPv4 networking as well.
-
-          For general information about IPv6, see
-          <http://playground.sun.com/pub/ipng/html/ipng-main.html>.
-          For Linux IPv6 development information, see <http://www.linux-ipv6.org>.
-          For specific information about IPv6 under Linux, read the HOWTO at
-          <http://www.bieringer.de/linux/IPv6/>.
-
-          To compile this protocol support as a module, choose M here: the 
-          module will be called ipv6.
-
 source "net/ipv6/Kconfig"
 
+endif # if INET
+
 menuconfig NETFILTER
         bool "Network packet filtering (replaces ipchains)"
         ---help---
@@ -206,269 +147,16 @@ source "net/bridge/netfilter/Kconfig"
 
 endif
 
-config XFRM
-       bool
-       depends on NET
-
-source "net/xfrm/Kconfig"
-
 source "net/sctp/Kconfig"
-
-config ATM
-        tristate "Asynchronous Transfer Mode (ATM) (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
-        ---help---
-          ATM is a high-speed networking technology for Local Area Networks
-          and Wide Area Networks.  It uses a fixed packet size and is
-          connection oriented, allowing for the negotiation of minimum
-          bandwidth requirements.
-
-          In order to participate in an ATM network, your Linux box needs an
-          ATM networking card. If you have that, say Y here and to the driver
-          of your ATM card below.
-
-          Note that you need a set of user-space programs to actually make use
-          of ATM.  See the file <file:Documentation/networking/atm.txt> for
-          further details.
-
-config ATM_CLIP
-        tristate "Classical IP over ATM (EXPERIMENTAL)"
-        depends on ATM && INET
-        help
-          Classical IP over ATM for PVCs and SVCs, supporting InARP and
-          ATMARP. If you want to communication with other IP hosts on your ATM
-          network, you will typically either say Y here or to "LAN Emulation
-          (LANE)" below.
-
-config ATM_CLIP_NO_ICMP
-        bool "Do NOT send ICMP if no neighbour (EXPERIMENTAL)"
-        depends on ATM_CLIP
-        help
-          Normally, an "ICMP host unreachable" message is sent if a neighbour
-          cannot be reached because there is no VC to it in the kernel's
-          ATMARP table. This may cause problems when ATMARP table entries are
-          briefly removed during revalidation. If you say Y here, packets to
-          such neighbours are silently discarded instead.
-
-config ATM_LANE
-        tristate "LAN Emulation (LANE) support (EXPERIMENTAL)"
-        depends on ATM
-        help
-          LAN Emulation emulates services of existing LANs across an ATM
-          network. Besides operating as a normal ATM end station client, Linux
-          LANE client can also act as an proxy client bridging packets between
-          ELAN and Ethernet segments. You need LANE if you want to try MPOA.
-
-config ATM_MPOA
-        tristate "Multi-Protocol Over ATM (MPOA) support (EXPERIMENTAL)"
-        depends on ATM && INET && ATM_LANE!=n
-        help
-          Multi-Protocol Over ATM allows ATM edge devices such as routers,
-          bridges and ATM attached hosts establish direct ATM VCs across
-          subnetwork boundaries. These shortcut connections bypass routers
-          enhancing overall network performance.
-
-config ATM_BR2684
-        tristate "RFC1483/2684 Bridged protocols"
-        depends on ATM && INET
-        help
-          ATM PVCs can carry ethernet PDUs according to rfc2684 (formerly 1483)
-          This device will act like an ethernet from the kernels point of view,
-          with the traffic being carried by ATM PVCs (currently 1 PVC/device).
-          This is sometimes used over DSL lines.  If in doubt, say N.
-
-config ATM_BR2684_IPFILTER
-        bool "Per-VC IP filter kludge"
-        depends on ATM_BR2684
-        help
-          This is an experimental mechanism for users who need to terminating a
-          large number of IP-only vcc's.  Do not enable this unless you are sure
-          you know what you are doing.
-
-config BRIDGE
-        tristate "802.1d Ethernet Bridging"
-        ---help---
-          If you say Y here, then your Linux box will be able to act as an
-          Ethernet bridge, which means that the different Ethernet segments it
-          is connected to will appear as one Ethernet to the participants.
-          Several such bridges can work together to create even larger
-          networks of Ethernets using the IEEE 802.1 spanning tree algorithm.
-          As this is a standard, Linux bridges will cooperate properly with
-          other third party bridge products.
-
-          In order to use the Ethernet bridge, you'll need the bridge
-          configuration tools; see <file:Documentation/networking/bridge.txt>
-          for location. Please read the Bridge mini-HOWTO for more
-          information.
-
-          If you enable iptables support along with the bridge support then you
-          turn your bridge into a bridging IP firewall.
-          iptables will then see the IP packets being bridged, so you need to
-          take this into account when setting up your firewall rules.
-          Enabling arptables support when bridging will let arptables see
-          bridged ARP traffic in the arptables FORWARD chain.
-
-          To compile this code as a module, choose M here: the module
-          will be called bridge.
-
-          If unsure, say N.
-
-config VLAN_8021Q
-        tristate "802.1Q VLAN Support"
-        ---help---
-          Select this and you will be able to create 802.1Q VLAN interfaces
-          on your ethernet interfaces.  802.1Q VLAN supports almost
-          everything a regular ethernet interface does, including
-          firewalling, bridging, and of course IP traffic.  You will need
-          the 'vconfig' tool from the VLAN project in order to effectively
-          use VLANs.  See the VLAN web page for more information:
-          <http://www.candelatech.com/~greear/vlan.html>
-
-          To compile this code as a module, choose M here: the module
-          will be called 8021q.
-
-          If unsure, say N.
-
-config DECNET
-        tristate "DECnet Support"
-        ---help---
-          The DECnet networking protocol was used in many products made by
-          Digital (now Compaq).  It provides reliable stream and sequenced
-          packet communications over which run a variety of services similar
-          to those which run over TCP/IP.
-
-          To find some tools to use with the kernel layer support, please
-          look at Patrick Caulfield's web site:
-          <http://linux-decnet.sourceforge.net/>.
-
-          More detailed documentation is available in
-          <file:Documentation/networking/decnet.txt>.
-
-          Be sure to say Y to "/proc file system support" and "Sysctl support"
-          below when using DECnet, since you will need sysctl support to aid
-          in configuration at run time.
-
-          The DECnet code is also available as a module ( = code which can be
-          inserted in and removed from the running kernel whenever you want).
-          The module is called decnet.
-
+source "net/atm/Kconfig"
+source "net/bridge/Kconfig"
+source "net/8021q/Kconfig"
 source "net/decnet/Kconfig"
-
 source "net/llc/Kconfig"
-
-config IPX
-        tristate "The IPX protocol"
-        select LLC
-        ---help---
-          This is support for the Novell networking protocol, IPX, commonly
-          used for local networks of Windows machines.  You need it if you
-          want to access Novell NetWare file or print servers using the Linux
-          Novell client ncpfs (available from
-          <ftp://platan.vc.cvut.cz/pub/linux/ncpfs/>) or from
-          within the Linux DOS emulator DOSEMU (read the DOSEMU-HOWTO,
-          available from <http://www.tldp.org/docs.html#howto>).  In order
-          to do the former, you'll also have to say Y to "NCP file system
-          support", below.
-
-          IPX is similar in scope to IP, while SPX, which runs on top of IPX,
-          is similar to TCP. There is also experimental support for SPX in
-          Linux (see "SPX networking", below).
-
-          To turn your Linux box into a fully featured NetWare file server and
-          IPX router, say Y here and fetch either lwared from
-          <ftp://ibiblio.org/pub/Linux/system/network/daemons/> or
-          mars_nwe from <ftp://www.compu-art.de/mars_nwe/>. For more
-          information, read the IPX-HOWTO available from
-          <http://www.tldp.org/docs.html#howto>.
-
-          General information about how to connect Linux, Windows machines and
-          Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>.
-
-          The IPX driver would enlarge your kernel by about 16 KB. To compile
-          this driver as a module, choose M here: the module will be called ipx.
-          Unless you want to integrate your Linux box with a local Novell
-          network, say N.
-
 source "net/ipx/Kconfig"
-
-config ATALK
-        tristate "Appletalk protocol support"
-        select LLC
-        ---help---
-          AppleTalk is the protocol that Apple computers can use to communicate
-          on a network.  If your Linux box is connected to such a network and you
-          wish to connect to it, say Y.  You will need to use the netatalk package
-          so that your Linux box can act as a print and file server for Macs as
-          well as access AppleTalk printers.  Check out
-          <http://www.zettabyte.net/netatalk/> on the WWW for details.
-          EtherTalk is the name used for AppleTalk over Ethernet and the
-          cheaper and slower LocalTalk is AppleTalk over a proprietary Apple
-          network using serial links.  EtherTalk and LocalTalk are fully
-          supported by Linux.
-
-          General information about how to connect Linux, Windows machines and
-          Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>.  The
-          NET-3-HOWTO, available from
-          <http://www.tldp.org/docs.html#howto>, contains valuable
-          information as well.
-
-          To compile this driver as a module, choose M here: the module will be
-          called appletalk. You almost certainly want to compile it as a
-          module so you can restart your AppleTalk stack without rebooting
-          your machine. I hear that the GNU boycott of Apple is over, so
-          even politically correct people are allowed to say Y here.
-
 source "drivers/net/appletalk/Kconfig"
-
-config X25
-        tristate "CCITT X.25 Packet Layer (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
-        ---help---
-          X.25 is a set of standardized network protocols, similar in scope to
-          frame relay; the one physical line from your box to the X.25 network
-          entry point can carry several logical point-to-point connections
-          (called "virtual circuits") to other computers connected to the X.25
-          network. Governments, banks, and other organizations tend to use it
-          to connect to each other or to form Wide Area Networks (WANs). Many
-          countries have public X.25 networks. X.25 consists of two
-          protocols: the higher level Packet Layer Protocol (PLP) (say Y here
-          if you want that) and the lower level data link layer protocol LAPB
-          (say Y to "LAPB Data Link Driver" below if you want that).
-
-          You can read more about X.25 at <http://www.sangoma.com/x25.htm> and
-          <http://www.cisco.com/univercd/cc/td/doc/product/software/ios11/cbook/cx25.htm>.
-          Information about X.25 for Linux is contained in the files
-          <file:Documentation/networking/x25.txt> and
-          <file:Documentation/networking/x25-iface.txt>.
-
-          One connects to an X.25 network either with a dedicated network card
-          using the X.21 protocol (not yet supported by Linux) or one can do
-          X.25 over a standard telephone line using an ordinary modem (say Y
-          to "X.25 async driver" below) or over Ethernet using an ordinary
-          Ethernet card and the LAPB over Ethernet (say Y to "LAPB Data Link
-          Driver" and "LAPB over Ethernet driver" below).
-
-          To compile this driver as a module, choose M here: the module
-          will be called x25. If unsure, say N.
-
-config LAPB
-        tristate "LAPB Data Link Driver (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
-        ---help---
-          Link Access Procedure, Balanced (LAPB) is the data link layer (i.e.
-          the lower) part of the X.25 protocol. It offers a reliable
-          connection service to exchange data frames with one other host, and
-          it is used to transport higher level protocols (mostly X.25 Packet
-          Layer, the higher part of X.25, but others are possible as well).
-          Usually, LAPB is used with specialized X.21 network cards, but Linux
-          currently supports LAPB only over Ethernet connections. If you want
-          to use LAPB connections over Ethernet, say Y here and to "LAPB over
-          Ethernet driver" below. Read
-          <file:Documentation/networking/lapb-module.txt> for technical
-          details.
-
-          To compile this driver as a module, choose M here: the
-          module will be called lapb.  If unsure, say N.
+source "net/x25/Kconfig"
+source "net/lapb/Kconfig"
 
 config NET_DIVERT
         bool "Frame Diverter (EXPERIMENTAL)"
@@ -496,107 +184,10 @@ config NET_DIVERT
 
           If unsure, say N.
 
-config ECONET
-        tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && INET
-        ---help---
-          Econet is a fairly old and slow networking protocol mainly used by
-          Acorn computers to access file and print servers. It uses native
-          Econet network cards. AUN is an implementation of the higher level
-          parts of Econet that runs over ordinary Ethernet connections, on
-          top of the UDP packet protocol, which in turn runs on top of the
-          Internet protocol IP.
-
-          If you say Y here, you can choose with the next two options whether
-          to send Econet/AUN traffic over a UDP Ethernet connection or over
-          a native Econet network card.
-
-          To compile this driver as a module, choose M here: the module
-          will be called econet.
-
-config ECONET_AUNUDP
-        bool "AUN over UDP"
-        depends on ECONET
-        help
-          Say Y here if you want to send Econet/AUN traffic over a UDP
-          connection (UDP is a packet based protocol that runs on top of the
-          Internet protocol IP) using an ordinary Ethernet network card.
-
-config ECONET_NATIVE
-        bool "Native Econet"
-        depends on ECONET
-        help
-          Say Y here if you have a native Econet network card installed in
-          your computer.
-
-config WAN_ROUTER
-        tristate "WAN router"
-        depends on EXPERIMENTAL
-        ---help---
-          Wide Area Networks (WANs), such as X.25, frame relay and leased
-          lines, are used to interconnect Local Area Networks (LANs) over vast
-          distances with data transfer rates significantly higher than those
-          achievable with commonly used asynchronous modem connections.
-          Usually, a quite expensive external device called a `WAN router' is
-          needed to connect to a WAN.
-
-          As an alternative, WAN routing can be built into the Linux kernel.
-          With relatively inexpensive WAN interface cards available on the
-          market, a perfectly usable router can be built for less than half
-          the price of an external router.  If you have one of those cards and
-          wish to use your Linux box as a WAN router, say Y here and also to
-          the WAN driver for your card, below.  You will then need the
-          wan-tools package which is available from <ftp://ftp.sangoma.com/>.
-          Read <file:Documentation/networking/wan-router.txt> for more
-          information.
-
-          To compile WAN routing support as a module, choose M here: the
-          module will be called wanrouter.
-
-          If unsure, say N.
-
-menu "QoS and/or fair queueing"
-
-config NET_SCHED
-        bool "QoS and/or fair queueing"
-        ---help---
-          When the kernel has several packets to send out over a network
-          device, it has to decide which ones to send first, which ones to
-          delay, and which ones to drop. This is the job of the packet
-          scheduler, and several different algorithms for how to do this
-          "fairly" have been proposed.
-
-          If you say N here, you will get the standard packet scheduler, which
-          is a FIFO (first come, first served). If you say Y here, you will be
-          able to choose from among several alternative algorithms which can
-          then be attached to different network devices. This is useful for
-          example if some of your network devices are real time devices that
-          need a certain minimum data flow rate, or if you need to limit the
-          maximum data flow rate for traffic which matches specified criteria.
-          This code is considered to be experimental.
-
-          To administer these schedulers, you'll need the user-level utilities
-          from the package iproute2+tc at <ftp://ftp.tux.org/pub/net/ip-routing/>.
-          That package also contains some documentation; for more, check out
-          <http://snafu.freedom.org/linux2.2/iproute-notes.html>.
-
-          This Quality of Service (QoS) support will enable you to use
-          Differentiated Services (diffserv) and Resource Reservation Protocol
-          (RSVP) on your Linux router if you also say Y to "QoS support",
-          "Packet classifier API" and to some classifiers below. Documentation
-          and software is at <http://diffserv.sourceforge.net/>.
-
-          If you say Y here and to "/proc file system" below, you will be able
-          to read status information about packet schedulers from the file
-          /proc/net/psched.
-
-          The available schedulers are listed in the following questions; you
-          can say Y to as many as you like. If unsure, say N now.
-
+source "net/econet/Kconfig"
+source "net/wanrouter/Kconfig"
 source "net/sched/Kconfig"
 
-endmenu
-
 menu "Network testing"
 
 config NET_PKTGEN
@@ -618,29 +209,10 @@ endmenu
 
 endmenu
 
-config NETPOLL
-        def_bool NETCONSOLE
-
-config NETPOLL_RX
-        bool "Netpoll support for trapping incoming packets"
-        default n
-        depends on NETPOLL
-
-config NETPOLL_TRAP
-        bool "Netpoll traffic trapping"
-        default n
-        depends on NETPOLL
-
-config NET_POLL_CONTROLLER
-        def_bool NETPOLL
-
 source "net/ax25/Kconfig"
-
 source "net/irda/Kconfig"
-
 source "net/bluetooth/Kconfig"
 
-source "drivers/net/Kconfig"
-
-endmenu
+endif   # if NET
+endmenu # Networking
 
diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c
index 54640c01b50c..c34614ea5fce 100644
--- a/net/appletalk/aarp.c
+++ b/net/appletalk/aarp.c
@@ -35,6 +35,7 @@
 #include <net/datalink.h>
 #include <net/psnap.h>
 #include <linux/atalk.h>
+#include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
@@ -462,8 +463,7 @@ void aarp_probe_network(struct atalk_iface *atif)
                         aarp_send_probe(atif->dev, &atif->address);
 
                         /* Defer 1/10th */
-                        current->state = TASK_INTERRUPTIBLE;
-                        schedule_timeout(HZ / 10);
+                        msleep(100);
 
                         if (atif->status & ATIF_PROBE_FAIL)
                                 break;
@@ -510,9 +510,8 @@ int aarp_proxy_probe_network(struct atalk_iface *atif, struct atalk_addr *sa)
                 aarp_send_probe(atif->dev, sa);
 
                 /* Defer 1/10th */
-                current->state = TASK_INTERRUPTIBLE;
                 write_unlock_bh(&aarp_lock);
-                schedule_timeout(HZ / 10);
+                msleep(100);
                 write_lock_bh(&aarp_lock);
 
                 if (entry->status & ATIF_PROBE_FAIL)
@@ -565,7 +564,7 @@ int aarp_send_ddp(struct net_device *dev, struct sk_buff *skb,
                          *      numbers we just happen to need. Now put the
                          *      length in the lower two.
                          */
-                        *((__u16 *)skb->data) = htons(skb->len);
+                        *((__be16 *)skb->data) = htons(skb->len);
                         ft = 1;
                 }
                 /*
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 876dbac71060..192b529f86a4 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -401,7 +401,7 @@ out_err:
 }
 
 /* Find a match for a specific network:node pair */
-static struct atalk_iface *atalk_find_interface(int net, int node)
+static struct atalk_iface *atalk_find_interface(__be16 net, int node)
 {
         struct atalk_iface *iface;
 
diff --git a/net/atm/Kconfig b/net/atm/Kconfig
new file mode 100644
index 000000000000..21ff276b2d80
--- /dev/null
+++ b/net/atm/Kconfig
@@ -0,0 +1,74 @@
+#
+# Asynchronous Transfer Mode (ATM) (EXPERIMENTAL)
+#
+
+config ATM
+        tristate "Asynchronous Transfer Mode (ATM) (EXPERIMENTAL)"
+        depends on EXPERIMENTAL
+        ---help---
+          ATM is a high-speed networking technology for Local Area Networks
+          and Wide Area Networks.  It uses a fixed packet size and is
+          connection oriented, allowing for the negotiation of minimum
+          bandwidth requirements.
+
+          In order to participate in an ATM network, your Linux box needs an
+          ATM networking card. If you have that, say Y here and to the driver
+          of your ATM card below.
+
+          Note that you need a set of user-space programs to actually make use
+          of ATM.  See the file <file:Documentation/networking/atm.txt> for
+          further details.
+
+config ATM_CLIP
+        tristate "Classical IP over ATM (EXPERIMENTAL)"
+        depends on ATM && INET
+        help
+          Classical IP over ATM for PVCs and SVCs, supporting InARP and
+          ATMARP. If you want to communication with other IP hosts on your ATM
+          network, you will typically either say Y here or to "LAN Emulation
+          (LANE)" below.
+
+config ATM_CLIP_NO_ICMP
+        bool "Do NOT send ICMP if no neighbour (EXPERIMENTAL)"
+        depends on ATM_CLIP
+        help
+          Normally, an "ICMP host unreachable" message is sent if a neighbour
+          cannot be reached because there is no VC to it in the kernel's
+          ATMARP table. This may cause problems when ATMARP table entries are
+          briefly removed during revalidation. If you say Y here, packets to
+          such neighbours are silently discarded instead.
+
+config ATM_LANE
+        tristate "LAN Emulation (LANE) support (EXPERIMENTAL)"
+        depends on ATM
+        help
+          LAN Emulation emulates services of existing LANs across an ATM
+          network. Besides operating as a normal ATM end station client, Linux
+          LANE client can also act as an proxy client bridging packets between
+          ELAN and Ethernet segments. You need LANE if you want to try MPOA.
+
+config ATM_MPOA
+        tristate "Multi-Protocol Over ATM (MPOA) support (EXPERIMENTAL)"
+        depends on ATM && INET && ATM_LANE!=n
+        help
+          Multi-Protocol Over ATM allows ATM edge devices such as routers,
+          bridges and ATM attached hosts establish direct ATM VCs across
+          subnetwork boundaries. These shortcut connections bypass routers
+          enhancing overall network performance.
+
+config ATM_BR2684
+        tristate "RFC1483/2684 Bridged protocols"
+        depends on ATM && INET
+        help
+          ATM PVCs can carry ethernet PDUs according to RFC2684 (formerly 1483)
+          This device will act like an ethernet from the kernels point of view,
+          with the traffic being carried by ATM PVCs (currently 1 PVC/device).
+          This is sometimes used over DSL lines.  If in doubt, say N.
+
+config ATM_BR2684_IPFILTER
+        bool "Per-VC IP filter kludge"
+        depends on ATM_BR2684
+        help
+          This is an experimental mechanism for users who need to terminate a
+          large number of IP-only vcc's.  Do not enable this unless you are sure
+          you know what you are doing.
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index e6954cf1459d..289956c4dd3e 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -289,8 +289,7 @@ xmit will add the additional header part in that case */
  * This is similar to eth_type_trans, which cannot be used because of
  * our dev->hard_header_len
  */
-static inline unsigned short br_type_trans(struct sk_buff *skb,
-                                               struct net_device *dev)
+static inline __be16 br_type_trans(struct sk_buff *skb, struct net_device *dev)
 {
         struct ethhdr *eth;
         unsigned char *rawp;
diff --git a/net/atm/svc.c b/net/atm/svc.c
index 02f5374a51f2..08e46052a3e4 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -118,10 +118,6 @@ static int svc_bind(struct socket *sock,struct sockaddr *sockaddr,
                 goto out;
         }
         vcc = ATM_SD(sock);
-        if (test_bit(ATM_VF_SESSION, &vcc->flags)) {
-                error = -EINVAL;
-                goto out;
-        }
         addr = (struct sockaddr_atmsvc *) sockaddr;
         if (addr->sas_family != AF_ATMSVC) {
                 error = -EAFNOSUPPORT;
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 2e341de3e763..901eff7ebe74 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -213,7 +213,7 @@ static int cmtp_send_frame(struct cmtp_session *session, unsigned char *data, in
         return kernel_sendmsg(sock, &msg, &iv, 1, len);
 }
 
-static int cmtp_process_transmit(struct cmtp_session *session)
+static void cmtp_process_transmit(struct cmtp_session *session)
 {
         struct sk_buff *skb, *nskb;
         unsigned char *hdr;
@@ -223,7 +223,7 @@ static int cmtp_process_transmit(struct cmtp_session *session)
 
         if (!(nskb = alloc_skb(session->mtu, GFP_ATOMIC))) {
                 BT_ERR("Can't allocate memory for new frame");
-                return -ENOMEM;
+                return;
         }
 
         while ((skb = skb_dequeue(&session->transmit))) {
@@ -275,8 +275,6 @@ static int cmtp_process_transmit(struct cmtp_session *session)
         cmtp_send_frame(session, nskb->data, nskb->len);
 
         kfree_skb(nskb);
-
-        return skb_queue_len(&session->transmit);
 }
 
 static int cmtp_session(void *arg)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index fb5524365bc2..ffa26c10bfe8 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -299,7 +299,6 @@ struct hci_dev *hci_dev_get(int index)
         read_unlock(&hci_dev_list_lock);
         return hdev;
 }
-EXPORT_SYMBOL(hci_dev_get);
 
 /* ---- Inquiry support ---- */
 static void inquiry_cache_flush(struct hci_dev *hdev)
@@ -1042,7 +1041,6 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *p
 
         return 0;
 }
-EXPORT_SYMBOL(hci_send_cmd);
 
 /* Get data from the previously sent command */
 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 ogf, __u16 ocf)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index c4b592b4ef10..46367bd129c3 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1035,9 +1035,11 @@ void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
         ev->type = type;
         memcpy(ev->data, data, dlen);
 
+        bt_cb(skb)->incoming = 1;
+        do_gettimeofday(&skb->stamp);
+
         skb->pkt_type = HCI_EVENT_PKT;
         skb->dev = (void *) hdev;
         hci_send_to_sock(hdev, skb);
         kfree_skb(skb);
 }
-EXPORT_SYMBOL(hci_si_event);
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index affbc55462e8..de8af5f42394 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -428,7 +428,7 @@ static int hidp_send_frame(struct socket *sock, unsigned char *data, int len)
         return kernel_sendmsg(sock, &msg, &iv, 1, len);
 }
 
-static int hidp_process_transmit(struct hidp_session *session)
+static void hidp_process_transmit(struct hidp_session *session)
 {
         struct sk_buff *skb;
 
@@ -453,9 +453,6 @@ static int hidp_process_transmit(struct hidp_session *session)
                 hidp_set_timer(session);
                 kfree_skb(skb);
         }
-
-        return skb_queue_len(&session->ctrl_transmit) +
-                                skb_queue_len(&session->intr_transmit);
 }
 
 static int hidp_session(void *arg)
diff --git a/net/bluetooth/lib.c b/net/bluetooth/lib.c
index 9efb0a093612..ee6a66979913 100644
--- a/net/bluetooth/lib.c
+++ b/net/bluetooth/lib.c
@@ -34,31 +34,6 @@
 
 #include <net/bluetooth/bluetooth.h>
 
-void bt_dump(char *pref, __u8 *buf, int count)
-{
-        char *ptr;
-        char line[100];
-        unsigned int i;
-
-        printk(KERN_INFO "%s: dump, len %d\n", pref, count);
-
-        ptr = line;
-        *ptr = 0;
-        for (i = 0; i < count; i++) {
-                ptr += sprintf(ptr, " %2.2X", buf[i]);
-
-                if (i && !((i + 1) % 20)) {
-                        printk(KERN_INFO "%s:%s\n", pref, line);
-                        ptr = line;
-                        *ptr = 0;
-                }
-        }
-
-        if (line[0])
-                printk(KERN_INFO "%s:%s\n", pref, line);
-}
-EXPORT_SYMBOL(bt_dump);
-
 void baswap(bdaddr_t *dst, bdaddr_t *src)
 {
         unsigned char *d = (unsigned char *) dst;
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index e9e6fda66f1a..27bf5047cd33 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -389,8 +389,6 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
                 rfcomm_dlc_unlock(d);
 
                 skb_queue_purge(&d->tx_queue);
-                rfcomm_session_put(s);
-
                 rfcomm_dlc_unlink(d);
         }
 
@@ -600,8 +598,6 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
                 goto failed;
         }
 
-        rfcomm_session_hold(s);
-
         s->initiator = 1;
 
         bacpy(&addr.l2_bdaddr, dst);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index f3f6355a2786..63a123c5c41b 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -590,8 +590,11 @@ static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
         for (;;) {
                 set_current_state(TASK_INTERRUPTIBLE);
 
-                if (skb_queue_len(&sk->sk_receive_queue) || sk->sk_err || (sk->sk_shutdown & RCV_SHUTDOWN) ||
-                                signal_pending(current) || !timeo)
+                if (!skb_queue_empty(&sk->sk_receive_queue) ||
+                    sk->sk_err ||
+                    (sk->sk_shutdown & RCV_SHUTDOWN) ||
+                    signal_pending(current) ||
+                    !timeo)
                         break;
 
                 set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 6d689200bcf3..6304590fd36a 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -781,7 +781,7 @@ static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 
         BT_DBG("tty %p dev %p", tty, dev);
 
-        if (skb_queue_len(&dlc->tx_queue))
+        if (!skb_queue_empty(&dlc->tx_queue))
                 return dlc->mtu;
 
         return 0;
diff --git a/net/bridge/Kconfig b/net/bridge/Kconfig
new file mode 100644
index 000000000000..db23d59746cf
--- /dev/null
+++ b/net/bridge/Kconfig
@@ -0,0 +1,31 @@
+#
+# 802.1d Ethernet Bridging
+#
+
+config BRIDGE
+        tristate "802.1d Ethernet Bridging"
+        ---help---
+          If you say Y here, then your Linux box will be able to act as an
+          Ethernet bridge, which means that the different Ethernet segments it
+          is connected to will appear as one Ethernet to the participants.
+          Several such bridges can work together to create even larger
+          networks of Ethernets using the IEEE 802.1 spanning tree algorithm.
+          As this is a standard, Linux bridges will cooperate properly with
+          other third party bridge products.
+
+          In order to use the Ethernet bridge, you'll need the bridge
+          configuration tools; see <file:Documentation/networking/bridge.txt>
+          for location. Please read the Bridge mini-HOWTO for more
+          information.
+
+          If you enable iptables support along with the bridge support then you
+          turn your bridge into a bridging IP firewall.
+          iptables will then see the IP packets being bridged, so you need to
+          take this into account when setting up your firewall rules.
+          Enabling arptables support when bridging will let arptables see
+          bridged ARP traffic in the arptables FORWARD chain.
+
+          To compile this code as a module, choose M here: the module
+          will be called bridge.
+
+          If unsure, say N.
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index ef9f2095f96e..069253f830c1 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -57,9 +57,6 @@ int br_forward_finish(struct sk_buff *skb)
 static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 {
         skb->dev = to->dev;
-#ifdef CONFIG_NETFILTER_DEBUG
-        skb->nf_debug = 0;
-#endif
         NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
                         br_forward_finish);
 }
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 8f5f2e730992..9a45e6279c57 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -23,11 +23,7 @@ const unsigned char bridge_ula[6] = { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x00 };
 
 static int br_pass_frame_up_finish(struct sk_buff *skb)
 {
-#ifdef CONFIG_NETFILTER_DEBUG
-        skb->nf_debug = 0;
-#endif
         netif_receive_skb(skb);
-
         return 0;
 }
 
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index be03d3ad2648..2d52fee63a8c 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -102,10 +102,6 @@ static int br_nf_pre_routing_finish_ipv6(struct sk_buff *skb)
 {
         struct nf_bridge_info *nf_bridge = skb->nf_bridge;
 
-#ifdef CONFIG_NETFILTER_DEBUG
-        skb->nf_debug ^= (1 << NF_BR_PRE_ROUTING);
-#endif
-
         if (nf_bridge->mask & BRNF_PKT_TYPE) {
                 skb->pkt_type = PACKET_OTHERHOST;
                 nf_bridge->mask ^= BRNF_PKT_TYPE;
@@ -182,10 +178,6 @@ static void __br_dnat_complain(void)
  * --Bart, 20021007 (updated) */
 static int br_nf_pre_routing_finish_bridge(struct sk_buff *skb)
 {
-#ifdef CONFIG_NETFILTER_DEBUG
-        skb->nf_debug |= (1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_FORWARD);
-#endif
-
         if (skb->pkt_type == PACKET_OTHERHOST) {
                 skb->pkt_type = PACKET_HOST;
                 skb->nf_bridge->mask |= BRNF_PKT_TYPE;
@@ -207,10 +199,6 @@ static int br_nf_pre_routing_finish(struct sk_buff *skb)
         struct iphdr *iph = skb->nh.iph;
         struct nf_bridge_info *nf_bridge = skb->nf_bridge;
 
-#ifdef CONFIG_NETFILTER_DEBUG
-        skb->nf_debug ^= (1 << NF_BR_PRE_ROUTING);
-#endif
-
         if (nf_bridge->mask & BRNF_PKT_TYPE) {
                 skb->pkt_type = PACKET_OTHERHOST;
                 nf_bridge->mask ^= BRNF_PKT_TYPE;
@@ -382,9 +370,6 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
         if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb))
                         goto inhdr_error;
 
-#ifdef CONFIG_NETFILTER_DEBUG
-        skb->nf_debug ^= (1 << NF_IP6_PRE_ROUTING);
-#endif
         if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
                 return NF_DROP;
         setup_pre_routing(skb);
@@ -468,9 +453,6 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
                         skb->ip_summed = CHECKSUM_NONE;
         }
 
-#ifdef CONFIG_NETFILTER_DEBUG
-        skb->nf_debug ^= (1 << NF_IP_PRE_ROUTING);
-#endif
         if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
                 return NF_DROP;
         setup_pre_routing(skb);
@@ -517,10 +499,6 @@ static int br_nf_forward_finish(struct sk_buff *skb)
         struct net_device *in;
         struct vlan_ethhdr *hdr = vlan_eth_hdr(skb);
 
-#ifdef CONFIG_NETFILTER_DEBUG
-        skb->nf_debug ^= (1 << NF_BR_FORWARD);
-#endif
-
         if (skb->protocol != __constant_htons(ETH_P_ARP) && !IS_VLAN_ARP) {
                 in = nf_bridge->physindev;
                 if (nf_bridge->mask & BRNF_PKT_TYPE) {
@@ -566,9 +544,6 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff **pskb,
                 (*pskb)->nh.raw += VLAN_HLEN;
         }
 
-#ifdef CONFIG_NETFILTER_DEBUG
-        skb->nf_debug ^= (1 << NF_BR_FORWARD);
-#endif
         nf_bridge = skb->nf_bridge;
         if (skb->pkt_type == PACKET_OTHERHOST) {
                 skb->pkt_type = PACKET_HOST;
@@ -605,10 +580,6 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff **pskb,
                 (*pskb)->nh.raw += VLAN_HLEN;
         }
 
-#ifdef CONFIG_NETFILTER_DEBUG
-        skb->nf_debug ^= (1 << NF_BR_FORWARD);
-#endif
-
         if (skb->nh.arph->ar_pln != 4) {
                 if (IS_VLAN_ARP) {
                         skb_push(*pskb, VLAN_HLEN);
@@ -627,9 +598,6 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff **pskb,
 /* PF_BRIDGE/LOCAL_OUT ***********************************************/
 static int br_nf_local_out_finish(struct sk_buff *skb)
 {
-#ifdef CONFIG_NETFILTER_DEBUG
-        skb->nf_debug &= ~(1 << NF_BR_LOCAL_OUT);
-#endif
         if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
                 skb_push(skb, VLAN_HLEN);
                 skb->nh.raw -= VLAN_HLEN;
@@ -731,10 +699,6 @@ static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff **pskb,
                                realoutdev, br_nf_local_out_finish,
                                NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD + 1);
         } else {
-#ifdef CONFIG_NETFILTER_DEBUG
-                skb->nf_debug ^= (1 << NF_IP_LOCAL_OUT);
-#endif
-
                 NF_HOOK_THRESH(pf, NF_IP_LOCAL_OUT, skb, realindev,
                                realoutdev, br_nf_local_out_finish,
                                NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT + 1);
@@ -779,8 +743,6 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
                 printk(KERN_CRIT "br_netfilter: skb->dst == NULL.");
                 goto print_error;
         }
-
-        skb->nf_debug ^= (1 << NF_IP_POST_ROUTING);
 #endif
 
         /* We assume any code from br_dev_queue_push_xmit onwards doesn't care
@@ -882,7 +844,7 @@ static unsigned int ip_sabotage_out(unsigned int hook, struct sk_buff **pskb,
                  * doesn't use the bridge parent of the indev by using
                  * the BRNF_DONT_TAKE_PARENT mask. */
                 if (hook == NF_IP_FORWARD && nf_bridge->physindev == NULL) {
-                        nf_bridge->mask &= BRNF_DONT_TAKE_PARENT;
+                        nf_bridge->mask |= BRNF_DONT_TAKE_PARENT;
                         nf_bridge->physindev = (struct net_device *)in;
                 }
 #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
diff --git a/net/bridge/netfilter/Kconfig b/net/bridge/netfilter/Kconfig
index 68ccef507b49..c70b3be23026 100644
--- a/net/bridge/netfilter/Kconfig
+++ b/net/bridge/netfilter/Kconfig
@@ -138,7 +138,7 @@ config BRIDGE_EBT_VLAN
 #
 config BRIDGE_EBT_ARPREPLY
         tristate "ebt: arp reply target support"
-        depends on BRIDGE_NF_EBTABLES
+        depends on BRIDGE_NF_EBTABLES && INET
         help
           This option adds the arp reply target, which allows
           automatically sending arp replies to arp requests.
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index e4ae34b88925..662975be3d1d 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -61,8 +61,6 @@ static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
 {
         struct ebt_log_info *info = (struct ebt_log_info *)data;
         char level_string[4] = "< >";
-        union {struct iphdr iph; struct tcpudphdr ports;
-               struct arphdr arph; struct arppayload arpp;} u;
 
         level_string[1] = '0' + info->loglevel;
         spin_lock_bh(&ebt_log_lock);
@@ -88,7 +86,7 @@ static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
                 }
                 printk(" IP SRC=%u.%u.%u.%u IP DST=%u.%u.%u.%u,",
                    NIPQUAD(ih->saddr), NIPQUAD(ih->daddr));
-                printk(" IP tos=0x%02X, IP proto=%d", u.iph.tos,
+                printk(" IP tos=0x%02X, IP proto=%d", ih->tos,
                        ih->protocol);
                 if (ih->protocol == IPPROTO_TCP ||
                     ih->protocol == IPPROTO_UDP) {
@@ -127,7 +125,7 @@ static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
                     ah->ar_pln == sizeof(uint32_t)) {
                         struct arppayload _arpp, *ap;
 
-                        ap = skb_header_pointer(skb, sizeof(u.arph),
+                        ap = skb_header_pointer(skb, sizeof(_arph),
                                                 sizeof(_arpp), &_arpp);
                         if (ap == NULL) {
                                 printk(" INCOMPLETE ARP payload");
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 18ebc664769b..c4540144f0f4 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -859,8 +859,7 @@ static int translate_table(struct ebt_replace *repl,
                 if (repl->valid_hooks & (1 << i))
                         if (check_chainloops(newinfo->hook_entry[i],
                            cl_s, udc_cnt, i, newinfo->entries)) {
-                                if (cl_s)
-                                        vfree(cl_s);
+                                vfree(cl_s);
                                 return -EINVAL;
                         }
 
@@ -883,8 +882,7 @@ static int translate_table(struct ebt_replace *repl,
                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
                    ebt_cleanup_entry, &i);
         }
-        if (cl_s)
-                vfree(cl_s);
+        vfree(cl_s);
         return ret;
 }
 
@@ -1030,8 +1028,7 @@ static int do_replace(void __user *user, unsigned int len)
         }
         vfree(table);
 
-        if (counterstmp)
-                vfree(counterstmp);
+        vfree(counterstmp);
         return ret;
 
 free_unlock:
@@ -1040,8 +1037,7 @@ free_iterate:
         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
            ebt_cleanup_entry, NULL);
 free_counterstmp:
-        if (counterstmp)
-                vfree(counterstmp);
+        vfree(counterstmp);
         /* can be initialized in translate_table() */
         if (newinfo->chainstack) {
                 for (i = 0; i < num_possible_cpus(); i++)
@@ -1049,11 +1045,9 @@ free_counterstmp:
                 vfree(newinfo->chainstack);
         }
 free_entries:
-        if (newinfo->entries)
-                vfree(newinfo->entries);
+        vfree(newinfo->entries);
 free_newinfo:
-        if (newinfo)
-                vfree(newinfo);
+        vfree(newinfo);
         return ret;
 }
 
@@ -1213,8 +1207,7 @@ void ebt_unregister_table(struct ebt_table *table)
         down(&ebt_mutex);
         LIST_DELETE(&ebt_tables, table);
         up(&ebt_mutex);
-        if (table->private->entries)
-                vfree(table->private->entries);
+        vfree(table->private->entries);
         if (table->private->chainstack) {
                 for (i = 0; i < num_possible_cpus(); i++)
                         vfree(table->private->chainstack[i]);
diff --git a/net/compat.c b/net/compat.c
index be5d936dc423..d99ab9695893 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -91,20 +91,11 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
         } else
                 kern_msg->msg_name = NULL;
 
-        if(kern_msg->msg_iovlen > UIO_FASTIOV) {
-                kern_iov = kmalloc(kern_msg->msg_iovlen * sizeof(struct iovec),
-                                   GFP_KERNEL);
-                if(!kern_iov)
-                        return -ENOMEM;
-        }
-
         tot_len = iov_from_user_compat_to_kern(kern_iov,
                                           (struct compat_iovec __user *)kern_msg->msg_iov,
                                           kern_msg->msg_iovlen);
         if(tot_len >= 0)
                 kern_msg->msg_iov = kern_iov;
-        else if(kern_msg->msg_iovlen > UIO_FASTIOV)
-                kfree(kern_iov);
 
         return tot_len;
 }
diff --git a/net/core/Makefile b/net/core/Makefile
index 81f03243fe2f..f5f5e58943e8 100644
--- a/net/core/Makefile
+++ b/net/core/Makefile
@@ -2,13 +2,15 @@
 # Makefile for the Linux networking core.
 #
 
-obj-y := sock.o skbuff.o iovec.o datagram.o stream.o scm.o gen_stats.o gen_estimator.o
+obj-y := sock.o request_sock.o skbuff.o iovec.o datagram.o stream.o scm.o \
+         gen_stats.o gen_estimator.o
 
 obj-$(CONFIG_SYSCTL) += sysctl_net_core.o
 
-obj-y                += flow.o dev.o ethtool.o dev_mcast.o dst.o \
+obj-y                += dev.o ethtool.o dev_mcast.o dst.o \
                         neighbour.o rtnetlink.o utils.o link_watch.o filter.o
 
+obj-$(CONFIG_XFRM) += flow.o
 obj-$(CONFIG_SYSFS) += net-sysfs.o
 obj-$(CONFIG_NETFILTER) += netfilter.o
 obj-$(CONFIG_NET_DIVERT) += dv.o
diff --git a/net/core/dev.c b/net/core/dev.c
index f15a3ffff635..faf59b02c4bf 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -115,18 +115,6 @@
 #endif  /* CONFIG_NET_RADIO */
 #include <asm/current.h>
 
-/* This define, if set, will randomly drop a packet when congestion
- * is more than moderate.  It helps fairness in the multi-interface
- * case when one of them is a hog, but it kills performance for the
- * single interface case so it is off now by default.
- */
-#undef RAND_LIE
-
-/* Setting this will sample the queue lengths and thus congestion
- * via a timer instead of as each packet is received.
- */
-#undef OFFLINE_SAMPLE
-
 /*
  *      The list of packet types we will receive (as opposed to discard)
  *      and the routines to invoke.
@@ -159,11 +147,6 @@ static DEFINE_SPINLOCK(ptype_lock);
 static struct list_head ptype_base[16]; /* 16 way hashed list */
 static struct list_head ptype_all;              /* Taps */
 
-#ifdef OFFLINE_SAMPLE
-static void sample_queue(unsigned long dummy);
-static struct timer_list samp_timer = TIMER_INITIALIZER(sample_queue, 0, 0);
-#endif
-
 /*
  * The @dev_base list is protected by @dev_base_lock and the rtln
  * semaphore.
@@ -215,7 +198,7 @@ static struct notifier_block *netdev_chain;
  *      Device drivers call our routines to queue packets here. We empty the
  *      queue in the local softnet handler.
  */
-DEFINE_PER_CPU(struct softnet_data, softnet_data) = { 0, };
+DEFINE_PER_CPU(struct softnet_data, softnet_data) = { NULL };
 
 #ifdef CONFIG_SYSFS
 extern int netdev_sysfs_init(void);
@@ -918,8 +901,7 @@ int dev_close(struct net_device *dev)
         smp_mb__after_clear_bit(); /* Commit netif_running(). */
         while (test_bit(__LINK_STATE_RX_SCHED, &dev->state)) {
                 /* No hurry. */
-                current->state = TASK_INTERRUPTIBLE;
-                schedule_timeout(1);
+                msleep(1);
         }
 
         /*
@@ -1144,7 +1126,7 @@ static inline int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
 extern void skb_release_data(struct sk_buff *);
 
 /* Keep head the same: replace data */
-int __skb_linearize(struct sk_buff *skb, int gfp_mask)
+int __skb_linearize(struct sk_buff *skb, unsigned int __nocast gfp_mask)
 {
         unsigned int size;
         u8 *data;
@@ -1363,71 +1345,13 @@ out:
                         Receiver routines
   =======================================================================*/
 
-int netdev_max_backlog = 300;
+int netdev_max_backlog = 1000;
+int netdev_budget = 300;
 int weight_p = 64;            /* old backlog weight */
-/* These numbers are selected based on intuition and some
- * experimentatiom, if you have more scientific way of doing this
- * please go ahead and fix things.
- */
-int no_cong_thresh = 10;
-int no_cong = 20;
-int lo_cong = 100;
-int mod_cong = 290;
 
 DEFINE_PER_CPU(struct netif_rx_stats, netdev_rx_stat) = { 0, };
 
 
-static void get_sample_stats(int cpu)
-{
-#ifdef RAND_LIE
-        unsigned long rd;
-        int rq;
-#endif
-        struct softnet_data *sd = &per_cpu(softnet_data, cpu);
-        int blog = sd->input_pkt_queue.qlen;
-        int avg_blog = sd->avg_blog;
-
-        avg_blog = (avg_blog >> 1) + (blog >> 1);
-
-        if (avg_blog > mod_cong) {
-                /* Above moderate congestion levels. */
-                sd->cng_level = NET_RX_CN_HIGH;
-#ifdef RAND_LIE
-                rd = net_random();
-                rq = rd % netdev_max_backlog;
-                if (rq < avg_blog) /* unlucky bastard */
-                        sd->cng_level = NET_RX_DROP;
-#endif
-        } else if (avg_blog > lo_cong) {
-                sd->cng_level = NET_RX_CN_MOD;
-#ifdef RAND_LIE
-                rd = net_random();
-                rq = rd % netdev_max_backlog;
-                        if (rq < avg_blog) /* unlucky bastard */
-                                sd->cng_level = NET_RX_CN_HIGH;
-#endif
-        } else if (avg_blog > no_cong)
-                sd->cng_level = NET_RX_CN_LOW;
-        else  /* no congestion */
-                sd->cng_level = NET_RX_SUCCESS;
-
-        sd->avg_blog = avg_blog;
-}
-
-#ifdef OFFLINE_SAMPLE
-static void sample_queue(unsigned long dummy)
-{
-/* 10 ms 0r 1ms -- i don't care -- JHS */
-        int next_tick = 1;
-        int cpu = smp_processor_id();
-
-        get_sample_stats(cpu);
-        next_tick += jiffies;
-        mod_timer(&samp_timer, next_tick);
-}
-#endif
-
-
 /**
  *      netif_rx        -       post buffer to the network code
  *      @skb: buffer to post
@@ -1448,7 +1372,6 @@ static void sample_queue(unsigned long dummy)
 
 int netif_rx(struct sk_buff *skb)
 {
-        int this_cpu;
         struct softnet_data *queue;
         unsigned long flags;
 
@@ -1464,38 +1387,22 @@ int netif_rx(struct sk_buff *skb)
          * short when CPU is congested, but is still operating.
          */
         local_irq_save(flags);
-        this_cpu = smp_processor_id();
         queue = &__get_cpu_var(softnet_data);
 
         __get_cpu_var(netdev_rx_stat).total++;
         if (queue->input_pkt_queue.qlen <= netdev_max_backlog) {
                 if (queue->input_pkt_queue.qlen) {
-                        if (queue->throttle)
-                                goto drop;
-
 enqueue:
                         dev_hold(skb->dev);
                         __skb_queue_tail(&queue->input_pkt_queue, skb);
-#ifndef OFFLINE_SAMPLE
-                        get_sample_stats(this_cpu);
-#endif
                         local_irq_restore(flags);
-                        return queue->cng_level;
+                        return NET_RX_SUCCESS;
                 }
 
-                if (queue->throttle)
-                        queue->throttle = 0;
-
                 netif_rx_schedule(&queue->backlog_dev);
                 goto enqueue;
         }
 
-        if (!queue->throttle) {
-                queue->throttle = 1;
-                __get_cpu_var(netdev_rx_stat).throttled++;
-        }
-
-drop:
         __get_cpu_var(netdev_rx_stat).dropped++;
         local_irq_restore(flags);
 
@@ -1744,6 +1651,7 @@ static int process_backlog(struct net_device *backlog_dev, int *budget)
         struct softnet_data *queue = &__get_cpu_var(softnet_data);
         unsigned long start_time = jiffies;
 
+        backlog_dev->weight = weight_p;
         for (;;) {
                 struct sk_buff *skb;
                 struct net_device *dev;
@@ -1779,8 +1687,6 @@ job_done:
         smp_mb__before_clear_bit();
         netif_poll_enable(backlog_dev);
 
-        if (queue->throttle)
-                queue->throttle = 0;
         local_irq_enable();
         return 0;
 }
@@ -1789,9 +1695,9 @@ static void net_rx_action(struct softirq_action *h)
 {
         struct softnet_data *queue = &__get_cpu_var(softnet_data);
         unsigned long start_time = jiffies;
-        int budget = netdev_max_backlog;
+        int budget = netdev_budget;
+        void *have;
 
-        
         local_irq_disable();
 
         while (!list_empty(&queue->poll_list)) {
@@ -1804,10 +1710,10 @@ static void net_rx_action(struct softirq_action *h)
 
                 dev = list_entry(queue->poll_list.next,
                                  struct net_device, poll_list);
-                netpoll_poll_lock(dev);
+                have = netpoll_poll_lock(dev);
 
                 if (dev->quota <= 0 || dev->poll(dev, &budget)) {
-                        netpoll_poll_unlock(dev);
+                        netpoll_poll_unlock(have);
                         local_irq_disable();
                         list_del(&dev->poll_list);
                         list_add_tail(&dev->poll_list, &queue->poll_list);
@@ -1816,7 +1722,7 @@ static void net_rx_action(struct softirq_action *h)
                         else
                                 dev->quota = dev->weight;
                 } else {
-                        netpoll_poll_unlock(dev);
+                        netpoll_poll_unlock(have);
                         dev_put(dev);
                         local_irq_disable();
                 }
@@ -2054,15 +1960,9 @@ static int softnet_seq_show(struct seq_file *seq, void *v)
         struct netif_rx_stats *s = v;
 
         seq_printf(seq, "%08x %08x %08x %08x %08x %08x %08x %08x %08x\n",
-                   s->total, s->dropped, s->time_squeeze, s->throttled,
-                   s->fastroute_hit, s->fastroute_success, s->fastroute_defer,
-                   s->fastroute_deferred_out,
-#if 0
-                   s->fastroute_latency_reduction
-#else
-                   s->cpu_collision
-#endif
-                  );
+                   s->total, s->dropped, s->time_squeeze, 0,
+                   0, 0, 0, 0, /* was fastroute */
+                   s->cpu_collision );
         return 0;
 }
 
@@ -2189,10 +2089,11 @@ void dev_set_promiscuity(struct net_device *dev, int inc)
 {
         unsigned short old_flags = dev->flags;
 
-        dev->flags |= IFF_PROMISC;
         if ((dev->promiscuity += inc) == 0)
                 dev->flags &= ~IFF_PROMISC;
-        if (dev->flags ^ old_flags) {
+        else
+                dev->flags |= IFF_PROMISC;
+        if (dev->flags != old_flags) {
                 dev_mc_upload(dev);
                 printk(KERN_INFO "device %s %s promiscuous mode\n",
                        dev->name, (dev->flags & IFF_PROMISC) ? "entered" :
@@ -3304,9 +3205,6 @@ static int __init net_dev_init(void)
 
                 queue = &per_cpu(softnet_data, i);
                 skb_queue_head_init(&queue->input_pkt_queue);
-                queue->throttle = 0;
-                queue->cng_level = 0;
-                queue->avg_blog = 10; /* arbitrary non-zero */
                 queue->completion_queue = NULL;
                 INIT_LIST_HEAD(&queue->poll_list);
                 set_bit(__LINK_STATE_START, &queue->backlog_dev.state);
@@ -3315,11 +3213,6 @@ static int __init net_dev_init(void)
                 atomic_set(&queue->backlog_dev.refcnt, 1);
         }
 
-#ifdef OFFLINE_SAMPLE
-        samp_timer.expires = jiffies + (10 * HZ);
-        add_timer(&samp_timer);
-#endif
-
         dev_boot_phase = 0;
 
         open_softirq(NET_TX_SOFTIRQ, net_tx_action, NULL);
diff --git a/net/core/dst.c b/net/core/dst.c
index fc434ade5270..334790da9f16 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -45,6 +45,7 @@ static struct timer_list dst_gc_timer =
 static void dst_run_gc(unsigned long dummy)
 {
         int    delayed = 0;
+        int    work_performed;
         struct dst_entry * dst, **dstp;
 
         if (!spin_trylock(&dst_lock)) {
@@ -52,9 +53,9 @@ static void dst_run_gc(unsigned long dummy)
                 return;
         }
 
-
         del_timer(&dst_gc_timer);
         dstp = &dst_garbage_list;
+        work_performed = 0;
         while ((dst = *dstp) != NULL) {
                 if (atomic_read(&dst->__refcnt)) {
                         dstp = &dst->next;
@@ -62,6 +63,7 @@ static void dst_run_gc(unsigned long dummy)
                         continue;
                 }
                 *dstp = dst->next;
+                work_performed = 1;
 
                 dst = dst_destroy(dst);
                 if (dst) {
@@ -86,9 +88,14 @@ static void dst_run_gc(unsigned long dummy)
                 dst_gc_timer_inc = DST_GC_MAX;
                 goto out;
         }
-        if ((dst_gc_timer_expires += dst_gc_timer_inc) > DST_GC_MAX)
-                dst_gc_timer_expires = DST_GC_MAX;
-        dst_gc_timer_inc += DST_GC_INC;
+        if (!work_performed) {
+                if ((dst_gc_timer_expires += dst_gc_timer_inc) > DST_GC_MAX)
+                        dst_gc_timer_expires = DST_GC_MAX;
+                dst_gc_timer_inc += DST_GC_INC;
+        } else {
+                dst_gc_timer_inc = DST_GC_INC;
+                dst_gc_timer_expires = DST_GC_MIN;
+        }
         dst_gc_timer.expires = jiffies + dst_gc_timer_expires;
 #if RT_CACHE_DEBUG >= 2
         printk("dst_total: %d/%d %ld\n",
diff --git a/net/core/filter.c b/net/core/filter.c
index f3b88205ace2..cd91a24f9720 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -36,7 +36,7 @@
 #include <linux/filter.h>
 
 /* No hurry in this branch */
-static u8 *load_pointer(struct sk_buff *skb, int k)
+static void *__load_pointer(struct sk_buff *skb, int k)
 {
         u8 *ptr = NULL;
 
@@ -50,6 +50,18 @@ static u8 *load_pointer(struct sk_buff *skb, int k)
         return NULL;
 }
 
+static inline void *load_pointer(struct sk_buff *skb, int k,
+                                 unsigned int size, void *buffer)
+{
+        if (k >= 0)
+                return skb_header_pointer(skb, k, size, buffer);
+        else {
+                if (k >= SKF_AD_OFF)
+                        return NULL;
+                return __load_pointer(skb, k);
+        }
+}
+
 /**
  *      sk_run_filter   -       run a filter on a socket
  *      @skb: buffer to run the filter on
@@ -64,15 +76,12 @@ static u8 *load_pointer(struct sk_buff *skb, int k)
  
 int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen)
 {
-        unsigned char *data = skb->data;
-        /* len is UNSIGNED. Byte wide insns relies only on implicit
-           type casts to prevent reading arbitrary memory locations.
-         */
-        unsigned int len = skb->len-skb->data_len;
         struct sock_filter *fentry;     /* We walk down these */
+        void *ptr;
         u32 A = 0;                      /* Accumulator */
         u32 X = 0;                      /* Index Register */
         u32 mem[BPF_MEMWORDS];          /* Scratch Memory Store */
+        u32 tmp;
         int k;
         int pc;
 
@@ -168,86 +177,35 @@ int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen)
                 case BPF_LD|BPF_W|BPF_ABS:
                         k = fentry->k;
  load_w:
-                        if (k >= 0 && (unsigned int)(k+sizeof(u32)) <= len) {
-                                A = ntohl(*(u32*)&data[k]);
+                        ptr = load_pointer(skb, k, 4, &tmp);
+                        if (ptr != NULL) {
+                                A = ntohl(*(u32 *)ptr);
                                 continue;
                         }
-                        if (k < 0) {
-                                u8 *ptr;
-
-                                if (k >= SKF_AD_OFF)
-                                        break;
-                                ptr = load_pointer(skb, k);
-                                if (ptr) {
-                                        A = ntohl(*(u32*)ptr);
-                                        continue;
-                                }
-                        } else {
-                                u32 _tmp, *p;
-                                p = skb_header_pointer(skb, k, 4, &_tmp);
-                                if (p != NULL) {
-                                        A = ntohl(*p);
-                                        continue;
-                                }
-                        }
                         return 0;
                 case BPF_LD|BPF_H|BPF_ABS:
                         k = fentry->k;
  load_h:
-                        if (k >= 0 && (unsigned int)(k + sizeof(u16)) <= len) {
-                                A = ntohs(*(u16*)&data[k]);
+                        ptr = load_pointer(skb, k, 2, &tmp);
+                        if (ptr != NULL) {
+                                A = ntohs(*(u16 *)ptr);
                                 continue;
                         }
-                        if (k < 0) {
-                                u8 *ptr;
-
-                                if (k >= SKF_AD_OFF)
-                                        break;
-                                ptr = load_pointer(skb, k);
-                                if (ptr) {
-                                        A = ntohs(*(u16*)ptr);
-                                        continue;
-                                }
-                        } else {
-                                u16 _tmp, *p;
-                                p = skb_header_pointer(skb, k, 2, &_tmp);
-                                if (p != NULL) {
-                                        A = ntohs(*p);
-                                        continue;
-                                }
-                        }
                         return 0;
                 case BPF_LD|BPF_B|BPF_ABS:
                         k = fentry->k;
 load_b:
-                        if (k >= 0 && (unsigned int)k < len) {
-                                A = data[k];
+                        ptr = load_pointer(skb, k, 1, &tmp);
+                        if (ptr != NULL) {
+                                A = *(u8 *)ptr;
                                 continue;
                         }
-                        if (k < 0) {
-                                u8 *ptr;
-
-                                if (k >= SKF_AD_OFF)
-                                        break;
-                                ptr = load_pointer(skb, k);
-                                if (ptr) {
-                                        A = *ptr;
-                                        continue;
-                                }
-                        } else {
-                                u8 _tmp, *p;
-                                p = skb_header_pointer(skb, k, 1, &_tmp);
-                                if (p != NULL) {
-                                        A = *p;
-                                        continue;
-                                }
-                        }
                         return 0;
                 case BPF_LD|BPF_W|BPF_LEN:
-                        A = len;
+                        A = skb->len;
                         continue;
                 case BPF_LDX|BPF_W|BPF_LEN:
-                        X = len;
+                        X = skb->len;
                         continue;
                 case BPF_LD|BPF_W|BPF_IND:
                         k = X + fentry->k;
@@ -259,10 +217,12 @@ load_b:
                         k = X + fentry->k;
                         goto load_b;
                 case BPF_LDX|BPF_B|BPF_MSH:
-                        if (fentry->k >= len)
-                                return 0;
-                        X = (data[fentry->k] & 0xf) << 2;
-                        continue;
+                        ptr = load_pointer(skb, fentry->k, 1, &tmp);
+                        if (ptr != NULL) {
+                                X = (*(u8 *)ptr & 0xf) << 2;
+                                continue;
+                        }
+                        return 0;
                 case BPF_LD|BPF_IMM:
                         A = fentry->k;
                         continue;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 43bdc521e20d..1beb782ac41b 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -32,6 +32,7 @@
 #include <net/sock.h>
 #include <linux/rtnetlink.h>
 #include <linux/random.h>
+#include <linux/string.h>
 
 #define NEIGH_DEBUG 1
 
@@ -1276,9 +1277,14 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
                 INIT_RCU_HEAD(&p->rcu_head);
                 p->reachable_time =
                                 neigh_rand_reach_time(p->base_reachable_time);
-                if (dev && dev->neigh_setup && dev->neigh_setup(dev, p)) {
-                        kfree(p);
-                        return NULL;
+                if (dev) {
+                        if (dev->neigh_setup && dev->neigh_setup(dev, p)) {
+                                kfree(p);
+                                return NULL;
+                        }
+
+                        dev_hold(dev);
+                        p->dev = dev;
                 }
                 p->sysctl_table = NULL;
                 write_lock_bh(&tbl->lock);
@@ -1309,6 +1315,8 @@ void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
                         *p = parms->next;
                         parms->dead = 1;
                         write_unlock_bh(&tbl->lock);
+                        if (parms->dev)
+                                dev_put(parms->dev);
                         call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
                         return;
                 }
@@ -1546,21 +1554,330 @@ out:
         return err;
 }
 
+static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
+{
+        struct rtattr *nest = NULL;
+        
+        nest = RTA_NEST(skb, NDTA_PARMS);
+
+        if (parms->dev)
+                RTA_PUT_U32(skb, NDTPA_IFINDEX, parms->dev->ifindex);
+
+        RTA_PUT_U32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt));
+        RTA_PUT_U32(skb, NDTPA_QUEUE_LEN, parms->queue_len);
+        RTA_PUT_U32(skb, NDTPA_PROXY_QLEN, parms->proxy_qlen);
+        RTA_PUT_U32(skb, NDTPA_APP_PROBES, parms->app_probes);
+        RTA_PUT_U32(skb, NDTPA_UCAST_PROBES, parms->ucast_probes);
+        RTA_PUT_U32(skb, NDTPA_MCAST_PROBES, parms->mcast_probes);
+        RTA_PUT_MSECS(skb, NDTPA_REACHABLE_TIME, parms->reachable_time);
+        RTA_PUT_MSECS(skb, NDTPA_BASE_REACHABLE_TIME,
+                      parms->base_reachable_time);
+        RTA_PUT_MSECS(skb, NDTPA_GC_STALETIME, parms->gc_staletime);
+        RTA_PUT_MSECS(skb, NDTPA_DELAY_PROBE_TIME, parms->delay_probe_time);
+        RTA_PUT_MSECS(skb, NDTPA_RETRANS_TIME, parms->retrans_time);
+        RTA_PUT_MSECS(skb, NDTPA_ANYCAST_DELAY, parms->anycast_delay);
+        RTA_PUT_MSECS(skb, NDTPA_PROXY_DELAY, parms->proxy_delay);
+        RTA_PUT_MSECS(skb, NDTPA_LOCKTIME, parms->locktime);
+
+        return RTA_NEST_END(skb, nest);
+
+rtattr_failure:
+        return RTA_NEST_CANCEL(skb, nest);
+}
+
+static int neightbl_fill_info(struct neigh_table *tbl, struct sk_buff *skb,
+                              struct netlink_callback *cb)
+{
+        struct nlmsghdr *nlh;
+        struct ndtmsg *ndtmsg;
+
+        nlh = NLMSG_NEW_ANSWER(skb, cb, RTM_NEWNEIGHTBL, sizeof(struct ndtmsg),
+                               NLM_F_MULTI);
+
+        ndtmsg = NLMSG_DATA(nlh);
+
+        read_lock_bh(&tbl->lock);
+        ndtmsg->ndtm_family = tbl->family;
+        ndtmsg->ndtm_pad1   = 0;
+        ndtmsg->ndtm_pad2   = 0;
+
+        RTA_PUT_STRING(skb, NDTA_NAME, tbl->id);
+        RTA_PUT_MSECS(skb, NDTA_GC_INTERVAL, tbl->gc_interval);
+        RTA_PUT_U32(skb, NDTA_THRESH1, tbl->gc_thresh1);
+        RTA_PUT_U32(skb, NDTA_THRESH2, tbl->gc_thresh2);
+        RTA_PUT_U32(skb, NDTA_THRESH3, tbl->gc_thresh3);
+
+        {
+                unsigned long now = jiffies;
+                unsigned int flush_delta = now - tbl->last_flush;
+                unsigned int rand_delta = now - tbl->last_rand;
+
+                struct ndt_config ndc = {
+                        .ndtc_key_len           = tbl->key_len,
+                        .ndtc_entry_size        = tbl->entry_size,
+                        .ndtc_entries           = atomic_read(&tbl->entries),
+                        .ndtc_last_flush        = jiffies_to_msecs(flush_delta),
+                        .ndtc_last_rand         = jiffies_to_msecs(rand_delta),
+                        .ndtc_hash_rnd          = tbl->hash_rnd,
+                        .ndtc_hash_mask         = tbl->hash_mask,
+                        .ndtc_hash_chain_gc     = tbl->hash_chain_gc,
+                        .ndtc_proxy_qlen        = tbl->proxy_queue.qlen,
+                };
+
+                RTA_PUT(skb, NDTA_CONFIG, sizeof(ndc), &ndc);
+        }
+
+        {
+                int cpu;
+                struct ndt_stats ndst;
+
+                memset(&ndst, 0, sizeof(ndst));
+
+                for (cpu = 0; cpu < NR_CPUS; cpu++) {
+                        struct neigh_statistics *st;
+
+                        if (!cpu_possible(cpu))
+                                continue;
+
+                        st = per_cpu_ptr(tbl->stats, cpu);
+                        ndst.ndts_allocs                += st->allocs;
+                        ndst.ndts_destroys              += st->destroys;
+                        ndst.ndts_hash_grows            += st->hash_grows;
+                        ndst.ndts_res_failed            += st->res_failed;
+                        ndst.ndts_lookups               += st->lookups;
+                        ndst.ndts_hits                  += st->hits;
+                        ndst.ndts_rcv_probes_mcast      += st->rcv_probes_mcast;
+                        ndst.ndts_rcv_probes_ucast      += st->rcv_probes_ucast;
+                        ndst.ndts_periodic_gc_runs      += st->periodic_gc_runs;
+                        ndst.ndts_forced_gc_runs        += st->forced_gc_runs;
+                }
+
+                RTA_PUT(skb, NDTA_STATS, sizeof(ndst), &ndst);
+        }
+
+        BUG_ON(tbl->parms.dev);
+        if (neightbl_fill_parms(skb, &tbl->parms) < 0)
+                goto rtattr_failure;
+
+        read_unlock_bh(&tbl->lock);
+        return NLMSG_END(skb, nlh);
+
+rtattr_failure:
+        read_unlock_bh(&tbl->lock);
+        return NLMSG_CANCEL(skb, nlh);
+ 
+nlmsg_failure:
+        return -1;
+}
+
+static int neightbl_fill_param_info(struct neigh_table *tbl,
+                                    struct neigh_parms *parms,
+                                    struct sk_buff *skb,
+                                    struct netlink_callback *cb)
+{
+        struct ndtmsg *ndtmsg;
+        struct nlmsghdr *nlh;
+
+        nlh = NLMSG_NEW_ANSWER(skb, cb, RTM_NEWNEIGHTBL, sizeof(struct ndtmsg),
+                               NLM_F_MULTI);
+
+        ndtmsg = NLMSG_DATA(nlh);
+
+        read_lock_bh(&tbl->lock);
+        ndtmsg->ndtm_family = tbl->family;
+        ndtmsg->ndtm_pad1   = 0;
+        ndtmsg->ndtm_pad2   = 0;
+        RTA_PUT_STRING(skb, NDTA_NAME, tbl->id);
+
+        if (neightbl_fill_parms(skb, parms) < 0)
+                goto rtattr_failure;
+
+        read_unlock_bh(&tbl->lock);
+        return NLMSG_END(skb, nlh);
+
+rtattr_failure:
+        read_unlock_bh(&tbl->lock);
+        return NLMSG_CANCEL(skb, nlh);
+
+nlmsg_failure:
+        return -1;
+}
+ 
+static inline struct neigh_parms *lookup_neigh_params(struct neigh_table *tbl,
+                                                      int ifindex)
+{
+        struct neigh_parms *p;
+        
+        for (p = &tbl->parms; p; p = p->next)
+                if ((p->dev && p->dev->ifindex == ifindex) ||
+                    (!p->dev && !ifindex))
+                        return p;
+
+        return NULL;
+}
+
+int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
+{
+        struct neigh_table *tbl;
+        struct ndtmsg *ndtmsg = NLMSG_DATA(nlh);
+        struct rtattr **tb = arg;
+        int err = -EINVAL;
+
+        if (!tb[NDTA_NAME - 1] || !RTA_PAYLOAD(tb[NDTA_NAME - 1]))
+                return -EINVAL;
+
+        read_lock(&neigh_tbl_lock);
+        for (tbl = neigh_tables; tbl; tbl = tbl->next) {
+                if (ndtmsg->ndtm_family && tbl->family != ndtmsg->ndtm_family)
+                        continue;
+
+                if (!rtattr_strcmp(tb[NDTA_NAME - 1], tbl->id))
+                        break;
+        }
+
+        if (tbl == NULL) {
+                err = -ENOENT;
+                goto errout;
+        }
+
+        /* 
+         * We acquire tbl->lock to be nice to the periodic timers and
+         * make sure they always see a consistent set of values.
+         */
+        write_lock_bh(&tbl->lock);
+
+        if (tb[NDTA_THRESH1 - 1])
+                tbl->gc_thresh1 = RTA_GET_U32(tb[NDTA_THRESH1 - 1]);
+
+        if (tb[NDTA_THRESH2 - 1])
+                tbl->gc_thresh2 = RTA_GET_U32(tb[NDTA_THRESH2 - 1]);
+
+        if (tb[NDTA_THRESH3 - 1])
+                tbl->gc_thresh3 = RTA_GET_U32(tb[NDTA_THRESH3 - 1]);
+
+        if (tb[NDTA_GC_INTERVAL - 1])
+                tbl->gc_interval = RTA_GET_MSECS(tb[NDTA_GC_INTERVAL - 1]);
+
+        if (tb[NDTA_PARMS - 1]) {
+                struct rtattr *tbp[NDTPA_MAX];
+                struct neigh_parms *p;
+                u32 ifindex = 0;
+
+                if (rtattr_parse_nested(tbp, NDTPA_MAX, tb[NDTA_PARMS - 1]) < 0)
+                        goto rtattr_failure;
+
+                if (tbp[NDTPA_IFINDEX - 1])
+                        ifindex = RTA_GET_U32(tbp[NDTPA_IFINDEX - 1]);
+
+                p = lookup_neigh_params(tbl, ifindex);
+                if (p == NULL) {
+                        err = -ENOENT;
+                        goto rtattr_failure;
+                }
+        
+                if (tbp[NDTPA_QUEUE_LEN - 1])
+                        p->queue_len = RTA_GET_U32(tbp[NDTPA_QUEUE_LEN - 1]);
+
+                if (tbp[NDTPA_PROXY_QLEN - 1])
+                        p->proxy_qlen = RTA_GET_U32(tbp[NDTPA_PROXY_QLEN - 1]);
+
+                if (tbp[NDTPA_APP_PROBES - 1])
+                        p->app_probes = RTA_GET_U32(tbp[NDTPA_APP_PROBES - 1]);
+
+                if (tbp[NDTPA_UCAST_PROBES - 1])
+                        p->ucast_probes =
+                           RTA_GET_U32(tbp[NDTPA_UCAST_PROBES - 1]);
+
+                if (tbp[NDTPA_MCAST_PROBES - 1])
+                        p->mcast_probes =
+                           RTA_GET_U32(tbp[NDTPA_MCAST_PROBES - 1]);
+
+                if (tbp[NDTPA_BASE_REACHABLE_TIME - 1])
+                        p->base_reachable_time =
+                           RTA_GET_MSECS(tbp[NDTPA_BASE_REACHABLE_TIME - 1]);
+
+                if (tbp[NDTPA_GC_STALETIME - 1])
+                        p->gc_staletime =
+                           RTA_GET_MSECS(tbp[NDTPA_GC_STALETIME - 1]);
+
+                if (tbp[NDTPA_DELAY_PROBE_TIME - 1])
+                        p->delay_probe_time =
+                           RTA_GET_MSECS(tbp[NDTPA_DELAY_PROBE_TIME - 1]);
+
+                if (tbp[NDTPA_RETRANS_TIME - 1])
+                        p->retrans_time =
+                           RTA_GET_MSECS(tbp[NDTPA_RETRANS_TIME - 1]);
+
+                if (tbp[NDTPA_ANYCAST_DELAY - 1])
+                        p->anycast_delay =
+                           RTA_GET_MSECS(tbp[NDTPA_ANYCAST_DELAY - 1]);
+
+                if (tbp[NDTPA_PROXY_DELAY - 1])
+                        p->proxy_delay =
+                           RTA_GET_MSECS(tbp[NDTPA_PROXY_DELAY - 1]);
+
+                if (tbp[NDTPA_LOCKTIME - 1])
+                        p->locktime = RTA_GET_MSECS(tbp[NDTPA_LOCKTIME - 1]);
+        }
+
+        err = 0;
+
+rtattr_failure:
+        write_unlock_bh(&tbl->lock);
+errout:
+        read_unlock(&neigh_tbl_lock);
+        return err;
+}
+
+int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        int idx, family;
+        int s_idx = cb->args[0];
+        struct neigh_table *tbl;
+
+        family = ((struct rtgenmsg *)NLMSG_DATA(cb->nlh))->rtgen_family;
+
+        read_lock(&neigh_tbl_lock);
+        for (tbl = neigh_tables, idx = 0; tbl; tbl = tbl->next) {
+                struct neigh_parms *p;
+
+                if (idx < s_idx || (family && tbl->family != family))
+                        continue;
+
+                if (neightbl_fill_info(tbl, skb, cb) <= 0)
+                        break;
+
+                for (++idx, p = tbl->parms.next; p; p = p->next, idx++) {
+                        if (idx < s_idx)
+                                continue;
+
+                        if (neightbl_fill_param_info(tbl, p, skb, cb) <= 0)
+                                goto out;
+                }
+
+        }
+out:
+        read_unlock(&neigh_tbl_lock);
+        cb->args[0] = idx;
+
+        return skb->len;
+}
 
 static int neigh_fill_info(struct sk_buff *skb, struct neighbour *n,
-                           u32 pid, u32 seq, int event)
+                           u32 pid, u32 seq, int event, unsigned int flags)
 {
         unsigned long now = jiffies;
         unsigned char *b = skb->tail;
         struct nda_cacheinfo ci;
         int locked = 0;
         u32 probes;
-        struct nlmsghdr *nlh = NLMSG_PUT(skb, pid, seq, event,
-                                         sizeof(struct ndmsg));
+        struct nlmsghdr *nlh = NLMSG_NEW(skb, pid, seq, event,
+                                         sizeof(struct ndmsg), flags);
         struct ndmsg *ndm = NLMSG_DATA(nlh);
 
-        nlh->nlmsg_flags = pid ? NLM_F_MULTI : 0;
         ndm->ndm_family  = n->ops->family;
+        ndm->ndm_pad1    = 0;
+        ndm->ndm_pad2    = 0;
         ndm->ndm_flags   = n->flags;
         ndm->ndm_type    = n->type;
         ndm->ndm_ifindex = n->dev->ifindex;
@@ -1609,7 +1926,8 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
                                 continue;
                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).pid,
                                             cb->nlh->nlmsg_seq,
-                                            RTM_NEWNEIGH) <= 0) {
+                                            RTM_NEWNEIGH,
+                                            NLM_F_MULTI) <= 0) {
                                 read_unlock_bh(&tbl->lock);
                                 rc = -1;
                                 goto out;
@@ -2018,7 +2336,7 @@ void neigh_app_ns(struct neighbour *n)
         if (!skb)
                 return;
 
-        if (neigh_fill_info(skb, n, 0, 0, RTM_GETNEIGH) < 0) {
+        if (neigh_fill_info(skb, n, 0, 0, RTM_GETNEIGH, 0) < 0) {
                 kfree_skb(skb);
                 return;
         }
@@ -2037,7 +2355,7 @@ static void neigh_app_notify(struct neighbour *n)
         if (!skb)
                 return;
 
-        if (neigh_fill_info(skb, n, 0, 0, RTM_NEWNEIGH) < 0) {
+        if (neigh_fill_info(skb, n, 0, 0, RTM_NEWNEIGH, 0) < 0) {
                 kfree_skb(skb);
                 return;
         }
@@ -2281,7 +2599,7 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
                 t->neigh_vars[17].extra1 = dev;
         }
 
-        dev_name = net_sysctl_strdup(dev_name_source);
+        dev_name = kstrdup(dev_name_source, GFP_KERNEL);
         if (!dev_name) {
                 err = -ENOBUFS;
                 goto free;
@@ -2352,6 +2670,8 @@ EXPORT_SYMBOL(neigh_update);
 EXPORT_SYMBOL(neigh_update_hhs);
 EXPORT_SYMBOL(pneigh_enqueue);
 EXPORT_SYMBOL(pneigh_lookup);
+EXPORT_SYMBOL(neightbl_dump_info);
+EXPORT_SYMBOL(neightbl_set);
 
 #ifdef CONFIG_ARPD
 EXPORT_SYMBOL(neigh_app_ns);
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 910eb4c05a47..e2137f3e489d 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -185,6 +185,22 @@ static ssize_t store_tx_queue_len(struct class_device *dev, const char *buf, siz
 static CLASS_DEVICE_ATTR(tx_queue_len, S_IRUGO | S_IWUSR, show_tx_queue_len, 
                          store_tx_queue_len);
 
+NETDEVICE_SHOW(weight, fmt_dec);
+
+static int change_weight(struct net_device *net, unsigned long new_weight)
+{
+        net->weight = new_weight;
+        return 0;
+}
+
+static ssize_t store_weight(struct class_device *dev, const char *buf, size_t len)
+{
+        return netdev_store(dev, buf, len, change_weight);
+}
+
+static CLASS_DEVICE_ATTR(weight, S_IRUGO | S_IWUSR, show_weight, 
+                         store_weight);
+
 
 static struct class_device_attribute *net_class_attributes[] = {
         &class_device_attr_ifindex,
@@ -194,6 +210,7 @@ static struct class_device_attribute *net_class_attributes[] = {
         &class_device_attr_features,
         &class_device_attr_mtu,
         &class_device_attr_flags,
+        &class_device_attr_weight,
         &class_device_attr_type,
         &class_device_attr_address,
         &class_device_attr_broadcast,
diff --git a/net/core/netfilter.c b/net/core/netfilter.c
index 22a8f127c4aa..076c156d5eda 100644
--- a/net/core/netfilter.c
+++ b/net/core/netfilter.c
@@ -141,136 +141,6 @@ void nf_unregister_sockopt(struct nf_sockopt_ops *reg)
         up(&nf_sockopt_mutex);
 }
 
-#ifdef CONFIG_NETFILTER_DEBUG
-#include <net/ip.h>
-#include <net/tcp.h>
-#include <linux/netfilter_ipv4.h>
-
-static void debug_print_hooks_ip(unsigned int nf_debug)
-{
-        if (nf_debug & (1 << NF_IP_PRE_ROUTING)) {
-                printk("PRE_ROUTING ");
-                nf_debug ^= (1 << NF_IP_PRE_ROUTING);
-        }
-        if (nf_debug & (1 << NF_IP_LOCAL_IN)) {
-                printk("LOCAL_IN ");
-                nf_debug ^= (1 << NF_IP_LOCAL_IN);
-        }
-        if (nf_debug & (1 << NF_IP_FORWARD)) {
-                printk("FORWARD ");
-                nf_debug ^= (1 << NF_IP_FORWARD);
-        }
-        if (nf_debug & (1 << NF_IP_LOCAL_OUT)) {
-                printk("LOCAL_OUT ");
-                nf_debug ^= (1 << NF_IP_LOCAL_OUT);
-        }
-        if (nf_debug & (1 << NF_IP_POST_ROUTING)) {
-                printk("POST_ROUTING ");
-                nf_debug ^= (1 << NF_IP_POST_ROUTING);
-        }
-        if (nf_debug)
-                printk("Crap bits: 0x%04X", nf_debug);
-        printk("\n");
-}
-
-static void nf_dump_skb(int pf, struct sk_buff *skb)
-{
-        printk("skb: pf=%i %s dev=%s len=%u\n", 
-               pf,
-               skb->sk ? "(owned)" : "(unowned)",
-               skb->dev ? skb->dev->name : "(no dev)",
-               skb->len);
-        switch (pf) {
-        case PF_INET: {
-                const struct iphdr *ip = skb->nh.iph;
-                __u32 *opt = (__u32 *) (ip + 1);
-                int opti;
-                __u16 src_port = 0, dst_port = 0;
-
-                if (ip->protocol == IPPROTO_TCP
-                    || ip->protocol == IPPROTO_UDP) {
-                        struct tcphdr *tcp=(struct tcphdr *)((__u32 *)ip+ip->ihl);
-                        src_port = ntohs(tcp->source);
-                        dst_port = ntohs(tcp->dest);
-                }
-        
-                printk("PROTO=%d %u.%u.%u.%u:%hu %u.%u.%u.%u:%hu"
-                       " L=%hu S=0x%2.2hX I=%hu F=0x%4.4hX T=%hu",
-                       ip->protocol, NIPQUAD(ip->saddr),
-                       src_port, NIPQUAD(ip->daddr),
-                       dst_port,
-                       ntohs(ip->tot_len), ip->tos, ntohs(ip->id),
-                       ntohs(ip->frag_off), ip->ttl);
-
-                for (opti = 0; opti < (ip->ihl - sizeof(struct iphdr) / 4); opti++)
-                        printk(" O=0x%8.8X", *opt++);
-                printk("\n");
-        }
-        }
-}
-
-void nf_debug_ip_local_deliver(struct sk_buff *skb)
-{
-        /* If it's a loopback packet, it must have come through
-         * NF_IP_LOCAL_OUT, NF_IP_RAW_INPUT, NF_IP_PRE_ROUTING and
-         * NF_IP_LOCAL_IN.  Otherwise, must have gone through
-         * NF_IP_RAW_INPUT and NF_IP_PRE_ROUTING.  */
-        if (!skb->dev) {
-                printk("ip_local_deliver: skb->dev is NULL.\n");
-        } else {
-                if (skb->nf_debug != ((1<<NF_IP_PRE_ROUTING)
-                                      | (1<<NF_IP_LOCAL_IN))) {
-                        printk("ip_local_deliver: bad skb: ");
-                        debug_print_hooks_ip(skb->nf_debug);
-                        nf_dump_skb(PF_INET, skb);
-                }
-        }
-}
-
-void nf_debug_ip_loopback_xmit(struct sk_buff *newskb)
-{
-        if (newskb->nf_debug != ((1 << NF_IP_LOCAL_OUT)
-                                 | (1 << NF_IP_POST_ROUTING))) {
-                printk("ip_dev_loopback_xmit: bad owned skb = %p: ", 
-                       newskb);
-                debug_print_hooks_ip(newskb->nf_debug);
-                nf_dump_skb(PF_INET, newskb);
-        }
-}
-
-void nf_debug_ip_finish_output2(struct sk_buff *skb)
-{
-        /* If it's owned, it must have gone through the
-         * NF_IP_LOCAL_OUT and NF_IP_POST_ROUTING.
-         * Otherwise, must have gone through
-         * NF_IP_PRE_ROUTING, NF_IP_FORWARD and NF_IP_POST_ROUTING.
-         */
-        if (skb->sk) {
-                if (skb->nf_debug != ((1 << NF_IP_LOCAL_OUT)
-                                      | (1 << NF_IP_POST_ROUTING))) {
-                        printk("ip_finish_output: bad owned skb = %p: ", skb);
-                        debug_print_hooks_ip(skb->nf_debug);
-                        nf_dump_skb(PF_INET, skb);
-                }
-        } else {
-                if (skb->nf_debug != ((1 << NF_IP_PRE_ROUTING)
-                                      | (1 << NF_IP_FORWARD)
-                                      | (1 << NF_IP_POST_ROUTING))) {
-                        /* Fragments, entunnelled packets, TCP RSTs
-                           generated by ipt_REJECT will have no
-                           owners, but still may be local */
-                        if (skb->nf_debug != ((1 << NF_IP_LOCAL_OUT)
-                                              | (1 << NF_IP_POST_ROUTING))){
-                                printk("ip_finish_output:"
-                                       " bad unowned skb = %p: ",skb);
-                                debug_print_hooks_ip(skb->nf_debug);
-                                nf_dump_skb(PF_INET, skb);
-                        }
-                }
-        }
-}
-#endif /*CONFIG_NETFILTER_DEBUG*/
-
 /* Call get/setsockopt() */
 static int nf_sockopt(struct sock *sk, int pf, int val, 
                       char __user *opt, int *len, int get)
@@ -488,14 +358,6 @@ int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
         /* We may already have this, but read-locks nest anyway */
         rcu_read_lock();
 
-#ifdef CONFIG_NETFILTER_DEBUG
-        if (unlikely((*pskb)->nf_debug & (1 << hook))) {
-                printk("nf_hook: hook %i already set.\n", hook);
-                nf_dump_skb(pf, *pskb);
-        }
-        (*pskb)->nf_debug |= (1 << hook);
-#endif
-
         elem = &nf_hooks[pf][hook];
 next_hook:
         verdict = nf_iterate(&nf_hooks[pf][hook], pskb, hook, indev,
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index a119696d5521..a1a9a7abff50 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -33,6 +33,7 @@
 #define MAX_UDP_CHUNK 1460
 #define MAX_SKBS 32
 #define MAX_QUEUE_DEPTH (MAX_SKBS / 2)
+#define MAX_RETRIES 20000
 
 static DEFINE_SPINLOCK(skb_list_lock);
 static int nr_skbs;
@@ -130,19 +131,20 @@ static int checksum_udp(struct sk_buff *skb, struct udphdr *uh,
  */
 static void poll_napi(struct netpoll *np)
 {
+        struct netpoll_info *npinfo = np->dev->npinfo;
         int budget = 16;
 
         if (test_bit(__LINK_STATE_RX_SCHED, &np->dev->state) &&
-            np->poll_owner != smp_processor_id() &&
-            spin_trylock(&np->poll_lock)) {
-                np->rx_flags |= NETPOLL_RX_DROP;
+            npinfo->poll_owner != smp_processor_id() &&
+            spin_trylock(&npinfo->poll_lock)) {
+                npinfo->rx_flags |= NETPOLL_RX_DROP;
                 atomic_inc(&trapped);
 
                 np->dev->poll(np->dev, &budget);
 
                 atomic_dec(&trapped);
-                np->rx_flags &= ~NETPOLL_RX_DROP;
-                spin_unlock(&np->poll_lock);
+                npinfo->rx_flags &= ~NETPOLL_RX_DROP;
+                spin_unlock(&npinfo->poll_lock);
         }
 }
 
@@ -245,16 +247,18 @@ repeat:
 static void netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)
 {
         int status;
+        struct netpoll_info *npinfo;
 
-repeat:
-        if(!np || !np->dev || !netif_running(np->dev)) {
+        if (!np || !np->dev || !netif_running(np->dev)) {
                 __kfree_skb(skb);
                 return;
         }
 
+        npinfo = np->dev->npinfo;
+
         /* avoid recursion */
-        if(np->poll_owner == smp_processor_id() ||
-           np->dev->xmit_lock_owner == smp_processor_id()) {
+        if (npinfo->poll_owner == smp_processor_id() ||
+            np->dev->xmit_lock_owner == smp_processor_id()) {
                 if (np->drop)
                         np->drop(skb);
                 else
@@ -262,30 +266,37 @@ repeat:
                 return;
         }
 
-        spin_lock(&np->dev->xmit_lock);
-        np->dev->xmit_lock_owner = smp_processor_id();
+        do {
+                npinfo->tries--;
+                spin_lock(&np->dev->xmit_lock);
+                np->dev->xmit_lock_owner = smp_processor_id();
 
-        /*
-         * network drivers do not expect to be called if the queue is
-         * stopped.
-         */
-        if (netif_queue_stopped(np->dev)) {
+                /*
+                 * network drivers do not expect to be called if the queue is
+                 * stopped.
+                 */
+                if (netif_queue_stopped(np->dev)) {
+                        np->dev->xmit_lock_owner = -1;
+                        spin_unlock(&np->dev->xmit_lock);
+                        netpoll_poll(np);
+                        udelay(50);
+                        continue;
+                }
+
+                status = np->dev->hard_start_xmit(skb, np->dev);
                 np->dev->xmit_lock_owner = -1;
                 spin_unlock(&np->dev->xmit_lock);
 
-                netpoll_poll(np);
-                goto repeat;
-        }
-
-        status = np->dev->hard_start_xmit(skb, np->dev);
-        np->dev->xmit_lock_owner = -1;
-        spin_unlock(&np->dev->xmit_lock);
+                /* success */
+                if(!status) {
+                        npinfo->tries = MAX_RETRIES; /* reset */
+                        return;
+                }
 
-        /* transmit busy */
-        if(status) {
+                /* transmit busy */
                 netpoll_poll(np);
-                goto repeat;
-        }
+                udelay(50);
+        } while (npinfo->tries > 0);
 }
 
 void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
@@ -341,14 +352,18 @@ void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
 
 static void arp_reply(struct sk_buff *skb)
 {
+        struct netpoll_info *npinfo = skb->dev->npinfo;
         struct arphdr *arp;
         unsigned char *arp_ptr;
         int size, type = ARPOP_REPLY, ptype = ETH_P_ARP;
         u32 sip, tip;
         struct sk_buff *send_skb;
-        struct netpoll *np = skb->dev->np;
+        struct netpoll *np = NULL;
 
-        if (!np) return;
+        if (npinfo->rx_np && npinfo->rx_np->dev == skb->dev)
+                np = npinfo->rx_np;
+        if (!np)
+                return;
 
         /* No arp on this interface */
         if (skb->dev->flags & IFF_NOARP)
@@ -429,9 +444,9 @@ int __netpoll_rx(struct sk_buff *skb)
         int proto, len, ulen;
         struct iphdr *iph;
         struct udphdr *uh;
-        struct netpoll *np = skb->dev->np;
+        struct netpoll *np = skb->dev->npinfo->rx_np;
 
-        if (!np->rx_hook)
+        if (!np)
                 goto out;
         if (skb->dev->type != ARPHRD_ETHER)
                 goto out;
@@ -611,9 +626,8 @@ int netpoll_setup(struct netpoll *np)
 {
         struct net_device *ndev = NULL;
         struct in_device *in_dev;
-
-        np->poll_lock = SPIN_LOCK_UNLOCKED;
-        np->poll_owner = -1;
+        struct netpoll_info *npinfo;
+        unsigned long flags;
 
         if (np->dev_name)
                 ndev = dev_get_by_name(np->dev_name);
@@ -624,7 +638,19 @@ int netpoll_setup(struct netpoll *np)
         }
 
         np->dev = ndev;
-        ndev->np = np;
+        if (!ndev->npinfo) {
+                npinfo = kmalloc(sizeof(*npinfo), GFP_KERNEL);
+                if (!npinfo)
+                        goto release;
+
+                npinfo->rx_flags = 0;
+                npinfo->rx_np = NULL;
+                npinfo->poll_lock = SPIN_LOCK_UNLOCKED;
+                npinfo->poll_owner = -1;
+                npinfo->tries = MAX_RETRIES;
+                npinfo->rx_lock = SPIN_LOCK_UNLOCKED;
+        } else
+                npinfo = ndev->npinfo;
 
         if (!ndev->poll_controller) {
                 printk(KERN_ERR "%s: %s doesn't support polling, aborting.\n",
@@ -692,13 +718,27 @@ int netpoll_setup(struct netpoll *np)
                        np->name, HIPQUAD(np->local_ip));
         }
 
-        if(np->rx_hook)
-                np->rx_flags = NETPOLL_RX_ENABLED;
+        if (np->rx_hook) {
+                spin_lock_irqsave(&npinfo->rx_lock, flags);
+                npinfo->rx_flags |= NETPOLL_RX_ENABLED;
+                npinfo->rx_np = np;
+                spin_unlock_irqrestore(&npinfo->rx_lock, flags);
+        }
+
+        /* fill up the skb queue */
+        refill_skbs();
+
+        /* last thing to do is link it to the net device structure */
+        ndev->npinfo = npinfo;
+
+        /* avoid racing with NAPI reading npinfo */
+        synchronize_rcu();
 
         return 0;
 
  release:
-        ndev->np = NULL;
+        if (!ndev->npinfo)
+                kfree(npinfo);
         np->dev = NULL;
         dev_put(ndev);
         return -1;
@@ -706,9 +746,20 @@ int netpoll_setup(struct netpoll *np)
 
 void netpoll_cleanup(struct netpoll *np)
 {
-        if (np->dev)
-                np->dev->np = NULL;
-        dev_put(np->dev);
+        struct netpoll_info *npinfo;
+        unsigned long flags;
+
+        if (np->dev) {
+                npinfo = np->dev->npinfo;
+                if (npinfo && npinfo->rx_np == np) {
+                        spin_lock_irqsave(&npinfo->rx_lock, flags);
+                        npinfo->rx_np = NULL;
+                        npinfo->rx_flags &= ~NETPOLL_RX_ENABLED;
+                        spin_unlock_irqrestore(&npinfo->rx_lock, flags);
+                }
+                dev_put(np->dev);
+        }
+
         np->dev = NULL;
 }
 
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index c57b06bc79f3..8eb083b6041a 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -151,7 +151,7 @@
 #include <asm/timex.h>
 
 
-#define VERSION  "pktgen v2.61: Packet Generator for packet performance testing.\n"
+#define VERSION  "pktgen v2.62: Packet Generator for packet performance testing.\n"
 
 /* #define PG_DEBUG(a) a */
 #define PG_DEBUG(a) 
@@ -363,7 +363,7 @@ struct pktgen_thread {
  * All Rights Reserved.
  *
  */
-inline static s64 divremdi3(s64 x, s64 y, int type) 
+static inline s64 divremdi3(s64 x, s64 y, int type)
 {
         u64 a = (x < 0) ? -x : x;
         u64 b = (y < 0) ? -y : y;
@@ -1921,6 +1921,11 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         struct iphdr *iph;
         struct pktgen_hdr *pgh = NULL;
         
+        /* Update any of the values, used when we're incrementing various
+         * fields.
+         */
+        mod_cur_headers(pkt_dev);
+
         skb = alloc_skb(pkt_dev->cur_pkt_size + 64 + 16, GFP_ATOMIC);
         if (!skb) {
                 sprintf(pkt_dev->result, "No memory");
@@ -1934,11 +1939,6 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         iph = (struct iphdr *)skb_put(skb, sizeof(struct iphdr));
         udph = (struct udphdr *)skb_put(skb, sizeof(struct udphdr));
 
-        /* Update any of the values, used when we're incrementing various
-         * fields.
-         */
-        mod_cur_headers(pkt_dev);
-
         memcpy(eth, pkt_dev->hh, 12);
         *(u16*)&eth[12] = __constant_htons(ETH_P_IP);
 
@@ -2192,7 +2192,12 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         int datalen;
         struct ipv6hdr *iph;
         struct pktgen_hdr *pgh = NULL;
-        
+
+        /* Update any of the values, used when we're incrementing various
+         * fields.
+         */
+        mod_cur_headers(pkt_dev);
+
         skb = alloc_skb(pkt_dev->cur_pkt_size + 64 + 16, GFP_ATOMIC);
         if (!skb) {
                 sprintf(pkt_dev->result, "No memory");
@@ -2206,17 +2211,9 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         iph = (struct ipv6hdr *)skb_put(skb, sizeof(struct ipv6hdr));
         udph = (struct udphdr *)skb_put(skb, sizeof(struct udphdr));
 
-
-        /* Update any of the values, used when we're incrementing various
-         * fields.
-         */
-        mod_cur_headers(pkt_dev);
-
-        
         memcpy(eth, pkt_dev->hh, 12);
         *(u16*)&eth[12] = __constant_htons(ETH_P_IPV6);
-        
-        
+
         datalen = pkt_dev->cur_pkt_size-14- 
                 sizeof(struct ipv6hdr)-sizeof(struct udphdr); /* Eth + IPh + UDPh */
 
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
new file mode 100644
index 000000000000..bb55675f0685
--- /dev/null
+++ b/net/core/request_sock.c
@@ -0,0 +1,64 @@
+/*
+ * NET          Generic infrastructure for Network protocols.
+ *
+ * Authors:     Arnaldo Carvalho de Melo <acme@conectiva.com.br>
+ *
+ *              From code originally in include/net/tcp.h
+ *
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              as published by the Free Software Foundation; either version
+ *              2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/random.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+
+#include <net/request_sock.h>
+
+/*
+ * Maximum number of SYN_RECV sockets in queue per LISTEN socket.
+ * One SYN_RECV socket costs about 80bytes on a 32bit machine.
+ * It would be better to replace it with a global counter for all sockets
+ * but then some measure against one socket starving all other sockets
+ * would be needed.
+ *
+ * It was 128 by default. Experiments with real servers show, that
+ * it is absolutely not enough even at 100conn/sec. 256 cures most
+ * of problems. This value is adjusted to 128 for very small machines
+ * (<=32Mb of memory) and to 1024 on normal or better ones (>=256Mb).
+ * Further increasing requires to change hash table size.
+ */
+int sysctl_max_syn_backlog = 256;
+EXPORT_SYMBOL(sysctl_max_syn_backlog);
+
+int reqsk_queue_alloc(struct request_sock_queue *queue,
+                      const int nr_table_entries)
+{
+        const int lopt_size = sizeof(struct listen_sock) +
+                              nr_table_entries * sizeof(struct request_sock *);
+        struct listen_sock *lopt = kmalloc(lopt_size, GFP_KERNEL);
+
+        if (lopt == NULL)
+                return -ENOMEM;
+
+        memset(lopt, 0, lopt_size);
+
+        for (lopt->max_qlen_log = 6;
+             (1 << lopt->max_qlen_log) < sysctl_max_syn_backlog;
+             lopt->max_qlen_log++);
+
+        get_random_bytes(&lopt->hash_rnd, sizeof(lopt->hash_rnd));
+        rwlock_init(&queue->syn_wait_lock);
+        queue->rskq_accept_head = queue->rskq_accept_head = NULL;
+
+        write_lock_bh(&queue->syn_wait_lock);
+        queue->listen_opt = lopt;
+        write_unlock_bh(&queue->syn_wait_lock);
+
+        return 0;
+}
+
+EXPORT_SYMBOL(reqsk_queue_alloc);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 00caf4b318b2..4b1bb30e6381 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -100,6 +100,7 @@ static const int rtm_min[RTM_NR_FAMILIES] =
         [RTM_FAM(RTM_NEWPREFIX)]    = NLMSG_LENGTH(sizeof(struct rtgenmsg)),
         [RTM_FAM(RTM_GETMULTICAST)] = NLMSG_LENGTH(sizeof(struct rtgenmsg)),
         [RTM_FAM(RTM_GETANYCAST)]   = NLMSG_LENGTH(sizeof(struct rtgenmsg)),
+        [RTM_FAM(RTM_NEWNEIGHTBL)]  = NLMSG_LENGTH(sizeof(struct ndtmsg)),
 };
 
 static const int rta_max[RTM_NR_FAMILIES] =
@@ -113,6 +114,7 @@ static const int rta_max[RTM_NR_FAMILIES] =
         [RTM_FAM(RTM_NEWTCLASS)]    = TCA_MAX,
         [RTM_FAM(RTM_NEWTFILTER)]   = TCA_MAX,
         [RTM_FAM(RTM_NEWACTION)]    = TCAA_MAX,
+        [RTM_FAM(RTM_NEWNEIGHTBL)]  = NDTA_MAX,
 };
 
 void __rta_fill(struct sk_buff *skb, int attrtype, int attrlen, const void *data)
@@ -124,6 +126,7 @@ void __rta_fill(struct sk_buff *skb, int attrtype, int attrlen, const void *data
         rta->rta_type = attrtype;
         rta->rta_len = size;
         memcpy(RTA_DATA(rta), data, attrlen);
+        memset(RTA_DATA(rta) + attrlen, 0, RTA_ALIGN(size) - size);
 }
 
 size_t rtattr_strlcpy(char *dest, const struct rtattr *rta, size_t size)
@@ -176,16 +179,17 @@ rtattr_failure:
 
 
 static int rtnetlink_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
-                                 int type, u32 pid, u32 seq, u32 change)
+                                 int type, u32 pid, u32 seq, u32 change, 
+                                 unsigned int flags)
 {
         struct ifinfomsg *r;
         struct nlmsghdr  *nlh;
         unsigned char    *b = skb->tail;
 
-        nlh = NLMSG_PUT(skb, pid, seq, type, sizeof(*r));
-        if (pid) nlh->nlmsg_flags |= NLM_F_MULTI;
+        nlh = NLMSG_NEW(skb, pid, seq, type, sizeof(*r), flags);
         r = NLMSG_DATA(nlh);
         r->ifi_family = AF_UNSPEC;
+        r->__ifi_pad = 0;
         r->ifi_type = dev->type;
         r->ifi_index = dev->ifindex;
         r->ifi_flags = dev_get_flags(dev);
@@ -273,7 +277,10 @@ static int rtnetlink_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *c
         for (dev=dev_base, idx=0; dev; dev = dev->next, idx++) {
                 if (idx < s_idx)
                         continue;
-                if (rtnetlink_fill_ifinfo(skb, dev, RTM_NEWLINK, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq, 0) <= 0)
+                if (rtnetlink_fill_ifinfo(skb, dev, RTM_NEWLINK,
+                                          NETLINK_CB(cb->skb).pid,
+                                          cb->nlh->nlmsg_seq, 0,
+                                          NLM_F_MULTI) <= 0)
                         break;
         }
         read_unlock(&dev_base_lock);
@@ -447,7 +454,7 @@ void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change)
         if (!skb)
                 return;
 
-        if (rtnetlink_fill_ifinfo(skb, dev, type, 0, 0, change) < 0) {
+        if (rtnetlink_fill_ifinfo(skb, dev, type, current->pid, 0, change, 0) < 0) {
                 kfree_skb(skb);
                 return;
         }
@@ -649,14 +656,16 @@ static void rtnetlink_rcv(struct sock *sk, int len)
 
 static struct rtnetlink_link link_rtnetlink_table[RTM_NR_MSGTYPES] =
 {
-        [RTM_GETLINK  - RTM_BASE] = { .dumpit = rtnetlink_dump_ifinfo },
-        [RTM_SETLINK  - RTM_BASE] = { .doit   = do_setlink            },
-        [RTM_GETADDR  - RTM_BASE] = { .dumpit = rtnetlink_dump_all    },
-        [RTM_GETROUTE - RTM_BASE] = { .dumpit = rtnetlink_dump_all    },
-        [RTM_NEWNEIGH - RTM_BASE] = { .doit   = neigh_add             },
-        [RTM_DELNEIGH - RTM_BASE] = { .doit   = neigh_delete          },
-        [RTM_GETNEIGH - RTM_BASE] = { .dumpit = neigh_dump_info       },
-        [RTM_GETRULE  - RTM_BASE] = { .dumpit = rtnetlink_dump_all    },
+        [RTM_GETLINK     - RTM_BASE] = { .dumpit = rtnetlink_dump_ifinfo },
+        [RTM_SETLINK     - RTM_BASE] = { .doit   = do_setlink            },
+        [RTM_GETADDR     - RTM_BASE] = { .dumpit = rtnetlink_dump_all    },
+        [RTM_GETROUTE    - RTM_BASE] = { .dumpit = rtnetlink_dump_all    },
+        [RTM_NEWNEIGH    - RTM_BASE] = { .doit   = neigh_add             },
+        [RTM_DELNEIGH    - RTM_BASE] = { .doit   = neigh_delete          },
+        [RTM_GETNEIGH    - RTM_BASE] = { .dumpit = neigh_dump_info       },
+        [RTM_GETRULE     - RTM_BASE] = { .dumpit = rtnetlink_dump_all    },
+        [RTM_GETNEIGHTBL - RTM_BASE] = { .dumpit = neightbl_dump_info    },
+        [RTM_SETNEIGHTBL - RTM_BASE] = { .doit   = neightbl_set          },
 };
 
 static int rtnetlink_event(struct notifier_block *this, unsigned long event, void *ptr)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index f65b3de590a9..7eab867ede59 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -129,7 +129,7 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
  *      Buffers may only be allocated from interrupts using a @gfp_mask of
  *      %GFP_ATOMIC.
  */
-struct sk_buff *alloc_skb(unsigned int size, int gfp_mask)
+struct sk_buff *alloc_skb(unsigned int size, unsigned int __nocast gfp_mask)
 {
         struct sk_buff *skb;
         u8 *data;
@@ -182,7 +182,8 @@ nodata:
  *      %GFP_ATOMIC.
  */
 struct sk_buff *alloc_skb_from_cache(kmem_cache_t *cp,
-                                     unsigned int size, int gfp_mask)
+                                     unsigned int size,
+                                     unsigned int __nocast gfp_mask)
 {
         struct sk_buff *skb;
         u8 *data;
@@ -322,7 +323,7 @@ void __kfree_skb(struct sk_buff *skb)
  *      %GFP_ATOMIC.
  */
 
-struct sk_buff *skb_clone(struct sk_buff *skb, int gfp_mask)
+struct sk_buff *skb_clone(struct sk_buff *skb, unsigned int __nocast gfp_mask)
 {
         struct sk_buff *n = kmem_cache_alloc(skbuff_head_cache, gfp_mask);
 
@@ -357,7 +358,6 @@ struct sk_buff *skb_clone(struct sk_buff *skb, int gfp_mask)
         C(ip_summed);
         C(priority);
         C(protocol);
-        C(security);
         n->destructor = NULL;
 #ifdef CONFIG_NETFILTER
         C(nfmark);
@@ -365,9 +365,6 @@ struct sk_buff *skb_clone(struct sk_buff *skb, int gfp_mask)
         C(nfct);
         nf_conntrack_get(skb->nfct);
         C(nfctinfo);
-#ifdef CONFIG_NETFILTER_DEBUG
-        C(nf_debug);
-#endif
 #ifdef CONFIG_BRIDGE_NETFILTER
         C(nf_bridge);
         nf_bridge_get(skb->nf_bridge);
@@ -380,8 +377,8 @@ struct sk_buff *skb_clone(struct sk_buff *skb, int gfp_mask)
         C(tc_index);
 #ifdef CONFIG_NET_CLS_ACT
         n->tc_verd = SET_TC_VERD(skb->tc_verd,0);
-        n->tc_verd = CLR_TC_OK2MUNGE(skb->tc_verd);
-        n->tc_verd = CLR_TC_MUNGED(skb->tc_verd);
+        n->tc_verd = CLR_TC_OK2MUNGE(n->tc_verd);
+        n->tc_verd = CLR_TC_MUNGED(n->tc_verd);
         C(input_dev);
         C(tc_classid);
 #endif
@@ -425,16 +422,12 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->pkt_type   = old->pkt_type;
         new->stamp      = old->stamp;
         new->destructor = NULL;
-        new->security   = old->security;
 #ifdef CONFIG_NETFILTER
         new->nfmark     = old->nfmark;
         new->nfcache    = old->nfcache;
         new->nfct       = old->nfct;
         nf_conntrack_get(old->nfct);
         new->nfctinfo   = old->nfctinfo;
-#ifdef CONFIG_NETFILTER_DEBUG
-        new->nf_debug   = old->nf_debug;
-#endif
 #ifdef CONFIG_BRIDGE_NETFILTER
         new->nf_bridge  = old->nf_bridge;
         nf_bridge_get(old->nf_bridge);
@@ -468,7 +461,7 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
  *      header is going to be modified. Use pskb_copy() instead.
  */
 
-struct sk_buff *skb_copy(const struct sk_buff *skb, int gfp_mask)
+struct sk_buff *skb_copy(const struct sk_buff *skb, unsigned int __nocast gfp_mask)
 {
         int headerlen = skb->data - skb->head;
         /*
@@ -507,7 +500,7 @@ struct sk_buff *skb_copy(const struct sk_buff *skb, int gfp_mask)
  *      The returned buffer has a reference count of 1.
  */
 
-struct sk_buff *pskb_copy(struct sk_buff *skb, int gfp_mask)
+struct sk_buff *pskb_copy(struct sk_buff *skb, unsigned int __nocast gfp_mask)
 {
         /*
          *      Allocate the copy buffer
@@ -565,7 +558,8 @@ out:
  *      reloaded after call to this function.
  */
 
-int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail, int gfp_mask)
+int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
+                     unsigned int __nocast gfp_mask)
 {
         int i;
         u8 *data;
@@ -655,7 +649,8 @@ struct sk_buff *skb_realloc_headroom(struct sk_buff *skb, unsigned int headroom)
  *      only by netfilter in the cases when checksum is recalculated? --ANK
  */
 struct sk_buff *skb_copy_expand(const struct sk_buff *skb,
-                                int newheadroom, int newtailroom, int gfp_mask)
+                                int newheadroom, int newtailroom,
+                                unsigned int __nocast gfp_mask)
 {
         /*
          *      Allocate the copy buffer
@@ -1506,6 +1501,159 @@ void skb_split(struct sk_buff *skb, struct sk_buff *skb1, const u32 len)
                 skb_split_no_header(skb, skb1, len, pos);
 }
 
+/**
+ * skb_prepare_seq_read - Prepare a sequential read of skb data
+ * @skb: the buffer to read
+ * @from: lower offset of data to be read
+ * @to: upper offset of data to be read
+ * @st: state variable
+ *
+ * Initializes the specified state variable. Must be called before
+ * invoking skb_seq_read() for the first time.
+ */
+void skb_prepare_seq_read(struct sk_buff *skb, unsigned int from,
+                          unsigned int to, struct skb_seq_state *st)
+{
+        st->lower_offset = from;
+        st->upper_offset = to;
+        st->root_skb = st->cur_skb = skb;
+        st->frag_idx = st->stepped_offset = 0;
+        st->frag_data = NULL;
+}
+
+/**
+ * skb_seq_read - Sequentially read skb data
+ * @consumed: number of bytes consumed by the caller so far
+ * @data: destination pointer for data to be returned
+ * @st: state variable
+ *
+ * Reads a block of skb data at &consumed relative to the
+ * lower offset specified to skb_prepare_seq_read(). Assigns
+ * the head of the data block to &data and returns the length
+ * of the block or 0 if the end of the skb data or the upper
+ * offset has been reached.
+ *
+ * The caller is not required to consume all of the data
+ * returned, i.e. &consumed is typically set to the number
+ * of bytes already consumed and the next call to
+ * skb_seq_read() will return the remaining part of the block.
+ *
+ * Note: The size of each block of data returned can be arbitary,
+ *       this limitation is the cost for zerocopy seqeuental
+ *       reads of potentially non linear data.
+ *
+ * Note: Fragment lists within fragments are not implemented
+ *       at the moment, state->root_skb could be replaced with
+ *       a stack for this purpose.
+ */
+unsigned int skb_seq_read(unsigned int consumed, const u8 **data,
+                          struct skb_seq_state *st)
+{
+        unsigned int block_limit, abs_offset = consumed + st->lower_offset;
+        skb_frag_t *frag;
+
+        if (unlikely(abs_offset >= st->upper_offset))
+                return 0;
+
+next_skb:
+        block_limit = skb_headlen(st->cur_skb);
+
+        if (abs_offset < block_limit) {
+                *data = st->cur_skb->data + abs_offset;
+                return block_limit - abs_offset;
+        }
+
+        if (st->frag_idx == 0 && !st->frag_data)
+                st->stepped_offset += skb_headlen(st->cur_skb);
+
+        while (st->frag_idx < skb_shinfo(st->cur_skb)->nr_frags) {
+                frag = &skb_shinfo(st->cur_skb)->frags[st->frag_idx];
+                block_limit = frag->size + st->stepped_offset;
+
+                if (abs_offset < block_limit) {
+                        if (!st->frag_data)
+                                st->frag_data = kmap_skb_frag(frag);
+
+                        *data = (u8 *) st->frag_data + frag->page_offset +
+                                (abs_offset - st->stepped_offset);
+
+                        return block_limit - abs_offset;
+                }
+
+                if (st->frag_data) {
+                        kunmap_skb_frag(st->frag_data);
+                        st->frag_data = NULL;
+                }
+
+                st->frag_idx++;
+                st->stepped_offset += frag->size;
+        }
+
+        if (st->cur_skb->next) {
+                st->cur_skb = st->cur_skb->next;
+                st->frag_idx = 0;
+                goto next_skb;
+        } else if (st->root_skb == st->cur_skb &&
+                   skb_shinfo(st->root_skb)->frag_list) {
+                st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
+                goto next_skb;
+        }
+
+        return 0;
+}
+
+/**
+ * skb_abort_seq_read - Abort a sequential read of skb data
+ * @st: state variable
+ *
+ * Must be called if skb_seq_read() was not called until it
+ * returned 0.
+ */
+void skb_abort_seq_read(struct skb_seq_state *st)
+{
+        if (st->frag_data)
+                kunmap_skb_frag(st->frag_data);
+}
+
+#define TS_SKB_CB(state)        ((struct skb_seq_state *) &((state)->cb))
+
+static unsigned int skb_ts_get_next_block(unsigned int offset, const u8 **text,
+                                          struct ts_config *conf,
+                                          struct ts_state *state)
+{
+        return skb_seq_read(offset, text, TS_SKB_CB(state));
+}
+
+static void skb_ts_finish(struct ts_config *conf, struct ts_state *state)
+{
+        skb_abort_seq_read(TS_SKB_CB(state));
+}
+
+/**
+ * skb_find_text - Find a text pattern in skb data
+ * @skb: the buffer to look in
+ * @from: search offset
+ * @to: search limit
+ * @config: textsearch configuration
+ * @state: uninitialized textsearch state variable
+ *
+ * Finds a pattern in the skb data according to the specified
+ * textsearch configuration. Use textsearch_next() to retrieve
+ * subsequent occurrences of the pattern. Returns the offset
+ * to the first occurrence or UINT_MAX if no match was found.
+ */
+unsigned int skb_find_text(struct sk_buff *skb, unsigned int from,
+                           unsigned int to, struct ts_config *config,
+                           struct ts_state *state)
+{
+        config->get_next_block = skb_ts_get_next_block;
+        config->finish = skb_ts_finish;
+
+        skb_prepare_seq_read(skb, from, to, TS_SKB_CB(state));
+
+        return textsearch_find(config, state);
+}
+
 void __init skb_init(void)
 {
         skbuff_head_cache = kmem_cache_create("skbuff_head_cache",
@@ -1544,3 +1692,7 @@ EXPORT_SYMBOL(skb_queue_tail);
 EXPORT_SYMBOL(skb_unlink);
 EXPORT_SYMBOL(skb_append);
 EXPORT_SYMBOL(skb_split);
+EXPORT_SYMBOL(skb_prepare_seq_read);
+EXPORT_SYMBOL(skb_seq_read);
+EXPORT_SYMBOL(skb_abort_seq_read);
+EXPORT_SYMBOL(skb_find_text);
diff --git a/net/core/sock.c b/net/core/sock.c
index 96e00b08698f..12f6d9a2a522 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -118,6 +118,7 @@
 #include <linux/netdevice.h>
 #include <net/protocol.h>
 #include <linux/skbuff.h>
+#include <net/request_sock.h>
 #include <net/sock.h>
 #include <net/xfrm.h>
 #include <linux/ipsec.h>
@@ -205,13 +206,14 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
          */
 
 #ifdef SO_DONTLINGER            /* Compatibility item... */
-        switch (optname) {
-                case SO_DONTLINGER:
-                        sock_reset_flag(sk, SOCK_LINGER);
-                        return 0;
+        if (optname == SO_DONTLINGER) {
+                lock_sock(sk);
+                sock_reset_flag(sk, SOCK_LINGER);
+                release_sock(sk);
+                return 0;
         }
-#endif  
-                
+#endif
+        
         if(optlen<sizeof(int))
                 return(-EINVAL);
         
@@ -621,7 +623,8 @@ lenout:
  *      @prot: struct proto associated with this new sock instance
  *      @zero_it: if we should zero the newly allocated sock
  */
-struct sock *sk_alloc(int family, int priority, struct proto *prot, int zero_it)
+struct sock *sk_alloc(int family, unsigned int __nocast priority,
+                      struct proto *prot, int zero_it)
 {
         struct sock *sk = NULL;
         kmem_cache_t *slab = prot->slab;
@@ -749,7 +752,8 @@ unsigned long sock_i_ino(struct sock *sk)
 /*
  * Allocate a skb from the socket's send buffer.
  */
-struct sk_buff *sock_wmalloc(struct sock *sk, unsigned long size, int force, int priority)
+struct sk_buff *sock_wmalloc(struct sock *sk, unsigned long size, int force,
+                             unsigned int __nocast priority)
 {
         if (force || atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
                 struct sk_buff * skb = alloc_skb(size, priority);
@@ -764,7 +768,8 @@ struct sk_buff *sock_wmalloc(struct sock *sk, unsigned long size, int force, int
 /*
  * Allocate a skb from the socket's receive buffer.
  */ 
-struct sk_buff *sock_rmalloc(struct sock *sk, unsigned long size, int force, int priority)
+struct sk_buff *sock_rmalloc(struct sock *sk, unsigned long size, int force,
+                             unsigned int __nocast priority)
 {
         if (force || atomic_read(&sk->sk_rmem_alloc) < sk->sk_rcvbuf) {
                 struct sk_buff *skb = alloc_skb(size, priority);
@@ -779,7 +784,7 @@ struct sk_buff *sock_rmalloc(struct sock *sk, unsigned long size, int force, int
 /* 
  * Allocate a memory block from the socket's option memory buffer.
  */ 
-void *sock_kmalloc(struct sock *sk, int size, int priority)
+void *sock_kmalloc(struct sock *sk, int size, unsigned int __nocast priority)
 {
         if ((unsigned)size <= sysctl_optmem_max &&
             atomic_read(&sk->sk_omem_alloc) + size < sysctl_optmem_max) {
@@ -1363,6 +1368,7 @@ static LIST_HEAD(proto_list);
 
 int proto_register(struct proto *prot, int alloc_slab)
 {
+        char *request_sock_slab_name;
         int rc = -ENOBUFS;
 
         if (alloc_slab) {
@@ -1374,6 +1380,25 @@ int proto_register(struct proto *prot, int alloc_slab)
                                prot->name);
                         goto out;
                 }
+
+                if (prot->rsk_prot != NULL) {
+                        static const char mask[] = "request_sock_%s";
+
+                        request_sock_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
+                        if (request_sock_slab_name == NULL)
+                                goto out_free_sock_slab;
+
+                        sprintf(request_sock_slab_name, mask, prot->name);
+                        prot->rsk_prot->slab = kmem_cache_create(request_sock_slab_name,
+                                                                 prot->rsk_prot->obj_size, 0,
+                                                                 SLAB_HWCACHE_ALIGN, NULL, NULL);
+
+                        if (prot->rsk_prot->slab == NULL) {
+                                printk(KERN_CRIT "%s: Can't create request sock SLAB cache!\n",
+                                       prot->name);
+                                goto out_free_request_sock_slab_name;
+                        }
+                }
         }
 
         write_lock(&proto_list_lock);
@@ -1382,6 +1407,12 @@ int proto_register(struct proto *prot, int alloc_slab)
         rc = 0;
 out:
         return rc;
+out_free_request_sock_slab_name:
+        kfree(request_sock_slab_name);
+out_free_sock_slab:
+        kmem_cache_destroy(prot->slab);
+        prot->slab = NULL;
+        goto out;
 }
 
 EXPORT_SYMBOL(proto_register);
@@ -1395,6 +1426,14 @@ void proto_unregister(struct proto *prot)
                 prot->slab = NULL;
         }
 
+        if (prot->rsk_prot != NULL && prot->rsk_prot->slab != NULL) {
+                const char *name = kmem_cache_name(prot->rsk_prot->slab);
+
+                kmem_cache_destroy(prot->rsk_prot->slab);
+                kfree(name);
+                prot->rsk_prot->slab = NULL;
+        }
+
         list_del(&prot->node);
         write_unlock(&proto_list_lock);
 }
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index c8be646cb191..8f817ad9f546 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -13,12 +13,8 @@
 #ifdef CONFIG_SYSCTL
 
 extern int netdev_max_backlog;
+extern int netdev_budget;
 extern int weight_p;
-extern int no_cong_thresh;
-extern int no_cong;
-extern int lo_cong;
-extern int mod_cong;
-extern int netdev_fastroute;
 extern int net_msg_cost;
 extern int net_msg_burst;
 
@@ -35,19 +31,6 @@ extern int sysctl_somaxconn;
 extern char sysctl_divert_version[];
 #endif /* CONFIG_NET_DIVERT */
 
-/*
- * This strdup() is used for creating copies of network 
- * device names to be handed over to sysctl.
- */
- 
-char *net_sysctl_strdup(const char *s)
-{
-        char *rv = kmalloc(strlen(s)+1, GFP_KERNEL);
-        if (rv)
-                strcpy(rv, s);
-        return rv;
-}
-
 ctl_table core_table[] = {
 #ifdef CONFIG_NET
         {
@@ -99,38 +82,6 @@ ctl_table core_table[] = {
                 .proc_handler   = &proc_dointvec
         },
         {
-                .ctl_name       = NET_CORE_NO_CONG_THRESH,
-                .procname       = "no_cong_thresh",
-                .data           = &no_cong_thresh,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec
-        },
-        {
-                .ctl_name       = NET_CORE_NO_CONG,
-                .procname       = "no_cong",
-                .data           = &no_cong,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec
-        },
-        {
-                .ctl_name       = NET_CORE_LO_CONG,
-                .procname       = "lo_cong",
-                .data           = &lo_cong,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec
-        },
-        {
-                .ctl_name       = NET_CORE_MOD_CONG,
-                .procname       = "mod_cong",
-                .data           = &mod_cong,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec
-        },
-        {
                 .ctl_name       = NET_CORE_MSG_COST,
                 .procname       = "message_cost",
                 .data           = &net_msg_cost,
@@ -174,9 +125,15 @@ ctl_table core_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec
         },
+        {
+                .ctl_name       = NET_CORE_BUDGET,
+                .procname       = "netdev_budget",
+                .data           = &netdev_budget,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec
+        },
         { .ctl_name = 0 }
 };
 
-EXPORT_SYMBOL(net_sysctl_strdup);
-
 #endif
diff --git a/net/core/utils.c b/net/core/utils.c
index e11a8654f363..88eb8b68e26b 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -23,10 +23,10 @@
 #include <linux/percpu.h>
 #include <linux/init.h>
 
+#include <asm/byteorder.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
 
-
 /*
   This is a maximally equidistributed combined Tausworthe generator
   based on code from GNU Scientific Library 1.5 (30 Jun 2004)
@@ -153,3 +153,38 @@ int net_ratelimit(void)
 EXPORT_SYMBOL(net_random);
 EXPORT_SYMBOL(net_ratelimit);
 EXPORT_SYMBOL(net_srandom);
+
+/*
+ * Convert an ASCII string to binary IP.
+ * This is outside of net/ipv4/ because various code that uses IP addresses
+ * is otherwise not dependent on the TCP/IP stack.
+ */
+
+__u32 in_aton(const char *str)
+{
+        unsigned long l;
+        unsigned int val;
+        int i;
+
+        l = 0;
+        for (i = 0; i < 4; i++)
+        {
+                l <<= 8;
+                if (*str != '\0')
+                {
+                        val = 0;
+                        while (*str != '\0' && *str != '.')
+                        {
+                                val *= 10;
+                                val += *str - '0';
+                                str++;
+                        }
+                        l |= val;
+                        if (*str != '\0')
+                                str++;
+                }
+        }
+        return(htonl(l));
+}
+
+EXPORT_SYMBOL(in_aton);
diff --git a/net/core/wireless.c b/net/core/wireless.c
index 750cc5daeb03..3ff5639c0b78 100644
--- a/net/core/wireless.c
+++ b/net/core/wireless.c
@@ -2,7 +2,7 @@
  * This file implement the Wireless Extensions APIs.
  *
  * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
- * Copyright (c) 1997-2004 Jean Tourrilhes, All Rights Reserved.
+ * Copyright (c) 1997-2005 Jean Tourrilhes, All Rights Reserved.
  *
  * (As all part of the Linux kernel, this file is GPL)
  */
@@ -187,6 +187,12 @@ static const struct iw_ioctl_description standard_ioctl[] = {
                 .header_type    = IW_HEADER_TYPE_ADDR,
                 .flags          = IW_DESCR_FLAG_DUMP,
         },
+        [SIOCSIWMLME    - SIOCIWFIRST] = {
+                .header_type    = IW_HEADER_TYPE_POINT,
+                .token_size     = 1,
+                .min_tokens     = sizeof(struct iw_mlme),
+                .max_tokens     = sizeof(struct iw_mlme),
+        },
         [SIOCGIWAPLIST  - SIOCIWFIRST] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
                 .token_size     = sizeof(struct sockaddr) +
@@ -195,7 +201,10 @@ static const struct iw_ioctl_description standard_ioctl[] = {
                 .flags          = IW_DESCR_FLAG_NOMAX,
         },
         [SIOCSIWSCAN    - SIOCIWFIRST] = {
-                .header_type    = IW_HEADER_TYPE_PARAM,
+                .header_type    = IW_HEADER_TYPE_POINT,
+                .token_size     = 1,
+                .min_tokens     = 0,
+                .max_tokens     = sizeof(struct iw_scan_req),
         },
         [SIOCGIWSCAN    - SIOCIWFIRST] = {
                 .header_type    = IW_HEADER_TYPE_POINT,
@@ -273,6 +282,42 @@ static const struct iw_ioctl_description standard_ioctl[] = {
         [SIOCGIWPOWER   - SIOCIWFIRST] = {
                 .header_type    = IW_HEADER_TYPE_PARAM,
         },
+        [SIOCSIWGENIE   - SIOCIWFIRST] = {
+                .header_type    = IW_HEADER_TYPE_POINT,
+                .token_size     = 1,
+                .max_tokens     = IW_GENERIC_IE_MAX,
+        },
+        [SIOCGIWGENIE   - SIOCIWFIRST] = {
+                .header_type    = IW_HEADER_TYPE_POINT,
+                .token_size     = 1,
+                .max_tokens     = IW_GENERIC_IE_MAX,
+        },
+        [SIOCSIWAUTH    - SIOCIWFIRST] = {
+                .header_type    = IW_HEADER_TYPE_PARAM,
+        },
+        [SIOCGIWAUTH    - SIOCIWFIRST] = {
+                .header_type    = IW_HEADER_TYPE_PARAM,
+        },
+        [SIOCSIWENCODEEXT - SIOCIWFIRST] = {
+                .header_type    = IW_HEADER_TYPE_POINT,
+                .token_size     = 1,
+                .min_tokens     = sizeof(struct iw_encode_ext),
+                .max_tokens     = sizeof(struct iw_encode_ext) +
+                                  IW_ENCODING_TOKEN_MAX,
+        },
+        [SIOCGIWENCODEEXT - SIOCIWFIRST] = {
+                .header_type    = IW_HEADER_TYPE_POINT,
+                .token_size     = 1,
+                .min_tokens     = sizeof(struct iw_encode_ext),
+                .max_tokens     = sizeof(struct iw_encode_ext) +
+                                  IW_ENCODING_TOKEN_MAX,
+        },
+        [SIOCSIWPMKSA - SIOCIWFIRST] = {
+                .header_type    = IW_HEADER_TYPE_POINT,
+                .token_size     = 1,
+                .min_tokens     = sizeof(struct iw_pmksa),
+                .max_tokens     = sizeof(struct iw_pmksa),
+        },
 };
 static const int standard_ioctl_num = (sizeof(standard_ioctl) /
                                        sizeof(struct iw_ioctl_description));
@@ -299,6 +344,31 @@ static const struct iw_ioctl_description standard_event[] = {
         [IWEVEXPIRED    - IWEVFIRST] = {
                 .header_type    = IW_HEADER_TYPE_ADDR, 
         },
+        [IWEVGENIE      - IWEVFIRST] = {
+                .header_type    = IW_HEADER_TYPE_POINT,
+                .token_size     = 1,
+                .max_tokens     = IW_GENERIC_IE_MAX,
+        },
+        [IWEVMICHAELMICFAILURE  - IWEVFIRST] = {
+                .header_type    = IW_HEADER_TYPE_POINT, 
+                .token_size     = 1,
+                .max_tokens     = sizeof(struct iw_michaelmicfailure),
+        },
+        [IWEVASSOCREQIE - IWEVFIRST] = {
+                .header_type    = IW_HEADER_TYPE_POINT,
+                .token_size     = 1,
+                .max_tokens     = IW_GENERIC_IE_MAX,
+        },
+        [IWEVASSOCRESPIE        - IWEVFIRST] = {
+                .header_type    = IW_HEADER_TYPE_POINT,
+                .token_size     = 1,
+                .max_tokens     = IW_GENERIC_IE_MAX,
+        },
+        [IWEVPMKIDCAND  - IWEVFIRST] = {
+                .header_type    = IW_HEADER_TYPE_POINT,
+                .token_size     = 1,
+                .max_tokens     = sizeof(struct iw_pmkid_cand),
+        },
 };
 static const int standard_event_num = (sizeof(standard_event) /
                                        sizeof(struct iw_ioctl_description));
@@ -1032,6 +1102,7 @@ static inline int rtnetlink_fill_iwinfo(struct sk_buff *	skb,
         nlh = NLMSG_PUT(skb, 0, 0, type, sizeof(*r));
         r = NLMSG_DATA(nlh);
         r->ifi_family = AF_UNSPEC;
+        r->__ifi_pad = 0;
         r->ifi_type = dev->type;
         r->ifi_index = dev->ifindex;
         r->ifi_flags = dev->flags;
diff --git a/net/decnet/Kconfig b/net/decnet/Kconfig
index 2101da542ba8..92f2ec46fd22 100644
--- a/net/decnet/Kconfig
+++ b/net/decnet/Kconfig
@@ -1,6 +1,29 @@
 #
 # DECnet configuration
 #
+config DECNET
+        tristate "DECnet Support"
+        ---help---
+          The DECnet networking protocol was used in many products made by
+          Digital (now Compaq).  It provides reliable stream and sequenced
+          packet communications over which run a variety of services similar
+          to those which run over TCP/IP.
+
+          To find some tools to use with the kernel layer support, please
+          look at Patrick Caulfield's web site:
+          <http://linux-decnet.sourceforge.net/>.
+
+          More detailed documentation is available in
+          <file:Documentation/networking/decnet.txt>.
+
+          Be sure to say Y to "/proc file system support" and "Sysctl support"
+          below when using DECnet, since you will need sysctl support to aid
+          in configuration at run time.
+
+          The DECnet code is also available as a module ( = code which can be
+          inserted in and removed from the running kernel whenever you want).
+          The module is called decnet.
+
 config DECNET_ROUTER
         bool "DECnet: router support (EXPERIMENTAL)"
         depends on DECNET && EXPERIMENTAL
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 29bb3cd21965..acdd18e6adb2 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -536,7 +536,7 @@ static void dn_keepalive(struct sock *sk)
          * we are double checking that we are not sending too
          * many of these keepalive frames.
          */
-        if (skb_queue_len(&scp->other_xmit_queue) == 0)
+        if (skb_queue_empty(&scp->other_xmit_queue))
                 dn_nsp_send_link(sk, DN_NOCHANGE, 0);
 }
 
@@ -1191,7 +1191,7 @@ static unsigned int dn_poll(struct file *file, struct socket *sock, poll_table
         struct dn_scp *scp = DN_SK(sk);
         int mask = datagram_poll(file, sock, wait);
 
-        if (skb_queue_len(&scp->other_receive_queue))
+        if (!skb_queue_empty(&scp->other_receive_queue))
                 mask |= POLLRDBAND;
 
         return mask;
@@ -1214,7 +1214,7 @@ static int dn_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 
         case SIOCATMARK:
                 lock_sock(sk);
-                val = (skb_queue_len(&scp->other_receive_queue) != 0);
+                val = !skb_queue_empty(&scp->other_receive_queue);
                 if (scp->state != DN_RUN)
                         val = -ENOTCONN;
                 release_sock(sk);
@@ -1630,7 +1630,7 @@ static int dn_data_ready(struct sock *sk, struct sk_buff_head *q, int flags, int
         int len = 0;
 
         if (flags & MSG_OOB)
-                return skb_queue_len(q) ? 1 : 0;
+                return !skb_queue_empty(q) ? 1 : 0;
 
         while(skb != (struct sk_buff *)q) {
                 struct dn_skb_cb *cb = DN_SKB_CB(skb);
@@ -1707,7 +1707,7 @@ static int dn_recvmsg(struct kiocb *iocb, struct socket *sock,
                 if (sk->sk_err)
                         goto out;
 
-                if (skb_queue_len(&scp->other_receive_queue)) {
+                if (!skb_queue_empty(&scp->other_receive_queue)) {
                         if (!(flags & MSG_OOB)) {
                                 msg->msg_flags |= MSG_OOB;
                                 if (!scp->other_report) {
@@ -1876,15 +1876,6 @@ static inline unsigned int dn_current_mss(struct sock *sk, int flags)
         return mss_now;
 }
 
-static int dn_error(struct sock *sk, int flags, int err)
-{
-        if (err == -EPIPE)
-                err = sock_error(sk) ? : -EPIPE;
-        if (err == -EPIPE && !(flags & MSG_NOSIGNAL))
-                send_sig(SIGPIPE, current, 0);
-        return err;
-}
-
 static int dn_sendmsg(struct kiocb *iocb, struct socket *sock,
            struct msghdr *msg, size_t size)
 {
@@ -2045,7 +2036,7 @@ out:
         return sent ? sent : err;
 
 out_err:
-        err = dn_error(sk, flags, err);
+        err = sk_stream_error(sk, flags, err);
         release_sock(sk);
         return err;
 }
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index ee7bf46eb78a..00233ecbc9cb 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -716,13 +716,13 @@ static int dn_dev_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *a
 }
 
 static int dn_dev_fill_ifaddr(struct sk_buff *skb, struct dn_ifaddr *ifa,
-                                u32 pid, u32 seq, int event)
+                                u32 pid, u32 seq, int event, unsigned int flags)
 {
         struct ifaddrmsg *ifm;
         struct nlmsghdr *nlh;
         unsigned char *b = skb->tail;
 
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*ifm));
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*ifm), flags);
         ifm = NLMSG_DATA(nlh);
 
         ifm->ifa_family = AF_DECnet;
@@ -755,7 +755,7 @@ static void rtmsg_ifa(int event, struct dn_ifaddr *ifa)
                 netlink_set_err(rtnl, 0, RTMGRP_DECnet_IFADDR, ENOBUFS);
                 return;
         }
-        if (dn_dev_fill_ifaddr(skb, ifa, 0, 0, event) < 0) {
+        if (dn_dev_fill_ifaddr(skb, ifa, 0, 0, event, 0) < 0) {
                 kfree_skb(skb);
                 netlink_set_err(rtnl, 0, RTMGRP_DECnet_IFADDR, EINVAL);
                 return;
@@ -790,7 +790,8 @@ static int dn_dev_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
                         if (dn_dev_fill_ifaddr(skb, ifa,
                                                NETLINK_CB(cb->skb).pid,
                                                cb->nlh->nlmsg_seq,
-                                               RTM_NEWADDR) <= 0)
+                                               RTM_NEWADDR,
+                                               NLM_F_MULTI) <= 0)
                                 goto done;
                 }
         }
diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
index 9934b25720e4..99bc061759c3 100644
--- a/net/decnet/dn_fib.c
+++ b/net/decnet/dn_fib.c
@@ -551,7 +551,8 @@ int dn_fib_dump(struct sk_buff *skb, struct netlink_callback *cb)
                 if (t < s_t)
                         continue;
                 if (t > s_t)
-                        memset(&cb->args[1], 0, sizeof(cb->args)-sizeof(int));
+                        memset(&cb->args[1], 0,
+                               sizeof(cb->args) - sizeof(cb->args[0]));
                 tb = dn_fib_get_table(t, 0);
                 if (tb == NULL)
                         continue;
diff --git a/net/decnet/dn_neigh.c b/net/decnet/dn_neigh.c
index f6dfe96f45b7..8d0cc3cf3e49 100644
--- a/net/decnet/dn_neigh.c
+++ b/net/decnet/dn_neigh.c
@@ -101,7 +101,6 @@ struct neigh_table dn_neigh_table = {
         .id =                           "dn_neigh_cache",
         .parms ={
                 .tbl =                  &dn_neigh_table,
-                .entries =              0,
                 .base_reachable_time =  30 * HZ,
                 .retrans_time = 1 * HZ,
                 .gc_staletime = 60 * HZ,
@@ -149,12 +148,12 @@ static int dn_neigh_construct(struct neighbour *neigh)
 
         __neigh_parms_put(neigh->parms);
         neigh->parms = neigh_parms_clone(parms);
-        rcu_read_unlock();
 
         if (dn_db->use_long)
                 neigh->ops = &dn_long_ops;
         else
                 neigh->ops = &dn_short_ops;
+        rcu_read_unlock();
 
         if (dn->flags & DN_NDFLAG_P3)
                 neigh->ops = &dn_phase3_ops;
diff --git a/net/decnet/dn_nsp_out.c b/net/decnet/dn_nsp_out.c
index 42abbf3f524f..8cce1fdbda90 100644
--- a/net/decnet/dn_nsp_out.c
+++ b/net/decnet/dn_nsp_out.c
@@ -342,7 +342,8 @@ int dn_nsp_xmit_timeout(struct sock *sk)
 
         dn_nsp_output(sk);
 
-        if (skb_queue_len(&scp->data_xmit_queue) || skb_queue_len(&scp->other_xmit_queue))
+        if (!skb_queue_empty(&scp->data_xmit_queue) ||
+            !skb_queue_empty(&scp->other_xmit_queue))
                 scp->persist = dn_nsp_persist(sk);
 
         return 0;
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 1e7b5c3ea215..2399fa8a3f86 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -1465,7 +1465,8 @@ int dn_route_input(struct sk_buff *skb)
         return dn_route_input_slow(skb);
 }
 
-static int dn_rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event, int nowait)
+static int dn_rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
+                           int event, int nowait, unsigned int flags)
 {
         struct dn_route *rt = (struct dn_route *)skb->dst;
         struct rtmsg *r;
@@ -1473,9 +1474,8 @@ static int dn_rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event, int
         unsigned char *b = skb->tail;
         struct rta_cacheinfo ci;
 
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*r));
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*r), flags);
         r = NLMSG_DATA(nlh);
-        nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
         r->rtm_family = AF_DECnet;
         r->rtm_dst_len = 16;
         r->rtm_src_len = 0;
@@ -1596,7 +1596,7 @@ int dn_cache_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, void *arg)
 
         NETLINK_CB(skb).dst_pid = NETLINK_CB(in_skb).pid;
 
-        err = dn_rt_fill_info(skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq, RTM_NEWROUTE, 0);
+        err = dn_rt_fill_info(skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq, RTM_NEWROUTE, 0, 0);
 
         if (err == 0)
                 goto out_free;
@@ -1644,7 +1644,8 @@ int dn_cache_dump(struct sk_buff *skb, struct netlink_callback *cb)
                                 continue;
                         skb->dst = dst_clone(&rt->u.dst);
                         if (dn_rt_fill_info(skb, NETLINK_CB(cb->skb).pid,
-                                        cb->nlh->nlmsg_seq, RTM_NEWROUTE, 1) <= 0) {
+                                        cb->nlh->nlmsg_seq, RTM_NEWROUTE, 
+                                        1, NLM_F_MULTI) <= 0) {
                                 dst_release(xchg(&skb->dst, NULL));
                                 rcu_read_unlock_bh();
                                 goto done;
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index 597587d170d8..1060de70bc0c 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -342,14 +342,15 @@ static struct notifier_block dn_fib_rules_notifier = {
         .notifier_call =        dn_fib_rules_event,
 };
 
-static int dn_fib_fill_rule(struct sk_buff *skb, struct dn_fib_rule *r, struct netlink_callback *cb)
+static int dn_fib_fill_rule(struct sk_buff *skb, struct dn_fib_rule *r,
+                            struct netlink_callback *cb, unsigned int flags)
 {
         struct rtmsg *rtm;
         struct nlmsghdr *nlh;
         unsigned char *b = skb->tail;
 
 
-        nlh = NLMSG_PUT(skb, NETLINK_CREDS(cb->skb)->pid, cb->nlh->nlmsg_seq, RTM_NEWRULE, sizeof(*rtm));
+        nlh = NLMSG_NEW_ANSWER(skb, cb, RTM_NEWRULE, sizeof(*rtm), flags);
         rtm = NLMSG_DATA(nlh);
         rtm->rtm_family = AF_DECnet;
         rtm->rtm_dst_len = r->r_dst_len;
@@ -394,7 +395,7 @@ int dn_fib_dump_rules(struct sk_buff *skb, struct netlink_callback *cb)
         for(r = dn_fib_rules, idx = 0; r; r = r->r_next, idx++) {
                 if (idx < s_idx)
                         continue;
-                if (dn_fib_fill_rule(skb, r, cb) < 0)
+                if (dn_fib_fill_rule(skb, r, cb, NLM_F_MULTI) < 0)
                         break;
         }
         read_unlock(&dn_fib_rules_lock);
diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
index dad5603912be..28ba5777a25a 100644
--- a/net/decnet/dn_table.c
+++ b/net/decnet/dn_table.c
@@ -270,13 +270,13 @@ static int dn_fib_nh_match(struct rtmsg *r, struct nlmsghdr *nlh, struct dn_kern
 
 static int dn_fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
                         u8 tb_id, u8 type, u8 scope, void *dst, int dst_len,
-                        struct dn_fib_info *fi)
+                        struct dn_fib_info *fi, unsigned int flags)
 {
         struct rtmsg *rtm;
         struct nlmsghdr *nlh;
         unsigned char *b = skb->tail;
 
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*rtm));
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*rtm), flags);
         rtm = NLMSG_DATA(nlh);
         rtm->rtm_family = AF_DECnet;
         rtm->rtm_dst_len = dst_len;
@@ -345,7 +345,7 @@ static void dn_rtmsg_fib(int event, struct dn_fib_node *f, int z, int tb_id,
 
         if (dn_fib_dump_info(skb, pid, nlh->nlmsg_seq, event, tb_id, 
                                 f->fn_type, f->fn_scope, &f->fn_key, z, 
-                                DN_FIB_INFO(f)) < 0) {
+                                DN_FIB_INFO(f), 0) < 0) {
                 kfree_skb(skb);
                 return;
         }
@@ -377,7 +377,7 @@ static __inline__ int dn_hash_dump_bucket(struct sk_buff *skb,
                                 tb->n, 
                                 (f->fn_state & DN_S_ZOMBIE) ? 0 : f->fn_type,
                                 f->fn_scope, &f->fn_key, dz->dz_order, 
-                                f->fn_info) < 0) {
+                                f->fn_info, NLM_F_MULTI) < 0) {
                         cb->args[3] = i;
                         return -1;
                 }
diff --git a/net/econet/Kconfig b/net/econet/Kconfig
new file mode 100644
index 000000000000..39a2d2975e0e
--- /dev/null
+++ b/net/econet/Kconfig
@@ -0,0 +1,36 @@
+#
+# Acorn Econet/AUN protocols 
+#
+
+config ECONET
+        tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && INET
+        ---help---
+          Econet is a fairly old and slow networking protocol mainly used by
+          Acorn computers to access file and print servers. It uses native
+          Econet network cards. AUN is an implementation of the higher level
+          parts of Econet that runs over ordinary Ethernet connections, on
+          top of the UDP packet protocol, which in turn runs on top of the
+          Internet protocol IP.
+
+          If you say Y here, you can choose with the next two options whether
+          to send Econet/AUN traffic over a UDP Ethernet connection or over
+          a native Econet network card.
+
+          To compile this driver as a module, choose M here: the module
+          will be called econet.
+
+config ECONET_AUNUDP
+        bool "AUN over UDP"
+        depends on ECONET
+        help
+          Say Y here if you want to send Econet/AUN traffic over a UDP
+          connection (UDP is a packet based protocol that runs on top of the
+          Internet protocol IP) using an ordinary Ethernet network card.
+
+config ECONET_NATIVE
+        bool "Native Econet"
+        depends on ECONET
+        help
+          Say Y here if you have a native Econet network card installed in
+          your computer.
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 6617ea47d365..f6dbfb99b14d 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -92,10 +92,9 @@ int eth_header(struct sk_buff *skb, struct net_device *dev, unsigned short type,
          *      Set the source hardware address. 
          */
          
-        if(saddr)
-                memcpy(eth->h_source,saddr,dev->addr_len);
-        else
-                memcpy(eth->h_source,dev->dev_addr,dev->addr_len);
+        if(!saddr)
+                saddr = dev->dev_addr;
+        memcpy(eth->h_source,saddr,dev->addr_len);
 
         /*
          *      Anyway, the loopback-device should never use this function... 
@@ -156,7 +155,7 @@ int eth_rebuild_header(struct sk_buff *skb)
  *      This is normal practice and works for any 'now in use' protocol.
  */
  
-unsigned short eth_type_trans(struct sk_buff *skb, struct net_device *dev)
+__be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev)
 {
         struct ethhdr *eth;
         unsigned char *rawp;
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 6d3e8b1bd1f2..0b3d9f1d8069 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -3,7 +3,6 @@
 #
 config IP_MULTICAST
         bool "IP: multicasting"
-        depends on INET
         help
           This is code for addressing several networked computers at once,
           enlarging your kernel by about 2 KB. You need multicasting if you
@@ -17,7 +16,6 @@ config IP_MULTICAST
 
 config IP_ADVANCED_ROUTER
         bool "IP: advanced router"
-        depends on INET
         ---help---
           If you intend to run your Linux box mostly as a router, i.e. as a
           computer that forwards and redistributes network packets, say Y; you
@@ -53,6 +51,40 @@ config IP_ADVANCED_ROUTER
 
           If unsure, say N here.
 
+choice 
+        prompt "Choose IP: FIB lookup algorithm (choose FIB_HASH if unsure)"
+        depends on IP_ADVANCED_ROUTER
+        default ASK_IP_FIB_HASH
+
+config ASK_IP_FIB_HASH
+        bool "FIB_HASH"
+        ---help---
+        Current FIB is very proven and good enough for most users.
+
+config IP_FIB_TRIE
+        bool "FIB_TRIE"
+        ---help---
+        Use new experimental LC-trie as FIB lookup algoritm. 
+        This improves lookup performance if you have a large
+        number of routes.
+
+        LC-trie is a longest matching prefix lookup algorithm which
+        performs better than FIB_HASH for large routing tables.
+        But, it consumes more memory and is more complex.
+        
+        LC-trie is described in:
+        
+        IP-address lookup using LC-tries. Stefan Nilsson and Gunnar Karlsson
+        IEEE Journal on Selected Areas in Communications, 17(6):1083-1092, June 1999
+        An experimental study of compression methods for dynamic tries
+        Stefan Nilsson and Matti Tikkanen. Algorithmica, 33(1):19-33, 2002.
+        http://www.nada.kth.se/~snilsson/public/papers/dyntrie2/
+       
+endchoice
+
+config IP_FIB_HASH
+        def_bool ASK_IP_FIB_HASH || !IP_ADVANCED_ROUTER
+
 config IP_MULTIPLE_TABLES
         bool "IP: policy routing"
         depends on IP_ADVANCED_ROUTER
@@ -92,7 +124,7 @@ config IP_ROUTE_MULTIPATH
 
 config IP_ROUTE_MULTIPATH_CACHED
         bool "IP: equal cost multipath with caching support (EXPERIMENTAL)"
-        depends on: IP_ROUTE_MULTIPATH
+        depends on IP_ROUTE_MULTIPATH
         help
           Normally, equal cost multipath routing is not supported by the
           routing cache. If you say Y here, alternative routes are cached
@@ -145,7 +177,6 @@ config IP_ROUTE_VERBOSE
 
 config IP_PNP
         bool "IP: kernel level autoconfiguration"
-        depends on INET
         help
           This enables automatic configuration of IP addresses of devices and
           of the routing table during kernel boot, based on either information
@@ -204,8 +235,6 @@ config IP_PNP_RARP
 #   bool '    IP: ARP support' CONFIG_IP_PNP_ARP                
 config NET_IPIP
         tristate "IP: tunneling"
-        depends on INET
-        select INET_TUNNEL
         ---help---
           Tunneling means encapsulating data of one protocol type within
           another protocol and sending it over a channel that understands the
@@ -222,8 +251,6 @@ config NET_IPIP
 
 config NET_IPGRE
         tristate "IP: GRE tunnels over IP"
-        depends on INET
-        select XFRM
         help
           Tunneling means encapsulating data of one protocol type within
           another protocol and sending it over a channel that understands the
@@ -281,7 +308,7 @@ config IP_PIMSM_V2
 
 config ARPD
         bool "IP: ARP daemon support (EXPERIMENTAL)"
-        depends on INET && EXPERIMENTAL
+        depends on EXPERIMENTAL
         ---help---
           Normally, the kernel maintains an internal cache which maps IP
           addresses to hardware addresses on the local network, so that
@@ -306,7 +333,6 @@ config ARPD
 
 config SYN_COOKIES
         bool "IP: TCP syncookie support (disabled per default)"
-        depends on INET
         ---help---
           Normal TCP/IP networking is open to an attack known as "SYN
           flooding". This denial-of-service attack prevents legitimate remote
@@ -343,7 +369,6 @@ config SYN_COOKIES
 
 config INET_AH
         tristate "IP: AH transformation"
-        depends on INET
         select XFRM
         select CRYPTO
         select CRYPTO_HMAC
@@ -356,7 +381,6 @@ config INET_AH
 
 config INET_ESP
         tristate "IP: ESP transformation"
-        depends on INET
         select XFRM
         select CRYPTO
         select CRYPTO_HMAC
@@ -370,7 +394,6 @@ config INET_ESP
 
 config INET_IPCOMP
         tristate "IP: IPComp transformation"
-        depends on INET
         select XFRM
         select INET_TUNNEL
         select CRYPTO
@@ -383,7 +406,6 @@ config INET_IPCOMP
 
 config INET_TUNNEL
         tristate "IP: tunnel transformation"
-        depends on INET
         select XFRM
         ---help---
           Support for generic IP tunnel transformation, which is required by
@@ -393,7 +415,6 @@ config INET_TUNNEL
 
 config IP_TCPDIAG
         tristate "IP: TCP socket monitoring interface"
-        depends on INET
         default y
         ---help---
           Support for TCP socket monitoring interface used by native Linux
@@ -407,5 +428,108 @@ config IP_TCPDIAG
 config IP_TCPDIAG_IPV6
         def_bool (IP_TCPDIAG=y && IPV6=y) || (IP_TCPDIAG=m && IPV6)
 
+config TCP_CONG_ADVANCED
+        bool "TCP: advanced congestion control"
+        ---help---
+          Support for selection of various TCP congestion control
+          modules.
+
+          Nearly all users can safely say no here, and a safe default
+          selection will be made (BIC-TCP with new Reno as a fallback).
+
+          If unsure, say N.
+
+# TCP Reno is builtin (required as fallback)
+menu "TCP congestion control"
+        depends on TCP_CONG_ADVANCED
+
+config TCP_CONG_BIC
+        tristate "Binary Increase Congestion (BIC) control"
+        default y
+        ---help---
+        BIC-TCP is a sender-side only change that ensures a linear RTT
+        fairness under large windows while offering both scalability and
+        bounded TCP-friendliness. The protocol combines two schemes
+        called additive increase and binary search increase. When the
+        congestion window is large, additive increase with a large
+        increment ensures linear RTT fairness as well as good
+        scalability. Under small congestion windows, binary search
+        increase provides TCP friendliness.
+        See http://www.csc.ncsu.edu/faculty/rhee/export/bitcp/
+
+config TCP_CONG_WESTWOOD
+        tristate "TCP Westwood+"
+        default m
+        ---help---
+        TCP Westwood+ is a sender-side only modification of the TCP Reno
+        protocol stack that optimizes the performance of TCP congestion
+        control. It is based on end-to-end bandwidth estimation to set
+        congestion window and slow start threshold after a congestion
+        episode. Using this estimation, TCP Westwood+ adaptively sets a
+        slow start threshold and a congestion window which takes into
+        account the bandwidth used  at the time congestion is experienced.
+        TCP Westwood+ significantly increases fairness wrt TCP Reno in
+        wired networks and throughput over wireless links.
+
+config TCP_CONG_HTCP
+        tristate "H-TCP"
+        default m
+        ---help---
+        H-TCP is a send-side only modifications of the TCP Reno
+        protocol stack that optimizes the performance of TCP
+        congestion control for high speed network links. It uses a
+        modeswitch to change the alpha and beta parameters of TCP Reno
+        based on network conditions and in a way so as to be fair with
+        other Reno and H-TCP flows.
+
+config TCP_CONG_HSTCP
+        tristate "High Speed TCP"
+        depends on EXPERIMENTAL
+        default n
+        ---help---
+        Sally Floyd's High Speed TCP (RFC 3649) congestion control.
+        A modification to TCP's congestion control mechanism for use
+        with large congestion windows. A table indicates how much to
+        increase the congestion window by when an ACK is received.
+        For more detail see http://www.icir.org/floyd/hstcp.html
+
+config TCP_CONG_HYBLA
+        tristate "TCP-Hybla congestion control algorithm"
+        depends on EXPERIMENTAL
+        default n
+        ---help---
+        TCP-Hybla is a sender-side only change that eliminates penalization of
+        long-RTT, large-bandwidth connections, like when satellite legs are
+        involved, expecially when sharing a common bottleneck with normal
+        terrestrial connections.
+
+config TCP_CONG_VEGAS
+        tristate "TCP Vegas"
+        depends on EXPERIMENTAL
+        default n
+        ---help---
+        TCP Vegas is a sender-side only change to TCP that anticipates
+        the onset of congestion by estimating the bandwidth. TCP Vegas
+        adjusts the sending rate by modifying the congestion
+        window. TCP Vegas should provide less packet loss, but it is
+        not as aggressive as TCP Reno.
+
+config TCP_CONG_SCALABLE
+        tristate "Scalable TCP"
+        depends on EXPERIMENTAL
+        default n
+        ---help---
+        Scalable TCP is a sender-side only change to TCP which uses a
+        MIMD congestion control algorithm which has some nice scaling
+        properties, though is known to have fairness issues.
+        See http://www-lce.eng.cam.ac.uk/~ctk21/scalable/
+
+endmenu
+
+config TCP_CONG_BIC
+        tristate
+        depends on !TCP_CONG_ADVANCED
+        default y
+
 source "net/ipv4/ipvs/Kconfig"
 
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index 8b379627ebb6..55dc6cca1e7b 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -2,13 +2,16 @@
 # Makefile for the Linux TCP/IP (INET) layer.
 #
 
-obj-y     := utils.o route.o inetpeer.o protocol.o \
+obj-y     := route.o inetpeer.o protocol.o \
              ip_input.o ip_fragment.o ip_forward.o ip_options.o \
              ip_output.o ip_sockglue.o \
-             tcp.o tcp_input.o tcp_output.o tcp_timer.o tcp_ipv4.o tcp_minisocks.o \
+             tcp.o tcp_input.o tcp_output.o tcp_timer.o tcp_ipv4.o \
+             tcp_minisocks.o tcp_cong.o \
              datagram.o raw.o udp.o arp.o icmp.o devinet.o af_inet.o igmp.o \
-             sysctl_net_ipv4.o fib_frontend.o fib_semantics.o fib_hash.o
+             sysctl_net_ipv4.o fib_frontend.o fib_semantics.o
 
+obj-$(CONFIG_IP_FIB_HASH) += fib_hash.o
+obj-$(CONFIG_IP_FIB_TRIE) += fib_trie.o
 obj-$(CONFIG_PROC_FS) += proc.o
 obj-$(CONFIG_IP_MULTIPLE_TABLES) += fib_rules.o
 obj-$(CONFIG_IP_MROUTE) += ipmr.o
@@ -28,6 +31,13 @@ obj-$(CONFIG_NETFILTER)	+= netfilter/
 obj-$(CONFIG_IP_VS) += ipvs/
 obj-$(CONFIG_IP_TCPDIAG) += tcp_diag.o 
 obj-$(CONFIG_IP_ROUTE_MULTIPATH_CACHED) += multipath.o
+obj-$(CONFIG_TCP_CONG_BIC) += tcp_bic.o
+obj-$(CONFIG_TCP_CONG_WESTWOOD) += tcp_westwood.o
+obj-$(CONFIG_TCP_CONG_HSTCP) += tcp_highspeed.o
+obj-$(CONFIG_TCP_CONG_HYBLA) += tcp_hybla.o
+obj-$(CONFIG_TCP_CONG_HTCP) += tcp_htcp.o
+obj-$(CONFIG_TCP_CONG_VEGAS) += tcp_vegas.o
+obj-$(CONFIG_TCP_CONG_SCALABLE) += tcp_scalable.o
 
 obj-$(CONFIG_XFRM) += xfrm4_policy.o xfrm4_state.o xfrm4_input.o \
                       xfrm4_output.o
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index b3cb49ce5fad..163ae4068b5f 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1009,6 +1009,15 @@ static int __init init_ipv4_mibs(void)
 static int ipv4_proc_init(void);
 extern void ipfrag_init(void);
 
+/*
+ *      IP protocol layer initialiser
+ */
+
+static struct packet_type ip_packet_type = {
+        .type = __constant_htons(ETH_P_IP),
+        .func = ip_rcv,
+};
+
 static int __init inet_init(void)
 {
         struct sk_buff *dummy_skb;
@@ -1102,6 +1111,8 @@ static int __init inet_init(void)
 
         ipfrag_init();
 
+        dev_add_pack(&ip_packet_type);
+
         rc = 0;
 out:
         return rc;
@@ -1119,6 +1130,10 @@ module_init(inet_init);
 #ifdef CONFIG_PROC_FS
 extern int  fib_proc_init(void);
 extern void fib_proc_exit(void);
+#ifdef CONFIG_IP_FIB_TRIE
+extern int  fib_stat_proc_init(void);
+extern void fib_stat_proc_exit(void);
+#endif
 extern int  ip_misc_proc_init(void);
 extern int  raw_proc_init(void);
 extern void raw_proc_exit(void);
@@ -1139,11 +1154,19 @@ static int __init ipv4_proc_init(void)
                 goto out_udp;
         if (fib_proc_init())
                 goto out_fib;
+#ifdef CONFIG_IP_FIB_TRIE
+         if (fib_stat_proc_init())
+                 goto out_fib_stat;
+#endif
         if (ip_misc_proc_init())
                 goto out_misc;
 out:
         return rc;
 out_misc:
+#ifdef CONFIG_IP_FIB_TRIE
+        fib_stat_proc_exit();
+out_fib_stat:
+#endif
         fib_proc_exit();
 out_fib:
         udp4_proc_exit();
@@ -1181,6 +1204,7 @@ EXPORT_SYMBOL(inet_stream_connect);
 EXPORT_SYMBOL(inet_stream_ops);
 EXPORT_SYMBOL(inet_unregister_protosw);
 EXPORT_SYMBOL(net_statistics);
+EXPORT_SYMBOL(sysctl_ip_nonlocal_bind);
 
 #ifdef INET_REFCNT_DEBUG
 EXPORT_SYMBOL(inet_sock_nr);
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 0e98f2235b6e..514c85b2631a 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -200,7 +200,7 @@ static void ah4_err(struct sk_buff *skb, u32 info)
         xfrm_state_put(x);
 }
 
-static int ah_init_state(struct xfrm_state *x, void *args)
+static int ah_init_state(struct xfrm_state *x)
 {
         struct ah_data *ahp = NULL;
         struct xfrm_algo_desc *aalg_desc;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 478a30179a52..d8a10e3dd77d 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1030,14 +1030,13 @@ static struct notifier_block ip_netdev_notifier = {
 };
 
 static int inet_fill_ifaddr(struct sk_buff *skb, struct in_ifaddr *ifa,
-                            u32 pid, u32 seq, int event)
+                            u32 pid, u32 seq, int event, unsigned int flags)
 {
         struct ifaddrmsg *ifm;
         struct nlmsghdr  *nlh;
         unsigned char    *b = skb->tail;
 
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*ifm));
-        if (pid) nlh->nlmsg_flags |= NLM_F_MULTI;
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*ifm), flags);
         ifm = NLMSG_DATA(nlh);
         ifm->ifa_family = AF_INET;
         ifm->ifa_prefixlen = ifa->ifa_prefixlen;
@@ -1090,7 +1089,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
                                 continue;
                         if (inet_fill_ifaddr(skb, ifa, NETLINK_CB(cb->skb).pid,
                                              cb->nlh->nlmsg_seq,
-                                             RTM_NEWADDR) <= 0) {
+                                             RTM_NEWADDR, NLM_F_MULTI) <= 0) {
                                 rcu_read_unlock();
                                 goto done;
                         }
@@ -1113,7 +1112,7 @@ static void rtmsg_ifa(int event, struct in_ifaddr* ifa)
 
         if (!skb)
                 netlink_set_err(rtnl, 0, RTMGRP_IPV4_IFADDR, ENOBUFS);
-        else if (inet_fill_ifaddr(skb, ifa, 0, 0, event) < 0) {
+        else if (inet_fill_ifaddr(skb, ifa, current->pid, 0, event, 0) < 0) {
                 kfree_skb(skb);
                 netlink_set_err(rtnl, 0, RTMGRP_IPV4_IFADDR, EINVAL);
         } else {
@@ -1472,7 +1471,7 @@ static void devinet_sysctl_register(struct in_device *in_dev,
          * by sysctl and we wouldn't want anyone to change it under our feet
          * (see SIOCSIFNAME).
          */     
-        dev_name = net_sysctl_strdup(dev_name);
+        dev_name = kstrdup(dev_name, GFP_KERNEL);
         if (!dev_name)
             goto free;
 
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index eae84cc39d3f..ba57446d5d1f 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -362,7 +362,7 @@ static void esp_destroy(struct xfrm_state *x)
         kfree(esp);
 }
 
-static int esp_init_state(struct xfrm_state *x, void *args)
+static int esp_init_state(struct xfrm_state *x)
 {
         struct esp_data *esp = NULL;
 
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 563e7d612706..cd8e45ab9580 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -516,6 +516,60 @@ static void fib_del_ifaddr(struct in_ifaddr *ifa)
 #undef BRD1_OK
 }
 
+static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb )
+{
+        
+        struct fib_result       res;
+        struct flowi            fl = { .nl_u = { .ip4_u = { .daddr = frn->fl_addr, 
+                                                            .fwmark = frn->fl_fwmark,
+                                                            .tos = frn->fl_tos,
+                                                            .scope = frn->fl_scope } } };
+        if (tb) {
+                local_bh_disable();
+
+                frn->tb_id = tb->tb_id;
+                frn->err = tb->tb_lookup(tb, &fl, &res);
+
+                if (!frn->err) {
+                        frn->prefixlen = res.prefixlen;
+                        frn->nh_sel = res.nh_sel;
+                        frn->type = res.type;
+                        frn->scope = res.scope;
+                }
+                local_bh_enable();
+        }
+}
+
+static void nl_fib_input(struct sock *sk, int len)
+{
+        struct sk_buff *skb = NULL;
+        struct nlmsghdr *nlh = NULL;
+        struct fib_result_nl *frn;
+        int err;
+        u32 pid;     
+        struct fib_table *tb;
+        
+        skb = skb_recv_datagram(sk, 0, 0, &err);
+        nlh = (struct nlmsghdr *)skb->data;
+        
+        frn = (struct fib_result_nl *) NLMSG_DATA(nlh);
+        tb = fib_get_table(frn->tb_id_in);
+
+        nl_fib_lookup(frn, tb);
+        
+        pid = nlh->nlmsg_pid;           /*pid of sending process */
+        NETLINK_CB(skb).groups = 0;     /* not in mcast group */
+        NETLINK_CB(skb).pid = 0;         /* from kernel */
+        NETLINK_CB(skb).dst_pid = pid;
+        NETLINK_CB(skb).dst_groups = 0;  /* unicast */
+        netlink_unicast(sk, skb, pid, MSG_DONTWAIT);
+}    
+
+static void nl_fib_lookup_init(void)
+{
+      netlink_kernel_create(NETLINK_FIB_LOOKUP, nl_fib_input);
+}
+
 static void fib_disable_ip(struct net_device *dev, int force)
 {
         if (fib_sync_down(0, dev, force))
@@ -604,6 +658,7 @@ void __init ip_fib_init(void)
 
         register_netdevice_notifier(&fib_netdev_notifier);
         register_inetaddr_notifier(&fib_inetaddr_notifier);
+        nl_fib_lookup_init();
 }
 
 EXPORT_SYMBOL(inet_addr_type);
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index 6506dcc01b46..b10d6bb5ef3d 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -703,7 +703,8 @@ fn_hash_dump_bucket(struct sk_buff *skb, struct netlink_callback *cb,
                                           &f->fn_key,
                                           fz->fz_order,
                                           fa->fa_tos,
-                                          fa->fa_info) < 0) {
+                                          fa->fa_info,
+                                          NLM_F_MULTI) < 0) {
                                 cb->args[3] = i;
                                 return -1;
                         }
diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
index ac4485f75e97..b729d97cfa93 100644
--- a/net/ipv4/fib_lookup.h
+++ b/net/ipv4/fib_lookup.h
@@ -30,7 +30,8 @@ extern int fib_nh_match(struct rtmsg *r, struct nlmsghdr *,
                         struct kern_rta *rta, struct fib_info *fi);
 extern int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
                          u8 tb_id, u8 type, u8 scope, void *dst,
-                         int dst_len, u8 tos, struct fib_info *fi);
+                         int dst_len, u8 tos, struct fib_info *fi,
+                         unsigned int);
 extern void rtmsg_fib(int event, u32 key, struct fib_alias *fa,
                       int z, int tb_id,
                       struct nlmsghdr *n, struct netlink_skb_parms *req);
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 39d0aadb9a2a..0b298bbc1518 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -367,13 +367,14 @@ static struct notifier_block fib_rules_notifier = {
 
 static __inline__ int inet_fill_rule(struct sk_buff *skb,
                                      struct fib_rule *r,
-                                     struct netlink_callback *cb)
+                                     struct netlink_callback *cb,
+                                     unsigned int flags)
 {
         struct rtmsg *rtm;
         struct nlmsghdr  *nlh;
         unsigned char    *b = skb->tail;
 
-        nlh = NLMSG_PUT(skb, NETLINK_CREDS(cb->skb)->pid, cb->nlh->nlmsg_seq, RTM_NEWRULE, sizeof(*rtm));
+        nlh = NLMSG_NEW_ANSWER(skb, cb, RTM_NEWRULE, sizeof(*rtm), flags);
         rtm = NLMSG_DATA(nlh);
         rtm->rtm_family = AF_INET;
         rtm->rtm_dst_len = r->r_dst_len;
@@ -422,7 +423,7 @@ int inet_dump_rules(struct sk_buff *skb, struct netlink_callback *cb)
         for (r=fib_rules, idx=0; r; r = r->r_next, idx++) {
                 if (idx < s_idx)
                         continue;
-                if (inet_fill_rule(skb, r, cb) < 0)
+                if (inet_fill_rule(skb, r, cb, NLM_F_MULTI) < 0)
                         break;
         }
         read_unlock(&fib_rules_lock);
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 029362d66135..e278cb9d0075 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -276,7 +276,7 @@ void rtmsg_fib(int event, u32 key, struct fib_alias *fa,
                struct nlmsghdr *n, struct netlink_skb_parms *req)
 {
         struct sk_buff *skb;
-        u32 pid = req ? req->pid : 0;
+        u32 pid = req ? req->pid : n->nlmsg_pid;
         int size = NLMSG_SPACE(sizeof(struct rtmsg)+256);
 
         skb = alloc_skb(size, GFP_KERNEL);
@@ -286,7 +286,7 @@ void rtmsg_fib(int event, u32 key, struct fib_alias *fa,
         if (fib_dump_info(skb, pid, n->nlmsg_seq, event, tb_id,
                           fa->fa_type, fa->fa_scope, &key, z,
                           fa->fa_tos,
-                          fa->fa_info) < 0) {
+                          fa->fa_info, 0) < 0) {
                 kfree_skb(skb);
                 return;
         }
@@ -593,10 +593,13 @@ static void fib_hash_move(struct hlist_head *new_info_hash,
                           struct hlist_head *new_laddrhash,
                           unsigned int new_size)
 {
+        struct hlist_head *old_info_hash, *old_laddrhash;
         unsigned int old_size = fib_hash_size;
-        unsigned int i;
+        unsigned int i, bytes;
 
         write_lock(&fib_info_lock);
+        old_info_hash = fib_info_hash;
+        old_laddrhash = fib_info_laddrhash;
         fib_hash_size = new_size;
 
         for (i = 0; i < old_size; i++) {
@@ -636,6 +639,10 @@ static void fib_hash_move(struct hlist_head *new_info_hash,
         fib_info_laddrhash = new_laddrhash;
 
         write_unlock(&fib_info_lock);
+
+        bytes = old_size * sizeof(struct hlist_head *);
+        fib_hash_free(old_info_hash, bytes);
+        fib_hash_free(old_laddrhash, bytes);
 }
 
 struct fib_info *
@@ -932,13 +939,13 @@ u32 __fib_res_prefsrc(struct fib_result *res)
 int
 fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
               u8 tb_id, u8 type, u8 scope, void *dst, int dst_len, u8 tos,
-              struct fib_info *fi)
+              struct fib_info *fi, unsigned int flags)
 {
         struct rtmsg *rtm;
         struct nlmsghdr  *nlh;
         unsigned char    *b = skb->tail;
 
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*rtm));
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*rtm), flags);
         rtm = NLMSG_DATA(nlh);
         rtm->rtm_family = AF_INET;
         rtm->rtm_dst_len = dst_len;
@@ -1035,7 +1042,7 @@ fib_convert_rtentry(int cmd, struct nlmsghdr *nl, struct rtmsg *rtm,
         }
 
         nl->nlmsg_flags = NLM_F_REQUEST;
-        nl->nlmsg_pid = 0;
+        nl->nlmsg_pid = current->pid;
         nl->nlmsg_seq = 0;
         nl->nlmsg_len = NLMSG_LENGTH(sizeof(*rtm));
         if (cmd == SIOCDELRT) {
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
new file mode 100644
index 000000000000..a701405fab0b
--- /dev/null
+++ b/net/ipv4/fib_trie.c
@@ -0,0 +1,2612 @@
+/*
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation; either version
+ *   2 of the License, or (at your option) any later version.
+ *
+ *   Robert Olsson <robert.olsson@its.uu.se> Uppsala Universitet
+ *     & Swedish University of Agricultural Sciences.
+ *
+ *   Jens Laas <jens.laas@data.slu.se> Swedish University of 
+ *     Agricultural Sciences.
+ * 
+ *   Hans Liss <hans.liss@its.uu.se>  Uppsala Universitet
+ *
+ * This work is based on the LPC-trie which is originally descibed in:
+ * 
+ * An experimental study of compression methods for dynamic tries
+ * Stefan Nilsson and Matti Tikkanen. Algorithmica, 33(1):19-33, 2002.
+ * http://www.nada.kth.se/~snilsson/public/papers/dyntrie2/
+ *
+ *
+ * IP-address lookup using LC-tries. Stefan Nilsson and Gunnar Karlsson
+ * IEEE Journal on Selected Areas in Communications, 17(6):1083-1092, June 1999
+ *
+ * Version:     $Id: fib_trie.c,v 1.3 2005/06/08 14:20:01 robert Exp $
+ *
+ *
+ * Code from fib_hash has been reused which includes the following header:
+ *
+ *
+ * INET         An implementation of the TCP/IP protocol suite for the LINUX
+ *              operating system.  INET is implemented using the  BSD Socket
+ *              interface as the means of communication with the user level.
+ *
+ *              IPv4 FIB: lookup engine and maintenance routines.
+ *
+ *
+ * Authors:     Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
+ *
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              as published by the Free Software Foundation; either version
+ *              2 of the License, or (at your option) any later version.
+ */
+
+#define VERSION "0.325"
+
+#include <linux/config.h>
+#include <asm/uaccess.h>
+#include <asm/system.h>
+#include <asm/bitops.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/mm.h>
+#include <linux/string.h>
+#include <linux/socket.h>
+#include <linux/sockios.h>
+#include <linux/errno.h>
+#include <linux/in.h>
+#include <linux/inet.h>
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <linux/proc_fs.h>
+#include <linux/skbuff.h>
+#include <linux/netlink.h>
+#include <linux/init.h>
+#include <linux/list.h>
+#include <net/ip.h>
+#include <net/protocol.h>
+#include <net/route.h>
+#include <net/tcp.h>
+#include <net/sock.h>
+#include <net/ip_fib.h>
+#include "fib_lookup.h"
+
+#undef CONFIG_IP_FIB_TRIE_STATS
+#define MAX_CHILDS 16384
+
+#define EXTRACT(p, n, str) ((str)<<(p)>>(32-(n)))
+#define KEYLENGTH (8*sizeof(t_key))
+#define MASK_PFX(k, l) (((l)==0)?0:(k >> (KEYLENGTH-l)) << (KEYLENGTH-l))
+#define TKEY_GET_MASK(offset, bits) (((bits)==0)?0:((t_key)(-1) << (KEYLENGTH - bits) >> offset))
+
+static DEFINE_RWLOCK(fib_lock);
+
+typedef unsigned int t_key;
+
+#define T_TNODE 0
+#define T_LEAF  1
+#define NODE_TYPE_MASK  0x1UL
+#define NODE_PARENT(_node) \
+        ((struct tnode *)((_node)->_parent & ~NODE_TYPE_MASK))
+#define NODE_SET_PARENT(_node, _ptr) \
+        ((_node)->_parent = (((unsigned long)(_ptr)) | \
+                     ((_node)->_parent & NODE_TYPE_MASK)))
+#define NODE_INIT_PARENT(_node, _type) \
+        ((_node)->_parent = (_type))
+#define NODE_TYPE(_node) \
+        ((_node)->_parent & NODE_TYPE_MASK)
+
+#define IS_TNODE(n) (!(n->_parent & T_LEAF))
+#define IS_LEAF(n) (n->_parent & T_LEAF)
+
+struct node {
+        t_key key;
+        unsigned long _parent;
+};
+
+struct leaf {
+        t_key key;
+        unsigned long _parent;
+        struct hlist_head list;
+};
+
+struct leaf_info {
+        struct hlist_node hlist;
+        int plen;
+        struct list_head falh;
+};
+
+struct tnode {
+        t_key key;
+        unsigned long _parent;
+        unsigned short pos:5;        /* 2log(KEYLENGTH) bits needed */
+        unsigned short bits:5;       /* 2log(KEYLENGTH) bits needed */
+        unsigned short full_children;  /* KEYLENGTH bits needed */
+        unsigned short empty_children; /* KEYLENGTH bits needed */
+        struct node *child[0];
+};
+
+#ifdef CONFIG_IP_FIB_TRIE_STATS
+struct trie_use_stats {
+        unsigned int gets;
+        unsigned int backtrack;
+        unsigned int semantic_match_passed;
+        unsigned int semantic_match_miss;
+        unsigned int null_node_hit;
+        unsigned int resize_node_skipped;
+};
+#endif
+
+struct trie_stat {
+        unsigned int totdepth;
+        unsigned int maxdepth;
+        unsigned int tnodes;
+        unsigned int leaves;
+        unsigned int nullpointers;
+        unsigned int nodesizes[MAX_CHILDS];
+};
+
+struct trie {
+        struct node *trie;
+#ifdef CONFIG_IP_FIB_TRIE_STATS
+        struct trie_use_stats stats;
+#endif
+        int size;
+        unsigned int revision;
+};
+
+static int trie_debug = 0;
+
+static int tnode_full(struct tnode *tn, struct node *n);
+static void put_child(struct trie *t, struct tnode *tn, int i, struct node *n);
+static void tnode_put_child_reorg(struct tnode *tn, int i, struct node *n, int wasfull);
+static int tnode_child_length(struct tnode *tn);
+static struct node *resize(struct trie *t, struct tnode *tn);
+static struct tnode *inflate(struct trie *t, struct tnode *tn, int *err);
+static struct tnode *halve(struct trie *t, struct tnode *tn, int *err);
+static void tnode_free(struct tnode *tn);
+static void trie_dump_seq(struct seq_file *seq, struct trie *t);
+extern struct fib_alias *fib_find_alias(struct list_head *fah, u8 tos, u32 prio);
+extern int fib_detect_death(struct fib_info *fi, int order,
+                            struct fib_info **last_resort, int *last_idx, int *dflt);
+
+extern void rtmsg_fib(int event, u32 key, struct fib_alias *fa, int z, int tb_id,
+               struct nlmsghdr *n, struct netlink_skb_parms *req);
+
+static kmem_cache_t *fn_alias_kmem;
+static struct trie *trie_local = NULL, *trie_main = NULL;
+
+static void trie_bug(char *err)
+{
+        printk("Trie Bug: %s\n", err);
+        BUG();
+}
+
+static inline struct node *tnode_get_child(struct tnode *tn, int i)
+{
+        if (i >= 1<<tn->bits)
+                trie_bug("tnode_get_child");
+
+        return tn->child[i];
+}
+
+static inline int tnode_child_length(struct tnode *tn)
+{
+        return 1<<tn->bits;
+}
+
+/*
+  _________________________________________________________________
+  | i | i | i | i | i | i | i | N | N | N | S | S | S | S | S | C |
+  ----------------------------------------------------------------
+    0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15
+
+  _________________________________________________________________
+  | C | C | C | u | u | u | u | u | u | u | u | u | u | u | u | u |
+  -----------------------------------------------------------------
+   16  17  18  19  20  21  22  23  24  25  26  27  28  29  30  31
+
+  tp->pos = 7
+  tp->bits = 3
+  n->pos = 15
+  n->bits=4
+  KEYLENGTH=32
+*/
+
+static inline t_key tkey_extract_bits(t_key a, int offset, int bits)
+{
+        if (offset < KEYLENGTH)
+                return ((t_key)(a << offset)) >> (KEYLENGTH - bits);
+        else
+                return 0;
+}
+
+static inline int tkey_equals(t_key a, t_key b)
+{
+        return a == b;
+}
+
+static inline int tkey_sub_equals(t_key a, int offset, int bits, t_key b)
+{
+        if (bits == 0 || offset >= KEYLENGTH)
+                return 1;
+        bits = bits > KEYLENGTH ? KEYLENGTH : bits;
+        return ((a ^ b) << offset) >> (KEYLENGTH - bits) == 0;
+}
+
+static inline int tkey_mismatch(t_key a, int offset, t_key b)
+{
+        t_key diff = a ^ b;
+        int i = offset;
+
+        if (!diff)
+                return 0;
+        while ((diff << i) >> (KEYLENGTH-1) == 0)
+                i++;
+        return i;
+}
+
+/* Candiate for fib_semantics */
+
+static void fn_free_alias(struct fib_alias *fa)
+{
+        fib_release_info(fa->fa_info);
+        kmem_cache_free(fn_alias_kmem, fa);
+}
+
+/*
+  To understand this stuff, an understanding of keys and all their bits is 
+  necessary. Every node in the trie has a key associated with it, but not 
+  all of the bits in that key are significant.
+
+  Consider a node 'n' and its parent 'tp'.
+
+  If n is a leaf, every bit in its key is significant. Its presence is 
+  necessitaded by path compression, since during a tree traversal (when 
+  searching for a leaf - unless we are doing an insertion) we will completely 
+  ignore all skipped bits we encounter. Thus we need to verify, at the end of 
+  a potentially successful search, that we have indeed been walking the 
+  correct key path.
+
+  Note that we can never "miss" the correct key in the tree if present by 
+  following the wrong path. Path compression ensures that segments of the key 
+  that are the same for all keys with a given prefix are skipped, but the 
+  skipped part *is* identical for each node in the subtrie below the skipped 
+  bit! trie_insert() in this implementation takes care of that - note the 
+  call to tkey_sub_equals() in trie_insert().
+
+  if n is an internal node - a 'tnode' here, the various parts of its key 
+  have many different meanings.
+
+  Example:  
+  _________________________________________________________________
+  | i | i | i | i | i | i | i | N | N | N | S | S | S | S | S | C |
+  -----------------------------------------------------------------
+    0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15 
+
+  _________________________________________________________________
+  | C | C | C | u | u | u | u | u | u | u | u | u | u | u | u | u |
+  -----------------------------------------------------------------
+   16  17  18  19  20  21  22  23  24  25  26  27  28  29  30  31
+
+  tp->pos = 7
+  tp->bits = 3
+  n->pos = 15
+  n->bits=4
+
+  First, let's just ignore the bits that come before the parent tp, that is 
+  the bits from 0 to (tp->pos-1). They are *known* but at this point we do 
+  not use them for anything.
+
+  The bits from (tp->pos) to (tp->pos + tp->bits - 1) - "N", above - are the
+  index into the parent's child array. That is, they will be used to find 
+  'n' among tp's children.
+
+  The bits from (tp->pos + tp->bits) to (n->pos - 1) - "S" - are skipped bits
+  for the node n.
+
+  All the bits we have seen so far are significant to the node n. The rest 
+  of the bits are really not needed or indeed known in n->key.
+
+  The bits from (n->pos) to (n->pos + n->bits - 1) - "C" - are the index into 
+  n's child array, and will of course be different for each child.
+  
+
+  The rest of the bits, from (n->pos + n->bits) onward, are completely unknown
+  at this point.
+
+*/
+
+static void check_tnode(struct tnode *tn)
+{
+        if (tn && tn->pos+tn->bits > 32) {
+                printk("TNODE ERROR tn=%p, pos=%d, bits=%d\n", tn, tn->pos, tn->bits);
+        }
+}
+
+static int halve_threshold = 25;
+static int inflate_threshold = 50;
+
+static struct leaf *leaf_new(void)
+{
+        struct leaf *l = kmalloc(sizeof(struct leaf),  GFP_KERNEL);
+        if (l) {
+                NODE_INIT_PARENT(l, T_LEAF);
+                INIT_HLIST_HEAD(&l->list);
+        }
+        return l;
+}
+
+static struct leaf_info *leaf_info_new(int plen)
+{
+        struct leaf_info *li = kmalloc(sizeof(struct leaf_info),  GFP_KERNEL);
+        if (li) {
+                li->plen = plen;
+                INIT_LIST_HEAD(&li->falh);
+        }
+        return li;
+}
+
+static inline void free_leaf(struct leaf *l)
+{
+        kfree(l);
+}
+
+static inline void free_leaf_info(struct leaf_info *li)
+{
+        kfree(li);
+}
+
+static struct tnode *tnode_alloc(unsigned int size)
+{
+        if (size <= PAGE_SIZE) {
+                return kmalloc(size, GFP_KERNEL);
+        } else {
+                return (struct tnode *)
+                        __get_free_pages(GFP_KERNEL, get_order(size));
+        }
+}
+
+static void __tnode_free(struct tnode *tn)
+{
+        unsigned int size = sizeof(struct tnode) +
+                            (1<<tn->bits) * sizeof(struct node *);
+
+        if (size <= PAGE_SIZE)
+                kfree(tn);
+        else
+                free_pages((unsigned long)tn, get_order(size));
+}
+
+static struct tnode* tnode_new(t_key key, int pos, int bits)
+{
+        int nchildren = 1<<bits;
+        int sz = sizeof(struct tnode) + nchildren * sizeof(struct node *);
+        struct tnode *tn = tnode_alloc(sz);
+
+        if (tn)  {
+                memset(tn, 0, sz);
+                NODE_INIT_PARENT(tn, T_TNODE);
+                tn->pos = pos;
+                tn->bits = bits;
+                tn->key = key;
+                tn->full_children = 0;
+                tn->empty_children = 1<<bits;
+        }
+
+        if (trie_debug > 0)
+                printk("AT %p s=%u %u\n", tn, (unsigned int) sizeof(struct tnode),
+                       (unsigned int) (sizeof(struct node) * 1<<bits));
+        return tn;
+}
+
+static void tnode_free(struct tnode *tn)
+{
+        if (!tn) {
+                trie_bug("tnode_free\n");
+        }
+        if (IS_LEAF(tn)) {
+                free_leaf((struct leaf *)tn);
+                if (trie_debug > 0 )
+                        printk("FL %p \n", tn);
+        }
+        else if (IS_TNODE(tn)) {
+                __tnode_free(tn);
+                if (trie_debug > 0 )
+                        printk("FT %p \n", tn);
+        }
+        else {
+                trie_bug("tnode_free\n");
+        }
+}
+
+/*
+ * Check whether a tnode 'n' is "full", i.e. it is an internal node
+ * and no bits are skipped. See discussion in dyntree paper p. 6
+ */
+
+static inline int tnode_full(struct tnode *tn, struct node *n)
+{
+        if (n == NULL || IS_LEAF(n))
+                return 0;
+
+        return ((struct tnode *) n)->pos == tn->pos + tn->bits;
+}
+
+static inline void put_child(struct trie *t, struct tnode *tn, int i, struct node *n)
+{
+        tnode_put_child_reorg(tn, i, n, -1);
+}
+
+ /*
+  * Add a child at position i overwriting the old value.
+  * Update the value of full_children and empty_children.
+  */
+
+static void tnode_put_child_reorg(struct tnode *tn, int i, struct node *n, int wasfull)
+{
+        struct node *chi;
+        int isfull;
+
+        if (i >= 1<<tn->bits) {
+                printk("bits=%d, i=%d\n", tn->bits, i);
+                trie_bug("tnode_put_child_reorg bits");
+        }
+        write_lock_bh(&fib_lock);
+        chi = tn->child[i];
+
+        /* update emptyChildren */
+        if (n == NULL && chi != NULL)
+                tn->empty_children++;
+        else if (n != NULL && chi == NULL)
+                tn->empty_children--;
+
+        /* update fullChildren */
+        if (wasfull == -1)
+                wasfull = tnode_full(tn, chi);
+
+        isfull = tnode_full(tn, n);
+        if (wasfull && !isfull)
+                tn->full_children--;
+
+        else if (!wasfull && isfull)
+                tn->full_children++;
+        if (n)
+                NODE_SET_PARENT(n, tn);
+
+        tn->child[i] = n;
+        write_unlock_bh(&fib_lock);
+}
+
+static struct node *resize(struct trie *t, struct tnode *tn)
+{
+        int i;
+        int err = 0;
+
+        if (!tn)
+                return NULL;
+
+        if (trie_debug)
+                printk("In tnode_resize %p inflate_threshold=%d threshold=%d\n",
+                      tn, inflate_threshold, halve_threshold);
+
+        /* No children */
+        if (tn->empty_children == tnode_child_length(tn)) {
+                tnode_free(tn);
+                return NULL;
+        }
+        /* One child */
+        if (tn->empty_children == tnode_child_length(tn) - 1)
+                for (i = 0; i < tnode_child_length(tn); i++) {
+
+                        write_lock_bh(&fib_lock);
+                        if (tn->child[i] != NULL) {
+
+                                /* compress one level */
+                                struct node *n = tn->child[i];
+                                if (n)
+                                        NODE_INIT_PARENT(n, NODE_TYPE(n));
+
+                                write_unlock_bh(&fib_lock);
+                                tnode_free(tn);
+                                return n;
+                        }
+                        write_unlock_bh(&fib_lock);
+                }
+        /*
+         * Double as long as the resulting node has a number of
+         * nonempty nodes that are above the threshold.
+         */
+
+        /*
+         * From "Implementing a dynamic compressed trie" by Stefan Nilsson of
+         * the Helsinki University of Technology and Matti Tikkanen of Nokia
+         * Telecommunications, page 6:
+         * "A node is doubled if the ratio of non-empty children to all
+         * children in the *doubled* node is at least 'high'."
+         *
+         * 'high' in this instance is the variable 'inflate_threshold'. It
+         * is expressed as a percentage, so we multiply it with
+         * tnode_child_length() and instead of multiplying by 2 (since the
+         * child array will be doubled by inflate()) and multiplying
+         * the left-hand side by 100 (to handle the percentage thing) we
+         * multiply the left-hand side by 50.
+         *
+         * The left-hand side may look a bit weird: tnode_child_length(tn)
+         * - tn->empty_children is of course the number of non-null children
+         * in the current node. tn->full_children is the number of "full"
+         * children, that is non-null tnodes with a skip value of 0.
+         * All of those will be doubled in the resulting inflated tnode, so
+         * we just count them one extra time here.
+         *
+         * A clearer way to write this would be:
+         *
+         * to_be_doubled = tn->full_children;
+         * not_to_be_doubled = tnode_child_length(tn) - tn->empty_children -
+         *     tn->full_children;
+         *
+         * new_child_length = tnode_child_length(tn) * 2;
+         *
+         * new_fill_factor = 100 * (not_to_be_doubled + 2*to_be_doubled) /
+         *      new_child_length;
+         * if (new_fill_factor >= inflate_threshold)
+         *
+         * ...and so on, tho it would mess up the while () loop.
+         *
+         * anyway,
+         * 100 * (not_to_be_doubled + 2*to_be_doubled) / new_child_length >=
+         *      inflate_threshold
+         *
+         * avoid a division:
+         * 100 * (not_to_be_doubled + 2*to_be_doubled) >=
+         *      inflate_threshold * new_child_length
+         *
+         * expand not_to_be_doubled and to_be_doubled, and shorten:
+         * 100 * (tnode_child_length(tn) - tn->empty_children +
+         *    tn->full_children ) >= inflate_threshold * new_child_length
+         *
+         * expand new_child_length:
+         * 100 * (tnode_child_length(tn) - tn->empty_children +
+         *    tn->full_children ) >=
+         *      inflate_threshold * tnode_child_length(tn) * 2
+         *
+         * shorten again:
+         * 50 * (tn->full_children + tnode_child_length(tn) -
+         *    tn->empty_children ) >= inflate_threshold *
+         *    tnode_child_length(tn)
+         *
+         */
+
+        check_tnode(tn);
+
+        err = 0;
+        while ((tn->full_children > 0 &&
+               50 * (tn->full_children + tnode_child_length(tn) - tn->empty_children) >=
+                                inflate_threshold * tnode_child_length(tn))) {
+
+                tn = inflate(t, tn, &err);
+
+                if (err) {
+#ifdef CONFIG_IP_FIB_TRIE_STATS
+                        t->stats.resize_node_skipped++;
+#endif
+                        break;
+                }
+        }
+
+        check_tnode(tn);
+
+        /*
+         * Halve as long as the number of empty children in this
+         * node is above threshold.
+         */
+
+        err = 0;
+        while (tn->bits > 1 &&
+               100 * (tnode_child_length(tn) - tn->empty_children) <
+               halve_threshold * tnode_child_length(tn)) {
+
+                tn = halve(t, tn, &err);
+
+                if (err) {
+#ifdef CONFIG_IP_FIB_TRIE_STATS
+                        t->stats.resize_node_skipped++;
+#endif
+                        break;
+                }
+        }
+
+
+        /* Only one child remains */
+
+        if (tn->empty_children == tnode_child_length(tn) - 1)
+                for (i = 0; i < tnode_child_length(tn); i++) {
+                
+                        write_lock_bh(&fib_lock);
+                        if (tn->child[i] != NULL) {
+                                /* compress one level */
+                                struct node *n = tn->child[i];
+
+                                if (n)
+                                        NODE_INIT_PARENT(n, NODE_TYPE(n));
+
+                                write_unlock_bh(&fib_lock);
+                                tnode_free(tn);
+                                return n;
+                        }
+                        write_unlock_bh(&fib_lock);
+                }
+
+        return (struct node *) tn;
+}
+
+static struct tnode *inflate(struct trie *t, struct tnode *tn, int *err)
+{
+        struct tnode *inode;
+        struct tnode *oldtnode = tn;
+        int olen = tnode_child_length(tn);
+        int i;
+
+        if (trie_debug)
+                printk("In inflate\n");
+
+        tn = tnode_new(oldtnode->key, oldtnode->pos, oldtnode->bits + 1);
+
+        if (!tn) {
+                *err = -ENOMEM;
+                return oldtnode;
+        }
+
+        /*
+         * Preallocate and store tnodes before the actual work so we
+         * don't get into an inconsistent state if memory allocation
+         * fails. In case of failure we return the oldnode and  inflate
+         * of tnode is ignored.
+         */
+                
+        for(i = 0; i < olen; i++) {
+                struct tnode *inode = (struct tnode *) tnode_get_child(oldtnode, i);
+
+                if (inode &&
+                    IS_TNODE(inode) &&
+                    inode->pos == oldtnode->pos + oldtnode->bits &&
+                    inode->bits > 1) {
+                        struct tnode *left, *right;
+
+                        t_key m = TKEY_GET_MASK(inode->pos, 1);
+
+                        left = tnode_new(inode->key&(~m), inode->pos + 1,
+                                         inode->bits - 1);
+
+                        if (!left) {
+                                *err = -ENOMEM;
+                                break;
+                        }
+                
+                        right = tnode_new(inode->key|m, inode->pos + 1,
+                                          inode->bits - 1);
+
+                        if (!right) {
+                                *err = -ENOMEM;
+                                break;
+                        }
+
+                        put_child(t, tn, 2*i, (struct node *) left);
+                        put_child(t, tn, 2*i+1, (struct node *) right);
+                }
+        }
+
+        if (*err) {
+                int size = tnode_child_length(tn);
+                int j;
+
+                for(j = 0; j < size; j++)
+                        if (tn->child[j])
+                                tnode_free((struct tnode *)tn->child[j]);
+
+                tnode_free(tn);
+        
+                *err = -ENOMEM;
+                return oldtnode;
+        }
+
+        for(i = 0; i < olen; i++) {
+                struct node *node = tnode_get_child(oldtnode, i);
+
+                /* An empty child */
+                if (node == NULL)
+                        continue;
+
+                /* A leaf or an internal node with skipped bits */
+
+                if (IS_LEAF(node) || ((struct tnode *) node)->pos >
+                   tn->pos + tn->bits - 1) {
+                        if (tkey_extract_bits(node->key, oldtnode->pos + oldtnode->bits,
+                                             1) == 0)
+                                put_child(t, tn, 2*i, node);
+                        else
+                                put_child(t, tn, 2*i+1, node);
+                        continue;
+                }
+
+                /* An internal node with two children */
+                inode = (struct tnode *) node;
+
+                if (inode->bits == 1) {
+                        put_child(t, tn, 2*i, inode->child[0]);
+                        put_child(t, tn, 2*i+1, inode->child[1]);
+
+                        tnode_free(inode);
+                }
+
+                        /* An internal node with more than two children */
+                else {
+                        struct tnode *left, *right;
+                        int size, j;
+
+                        /* We will replace this node 'inode' with two new
+                         * ones, 'left' and 'right', each with half of the
+                         * original children. The two new nodes will have
+                         * a position one bit further down the key and this
+                         * means that the "significant" part of their keys
+                         * (see the discussion near the top of this file)
+                         * will differ by one bit, which will be "0" in
+                         * left's key and "1" in right's key. Since we are
+                         * moving the key position by one step, the bit that
+                         * we are moving away from - the bit at position
+                         * (inode->pos) - is the one that will differ between
+                         * left and right. So... we synthesize that bit in the
+                         * two  new keys.
+                         * The mask 'm' below will be a single "one" bit at
+                         * the position (inode->pos)
+                         */
+
+                        /* Use the old key, but set the new significant
+                         *   bit to zero.
+                         */
+
+                        left = (struct tnode *) tnode_get_child(tn, 2*i);
+                        put_child(t, tn, 2*i, NULL);
+
+                        if (!left)
+                                BUG();
+
+                        right = (struct tnode *) tnode_get_child(tn, 2*i+1);
+                        put_child(t, tn, 2*i+1, NULL);
+
+                        if (!right)
+                                BUG();
+
+                        size = tnode_child_length(left);
+                        for(j = 0; j < size; j++) {
+                                put_child(t, left, j, inode->child[j]);
+                                put_child(t, right, j, inode->child[j + size]);
+                        }
+                        put_child(t, tn, 2*i, resize(t, left));
+                        put_child(t, tn, 2*i+1, resize(t, right));
+
+                        tnode_free(inode);
+                }
+        }
+        tnode_free(oldtnode);
+        return tn;
+}
+
+static struct tnode *halve(struct trie *t, struct tnode *tn, int *err)
+{
+        struct tnode *oldtnode = tn;
+        struct node *left, *right;
+        int i;
+        int olen = tnode_child_length(tn);
+
+        if (trie_debug) printk("In halve\n");
+
+        tn = tnode_new(oldtnode->key, oldtnode->pos, oldtnode->bits - 1);
+
+        if (!tn) {
+                *err = -ENOMEM;
+                return oldtnode;
+        }
+
+        /*
+         * Preallocate and store tnodes before the actual work so we
+         * don't get into an inconsistent state if memory allocation
+         * fails. In case of failure we return the oldnode and halve
+         * of tnode is ignored.
+         */
+
+        for(i = 0; i < olen; i += 2) {
+                left = tnode_get_child(oldtnode, i);
+                right = tnode_get_child(oldtnode, i+1);
+
+                /* Two nonempty children */
+                if (left && right)  {
+                        struct tnode *newBinNode =
+                                tnode_new(left->key, tn->pos + tn->bits, 1);
+
+                        if (!newBinNode) {
+                                *err = -ENOMEM;
+                                break;
+                        }
+                        put_child(t, tn, i/2, (struct node *)newBinNode);
+                }
+        }
+
+        if (*err) {
+                int size = tnode_child_length(tn);
+                int j;
+
+                for(j = 0; j < size; j++)
+                        if (tn->child[j])
+                                tnode_free((struct tnode *)tn->child[j]);
+
+                tnode_free(tn);
+        
+                *err = -ENOMEM;
+                return oldtnode;
+        }
+
+        for(i = 0; i < olen; i += 2) {
+                left = tnode_get_child(oldtnode, i);
+                right = tnode_get_child(oldtnode, i+1);
+
+                /* At least one of the children is empty */
+                if (left == NULL) {
+                        if (right == NULL)    /* Both are empty */
+                                continue;
+                        put_child(t, tn, i/2, right);
+                } else if (right == NULL)
+                        put_child(t, tn, i/2, left);
+
+                /* Two nonempty children */
+                else {
+                        struct tnode *newBinNode =
+                                (struct tnode *) tnode_get_child(tn, i/2);
+                        put_child(t, tn, i/2, NULL);
+
+                        if (!newBinNode)
+                                BUG();
+
+                        put_child(t, newBinNode, 0, left);
+                        put_child(t, newBinNode, 1, right);
+                        put_child(t, tn, i/2, resize(t, newBinNode));
+                }
+        }
+        tnode_free(oldtnode);
+        return tn;
+}
+
+static void *trie_init(struct trie *t)
+{
+        if (t) {
+                t->size = 0;
+                t->trie = NULL;
+                t->revision = 0;
+#ifdef CONFIG_IP_FIB_TRIE_STATS
+                memset(&t->stats, 0, sizeof(struct trie_use_stats));
+#endif
+        }
+        return t;
+}
+
+static struct leaf_info *find_leaf_info(struct hlist_head *head, int plen)
+{
+        struct hlist_node *node;
+        struct leaf_info *li;
+
+        hlist_for_each_entry(li, node, head, hlist) {
+                if (li->plen == plen)
+                        return li;
+        }
+        return NULL;
+}
+
+static inline struct list_head * get_fa_head(struct leaf *l, int plen)
+{
+        struct list_head *fa_head = NULL;
+        struct leaf_info *li = find_leaf_info(&l->list, plen);
+
+        if (li)
+                fa_head = &li->falh;
+
+        return fa_head;
+}
+
+static void insert_leaf_info(struct hlist_head *head, struct leaf_info *new)
+{
+        struct leaf_info *li = NULL, *last = NULL;
+        struct hlist_node *node, *tmp;
+
+        write_lock_bh(&fib_lock);
+
+        if (hlist_empty(head))
+                hlist_add_head(&new->hlist, head);
+        else {
+                hlist_for_each_entry_safe(li, node, tmp, head, hlist) {
+                
+                        if (new->plen > li->plen)
+                                break;
+                
+                        last = li;
+                }
+                if (last)
+                        hlist_add_after(&last->hlist, &new->hlist);
+                else
+                        hlist_add_before(&new->hlist, &li->hlist);
+        }
+        write_unlock_bh(&fib_lock);
+}
+
+static struct leaf *
+fib_find_node(struct trie *t, u32 key)
+{
+        int pos;
+        struct tnode *tn;
+        struct node *n;
+
+        pos = 0;
+        n = t->trie;
+
+        while (n != NULL &&  NODE_TYPE(n) == T_TNODE) {
+                tn = (struct tnode *) n;
+                
+                check_tnode(tn);
+                
+                if (tkey_sub_equals(tn->key, pos, tn->pos-pos, key)) {
+                        pos=tn->pos + tn->bits;
+                        n = tnode_get_child(tn, tkey_extract_bits(key, tn->pos, tn->bits));
+                }
+                else
+                        break;
+        }
+        /* Case we have found a leaf. Compare prefixes */
+
+        if (n != NULL && IS_LEAF(n) && tkey_equals(key, n->key)) {
+                struct leaf *l = (struct leaf *) n;
+                return l;
+        }
+        return NULL;
+}
+
+static struct node *trie_rebalance(struct trie *t, struct tnode *tn)
+{
+        int i = 0;
+        int wasfull;
+        t_key cindex, key;
+        struct tnode *tp = NULL;
+
+        if (!tn)
+                BUG();
+
+        key = tn->key;
+        i = 0;
+
+        while (tn != NULL && NODE_PARENT(tn) != NULL) {
+
+                if (i > 10) {
+                        printk("Rebalance tn=%p \n", tn);
+                        if (tn)                 printk("tn->parent=%p \n", NODE_PARENT(tn));
+                
+                        printk("Rebalance tp=%p \n", tp);
+                        if (tp)                 printk("tp->parent=%p \n", NODE_PARENT(tp));
+                }
+
+                if (i > 12) BUG();
+                i++;
+
+                tp = NODE_PARENT(tn);
+                cindex = tkey_extract_bits(key, tp->pos, tp->bits);
+                wasfull = tnode_full(tp, tnode_get_child(tp, cindex));
+                tn = (struct tnode *) resize (t, (struct tnode *)tn);
+                tnode_put_child_reorg((struct tnode *)tp, cindex,(struct node*)tn, wasfull);
+        
+                if (!NODE_PARENT(tn))
+                        break;
+
+                tn = NODE_PARENT(tn);
+        }
+        /* Handle last (top) tnode */
+        if (IS_TNODE(tn))
+                tn = (struct tnode*) resize(t, (struct tnode *)tn);
+
+        return (struct node*) tn;
+}
+
+static  struct list_head *
+fib_insert_node(struct trie *t, int *err, u32 key, int plen)
+{
+        int pos, newpos;
+        struct tnode *tp = NULL, *tn = NULL;
+        struct node *n;
+        struct leaf *l;
+        int missbit;
+        struct list_head *fa_head = NULL;
+        struct leaf_info *li;
+        t_key cindex;
+
+        pos = 0;
+        n = t->trie;
+
+        /* If we point to NULL, stop. Either the tree is empty and we should
+         * just put a new leaf in if, or we have reached an empty child slot,
+         * and we should just put our new leaf in that.
+         * If we point to a T_TNODE, check if it matches our key. Note that
+         * a T_TNODE might be skipping any number of bits - its 'pos' need
+         * not be the parent's 'pos'+'bits'!
+         *
+         * If it does match the current key, get pos/bits from it, extract
+         * the index from our key, push the T_TNODE and walk the tree.
+         *
+         * If it doesn't, we have to replace it with a new T_TNODE.
+         *
+         * If we point to a T_LEAF, it might or might not have the same key
+         * as we do. If it does, just change the value, update the T_LEAF's
+         * value, and return it.
+         * If it doesn't, we need to replace it with a T_TNODE.
+         */
+
+        while (n != NULL &&  NODE_TYPE(n) == T_TNODE) {
+                tn = (struct tnode *) n;
+                
+                check_tnode(tn);
+        
+                if (tkey_sub_equals(tn->key, pos, tn->pos-pos, key)) {
+                        tp = tn;
+                        pos=tn->pos + tn->bits;
+                        n = tnode_get_child(tn, tkey_extract_bits(key, tn->pos, tn->bits));
+
+                        if (n && NODE_PARENT(n) != tn) {
+                                printk("BUG tn=%p, n->parent=%p\n", tn, NODE_PARENT(n));
+                                BUG();
+                        }
+                }
+                else
+                        break;
+        }
+
+        /*
+         * n  ----> NULL, LEAF or TNODE
+         *
+         * tp is n's (parent) ----> NULL or TNODE
+         */
+
+        if (tp && IS_LEAF(tp))
+                BUG();
+
+
+        /* Case 1: n is a leaf. Compare prefixes */
+
+        if (n != NULL && IS_LEAF(n) && tkey_equals(key, n->key)) {
+                struct leaf *l = ( struct leaf *)  n;
+        
+                li = leaf_info_new(plen);
+        
+                if (!li) {
+                        *err = -ENOMEM;
+                        goto err;
+                }
+
+                fa_head = &li->falh;
+                insert_leaf_info(&l->list, li);
+                goto done;
+        }
+        t->size++;
+        l = leaf_new();
+
+        if (!l) {
+                *err = -ENOMEM;
+                goto err;
+        }
+
+        l->key = key;
+        li = leaf_info_new(plen);
+
+        if (!li) {
+                tnode_free((struct tnode *) l);
+                *err = -ENOMEM;
+                goto err;
+        }
+
+        fa_head = &li->falh;
+        insert_leaf_info(&l->list, li);
+
+        /* Case 2: n is NULL, and will just insert a new leaf */
+        if (t->trie && n == NULL) {
+
+                NODE_SET_PARENT(l, tp);
+        
+                if (!tp)
+                        BUG();
+
+                else {
+                        cindex = tkey_extract_bits(key, tp->pos, tp->bits);
+                        put_child(t, (struct tnode *)tp, cindex, (struct node *)l);
+                }
+        }
+        /* Case 3: n is a LEAF or a TNODE and the key doesn't match. */
+        else {
+                /*
+                 *  Add a new tnode here
+                 *  first tnode need some special handling
+                 */
+
+                if (tp)
+                        pos=tp->pos+tp->bits;
+                else
+                        pos=0;
+                if (n) {
+                        newpos = tkey_mismatch(key, pos, n->key);
+                        tn = tnode_new(n->key, newpos, 1);
+                }
+                else {
+                        newpos = 0;
+                        tn = tnode_new(key, newpos, 1); /* First tnode */
+                }
+
+                if (!tn) {
+                        free_leaf_info(li);
+                        tnode_free((struct tnode *) l);
+                        *err = -ENOMEM;
+                        goto err;
+                }               
+                
+                NODE_SET_PARENT(tn, tp);
+
+                missbit=tkey_extract_bits(key, newpos, 1);
+                put_child(t, tn, missbit, (struct node *)l);
+                put_child(t, tn, 1-missbit, n);
+
+                if (tp) {
+                        cindex = tkey_extract_bits(key, tp->pos, tp->bits);
+                        put_child(t, (struct tnode *)tp, cindex, (struct node *)tn);
+                }
+                else {
+                        t->trie = (struct node*) tn; /* First tnode */
+                        tp = tn;
+                }
+        }
+        if (tp && tp->pos+tp->bits > 32) {
+                printk("ERROR tp=%p pos=%d, bits=%d, key=%0x plen=%d\n",
+                       tp, tp->pos, tp->bits, key, plen);
+        }
+        /* Rebalance the trie */
+        t->trie = trie_rebalance(t, tp);
+done:
+        t->revision++;
+err:;
+        return fa_head;
+}
+
+static int
+fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
+               struct nlmsghdr *nlhdr, struct netlink_skb_parms *req)
+{
+        struct trie *t = (struct trie *) tb->tb_data;
+        struct fib_alias *fa, *new_fa;
+        struct list_head *fa_head = NULL;
+        struct fib_info *fi;
+        int plen = r->rtm_dst_len;
+        int type = r->rtm_type;
+        u8 tos = r->rtm_tos;
+        u32 key, mask;
+        int err;
+        struct leaf *l;
+
+        if (plen > 32)
+                return -EINVAL;
+
+        key = 0;
+        if (rta->rta_dst)
+                memcpy(&key, rta->rta_dst, 4);
+
+        key = ntohl(key);
+
+        if (trie_debug)
+                printk("Insert table=%d %08x/%d\n", tb->tb_id, key, plen);
+
+        mask = ntohl( inet_make_mask(plen) );
+
+        if (key & ~mask)
+                return -EINVAL;
+
+        key = key & mask;
+
+        if  ((fi = fib_create_info(r, rta, nlhdr, &err)) == NULL)
+                goto err;
+
+        l = fib_find_node(t, key);
+        fa = NULL;
+
+        if (l) {
+                fa_head = get_fa_head(l, plen);
+                fa = fib_find_alias(fa_head, tos, fi->fib_priority);
+        }
+
+        /* Now fa, if non-NULL, points to the first fib alias
+         * with the same keys [prefix,tos,priority], if such key already
+         * exists or to the node before which we will insert new one.
+         *
+         * If fa is NULL, we will need to allocate a new one and
+         * insert to the head of f.
+         *
+         * If f is NULL, no fib node matched the destination key
+         * and we need to allocate a new one of those as well.
+         */
+
+        if (fa &&
+            fa->fa_info->fib_priority == fi->fib_priority) {
+                struct fib_alias *fa_orig;
+
+                err = -EEXIST;
+                if (nlhdr->nlmsg_flags & NLM_F_EXCL)
+                        goto out;
+
+                if (nlhdr->nlmsg_flags & NLM_F_REPLACE) {
+                        struct fib_info *fi_drop;
+                        u8 state;
+
+                        write_lock_bh(&fib_lock);
+
+                        fi_drop = fa->fa_info;
+                        fa->fa_info = fi;
+                        fa->fa_type = type;
+                        fa->fa_scope = r->rtm_scope;
+                        state = fa->fa_state;
+                        fa->fa_state &= ~FA_S_ACCESSED;
+
+                        write_unlock_bh(&fib_lock);
+
+                        fib_release_info(fi_drop);
+                        if (state & FA_S_ACCESSED)
+                          rt_cache_flush(-1);
+
+                            goto succeeded;
+                }
+                /* Error if we find a perfect match which
+                 * uses the same scope, type, and nexthop
+                 * information.
+                 */
+                fa_orig = fa;
+                list_for_each_entry(fa, fa_orig->fa_list.prev, fa_list) {
+                        if (fa->fa_tos != tos)
+                                break;
+                        if (fa->fa_info->fib_priority != fi->fib_priority)
+                                break;
+                        if (fa->fa_type == type &&
+                            fa->fa_scope == r->rtm_scope &&
+                            fa->fa_info == fi) {
+                                goto out;
+                        }
+                }
+                if (!(nlhdr->nlmsg_flags & NLM_F_APPEND))
+                        fa = fa_orig;
+        }
+        err = -ENOENT;
+        if (!(nlhdr->nlmsg_flags&NLM_F_CREATE))
+                goto out;
+
+        err = -ENOBUFS;
+        new_fa = kmem_cache_alloc(fn_alias_kmem, SLAB_KERNEL);
+        if (new_fa == NULL)
+                goto out;
+
+        new_fa->fa_info = fi;
+        new_fa->fa_tos = tos;
+        new_fa->fa_type = type;
+        new_fa->fa_scope = r->rtm_scope;
+        new_fa->fa_state = 0;
+#if 0
+        new_fa->dst = NULL;
+#endif
+        /*
+         * Insert new entry to the list.
+         */
+
+        if (!fa_head) {
+                fa_head = fib_insert_node(t, &err, key, plen);
+                err = 0;
+                if (err)
+                        goto out_free_new_fa;
+        }
+
+        write_lock_bh(&fib_lock);
+
+        list_add_tail(&new_fa->fa_list,
+                 (fa ? &fa->fa_list : fa_head));
+
+        write_unlock_bh(&fib_lock);
+
+        rt_cache_flush(-1);
+        rtmsg_fib(RTM_NEWROUTE, htonl(key), new_fa, plen, tb->tb_id, nlhdr, req);
+succeeded:
+        return 0;
+
+out_free_new_fa:
+        kmem_cache_free(fn_alias_kmem, new_fa);
+out:
+        fib_release_info(fi);
+err:;
+        return err;
+}
+
+static inline int check_leaf(struct trie *t, struct leaf *l,  t_key key, int *plen, const struct flowi *flp,
+                             struct fib_result *res, int *err)
+{
+        int i;
+        t_key mask;
+        struct leaf_info *li;
+        struct hlist_head *hhead = &l->list;
+        struct hlist_node *node;
+
+        hlist_for_each_entry(li, node, hhead, hlist) {
+
+                i = li->plen;
+                mask = ntohl(inet_make_mask(i));
+                if (l->key != (key & mask))
+                        continue;
+
+                if (((*err) = fib_semantic_match(&li->falh, flp, res, l->key, mask, i)) == 0) {
+                        *plen = i;
+#ifdef CONFIG_IP_FIB_TRIE_STATS
+                        t->stats.semantic_match_passed++;
+#endif
+                        return 1;
+                }
+#ifdef CONFIG_IP_FIB_TRIE_STATS
+                t->stats.semantic_match_miss++;
+#endif
+        }
+        return 0;
+}
+
+static int
+fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result *res)
+{
+        struct trie *t = (struct trie *) tb->tb_data;
+        int plen, ret = 0;
+        struct node *n;
+        struct tnode *pn;
+        int pos, bits;
+        t_key key=ntohl(flp->fl4_dst);
+        int chopped_off;
+        t_key cindex = 0;
+        int current_prefix_length = KEYLENGTH;
+        n = t->trie;
+
+        read_lock(&fib_lock);
+        if (!n)
+                goto failed;
+
+#ifdef CONFIG_IP_FIB_TRIE_STATS
+        t->stats.gets++;
+#endif
+
+        /* Just a leaf? */
+        if (IS_LEAF(n)) {
+                if (check_leaf(t, (struct leaf *)n, key, &plen, flp, res, &ret))
+                        goto found;
+                goto failed;
+        }
+        pn = (struct tnode *) n;
+        chopped_off = 0;
+
+        while (pn) {
+
+                pos = pn->pos;
+                bits = pn->bits;
+
+                if (!chopped_off)
+                        cindex = tkey_extract_bits(MASK_PFX(key, current_prefix_length), pos, bits);
+
+                n = tnode_get_child(pn, cindex);
+
+                if (n == NULL) {
+#ifdef CONFIG_IP_FIB_TRIE_STATS
+                        t->stats.null_node_hit++;
+#endif
+                        goto backtrace;
+                }
+
+                if (IS_TNODE(n)) {
+#define HL_OPTIMIZE
+#ifdef HL_OPTIMIZE
+                        struct tnode *cn = (struct tnode *)n;
+                        t_key node_prefix, key_prefix, pref_mismatch;
+                        int mp;
+
+                        /*
+                         * It's a tnode, and we can do some extra checks here if we
+                         * like, to avoid descending into a dead-end branch.
+                         * This tnode is in the parent's child array at index
+                         * key[p_pos..p_pos+p_bits] but potentially with some bits
+                         * chopped off, so in reality the index may be just a
+                         * subprefix, padded with zero at the end.
+                         * We can also take a look at any skipped bits in this
+                         * tnode - everything up to p_pos is supposed to be ok,
+                         * and the non-chopped bits of the index (se previous
+                         * paragraph) are also guaranteed ok, but the rest is
+                         * considered unknown.
+                         *
+                         * The skipped bits are key[pos+bits..cn->pos].
+                         */
+                
+                        /* If current_prefix_length < pos+bits, we are already doing
+                         * actual prefix  matching, which means everything from
+                         * pos+(bits-chopped_off) onward must be zero along some
+                         * branch of this subtree - otherwise there is *no* valid
+                         * prefix present. Here we can only check the skipped
+                         * bits. Remember, since we have already indexed into the
+                         * parent's child array, we know that the bits we chopped of
+                         * *are* zero.
+                         */
+
+                        /* NOTA BENE: CHECKING ONLY SKIPPED BITS FOR THE NEW NODE HERE */
+                
+                        if (current_prefix_length < pos+bits) {
+                                if (tkey_extract_bits(cn->key, current_prefix_length,
+                                                      cn->pos - current_prefix_length) != 0 ||
+                                    !(cn->child[0]))
+                                        goto backtrace;
+                        }
+
+                        /*
+                         * If chopped_off=0, the index is fully validated and we
+                         * only need to look at the skipped bits for this, the new,
+                         * tnode. What we actually want to do is to find out if
+                         * these skipped bits match our key perfectly, or if we will
+                         * have to count on finding a matching prefix further down,
+                         * because if we do, we would like to have some way of
+                         * verifying the existence of such a prefix at this point.
+                         */
+
+                        /* The only thing we can do at this point is to verify that
+                         * any such matching prefix can indeed be a prefix to our
+                         * key, and if the bits in the node we are inspecting that
+                         * do not match our key are not ZERO, this cannot be true.
+                         * Thus, find out where there is a mismatch (before cn->pos)
+                         * and verify that all the mismatching bits are zero in the
+                         * new tnode's key.
+                         */
+
+                        /* Note: We aren't very concerned about the piece of the key
+                         * that precede pn->pos+pn->bits, since these have already been
+                         * checked. The bits after cn->pos aren't checked since these are
+                         * by definition "unknown" at this point. Thus, what we want to
+                         * see is if we are about to enter the "prefix matching" state,
+                         * and in that case verify that the skipped bits that will prevail
+                         * throughout this subtree are zero, as they have to be if we are
+                         * to find a matching prefix.
+                         */
+
+                        node_prefix = MASK_PFX(cn->key, cn->pos);
+                        key_prefix = MASK_PFX(key, cn->pos);
+                        pref_mismatch = key_prefix^node_prefix;
+                        mp = 0;
+
+                        /* In short: If skipped bits in this node do not match the search
+                         * key, enter the "prefix matching" state.directly.
+                         */
+                        if (pref_mismatch) {
+                                while (!(pref_mismatch & (1<<(KEYLENGTH-1)))) {
+                                        mp++;
+                                        pref_mismatch = pref_mismatch <<1;
+                                }
+                                key_prefix = tkey_extract_bits(cn->key, mp, cn->pos-mp);
+                        
+                                if (key_prefix != 0)
+                                        goto backtrace;
+
+                                if (current_prefix_length >= cn->pos)
+                                        current_prefix_length=mp;
+                       }
+#endif
+                       pn = (struct tnode *)n; /* Descend */
+                       chopped_off = 0;
+                       continue;
+                }
+                if (IS_LEAF(n)) {
+                        if (check_leaf(t, (struct leaf *)n, key, &plen, flp, res, &ret))
+                                goto found;
+               }
+backtrace:
+                chopped_off++;
+
+                /* As zero don't change the child key (cindex) */
+                while ((chopped_off <= pn->bits) && !(cindex & (1<<(chopped_off-1)))) {
+                        chopped_off++;
+                }
+
+                /* Decrease current_... with bits chopped off */
+                if (current_prefix_length > pn->pos + pn->bits - chopped_off)
+                        current_prefix_length = pn->pos + pn->bits - chopped_off;
+        
+                /*
+                 * Either we do the actual chop off according or if we have
+                 * chopped off all bits in this tnode walk up to our parent.
+                 */
+
+                if (chopped_off <= pn->bits)
+                        cindex &= ~(1 << (chopped_off-1));
+                else {
+                        if (NODE_PARENT(pn) == NULL)
+                                goto failed;
+                
+                        /* Get Child's index */
+                        cindex = tkey_extract_bits(pn->key, NODE_PARENT(pn)->pos, NODE_PARENT(pn)->bits);
+                        pn = NODE_PARENT(pn);
+                        chopped_off = 0;
+
+#ifdef CONFIG_IP_FIB_TRIE_STATS
+                        t->stats.backtrack++;
+#endif
+                        goto backtrace;
+                }
+        }
+failed:
+        ret = 1;
+found:
+        read_unlock(&fib_lock);
+        return ret;
+}
+
+static int trie_leaf_remove(struct trie *t, t_key key)
+{
+        t_key cindex;
+        struct tnode *tp = NULL;
+        struct node *n = t->trie;
+        struct leaf *l;
+
+        if (trie_debug)
+                printk("entering trie_leaf_remove(%p)\n", n);
+
+        /* Note that in the case skipped bits, those bits are *not* checked!
+         * When we finish this, we will have NULL or a T_LEAF, and the
+         * T_LEAF may or may not match our key.
+         */
+
+        while (n != NULL && IS_TNODE(n)) {
+                struct tnode *tn = (struct tnode *) n;
+                check_tnode(tn);
+                n = tnode_get_child(tn ,tkey_extract_bits(key, tn->pos, tn->bits));
+
+                        if (n && NODE_PARENT(n) != tn) {
+                                printk("BUG tn=%p, n->parent=%p\n", tn, NODE_PARENT(n));
+                                BUG();
+                        }
+        }
+        l = (struct leaf *) n;
+
+        if (!n || !tkey_equals(l->key, key))
+                return 0;
+
+        /*
+         * Key found.
+         * Remove the leaf and rebalance the tree
+         */
+
+        t->revision++;
+        t->size--;
+
+        tp = NODE_PARENT(n);
+        tnode_free((struct tnode *) n);
+
+        if (tp) {
+                cindex = tkey_extract_bits(key, tp->pos, tp->bits);
+                put_child(t, (struct tnode *)tp, cindex, NULL);
+                t->trie = trie_rebalance(t, tp);
+        }
+        else
+                t->trie = NULL;
+
+        return 1;
+}
+
+static int
+fn_trie_delete(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
+               struct nlmsghdr *nlhdr, struct netlink_skb_parms *req)
+{
+        struct trie *t = (struct trie *) tb->tb_data;
+        u32 key, mask;
+        int plen = r->rtm_dst_len;
+        u8 tos = r->rtm_tos;
+        struct fib_alias *fa, *fa_to_delete;
+        struct list_head *fa_head;
+        struct leaf *l;
+
+        if (plen > 32)
+                return -EINVAL;
+
+        key = 0;
+        if (rta->rta_dst)
+                memcpy(&key, rta->rta_dst, 4);
+
+        key = ntohl(key);
+        mask = ntohl( inet_make_mask(plen) );
+
+        if (key & ~mask)
+                return -EINVAL;
+
+        key = key & mask;
+        l = fib_find_node(t, key);
+
+        if (!l)
+                return -ESRCH;
+
+        fa_head = get_fa_head(l, plen);
+        fa = fib_find_alias(fa_head, tos, 0);
+
+        if (!fa)
+                return -ESRCH;
+
+        if (trie_debug)
+                printk("Deleting %08x/%d tos=%d t=%p\n", key, plen, tos, t);
+
+        fa_to_delete = NULL;
+        fa_head = fa->fa_list.prev;
+        list_for_each_entry(fa, fa_head, fa_list) {
+                struct fib_info *fi = fa->fa_info;
+
+                if (fa->fa_tos != tos)
+                        break;
+
+                if ((!r->rtm_type ||
+                     fa->fa_type == r->rtm_type) &&
+                    (r->rtm_scope == RT_SCOPE_NOWHERE ||
+                     fa->fa_scope == r->rtm_scope) &&
+                    (!r->rtm_protocol ||
+                     fi->fib_protocol == r->rtm_protocol) &&
+                    fib_nh_match(r, nlhdr, rta, fi) == 0) {
+                        fa_to_delete = fa;
+                        break;
+                }
+        }
+
+        if (fa_to_delete) {
+                int kill_li = 0;
+                struct leaf_info *li;
+
+                fa = fa_to_delete;
+                rtmsg_fib(RTM_DELROUTE, htonl(key), fa, plen, tb->tb_id, nlhdr, req);
+
+                l = fib_find_node(t, key);
+                li = find_leaf_info(&l->list, plen);
+
+                write_lock_bh(&fib_lock);
+
+                list_del(&fa->fa_list);
+
+                if (list_empty(fa_head)) {
+                        hlist_del(&li->hlist);
+                        kill_li = 1;
+                }
+                write_unlock_bh(&fib_lock);
+        
+                if (kill_li)
+                        free_leaf_info(li);
+
+                if (hlist_empty(&l->list))
+                        trie_leaf_remove(t, key);
+
+                if (fa->fa_state & FA_S_ACCESSED)
+                        rt_cache_flush(-1);
+
+                fn_free_alias(fa);
+                return 0;
+        }
+        return -ESRCH;
+}
+
+static int trie_flush_list(struct trie *t, struct list_head *head)
+{
+        struct fib_alias *fa, *fa_node;
+        int found = 0;
+
+        list_for_each_entry_safe(fa, fa_node, head, fa_list) {
+                struct fib_info *fi = fa->fa_info;
+        
+                if (fi && (fi->fib_flags&RTNH_F_DEAD)) {
+
+                        write_lock_bh(&fib_lock);
+                        list_del(&fa->fa_list);
+                        write_unlock_bh(&fib_lock);
+
+                        fn_free_alias(fa);
+                        found++;
+                }
+        }
+        return found;
+}
+
+static int trie_flush_leaf(struct trie *t, struct leaf *l)
+{
+        int found = 0;
+        struct hlist_head *lih = &l->list;
+        struct hlist_node *node, *tmp;
+        struct leaf_info *li = NULL;
+
+        hlist_for_each_entry_safe(li, node, tmp, lih, hlist) {
+                
+                found += trie_flush_list(t, &li->falh);
+
+                if (list_empty(&li->falh)) {
+
+                        write_lock_bh(&fib_lock);
+                        hlist_del(&li->hlist);
+                        write_unlock_bh(&fib_lock);
+
+                        free_leaf_info(li);
+                }
+        }
+        return found;
+}
+
+static struct leaf *nextleaf(struct trie *t, struct leaf *thisleaf)
+{
+        struct node *c = (struct node *) thisleaf;
+        struct tnode *p;
+        int idx;
+
+        if (c == NULL) {
+                if (t->trie == NULL)
+                        return NULL;
+
+                if (IS_LEAF(t->trie))          /* trie w. just a leaf */
+                        return (struct leaf *) t->trie;
+
+                p = (struct tnode*) t->trie;  /* Start */
+        }
+        else
+                p = (struct tnode *) NODE_PARENT(c);
+
+        while (p) {
+                int pos, last;
+
+                /*  Find the next child of the parent */
+                if (c)
+                        pos = 1 + tkey_extract_bits(c->key, p->pos, p->bits);
+                else
+                        pos = 0;
+
+                last = 1 << p->bits;
+                for(idx = pos; idx < last ; idx++) {
+                        if (p->child[idx]) {
+
+                                /* Decend if tnode */
+
+                                while (IS_TNODE(p->child[idx])) {
+                                        p = (struct tnode*) p->child[idx];
+                                        idx = 0;
+                                
+                                        /* Rightmost non-NULL branch */
+                                        if (p && IS_TNODE(p))
+                                                while (p->child[idx] == NULL && idx < (1 << p->bits)) idx++;
+
+                                        /* Done with this tnode? */
+                                        if (idx >= (1 << p->bits) || p->child[idx] == NULL )
+                                                goto up;
+                                }
+                                return (struct leaf*) p->child[idx];
+                        }
+                }
+up:
+                /* No more children go up one step  */
+                c = (struct node*) p;
+                p = (struct tnode *) NODE_PARENT(p);
+        }
+        return NULL; /* Ready. Root of trie */
+}
+
+static int fn_trie_flush(struct fib_table *tb)
+{
+        struct trie *t = (struct trie *) tb->tb_data;
+        struct leaf *ll = NULL, *l = NULL;
+        int found = 0, h;
+
+        t->revision++;
+
+        for (h=0; (l = nextleaf(t, l)) != NULL; h++) {
+                found += trie_flush_leaf(t, l);
+
+                if (ll && hlist_empty(&ll->list))
+                        trie_leaf_remove(t, ll->key);
+                ll = l;
+        }
+
+        if (ll && hlist_empty(&ll->list))
+                trie_leaf_remove(t, ll->key);
+
+        if (trie_debug)
+                printk("trie_flush found=%d\n", found);
+        return found;
+}
+
+static int trie_last_dflt=-1;
+
+static void
+fn_trie_select_default(struct fib_table *tb, const struct flowi *flp, struct fib_result *res)
+{
+        struct trie *t = (struct trie *) tb->tb_data;
+        int order, last_idx;
+        struct fib_info *fi = NULL;
+        struct fib_info *last_resort;
+        struct fib_alias *fa = NULL;
+        struct list_head *fa_head;
+        struct leaf *l;
+
+        last_idx = -1;
+        last_resort = NULL;
+        order = -1;
+
+        read_lock(&fib_lock);
+
+        l = fib_find_node(t, 0);
+        if (!l)
+                goto out;
+
+        fa_head = get_fa_head(l, 0);
+        if (!fa_head)
+                goto out;
+
+        if (list_empty(fa_head))
+                goto out;
+
+        list_for_each_entry(fa, fa_head, fa_list) {
+                struct fib_info *next_fi = fa->fa_info;
+        
+                if (fa->fa_scope != res->scope ||
+                    fa->fa_type != RTN_UNICAST)
+                        continue;
+        
+                if (next_fi->fib_priority > res->fi->fib_priority)
+                        break;
+                if (!next_fi->fib_nh[0].nh_gw ||
+                    next_fi->fib_nh[0].nh_scope != RT_SCOPE_LINK)
+                        continue;
+                fa->fa_state |= FA_S_ACCESSED;
+        
+                if (fi == NULL) {
+                        if (next_fi != res->fi)
+                                break;
+                } else if (!fib_detect_death(fi, order, &last_resort,
+                                             &last_idx, &trie_last_dflt)) {
+                        if (res->fi)
+                                fib_info_put(res->fi);
+                        res->fi = fi;
+                        atomic_inc(&fi->fib_clntref);
+                        trie_last_dflt = order;
+                        goto out;
+                }
+                fi = next_fi;
+                order++;
+        }
+        if (order <= 0 || fi == NULL) {
+                trie_last_dflt = -1;
+                goto out;
+        }
+
+        if (!fib_detect_death(fi, order, &last_resort, &last_idx, &trie_last_dflt)) {
+                if (res->fi)
+                        fib_info_put(res->fi);
+                res->fi = fi;
+                atomic_inc(&fi->fib_clntref);
+                trie_last_dflt = order;
+                goto out;
+        }
+        if (last_idx >= 0) {
+                if (res->fi)
+                        fib_info_put(res->fi);
+                res->fi = last_resort;
+                if (last_resort)
+                        atomic_inc(&last_resort->fib_clntref);
+        }
+        trie_last_dflt = last_idx;
+ out:;
+        read_unlock(&fib_lock);
+}
+
+static int fn_trie_dump_fa(t_key key, int plen, struct list_head *fah, struct fib_table *tb,
+                           struct sk_buff *skb, struct netlink_callback *cb)
+{
+        int i, s_i;
+        struct fib_alias *fa;
+
+        u32 xkey=htonl(key);
+
+        s_i=cb->args[3];
+        i = 0;
+
+        list_for_each_entry(fa, fah, fa_list) {
+                if (i < s_i) {
+                        i++;
+                        continue;
+                }
+                if (fa->fa_info->fib_nh == NULL) {
+                        printk("Trie error _fib_nh=NULL in fa[%d] k=%08x plen=%d\n", i, key, plen);
+                        i++;
+                        continue;
+                }
+                if (fa->fa_info == NULL) {
+                        printk("Trie error fa_info=NULL in fa[%d] k=%08x plen=%d\n", i, key, plen);
+                        i++;
+                        continue;
+                }
+
+                if (fib_dump_info(skb, NETLINK_CB(cb->skb).pid,
+                                  cb->nlh->nlmsg_seq,
+                                  RTM_NEWROUTE,
+                                  tb->tb_id,
+                                  fa->fa_type,
+                                  fa->fa_scope,
+                                  &xkey,
+                                  plen,
+                                  fa->fa_tos,
+                                  fa->fa_info, 0) < 0) {
+                        cb->args[3] = i;
+                        return -1;
+                        }
+                i++;
+        }
+        cb->args[3]=i;
+        return skb->len;
+}
+
+static int fn_trie_dump_plen(struct trie *t, int plen, struct fib_table *tb, struct sk_buff *skb,
+                             struct netlink_callback *cb)
+{
+        int h, s_h;
+        struct list_head *fa_head;
+        struct leaf *l = NULL;
+        s_h=cb->args[2];
+
+        for (h=0; (l = nextleaf(t, l)) != NULL; h++) {
+
+                if (h < s_h)
+                        continue;
+                if (h > s_h)
+                        memset(&cb->args[3], 0,
+                               sizeof(cb->args) - 3*sizeof(cb->args[0]));
+
+                fa_head = get_fa_head(l, plen);
+        
+                if (!fa_head)
+                        continue;
+
+                if (list_empty(fa_head))
+                        continue;
+
+                if (fn_trie_dump_fa(l->key, plen, fa_head, tb, skb, cb)<0) {
+                        cb->args[2]=h;
+                        return -1;
+                }
+        }
+        cb->args[2]=h;
+        return skb->len;
+}
+
+static int fn_trie_dump(struct fib_table *tb, struct sk_buff *skb, struct netlink_callback *cb)
+{
+        int m, s_m;
+        struct trie *t = (struct trie *) tb->tb_data;
+
+        s_m = cb->args[1];
+
+        read_lock(&fib_lock);
+        for (m=0; m<=32; m++) {
+
+                if (m < s_m)
+                        continue;
+                if (m > s_m)
+                        memset(&cb->args[2], 0,
+                               sizeof(cb->args) - 2*sizeof(cb->args[0]));
+
+                if (fn_trie_dump_plen(t, 32-m, tb, skb, cb)<0) {
+                        cb->args[1] = m;
+                        goto out;
+                }
+        }
+        read_unlock(&fib_lock);
+        cb->args[1] = m;
+        return skb->len;
+ out:
+        read_unlock(&fib_lock);
+        return -1;
+}
+
+/* Fix more generic FIB names for init later */
+
+#ifdef CONFIG_IP_MULTIPLE_TABLES
+struct fib_table * fib_hash_init(int id)
+#else
+struct fib_table * __init fib_hash_init(int id)
+#endif
+{
+        struct fib_table *tb;
+        struct trie *t;
+
+        if (fn_alias_kmem == NULL)
+                fn_alias_kmem = kmem_cache_create("ip_fib_alias",
+                                                  sizeof(struct fib_alias),
+                                                  0, SLAB_HWCACHE_ALIGN,
+                                                  NULL, NULL);
+
+        tb = kmalloc(sizeof(struct fib_table) + sizeof(struct trie),
+                     GFP_KERNEL);
+        if (tb == NULL)
+                return NULL;
+
+        tb->tb_id = id;
+        tb->tb_lookup = fn_trie_lookup;
+        tb->tb_insert = fn_trie_insert;
+        tb->tb_delete = fn_trie_delete;
+        tb->tb_flush = fn_trie_flush;
+        tb->tb_select_default = fn_trie_select_default;
+        tb->tb_dump = fn_trie_dump;
+        memset(tb->tb_data, 0, sizeof(struct trie));
+
+        t = (struct trie *) tb->tb_data;
+
+        trie_init(t);
+
+        if (id == RT_TABLE_LOCAL)
+                trie_local = t;
+        else if (id == RT_TABLE_MAIN)
+                trie_main = t;
+
+        if (id == RT_TABLE_LOCAL)
+                printk("IPv4 FIB: Using LC-trie version %s\n", VERSION);
+
+        return tb;
+}
+
+/* Trie dump functions */
+
+static void putspace_seq(struct seq_file *seq, int n)
+{
+        while (n--) seq_printf(seq, " ");
+}
+
+static void printbin_seq(struct seq_file *seq, unsigned int v, int bits)
+{
+        while (bits--)
+                seq_printf(seq, "%s", (v & (1<<bits))?"1":"0");
+}
+
+static void printnode_seq(struct seq_file *seq, int indent, struct node *n,
+                   int pend, int cindex, int bits)
+{
+        putspace_seq(seq, indent);
+        if (IS_LEAF(n))
+                seq_printf(seq, "|");
+        else
+                seq_printf(seq, "+");
+        if (bits) {
+                seq_printf(seq, "%d/", cindex);
+                printbin_seq(seq, cindex, bits);
+                seq_printf(seq, ": ");
+        }
+        else
+                seq_printf(seq, "<root>: ");
+        seq_printf(seq, "%s:%p ", IS_LEAF(n)?"Leaf":"Internal node", n);
+
+        if (IS_LEAF(n))
+                seq_printf(seq, "key=%d.%d.%d.%d\n",
+                           n->key >> 24, (n->key >> 16) % 256, (n->key >> 8) % 256, n->key % 256);
+        else {
+                int plen = ((struct tnode *)n)->pos;
+                t_key prf=MASK_PFX(n->key, plen);
+                seq_printf(seq, "key=%d.%d.%d.%d/%d\n",
+                           prf >> 24, (prf >> 16) % 256, (prf >> 8) % 256, prf % 256, plen);
+        }
+        if (IS_LEAF(n)) {
+                struct leaf *l=(struct leaf *)n;
+                struct fib_alias *fa;
+                int i;
+                for (i=32; i>=0; i--)
+                  if (find_leaf_info(&l->list, i)) {
+                
+                                struct list_head *fa_head = get_fa_head(l, i);
+                        
+                                if (!fa_head)
+                                        continue;
+
+                                if (list_empty(fa_head))
+                                        continue;
+
+                                putspace_seq(seq, indent+2);
+                                seq_printf(seq, "{/%d...dumping}\n", i);
+
+
+                                list_for_each_entry(fa, fa_head, fa_list) {
+                                        putspace_seq(seq, indent+2);
+                                        if (fa->fa_info->fib_nh == NULL) {
+                                                seq_printf(seq, "Error _fib_nh=NULL\n");
+                                                continue;
+                                        }
+                                        if (fa->fa_info == NULL) {
+                                                seq_printf(seq, "Error fa_info=NULL\n");
+                                                continue;
+                                        }
+
+                                        seq_printf(seq, "{type=%d scope=%d TOS=%d}\n",
+                                              fa->fa_type,
+                                              fa->fa_scope,
+                                              fa->fa_tos);
+                                }
+                        }
+        }
+        else if (IS_TNODE(n)) {
+                struct tnode *tn = (struct tnode *)n;
+                putspace_seq(seq, indent); seq_printf(seq, "|    ");
+                seq_printf(seq, "{key prefix=%08x/", tn->key&TKEY_GET_MASK(0, tn->pos));
+                printbin_seq(seq, tkey_extract_bits(tn->key, 0, tn->pos), tn->pos);
+                seq_printf(seq, "}\n");
+                putspace_seq(seq, indent); seq_printf(seq, "|    ");
+                seq_printf(seq, "{pos=%d", tn->pos);
+                seq_printf(seq, " (skip=%d bits)", tn->pos - pend);
+                seq_printf(seq, " bits=%d (%u children)}\n", tn->bits, (1 << tn->bits));
+                putspace_seq(seq, indent); seq_printf(seq, "|    ");
+                seq_printf(seq, "{empty=%d full=%d}\n", tn->empty_children, tn->full_children);
+        }
+}
+
+static void trie_dump_seq(struct seq_file *seq, struct trie *t)
+{
+        struct node *n = t->trie;
+        int cindex=0;
+        int indent=1;
+        int pend=0;
+        int depth = 0;
+
+        read_lock(&fib_lock);
+
+        seq_printf(seq, "------ trie_dump of t=%p ------\n", t);
+        if (n) {
+                printnode_seq(seq, indent, n, pend, cindex, 0);
+                if (IS_TNODE(n)) {
+                        struct tnode *tn = (struct tnode *)n;
+                        pend = tn->pos+tn->bits;
+                        putspace_seq(seq, indent); seq_printf(seq, "\\--\n");
+                        indent += 3;
+                        depth++;
+
+                        while (tn && cindex < (1 << tn->bits)) {
+                                if (tn->child[cindex]) {
+                                
+                                        /* Got a child */
+                                
+                                        printnode_seq(seq, indent, tn->child[cindex], pend, cindex, tn->bits);
+                                        if (IS_LEAF(tn->child[cindex])) {
+                                                cindex++;
+                                        
+                                        }
+                                        else {
+                                                /*
+                                                 * New tnode. Decend one level
+                                                 */
+                                        
+                                                depth++;
+                                                n = tn->child[cindex];
+                                                tn = (struct tnode *)n;
+                                                pend = tn->pos+tn->bits;
+                                                putspace_seq(seq, indent); seq_printf(seq, "\\--\n");
+                                                indent+=3;
+                                                cindex=0;
+                                        }
+                                }
+                                else
+                                        cindex++;
+
+                                /*
+                                 * Test if we are done
+                                 */
+                        
+                                while (cindex >= (1 << tn->bits)) {
+
+                                        /*
+                                         * Move upwards and test for root
+                                         * pop off all traversed  nodes
+                                         */
+                                
+                                        if (NODE_PARENT(tn) == NULL) {
+                                                tn = NULL;
+                                                n = NULL;
+                                                break;
+                                        }
+                                        else {
+                                                cindex = tkey_extract_bits(tn->key, NODE_PARENT(tn)->pos, NODE_PARENT(tn)->bits);
+                                                tn = NODE_PARENT(tn);
+                                                cindex++;
+                                                n = (struct node *)tn;
+                                                pend = tn->pos+tn->bits;
+                                                indent-=3;
+                                                depth--;
+                                        }
+                                }
+                        }
+                }
+                else n = NULL;
+        }
+        else seq_printf(seq, "------ trie is empty\n");
+
+        read_unlock(&fib_lock);
+}
+
+static struct trie_stat *trie_stat_new(void)
+{
+        struct trie_stat *s = kmalloc(sizeof(struct trie_stat), GFP_KERNEL);
+        int i;
+
+        if (s) {
+                s->totdepth = 0;
+                s->maxdepth = 0;
+                s->tnodes = 0;
+                s->leaves = 0;
+                s->nullpointers = 0;
+        
+                for(i=0; i< MAX_CHILDS; i++)
+                        s->nodesizes[i] = 0;
+        }
+        return s;
+}
+
+static struct trie_stat *trie_collect_stats(struct trie *t)
+{
+        struct node *n = t->trie;
+        struct trie_stat *s = trie_stat_new();
+        int cindex = 0;
+        int indent = 1;
+        int pend = 0;
+        int depth = 0;
+
+        read_lock(&fib_lock);   
+
+        if (s) {
+                if (n) {
+                        if (IS_TNODE(n)) {
+                                struct tnode *tn = (struct tnode *)n;
+                                pend = tn->pos+tn->bits;
+                                indent += 3;
+                                s->nodesizes[tn->bits]++;
+                                depth++;
+
+                                while (tn && cindex < (1 << tn->bits)) {
+                                        if (tn->child[cindex]) {
+                                                /* Got a child */
+                                
+                                                if (IS_LEAF(tn->child[cindex])) {
+                                                        cindex++;
+                                        
+                                                        /* stats */
+                                                        if (depth > s->maxdepth)
+                                                                s->maxdepth = depth;
+                                                        s->totdepth += depth;
+                                                        s->leaves++;
+                                                }
+                                
+                                                else {
+                                                        /*
+                                                         * New tnode. Decend one level
+                                                         */
+                                        
+                                                        s->tnodes++;
+                                                        s->nodesizes[tn->bits]++;
+                                                        depth++;
+                                        
+                                                        n = tn->child[cindex];
+                                                        tn = (struct tnode *)n;
+                                                        pend = tn->pos+tn->bits;
+
+                                                        indent += 3;
+                                                        cindex = 0;
+                                                }
+                                        }
+                                        else {
+                                                cindex++;
+                                                s->nullpointers++;
+                                        }
+
+                                        /*
+                                         * Test if we are done
+                                         */
+                        
+                                        while (cindex >= (1 << tn->bits)) {
+
+                                                /*
+                                                 * Move upwards and test for root
+                                                 * pop off all traversed  nodes
+                                                 */
+
+                                        
+                                                if (NODE_PARENT(tn) == NULL) {
+                                                        tn = NULL;
+                                                        n = NULL;
+                                                        break;
+                                                }
+                                                else {
+                                                        cindex = tkey_extract_bits(tn->key, NODE_PARENT(tn)->pos, NODE_PARENT(tn)->bits);
+                                                        tn = NODE_PARENT(tn);
+                                                        cindex++;
+                                                        n = (struct node *)tn;
+                                                        pend = tn->pos+tn->bits;
+                                                        indent -= 3;
+                                                        depth--;
+                                                }
+                                        }
+                                }
+                        }
+                        else n = NULL;
+                }
+        }
+
+        read_unlock(&fib_lock); 
+        return s;
+}
+
+#ifdef CONFIG_PROC_FS
+
+static struct fib_alias *fib_triestat_get_first(struct seq_file *seq)
+{
+        return NULL;
+}
+
+static struct fib_alias *fib_triestat_get_next(struct seq_file *seq)
+{
+        return NULL;
+}
+
+static void *fib_triestat_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        void *v = NULL;
+
+        if (ip_fib_main_table)
+                v = *pos ? fib_triestat_get_next(seq) : SEQ_START_TOKEN;
+        return v;
+}
+
+static void *fib_triestat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        ++*pos;
+        return v == SEQ_START_TOKEN ? fib_triestat_get_first(seq) : fib_triestat_get_next(seq);
+}
+
+static void fib_triestat_seq_stop(struct seq_file *seq, void *v)
+{
+
+}
+
+/*
+ *      This outputs /proc/net/fib_triestats
+ *
+ *      It always works in backward compatibility mode.
+ *      The format of the file is not supposed to be changed.
+ */
+
+static void collect_and_show(struct trie *t, struct seq_file *seq)
+{
+        int bytes = 0; /* How many bytes are used, a ref is 4 bytes */
+        int i, max, pointers;
+        struct trie_stat *stat;
+        int avdepth;
+
+        stat = trie_collect_stats(t);
+
+        bytes=0;
+        seq_printf(seq, "trie=%p\n", t);
+
+        if (stat) {
+                if (stat->leaves)
+                        avdepth=stat->totdepth*100 / stat->leaves;
+                else
+                        avdepth=0;
+                seq_printf(seq, "Aver depth: %d.%02d\n", avdepth / 100, avdepth % 100 );
+                seq_printf(seq, "Max depth: %4d\n", stat->maxdepth);
+                        
+                seq_printf(seq, "Leaves: %d\n", stat->leaves);
+                bytes += sizeof(struct leaf) * stat->leaves;
+                seq_printf(seq, "Internal nodes: %d\n", stat->tnodes);
+                bytes += sizeof(struct tnode) * stat->tnodes;
+
+                max = MAX_CHILDS-1;
+
+                while (max >= 0 && stat->nodesizes[max] == 0)
+                        max--;
+                pointers = 0;
+
+                for (i = 1; i <= max; i++)
+                        if (stat->nodesizes[i] != 0) {
+                                seq_printf(seq, "  %d: %d",  i, stat->nodesizes[i]);
+                                pointers += (1<<i) * stat->nodesizes[i];
+                        }
+                seq_printf(seq, "\n");
+                seq_printf(seq, "Pointers: %d\n", pointers);
+                bytes += sizeof(struct node *) * pointers;
+                seq_printf(seq, "Null ptrs: %d\n", stat->nullpointers);
+                seq_printf(seq, "Total size: %d  kB\n", bytes / 1024);
+
+                kfree(stat);
+        }
+
+#ifdef CONFIG_IP_FIB_TRIE_STATS
+        seq_printf(seq, "Counters:\n---------\n");
+        seq_printf(seq,"gets = %d\n", t->stats.gets);
+        seq_printf(seq,"backtracks = %d\n", t->stats.backtrack);
+        seq_printf(seq,"semantic match passed = %d\n", t->stats.semantic_match_passed);
+        seq_printf(seq,"semantic match miss = %d\n", t->stats.semantic_match_miss);
+        seq_printf(seq,"null node hit= %d\n", t->stats.null_node_hit);
+        seq_printf(seq,"skipped node resize = %d\n", t->stats.resize_node_skipped);
+#ifdef CLEAR_STATS
+        memset(&(t->stats), 0, sizeof(t->stats));
+#endif
+#endif /*  CONFIG_IP_FIB_TRIE_STATS */
+}
+
+static int fib_triestat_seq_show(struct seq_file *seq, void *v)
+{
+        char bf[128];
+
+        if (v == SEQ_START_TOKEN) {
+                seq_printf(seq, "Basic info: size of leaf: %Zd bytes, size of tnode: %Zd bytes.\n",
+                           sizeof(struct leaf), sizeof(struct tnode));
+                if (trie_local)
+                        collect_and_show(trie_local, seq);
+
+                if (trie_main)
+                        collect_and_show(trie_main, seq);
+        }
+        else {
+                snprintf(bf, sizeof(bf),
+                         "*\t%08X\t%08X", 200, 400);
+        
+                seq_printf(seq, "%-127s\n", bf);
+        }
+        return 0;
+}
+
+static struct seq_operations fib_triestat_seq_ops = {
+        .start = fib_triestat_seq_start,
+        .next  = fib_triestat_seq_next,
+        .stop  = fib_triestat_seq_stop,
+        .show  = fib_triestat_seq_show,
+};
+
+static int fib_triestat_seq_open(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq;
+        int rc = -ENOMEM;
+
+        rc = seq_open(file, &fib_triestat_seq_ops);
+        if (rc)
+                goto out_kfree;
+
+        seq = file->private_data;
+out:
+        return rc;
+out_kfree:
+        goto out;
+}
+
+static struct file_operations fib_triestat_seq_fops = {
+        .owner  = THIS_MODULE,
+        .open   = fib_triestat_seq_open,
+        .read   = seq_read,
+        .llseek = seq_lseek,
+        .release = seq_release_private,
+};
+
+int __init fib_stat_proc_init(void)
+{
+        if (!proc_net_fops_create("fib_triestat", S_IRUGO, &fib_triestat_seq_fops))
+                return -ENOMEM;
+        return 0;
+}
+
+void __init fib_stat_proc_exit(void)
+{
+        proc_net_remove("fib_triestat");
+}
+
+static struct fib_alias *fib_trie_get_first(struct seq_file *seq)
+{
+        return NULL;
+}
+
+static struct fib_alias *fib_trie_get_next(struct seq_file *seq)
+{
+        return NULL;
+}
+
+static void *fib_trie_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        void *v = NULL;
+
+        if (ip_fib_main_table)
+                v = *pos ? fib_trie_get_next(seq) : SEQ_START_TOKEN;
+        return v;
+}
+
+static void *fib_trie_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        ++*pos;
+        return v == SEQ_START_TOKEN ? fib_trie_get_first(seq) : fib_trie_get_next(seq);
+}
+
+static void fib_trie_seq_stop(struct seq_file *seq, void *v)
+{
+
+}
+
+/*
+ *      This outputs /proc/net/fib_trie.
+ *
+ *      It always works in backward compatibility mode.
+ *      The format of the file is not supposed to be changed.
+ */
+
+static int fib_trie_seq_show(struct seq_file *seq, void *v)
+{
+        char bf[128];
+
+        if (v == SEQ_START_TOKEN) {
+                if (trie_local)
+                        trie_dump_seq(seq, trie_local);
+
+                if (trie_main)
+                        trie_dump_seq(seq, trie_main);
+        }
+
+        else {
+                snprintf(bf, sizeof(bf),
+                         "*\t%08X\t%08X", 200, 400);
+                seq_printf(seq, "%-127s\n", bf);
+        }
+
+        return 0;
+}
+
+static struct seq_operations fib_trie_seq_ops = {
+        .start = fib_trie_seq_start,
+        .next  = fib_trie_seq_next,
+        .stop  = fib_trie_seq_stop,
+        .show  = fib_trie_seq_show,
+};
+
+static int fib_trie_seq_open(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq;
+        int rc = -ENOMEM;
+
+        rc = seq_open(file, &fib_trie_seq_ops);
+        if (rc)
+                goto out_kfree;
+
+        seq = file->private_data;
+out:
+        return rc;
+out_kfree:
+        goto out;
+}
+
+static struct file_operations fib_trie_seq_fops = {
+        .owner  = THIS_MODULE,
+        .open   = fib_trie_seq_open,
+        .read   = seq_read,
+        .llseek = seq_lseek,
+        .release= seq_release_private,
+};
+
+int __init fib_proc_init(void)
+{
+        if (!proc_net_fops_create("fib_trie", S_IRUGO, &fib_trie_seq_fops))
+                return -ENOMEM;
+        return 0;
+}
+
+void __init fib_proc_exit(void)
+{
+        proc_net_remove("fib_trie");
+}
+
+#endif /* CONFIG_PROC_FS */
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 85bf0d3e294b..3d78464f64ea 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -207,6 +207,7 @@ int sysctl_icmp_ignore_bogus_error_responses;
 
 int sysctl_icmp_ratelimit = 1 * HZ;
 int sysctl_icmp_ratemask = 0x1818;
+int sysctl_icmp_errors_use_inbound_ifaddr;
 
 /*
  *      ICMP control array. This specifies what to do with each ICMP.
@@ -511,8 +512,12 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, u32 info)
          */
 
         saddr = iph->daddr;
-        if (!(rt->rt_flags & RTCF_LOCAL))
-                saddr = 0;
+        if (!(rt->rt_flags & RTCF_LOCAL)) {
+                if (sysctl_icmp_errors_use_inbound_ifaddr)
+                        saddr = inet_select_addr(skb_in->dev, 0, RT_SCOPE_LINK);
+                else
+                        saddr = 0;
+        }
 
         tos = icmp_pointers[type].error ? ((iph->tos & IPTOS_TOS_MASK) |
                                            IPTOS_PREC_INTERNETCONTROL) :
@@ -931,8 +936,7 @@ int icmp_rcv(struct sk_buff *skb)
         case CHECKSUM_HW:
                 if (!(u16)csum_fold(skb->csum))
                         break;
-                NETDEBUG(if (net_ratelimit())
-                                printk(KERN_DEBUG "icmp v4 hw csum failure\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "icmp v4 hw csum failure\n"));
         case CHECKSUM_NONE:
                 if ((u16)csum_fold(skb_checksum(skb, 0, skb->len, 0)))
                         goto error;
@@ -965,7 +969,8 @@ int icmp_rcv(struct sk_buff *skb)
                  *      RFC 1122: 3.2.2.8 An ICMP_TIMESTAMP MAY be silently
                  *        discarded if to broadcast/multicast.
                  */
-                if (icmph->type == ICMP_ECHO &&
+                if ((icmph->type == ICMP_ECHO ||
+                     icmph->type == ICMP_TIMESTAMP) &&
                     sysctl_icmp_echo_ignore_broadcasts) {
                         goto error;
                 }
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 1f3183168a90..5088f90835ae 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1615,9 +1615,10 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
 {
         int err;
         u32 addr = imr->imr_multiaddr.s_addr;
-        struct ip_mc_socklist *iml, *i;
+        struct ip_mc_socklist *iml=NULL, *i;
         struct in_device *in_dev;
         struct inet_sock *inet = inet_sk(sk);
+        int ifindex;
         int count = 0;
 
         if (!MULTICAST(addr))
@@ -1633,37 +1634,30 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
                 goto done;
         }
 
-        iml = (struct ip_mc_socklist *)sock_kmalloc(sk, sizeof(*iml), GFP_KERNEL);
-
         err = -EADDRINUSE;
+        ifindex = imr->imr_ifindex;
         for (i = inet->mc_list; i; i = i->next) {
-                if (memcmp(&i->multi, imr, sizeof(*imr)) == 0) {
-                        /* New style additions are reference counted */
-                        if (imr->imr_address.s_addr == 0) {
-                                i->count++;
-                                err = 0;
-                        }
+                if (i->multi.imr_multiaddr.s_addr == addr &&
+                    i->multi.imr_ifindex == ifindex)
                         goto done;
-                }
                 count++;
         }
         err = -ENOBUFS;
-        if (iml == NULL || count >= sysctl_igmp_max_memberships)
+        if (count >= sysctl_igmp_max_memberships)
+                goto done;
+        iml = (struct ip_mc_socklist *)sock_kmalloc(sk,sizeof(*iml),GFP_KERNEL);
+        if (iml == NULL)
                 goto done;
+
         memcpy(&iml->multi, imr, sizeof(*imr));
         iml->next = inet->mc_list;
-        iml->count = 1;
         iml->sflist = NULL;
         iml->sfmode = MCAST_EXCLUDE;
         inet->mc_list = iml;
         ip_mc_inc_group(in_dev, addr);
-        iml = NULL;
         err = 0;
-
 done:
         rtnl_shunlock();
-        if (iml)
-                sock_kfree_s(sk, iml, sizeof(*iml));
         return err;
 }
 
@@ -1693,30 +1687,25 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct ip_mc_socklist *iml, **imlp;
+        struct in_device *in_dev;
+        u32 group = imr->imr_multiaddr.s_addr;
+        u32 ifindex;
 
         rtnl_lock();
+        in_dev = ip_mc_find_dev(imr);
+        if (!in_dev) {
+                rtnl_unlock();
+                return -ENODEV;
+        }
+        ifindex = imr->imr_ifindex;
         for (imlp = &inet->mc_list; (iml = *imlp) != NULL; imlp = &iml->next) {
-                if (iml->multi.imr_multiaddr.s_addr==imr->imr_multiaddr.s_addr &&
-                    iml->multi.imr_address.s_addr==imr->imr_address.s_addr &&
-                    (!imr->imr_ifindex || iml->multi.imr_ifindex==imr->imr_ifindex)) {
-                        struct in_device *in_dev;
-
-                        in_dev = inetdev_by_index(iml->multi.imr_ifindex);
-                        if (in_dev)
-                                (void) ip_mc_leave_src(sk, iml, in_dev);
-                        if (--iml->count) {
-                                rtnl_unlock();
-                                if (in_dev)
-                                        in_dev_put(in_dev);
-                                return 0;
-                        }
+                if (iml->multi.imr_multiaddr.s_addr == group &&
+                    iml->multi.imr_ifindex == ifindex) {
+                        (void) ip_mc_leave_src(sk, iml, in_dev);
 
                         *imlp = iml->next;
 
-                        if (in_dev) {
-                                ip_mc_dec_group(in_dev, imr->imr_multiaddr.s_addr);
-                                in_dev_put(in_dev);
-                        }
+                        ip_mc_dec_group(in_dev, group);
                         rtnl_unlock();
                         sock_kfree_s(sk, iml, sizeof(*iml));
                         return 0;
@@ -1736,6 +1725,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
         struct in_device *in_dev = NULL;
         struct inet_sock *inet = inet_sk(sk);
         struct ip_sf_socklist *psl;
+        int leavegroup = 0;
         int i, j, rv;
 
         if (!MULTICAST(addr))
@@ -1755,15 +1745,20 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
         err = -EADDRNOTAVAIL;
 
         for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
-                if (memcmp(&pmc->multi, mreqs, 2*sizeof(__u32)) == 0)
+                if (pmc->multi.imr_multiaddr.s_addr == imr.imr_multiaddr.s_addr
+                    && pmc->multi.imr_ifindex == imr.imr_ifindex)
                         break;
         }
-        if (!pmc)               /* must have a prior join */
+        if (!pmc) {             /* must have a prior join */
+                err = -EINVAL;
                 goto done;
+        }
         /* if a source filter was set, must be the same mode as before */
         if (pmc->sflist) {
-                if (pmc->sfmode != omode)
+                if (pmc->sfmode != omode) {
+                        err = -EINVAL;
                         goto done;
+                }
         } else if (pmc->sfmode != omode) {
                 /* allow mode switches for empty-set filters */
                 ip_mc_add_src(in_dev, &mreqs->imr_multiaddr, omode, 0, NULL, 0);
@@ -1775,7 +1770,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
         psl = pmc->sflist;
         if (!add) {
                 if (!psl)
-                        goto done;
+                        goto done;      /* err = -EADDRNOTAVAIL */
                 rv = !0;
                 for (i=0; i<psl->sl_count; i++) {
                         rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
@@ -1784,7 +1779,13 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                                 break;
                 }
                 if (rv)         /* source not found */
+                        goto done;      /* err = -EADDRNOTAVAIL */
+
+                /* special case - (INCLUDE, empty) == LEAVE_GROUP */
+                if (psl->sl_count == 1 && omode == MCAST_INCLUDE) {
+                        leavegroup = 1;
                         goto done;
+                }
 
                 /* update the interface filter */
                 ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, omode, 1, 
@@ -1842,18 +1843,21 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                 &mreqs->imr_sourceaddr, 1);
 done:
         rtnl_shunlock();
+        if (leavegroup)
+                return ip_mc_leave_group(sk, &imr);
         return err;
 }
 
 int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
 {
-        int err;
+        int err = 0;
         struct ip_mreqn imr;
         u32 addr = msf->imsf_multiaddr;
         struct ip_mc_socklist *pmc;
         struct in_device *in_dev;
         struct inet_sock *inet = inet_sk(sk);
         struct ip_sf_socklist *newpsl, *psl;
+        int leavegroup = 0;
 
         if (!MULTICAST(addr))
                 return -EINVAL;
@@ -1872,15 +1876,22 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
                 err = -ENODEV;
                 goto done;
         }
-        err = -EADDRNOTAVAIL;
+
+        /* special case - (INCLUDE, empty) == LEAVE_GROUP */
+        if (msf->imsf_fmode == MCAST_INCLUDE && msf->imsf_numsrc == 0) {
+                leavegroup = 1;
+                goto done;
+        }
 
         for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
                 if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
                     pmc->multi.imr_ifindex == imr.imr_ifindex)
                         break;
         }
-        if (!pmc)               /* must have a prior join */
+        if (!pmc) {             /* must have a prior join */
+                err = -EINVAL;
                 goto done;
+        }
         if (msf->imsf_numsrc) {
                 newpsl = (struct ip_sf_socklist *)sock_kmalloc(sk,
                                 IP_SFLSIZE(msf->imsf_numsrc), GFP_KERNEL);
@@ -1909,8 +1920,11 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
                         0, NULL, 0);
         pmc->sflist = newpsl;
         pmc->sfmode = msf->imsf_fmode;
+        err = 0;
 done:
         rtnl_shunlock();
+        if (leavegroup)
+                err = ip_mc_leave_group(sk, &imr);
         return err;
 }
 
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 7f68e27eb4ea..eb377ae15305 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -377,7 +377,7 @@ static struct ipq *ip_frag_create(unsigned hash, struct iphdr *iph, u32 user)
         return ip_frag_intern(hash, qp);
 
 out_nomem:
-        NETDEBUG(if (net_ratelimit()) printk(KERN_ERR "ip_frag_create: no memory left !\n"));
+        LIMIT_NETDEBUG(printk(KERN_ERR "ip_frag_create: no memory left !\n"));
         return NULL;
 }
 
@@ -625,10 +625,8 @@ static struct sk_buff *ip_frag_reasm(struct ipq *qp, struct net_device *dev)
         return head;
 
 out_nomem:
-        NETDEBUG(if (net_ratelimit())
-                 printk(KERN_ERR 
-                        "IP: queue_glue: no memory for gluing queue %p\n",
-                        qp));
+        LIMIT_NETDEBUG(printk(KERN_ERR "IP: queue_glue: no memory for gluing "
+                              "queue %p\n", qp));
         goto out_fail;
 out_oversize:
         if (net_ratelimit())
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 884835522224..f0d5740d7e22 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -290,7 +290,6 @@ static struct ip_tunnel * ipgre_tunnel_locate(struct ip_tunnel_parm *parms, int
 
         dev_hold(dev);
         ipgre_tunnel_link(nt);
-        /* Do not decrement MOD_USE_COUNT here. */
         return nt;
 
 failed:
@@ -1277,12 +1276,28 @@ err1:
         goto out;
 }
 
-static void ipgre_fini(void)
+static void __exit ipgre_destroy_tunnels(void)
+{
+        int prio;
+
+        for (prio = 0; prio < 4; prio++) {
+                int h;
+                for (h = 0; h < HASH_SIZE; h++) {
+                        struct ip_tunnel *t;
+                        while ((t = tunnels[prio][h]) != NULL)
+                                unregister_netdevice(t->dev);
+                }
+        }
+}
+
+static void __exit ipgre_fini(void)
 {
         if (inet_del_protocol(&ipgre_protocol, IPPROTO_GRE) < 0)
                 printk(KERN_INFO "ipgre close: can't remove protocol\n");
 
-        unregister_netdev(ipgre_fb_tunnel_dev);
+        rtnl_lock();
+        ipgre_destroy_tunnels();
+        rtnl_unlock();
 }
 
 module_init(ipgre_init);
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 4e47a2658c7c..c703528e0bcd 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -184,6 +184,7 @@ int ip_call_ra_chain(struct sk_buff *skb)
                                         raw_rcv(last, skb2);
                         }
                         last = sk;
+                        nf_reset(skb);
                 }
         }
 
@@ -200,10 +201,6 @@ static inline int ip_local_deliver_finish(struct sk_buff *skb)
 {
         int ihl = skb->nh.iph->ihl*4;
 
-#ifdef CONFIG_NETFILTER_DEBUG
-        nf_debug_ip_local_deliver(skb);
-#endif /*CONFIG_NETFILTER_DEBUG*/
-
         __skb_pull(skb, ihl);
 
         /* Free reference early: we don't need it any more, and it may
@@ -286,14 +283,18 @@ static inline int ip_rcv_finish(struct sk_buff *skb)
 {
         struct net_device *dev = skb->dev;
         struct iphdr *iph = skb->nh.iph;
+        int err;
 
         /*
          *      Initialise the virtual path cache for the packet. It describes
          *      how the packet travels inside Linux networking.
          */ 
         if (skb->dst == NULL) {
-                if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))
+                if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
+                        if (err == -EHOSTUNREACH)
+                                IP_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
                         goto drop; 
+                }
         }
 
 #ifdef CONFIG_NET_CLS_ROUTE
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 760dc8238d65..80d13103b2b0 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -107,11 +107,6 @@ static int ip_dev_loopback_xmit(struct sk_buff *newskb)
         newskb->pkt_type = PACKET_LOOPBACK;
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
         BUG_TRAP(newskb->dst);
-
-#ifdef CONFIG_NETFILTER_DEBUG
-        nf_debug_ip_loopback_xmit(newskb);
-#endif
-        nf_reset(newskb);
         netif_rx(newskb);
         return 0;
 }
@@ -192,12 +187,6 @@ static inline int ip_finish_output2(struct sk_buff *skb)
                 skb = skb2;
         }
 
-#ifdef CONFIG_NETFILTER_DEBUG
-        nf_debug_ip_finish_output2(skb);
-#endif /*CONFIG_NETFILTER_DEBUG*/
-
-        nf_reset(skb);
-
         if (hh) {
                 int hh_alen;
 
@@ -391,7 +380,6 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->pkt_type = from->pkt_type;
         to->priority = from->priority;
         to->protocol = from->protocol;
-        to->security = from->security;
         dst_release(to->dst);
         to->dst = dst_clone(from->dst);
         to->dev = from->dev;
@@ -415,9 +403,6 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->nf_bridge = from->nf_bridge;
         nf_bridge_get(to->nf_bridge);
 #endif
-#ifdef CONFIG_NETFILTER_DEBUG
-        to->nf_debug = from->nf_debug;
-#endif
 #endif
 }
 
@@ -1334,23 +1319,8 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
         ip_rt_put(rt);
 }
 
-/*
- *      IP protocol layer initialiser
- */
-
-static struct packet_type ip_packet_type = {
-        .type = __constant_htons(ETH_P_IP),
-        .func = ip_rcv,
-};
-
-/*
- *      IP registers the packet type and then calls the subprotocol initialisers
- */
-
 void __init ip_init(void)
 {
-        dev_add_pack(&ip_packet_type);
-
         ip_rt_init();
         inet_initpeers();
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 47012b93cad2..ff4bd067b397 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -360,14 +360,14 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)
         err = copied;
 
         /* Reset and regenerate socket error */
-        spin_lock_irq(&sk->sk_error_queue.lock);
+        spin_lock_bh(&sk->sk_error_queue.lock);
         sk->sk_err = 0;
         if ((skb2 = skb_peek(&sk->sk_error_queue)) != NULL) {
                 sk->sk_err = SKB_EXT_ERR(skb2)->ee.ee_errno;
-                spin_unlock_irq(&sk->sk_error_queue.lock);
+                spin_unlock_bh(&sk->sk_error_queue.lock);
                 sk->sk_error_report(sk);
         } else
-                spin_unlock_irq(&sk->sk_error_queue.lock);
+                spin_unlock_bh(&sk->sk_error_queue.lock);
 
 out_free_skb:   
         kfree_skb(skb);
@@ -677,11 +677,11 @@ int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
                                 mreq.imr_address.s_addr = mreqs.imr_interface;
                                 mreq.imr_ifindex = 0;
                                 err = ip_mc_join_group(sk, &mreq);
-                                if (err)
+                                if (err && err != -EADDRINUSE)
                                         break;
                                 omode = MCAST_INCLUDE;
                                 add = 1;
-                        } else /*IP_DROP_SOURCE_MEMBERSHIP */ {
+                        } else /* IP_DROP_SOURCE_MEMBERSHIP */ {
                                 omode = MCAST_INCLUDE;
                                 add = 0;
                         }
@@ -754,7 +754,7 @@ int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
                                 mreq.imr_address.s_addr = 0;
                                 mreq.imr_ifindex = greqs.gsr_interface;
                                 err = ip_mc_join_group(sk, &mreq);
-                                if (err)
+                                if (err && err != -EADDRINUSE)
                                         break;
                                 greqs.gsr_interface = mreq.imr_ifindex;
                                 omode = MCAST_INCLUDE;
@@ -848,6 +848,9 @@ mc_msf_out:
  
                 case IP_IPSEC_POLICY:
                 case IP_XFRM_POLICY:
+                        err = -EPERM;
+                        if (!capable(CAP_NET_ADMIN))
+                                break;
                         err = xfrm_user_policy(sk, optname, optval, optlen);
                         break;
 
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 1a23c5263b99..2065944fd9e5 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -236,15 +236,10 @@ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
         t->props.mode = 1;
         t->props.saddr.a4 = x->props.saddr.a4;
         t->props.flags = x->props.flags;
-        
-        t->type = xfrm_get_type(IPPROTO_IPIP, t->props.family);
-        if (t->type == NULL)
-                goto error;
-                
-        if (t->type->init_state(t, NULL))
+
+        if (xfrm_init_state(t))
                 goto error;
 
-        t->km.state = XFRM_STATE_VALID;
         atomic_set(&t->tunnel_users, 1);
 out:
         return t;
@@ -422,7 +417,7 @@ static void ipcomp_destroy(struct xfrm_state *x)
         kfree(ipcd);
 }
 
-static int ipcomp_init_state(struct xfrm_state *x, void *args)
+static int ipcomp_init_state(struct xfrm_state *x)
 {
         int err;
         struct ipcomp_data *ipcd;
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index f2509034ce72..d2bf8e1930a3 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1149,8 +1149,10 @@ static int __init ic_dynamic(void)
                 ic_rarp_cleanup();
 #endif
 
-        if (!ic_got_reply)
+        if (!ic_got_reply) {
+                ic_myaddr = INADDR_NONE;
                 return -1;
+        }
 
         printk("IP-Config: Got %s answer from %u.%u.%u.%u, ",
                 ((ic_got_reply & IC_RARP) ? "RARP" 
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 68a78731f722..c05c1df0bb04 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -255,7 +255,6 @@ static struct ip_tunnel * ipip_tunnel_locate(struct ip_tunnel_parm *parms, int c
 
         dev_hold(dev);
         ipip_tunnel_link(nt);
-        /* Do not decrement MOD_USE_COUNT here. */
         return nt;
 
 failed:
@@ -273,7 +272,7 @@ static void ipip_tunnel_uninit(struct net_device *dev)
         dev_put(dev);
 }
 
-static void ipip_err(struct sk_buff *skb, void *__unused)
+static void ipip_err(struct sk_buff *skb, u32 info)
 {
 #ifndef I_WISH_WORLD_WERE_PERFECT
 
@@ -852,11 +851,39 @@ static int __init ipip_fb_tunnel_init(struct net_device *dev)
         return 0;
 }
 
+#ifdef CONFIG_INET_TUNNEL
 static struct xfrm_tunnel ipip_handler = {
         .handler        =       ipip_rcv,
         .err_handler    =       ipip_err,
 };
 
+static inline int ipip_register(void)
+{
+        return xfrm4_tunnel_register(&ipip_handler);
+}
+
+static inline int ipip_unregister(void)
+{
+        return xfrm4_tunnel_deregister(&ipip_handler);
+}
+#else
+static struct net_protocol ipip_protocol = {
+        .handler        =       ipip_rcv,
+        .err_handler    =       ipip_err,
+        .no_policy      =       1,
+};
+
+static inline int ipip_register(void)
+{
+        return inet_add_protocol(&ipip_protocol, IPPROTO_IPIP);
+}
+
+static inline int ipip_unregister(void)
+{
+        return inet_del_protocol(&ipip_protocol, IPPROTO_IPIP);
+}
+#endif
+
 static char banner[] __initdata =
         KERN_INFO "IPv4 over IPv4 tunneling driver\n";
 
@@ -866,7 +893,7 @@ static int __init ipip_init(void)
 
         printk(banner);
 
-        if (xfrm4_tunnel_register(&ipip_handler) < 0) {
+        if (ipip_register() < 0) {
                 printk(KERN_INFO "ipip init: can't register tunnel\n");
                 return -EAGAIN;
         }
@@ -888,16 +915,33 @@ static int __init ipip_init(void)
  err2:
         free_netdev(ipip_fb_tunnel_dev);
  err1:
-        xfrm4_tunnel_deregister(&ipip_handler);
+        ipip_unregister();
         goto out;
 }
 
+static void __exit ipip_destroy_tunnels(void)
+{
+        int prio;
+
+        for (prio = 1; prio < 4; prio++) {
+                int h;
+                for (h = 0; h < HASH_SIZE; h++) {
+                        struct ip_tunnel *t;
+                        while ((t = tunnels[prio][h]) != NULL)
+                                unregister_netdevice(t->dev);
+                }
+        }
+}
+
 static void __exit ipip_fini(void)
 {
-        if (xfrm4_tunnel_deregister(&ipip_handler) < 0)
+        if (ipip_unregister() < 0)
                 printk(KERN_INFO "ipip close: can't deregister tunnel\n");
 
-        unregister_netdev(ipip_fb_tunnel_dev);
+        rtnl_lock();
+        ipip_destroy_tunnels();
+        unregister_netdevice(ipip_fb_tunnel_dev);
+        rtnl_unlock();
 }
 
 module_init(ipip_init);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index e21c049ec62a..dc806b578427 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -297,6 +297,7 @@ static int vif_delete(int vifi)
 static void ipmr_destroy_unres(struct mfc_cache *c)
 {
         struct sk_buff *skb;
+        struct nlmsgerr *e;
 
         atomic_dec(&cache_resolve_queue_len);
 
@@ -306,7 +307,9 @@ static void ipmr_destroy_unres(struct mfc_cache *c)
                         nlh->nlmsg_type = NLMSG_ERROR;
                         nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr));
                         skb_trim(skb, nlh->nlmsg_len);
-                        ((struct nlmsgerr*)NLMSG_DATA(nlh))->error = -ETIMEDOUT;
+                        e = NLMSG_DATA(nlh);
+                        e->error = -ETIMEDOUT;
+                        memset(&e->msg, 0, sizeof(e->msg));
                         netlink_unicast(rtnl, skb, NETLINK_CB(skb).dst_pid, MSG_DONTWAIT);
                 } else
                         kfree_skb(skb);
@@ -359,7 +362,7 @@ out:
 
 /* Fill oifs list. It is called under write locked mrt_lock. */
 
-static void ipmr_update_threshoulds(struct mfc_cache *cache, unsigned char *ttls)
+static void ipmr_update_thresholds(struct mfc_cache *cache, unsigned char *ttls)
 {
         int vifi;
 
@@ -499,6 +502,7 @@ static struct mfc_cache *ipmr_cache_alloc_unres(void)
 static void ipmr_cache_resolve(struct mfc_cache *uc, struct mfc_cache *c)
 {
         struct sk_buff *skb;
+        struct nlmsgerr *e;
 
         /*
          *      Play the pending entries through our router
@@ -515,7 +519,9 @@ static void ipmr_cache_resolve(struct mfc_cache *uc, struct mfc_cache *c)
                                 nlh->nlmsg_type = NLMSG_ERROR;
                                 nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr));
                                 skb_trim(skb, nlh->nlmsg_len);
-                                ((struct nlmsgerr*)NLMSG_DATA(nlh))->error = -EMSGSIZE;
+                                e = NLMSG_DATA(nlh);
+                                e->error = -EMSGSIZE;
+                                memset(&e->msg, 0, sizeof(e->msg));
                         }
                         err = netlink_unicast(rtnl, skb, NETLINK_CB(skb).dst_pid, MSG_DONTWAIT);
                 } else
@@ -721,7 +727,7 @@ static int ipmr_mfc_add(struct mfcctl *mfc, int mrtsock)
         if (c != NULL) {
                 write_lock_bh(&mrt_lock);
                 c->mfc_parent = mfc->mfcc_parent;
-                ipmr_update_threshoulds(c, mfc->mfcc_ttls);
+                ipmr_update_thresholds(c, mfc->mfcc_ttls);
                 if (!mrtsock)
                         c->mfc_flags |= MFC_STATIC;
                 write_unlock_bh(&mrt_lock);
@@ -738,7 +744,7 @@ static int ipmr_mfc_add(struct mfcctl *mfc, int mrtsock)
         c->mfc_origin=mfc->mfcc_origin.s_addr;
         c->mfc_mcastgrp=mfc->mfcc_mcastgrp.s_addr;
         c->mfc_parent=mfc->mfcc_parent;
-        ipmr_update_threshoulds(c, mfc->mfcc_ttls);
+        ipmr_update_thresholds(c, mfc->mfcc_ttls);
         if (!mrtsock)
                 c->mfc_flags |= MFC_STATIC;
 
@@ -1350,6 +1356,7 @@ int ip_mr_input(struct sk_buff *skb)
                              */
                             read_lock(&mrt_lock);
                             if (mroute_socket) {
+                                    nf_reset(skb);
                                     raw_rcv(mroute_socket, skb);
                                     read_unlock(&mrt_lock);
                                     return 0;
diff --git a/net/ipv4/ipvs/Kconfig b/net/ipv4/ipvs/Kconfig
index 63a82b4b64bb..c9820bfc493a 100644
--- a/net/ipv4/ipvs/Kconfig
+++ b/net/ipv4/ipvs/Kconfig
@@ -2,11 +2,11 @@
 # IP Virtual Server configuration
 #
 menu    "IP: Virtual Server Configuration"
-        depends on INET && NETFILTER
+        depends on NETFILTER
 
 config  IP_VS
         tristate "IP virtual server support (EXPERIMENTAL)"
-        depends on INET && NETFILTER
+        depends on NETFILTER
         ---help---
           IP Virtual Server support will let you build a high-performance
           virtual server based on cluster of two or more real servers. This
diff --git a/net/ipv4/ipvs/ip_vs_conn.c b/net/ipv4/ipvs/ip_vs_conn.c
index fd6feb5499fe..d0145a8b1551 100644
--- a/net/ipv4/ipvs/ip_vs_conn.c
+++ b/net/ipv4/ipvs/ip_vs_conn.c
@@ -548,7 +548,6 @@ void ip_vs_conn_expire_now(struct ip_vs_conn *cp)
 {
         if (del_timer(&cp->timer))
                 mod_timer(&cp->timer, jiffies);
-        __ip_vs_conn_put(cp);
 }
 
 
@@ -759,12 +758,11 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
         return 1;
 }
 
-
+/* Called from keventd and must protect itself from softirqs */
 void ip_vs_random_dropentry(void)
 {
         int idx;
         struct ip_vs_conn *cp;
-        struct ip_vs_conn *ct;
 
         /*
          * Randomly scan 1/32 of the whole table every second
@@ -775,7 +773,7 @@ void ip_vs_random_dropentry(void)
                 /*
                  *  Lock is actually needed in this loop.
                  */
-                ct_write_lock(hash);
+                ct_write_lock_bh(hash);
 
                 list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
                         if (!cp->cport && !(cp->flags & IP_VS_CONN_F_NO_CPORT))
@@ -801,23 +799,14 @@ void ip_vs_random_dropentry(void)
                                         continue;
                         }
 
-                        /*
-                         * Drop the entry, and drop its ct if not referenced
-                         */
-                        atomic_inc(&cp->refcnt);
-                        ct_write_unlock(hash);
-
-                        if ((ct = cp->control))
-                                atomic_inc(&ct->refcnt);
                         IP_VS_DBG(4, "del connection\n");
                         ip_vs_conn_expire_now(cp);
-                        if (ct) {
+                        if (cp->control) {
                                 IP_VS_DBG(4, "del conn template\n");
-                                ip_vs_conn_expire_now(ct);
+                                ip_vs_conn_expire_now(cp->control);
                         }
-                        ct_write_lock(hash);
                 }
-                ct_write_unlock(hash);
+                ct_write_unlock_bh(hash);
         }
 }
 
@@ -829,7 +818,6 @@ static void ip_vs_conn_flush(void)
 {
         int idx;
         struct ip_vs_conn *cp;
-        struct ip_vs_conn *ct;
 
   flush_again:
         for (idx=0; idx<IP_VS_CONN_TAB_SIZE; idx++) {
@@ -839,18 +827,13 @@ static void ip_vs_conn_flush(void)
                 ct_write_lock_bh(idx);
 
                 list_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {
-                        atomic_inc(&cp->refcnt);
-                        ct_write_unlock(idx);
 
-                        if ((ct = cp->control))
-                                atomic_inc(&ct->refcnt);
                         IP_VS_DBG(4, "del connection\n");
                         ip_vs_conn_expire_now(cp);
-                        if (ct) {
+                        if (cp->control) {
                                 IP_VS_DBG(4, "del conn template\n");
-                                ip_vs_conn_expire_now(ct);
+                                ip_vs_conn_expire_now(cp->control);
                         }
-                        ct_write_lock(idx);
                 }
                 ct_write_unlock_bh(idx);
         }
diff --git a/net/ipv4/ipvs/ip_vs_ctl.c b/net/ipv4/ipvs/ip_vs_ctl.c
index 218d9701036e..7d99ede2ef79 100644
--- a/net/ipv4/ipvs/ip_vs_ctl.c
+++ b/net/ipv4/ipvs/ip_vs_ctl.c
@@ -90,7 +90,8 @@ int ip_vs_get_debug_level(void)
 #endif
 
 /*
- *      update_defense_level is called from keventd and from sysctl.
+ *      update_defense_level is called from keventd and from sysctl,
+ *      so it needs to protect itself from softirqs
  */
 static void update_defense_level(void)
 {
@@ -110,6 +111,8 @@ static void update_defense_level(void)
 
         nomem = (availmem < sysctl_ip_vs_amemthresh);
 
+        local_bh_disable();
+
         /* drop_entry */
         spin_lock(&__ip_vs_dropentry_lock);
         switch (sysctl_ip_vs_drop_entry) {
@@ -206,6 +209,8 @@ static void update_defense_level(void)
         if (to_change >= 0)
                 ip_vs_protocol_timeout_change(sysctl_ip_vs_secure_tcp>1);
         write_unlock(&__ip_vs_securetcp_lock);
+
+        local_bh_enable();
 }
 
 
@@ -1360,9 +1365,7 @@ proc_do_defense_mode(ctl_table *table, int write, struct file * filp,
                         /* Restore the correct value */
                         *valp = val;
                 } else {
-                        local_bh_disable();
                         update_defense_level();
-                        local_bh_enable();
                 }
         }
         return rc;
@@ -2059,7 +2062,7 @@ ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
         dst->addr = src->addr;
         dst->port = src->port;
         dst->fwmark = src->fwmark;
-        strcpy(dst->sched_name, src->scheduler->name);
+        strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
         dst->flags = src->flags;
         dst->timeout = src->timeout / HZ;
         dst->netmask = src->netmask;
@@ -2080,6 +2083,7 @@ __ip_vs_get_service_entries(const struct ip_vs_get_services *get,
                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
                         if (count >= get->num_services)
                                 goto out;
+                        memset(&entry, 0, sizeof(entry));
                         ip_vs_copy_service(&entry, svc);
                         if (copy_to_user(&uptr->entrytable[count],
                                          &entry, sizeof(entry))) {
@@ -2094,6 +2098,7 @@ __ip_vs_get_service_entries(const struct ip_vs_get_services *get,
                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
                         if (count >= get->num_services)
                                 goto out;
+                        memset(&entry, 0, sizeof(entry));
                         ip_vs_copy_service(&entry, svc);
                         if (copy_to_user(&uptr->entrytable[count],
                                          &entry, sizeof(entry))) {
@@ -2304,12 +2309,12 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
                 memset(&d, 0, sizeof(d));
                 if (ip_vs_sync_state & IP_VS_STATE_MASTER) {
                         d[0].state = IP_VS_STATE_MASTER;
-                        strcpy(d[0].mcast_ifn, ip_vs_master_mcast_ifn);
+                        strlcpy(d[0].mcast_ifn, ip_vs_master_mcast_ifn, sizeof(d[0].mcast_ifn));
                         d[0].syncid = ip_vs_master_syncid;
                 }
                 if (ip_vs_sync_state & IP_VS_STATE_BACKUP) {
                         d[1].state = IP_VS_STATE_BACKUP;
-                        strcpy(d[1].mcast_ifn, ip_vs_backup_mcast_ifn);
+                        strlcpy(d[1].mcast_ifn, ip_vs_backup_mcast_ifn, sizeof(d[1].mcast_ifn));
                         d[1].syncid = ip_vs_backup_syncid;
                 }
                 if (copy_to_user(user, &d, sizeof(d)) != 0)
diff --git a/net/ipv4/ipvs/ip_vs_sync.c b/net/ipv4/ipvs/ip_vs_sync.c
index 25c479550a32..574d1f509b46 100644
--- a/net/ipv4/ipvs/ip_vs_sync.c
+++ b/net/ipv4/ipvs/ip_vs_sync.c
@@ -839,10 +839,10 @@ int start_sync_thread(int state, char *mcast_ifn, __u8 syncid)
 
         ip_vs_sync_state |= state;
         if (state == IP_VS_STATE_MASTER) {
-                strcpy(ip_vs_master_mcast_ifn, mcast_ifn);
+                strlcpy(ip_vs_master_mcast_ifn, mcast_ifn, sizeof(ip_vs_master_mcast_ifn));
                 ip_vs_master_syncid = syncid;
         } else {
-                strcpy(ip_vs_backup_mcast_ifn, mcast_ifn);
+                strlcpy(ip_vs_backup_mcast_ifn, mcast_ifn, sizeof(ip_vs_backup_mcast_ifn));
                 ip_vs_backup_syncid = syncid;
         }
 
diff --git a/net/ipv4/ipvs/ip_vs_xmit.c b/net/ipv4/ipvs/ip_vs_xmit.c
index de21da00057f..a8512a3fd08a 100644
--- a/net/ipv4/ipvs/ip_vs_xmit.c
+++ b/net/ipv4/ipvs/ip_vs_xmit.c
@@ -127,7 +127,6 @@ ip_vs_dst_reset(struct ip_vs_dest *dest)
 
 #define IP_VS_XMIT(skb, rt)                             \
 do {                                                    \
-        nf_reset_debug(skb);                            \
         (skb)->nfcache |= NFC_IPVS_PROPERTY;            \
         (skb)->ip_summed = CHECKSUM_NONE;               \
         NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, (skb), NULL,  \
diff --git a/net/ipv4/multipath_drr.c b/net/ipv4/multipath_drr.c
index cf2e6bcf7973..c9cf8726051d 100644
--- a/net/ipv4/multipath_drr.c
+++ b/net/ipv4/multipath_drr.c
@@ -31,6 +31,7 @@
 #include <linux/igmp.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/module.h>
 #include <linux/mroute.h>
 #include <linux/init.h>
 #include <net/ip.h>
@@ -247,3 +248,4 @@ static void __exit drr_exit(void)
 
 module_init(drr_init);
 module_exit(drr_exit);
+MODULE_LICENSE("GPL");
diff --git a/net/ipv4/multipath_random.c b/net/ipv4/multipath_random.c
index 805a16e47de5..5249dbe7c559 100644
--- a/net/ipv4/multipath_random.c
+++ b/net/ipv4/multipath_random.c
@@ -31,6 +31,7 @@
 #include <linux/igmp.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/module.h>
 #include <linux/mroute.h>
 #include <linux/init.h>
 #include <net/ip.h>
@@ -126,3 +127,4 @@ static void __exit random_exit(void)
 
 module_init(random_init);
 module_exit(random_exit);
+MODULE_LICENSE("GPL");
diff --git a/net/ipv4/multipath_rr.c b/net/ipv4/multipath_rr.c
index 061b6b253982..b6cd2870478f 100644
--- a/net/ipv4/multipath_rr.c
+++ b/net/ipv4/multipath_rr.c
@@ -31,6 +31,7 @@
 #include <linux/igmp.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/module.h>
 #include <linux/mroute.h>
 #include <linux/init.h>
 #include <net/ip.h>
@@ -93,3 +94,4 @@ static void __exit rr_exit(void)
 
 module_init(rr_init);
 module_exit(rr_exit);
+MODULE_LICENSE("GPL");
diff --git a/net/ipv4/multipath_wrandom.c b/net/ipv4/multipath_wrandom.c
index c3d2ca1a6781..bd7d75b6abe0 100644
--- a/net/ipv4/multipath_wrandom.c
+++ b/net/ipv4/multipath_wrandom.c
@@ -31,6 +31,7 @@
 #include <linux/igmp.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/module.h>
 #include <linux/mroute.h>
 #include <linux/init.h>
 #include <net/ip.h>
@@ -342,3 +343,4 @@ static void __exit wrandom_exit(void)
 
 module_init(wrandom_init);
 module_exit(wrandom_exit);
+MODULE_LICENSE("GPL");
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index df79f5ed6a0a..fa1634256680 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -60,7 +60,6 @@ static DECLARE_MUTEX(arpt_mutex);
 
 #define ASSERT_READ_LOCK(x) ARP_NF_ASSERT(down_trylock(&arpt_mutex) != 0)
 #define ASSERT_WRITE_LOCK(x) ARP_NF_ASSERT(down_trylock(&arpt_mutex) != 0)
-#include <linux/netfilter_ipv4/lockhelp.h>
 #include <linux/netfilter_ipv4/listhelp.h>
 
 struct arpt_table_info {
diff --git a/net/ipv4/netfilter/ip_conntrack_amanda.c b/net/ipv4/netfilter/ip_conntrack_amanda.c
index 3dbddd062605..01e1b58322a9 100644
--- a/net/ipv4/netfilter/ip_conntrack_amanda.c
+++ b/net/ipv4/netfilter/ip_conntrack_amanda.c
@@ -26,7 +26,6 @@
 #include <net/checksum.h>
 #include <net/udp.h>
 
-#include <linux/netfilter_ipv4/lockhelp.h>
 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
 #include <linux/netfilter_ipv4/ip_conntrack_amanda.h>
 
@@ -42,7 +41,7 @@ static char *conns[] = { "DATA ", "MESG ", "INDEX " };
 
 /* This is slow, but it's simple. --RR */
 static char amanda_buffer[65536];
-static DECLARE_LOCK(amanda_buffer_lock);
+static DEFINE_SPINLOCK(amanda_buffer_lock);
 
 unsigned int (*ip_nat_amanda_hook)(struct sk_buff **pskb,
                                    enum ip_conntrack_info ctinfo,
@@ -76,7 +75,7 @@ static int help(struct sk_buff **pskb,
                 return NF_ACCEPT;
         }
 
-        LOCK_BH(&amanda_buffer_lock);
+        spin_lock_bh(&amanda_buffer_lock);
         skb_copy_bits(*pskb, dataoff, amanda_buffer, (*pskb)->len - dataoff);
         data = amanda_buffer;
         data_limit = amanda_buffer + (*pskb)->len - dataoff;
@@ -102,14 +101,13 @@ static int help(struct sk_buff **pskb,
                 if (port == 0 || len > 5)
                         break;
 
-                exp = ip_conntrack_expect_alloc();
+                exp = ip_conntrack_expect_alloc(ct);
                 if (exp == NULL) {
                         ret = NF_DROP;
                         goto out;
                 }
 
                 exp->expectfn = NULL;
-                exp->master = ct;
 
                 exp->tuple.src.ip = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
                 exp->tuple.src.u.tcp.port = 0;
@@ -127,14 +125,13 @@ static int help(struct sk_buff **pskb,
                         ret = ip_nat_amanda_hook(pskb, ctinfo,
                                                  tmp - amanda_buffer,
                                                  len, exp);
-                else if (ip_conntrack_expect_related(exp) != 0) {
-                        ip_conntrack_expect_free(exp);
+                else if (ip_conntrack_expect_related(exp) != 0)
                         ret = NF_DROP;
-                }
+                ip_conntrack_expect_put(exp);
         }
 
 out:
-        UNLOCK_BH(&amanda_buffer_lock);
+        spin_unlock_bh(&amanda_buffer_lock);
         return ret;
 }
 
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 09e824622977..a7f0c821a9b2 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -38,10 +38,10 @@
 #include <linux/percpu.h>
 #include <linux/moduleparam.h>
 
-/* This rwlock protects the main hash table, protocol/helper/expected
+/* ip_conntrack_lock protects the main hash table, protocol/helper/expected
    registrations, conntrack timers*/
-#define ASSERT_READ_LOCK(x) MUST_BE_READ_LOCKED(&ip_conntrack_lock)
-#define ASSERT_WRITE_LOCK(x) MUST_BE_WRITE_LOCKED(&ip_conntrack_lock)
+#define ASSERT_READ_LOCK(x)
+#define ASSERT_WRITE_LOCK(x)
 
 #include <linux/netfilter_ipv4/ip_conntrack.h>
 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
@@ -57,7 +57,7 @@
 #define DEBUGP(format, args...)
 #endif
 
-DECLARE_RWLOCK(ip_conntrack_lock);
+DEFINE_RWLOCK(ip_conntrack_lock);
 
 /* ip_conntrack_standalone needs this */
 atomic_t ip_conntrack_count = ATOMIC_INIT(0);
@@ -137,19 +137,12 @@ ip_ct_invert_tuple(struct ip_conntrack_tuple *inverse,
 
 
 /* ip_conntrack_expect helper functions */
-static void destroy_expect(struct ip_conntrack_expect *exp)
-{
-        ip_conntrack_put(exp->master);
-        IP_NF_ASSERT(!timer_pending(&exp->timeout));
-        kmem_cache_free(ip_conntrack_expect_cachep, exp);
-        CONNTRACK_STAT_INC(expect_delete);
-}
-
 static void unlink_expect(struct ip_conntrack_expect *exp)
 {
-        MUST_BE_WRITE_LOCKED(&ip_conntrack_lock);
+        ASSERT_WRITE_LOCK(&ip_conntrack_lock);
+        IP_NF_ASSERT(!timer_pending(&exp->timeout));
         list_del(&exp->list);
-        /* Logically in destroy_expect, but we hold the lock here. */
+        CONNTRACK_STAT_INC(expect_delete);
         exp->master->expecting--;
 }
 
@@ -157,10 +150,10 @@ static void expectation_timed_out(unsigned long ul_expect)
 {
         struct ip_conntrack_expect *exp = (void *)ul_expect;
 
-        WRITE_LOCK(&ip_conntrack_lock);
+        write_lock_bh(&ip_conntrack_lock);
         unlink_expect(exp);
-        WRITE_UNLOCK(&ip_conntrack_lock);
-        destroy_expect(exp);
+        write_unlock_bh(&ip_conntrack_lock);
+        ip_conntrack_expect_put(exp);
 }
 
 /* If an expectation for this connection is found, it gets delete from
@@ -198,7 +191,7 @@ static void remove_expectations(struct ip_conntrack *ct)
         list_for_each_entry_safe(i, tmp, &ip_conntrack_expect_list, list) {
                 if (i->master == ct && del_timer(&i->timeout)) {
                         unlink_expect(i);
-                        destroy_expect(i);
+                        ip_conntrack_expect_put(i);
                 }
         }
 }
@@ -209,7 +202,7 @@ clean_from_lists(struct ip_conntrack *ct)
         unsigned int ho, hr;
         
         DEBUGP("clean_from_lists(%p)\n", ct);
-        MUST_BE_WRITE_LOCKED(&ip_conntrack_lock);
+        ASSERT_WRITE_LOCK(&ip_conntrack_lock);
 
         ho = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
         hr = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
@@ -240,7 +233,7 @@ destroy_conntrack(struct nf_conntrack *nfct)
         if (ip_conntrack_destroyed)
                 ip_conntrack_destroyed(ct);
 
-        WRITE_LOCK(&ip_conntrack_lock);
+        write_lock_bh(&ip_conntrack_lock);
         /* Expectations will have been removed in clean_from_lists,
          * except TFTP can create an expectation on the first packet,
          * before connection is in the list, so we need to clean here,
@@ -254,7 +247,7 @@ destroy_conntrack(struct nf_conntrack *nfct)
         }
 
         CONNTRACK_STAT_INC(delete);
-        WRITE_UNLOCK(&ip_conntrack_lock);
+        write_unlock_bh(&ip_conntrack_lock);
 
         if (ct->master)
                 ip_conntrack_put(ct->master);
@@ -268,12 +261,12 @@ static void death_by_timeout(unsigned long ul_conntrack)
 {
         struct ip_conntrack *ct = (void *)ul_conntrack;
 
-        WRITE_LOCK(&ip_conntrack_lock);
+        write_lock_bh(&ip_conntrack_lock);
         /* Inside lock so preempt is disabled on module removal path.
          * Otherwise we can get spurious warnings. */
         CONNTRACK_STAT_INC(delete_list);
         clean_from_lists(ct);
-        WRITE_UNLOCK(&ip_conntrack_lock);
+        write_unlock_bh(&ip_conntrack_lock);
         ip_conntrack_put(ct);
 }
 
@@ -282,7 +275,7 @@ conntrack_tuple_cmp(const struct ip_conntrack_tuple_hash *i,
                     const struct ip_conntrack_tuple *tuple,
                     const struct ip_conntrack *ignored_conntrack)
 {
-        MUST_BE_READ_LOCKED(&ip_conntrack_lock);
+        ASSERT_READ_LOCK(&ip_conntrack_lock);
         return tuplehash_to_ctrack(i) != ignored_conntrack
                 && ip_ct_tuple_equal(tuple, &i->tuple);
 }
@@ -294,7 +287,7 @@ __ip_conntrack_find(const struct ip_conntrack_tuple *tuple,
         struct ip_conntrack_tuple_hash *h;
         unsigned int hash = hash_conntrack(tuple);
 
-        MUST_BE_READ_LOCKED(&ip_conntrack_lock);
+        ASSERT_READ_LOCK(&ip_conntrack_lock);
         list_for_each_entry(h, &ip_conntrack_hash[hash], list) {
                 if (conntrack_tuple_cmp(h, tuple, ignored_conntrack)) {
                         CONNTRACK_STAT_INC(found);
@@ -313,11 +306,11 @@ ip_conntrack_find_get(const struct ip_conntrack_tuple *tuple,
 {
         struct ip_conntrack_tuple_hash *h;
 
-        READ_LOCK(&ip_conntrack_lock);
+        read_lock_bh(&ip_conntrack_lock);
         h = __ip_conntrack_find(tuple, ignored_conntrack);
         if (h)
                 atomic_inc(&tuplehash_to_ctrack(h)->ct_general.use);
-        READ_UNLOCK(&ip_conntrack_lock);
+        read_unlock_bh(&ip_conntrack_lock);
 
         return h;
 }
@@ -352,7 +345,7 @@ __ip_conntrack_confirm(struct sk_buff **pskb)
         IP_NF_ASSERT(!is_confirmed(ct));
         DEBUGP("Confirming conntrack %p\n", ct);
 
-        WRITE_LOCK(&ip_conntrack_lock);
+        write_lock_bh(&ip_conntrack_lock);
 
         /* See if there's one in the list already, including reverse:
            NAT could have grabbed it without realizing, since we're
@@ -380,12 +373,12 @@ __ip_conntrack_confirm(struct sk_buff **pskb)
                 atomic_inc(&ct->ct_general.use);
                 set_bit(IPS_CONFIRMED_BIT, &ct->status);
                 CONNTRACK_STAT_INC(insert);
-                WRITE_UNLOCK(&ip_conntrack_lock);
+                write_unlock_bh(&ip_conntrack_lock);
                 return NF_ACCEPT;
         }
 
         CONNTRACK_STAT_INC(insert_failed);
-        WRITE_UNLOCK(&ip_conntrack_lock);
+        write_unlock_bh(&ip_conntrack_lock);
 
         return NF_DROP;
 }
@@ -398,9 +391,9 @@ ip_conntrack_tuple_taken(const struct ip_conntrack_tuple *tuple,
 {
         struct ip_conntrack_tuple_hash *h;
 
-        READ_LOCK(&ip_conntrack_lock);
+        read_lock_bh(&ip_conntrack_lock);
         h = __ip_conntrack_find(tuple, ignored_conntrack);
-        READ_UNLOCK(&ip_conntrack_lock);
+        read_unlock_bh(&ip_conntrack_lock);
 
         return h != NULL;
 }
@@ -419,13 +412,13 @@ static int early_drop(struct list_head *chain)
         struct ip_conntrack *ct = NULL;
         int dropped = 0;
 
-        READ_LOCK(&ip_conntrack_lock);
+        read_lock_bh(&ip_conntrack_lock);
         h = LIST_FIND_B(chain, unreplied, struct ip_conntrack_tuple_hash *);
         if (h) {
                 ct = tuplehash_to_ctrack(h);
                 atomic_inc(&ct->ct_general.use);
         }
-        READ_UNLOCK(&ip_conntrack_lock);
+        read_unlock_bh(&ip_conntrack_lock);
 
         if (!ct)
                 return dropped;
@@ -508,7 +501,7 @@ init_conntrack(const struct ip_conntrack_tuple *tuple,
         conntrack->timeout.data = (unsigned long)conntrack;
         conntrack->timeout.function = death_by_timeout;
 
-        WRITE_LOCK(&ip_conntrack_lock);
+        write_lock_bh(&ip_conntrack_lock);
         exp = find_expectation(tuple);
 
         if (exp) {
@@ -517,9 +510,14 @@ init_conntrack(const struct ip_conntrack_tuple *tuple,
                 /* Welcome, Mr. Bond.  We've been expecting you... */
                 __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
                 conntrack->master = exp->master;
-#if CONFIG_IP_NF_CONNTRACK_MARK
+#ifdef CONFIG_IP_NF_CONNTRACK_MARK
                 conntrack->mark = exp->master->mark;
 #endif
+#if defined(CONFIG_IP_NF_TARGET_MASQUERADE) || \
+    defined(CONFIG_IP_NF_TARGET_MASQUERADE_MODULE)
+                /* this is ugly, but there is no other place where to put it */
+                conntrack->nat.masq_index = exp->master->nat.masq_index;
+#endif
                 nf_conntrack_get(&conntrack->master->ct_general);
                 CONNTRACK_STAT_INC(expect_new);
         } else {
@@ -532,12 +530,12 @@ init_conntrack(const struct ip_conntrack_tuple *tuple,
         list_add(&conntrack->tuplehash[IP_CT_DIR_ORIGINAL].list, &unconfirmed);
 
         atomic_inc(&ip_conntrack_count);
-        WRITE_UNLOCK(&ip_conntrack_lock);
+        write_unlock_bh(&ip_conntrack_lock);
 
         if (exp) {
                 if (exp->expectfn)
                         exp->expectfn(conntrack, exp);
-                destroy_expect(exp);
+                ip_conntrack_expect_put(exp);
         }
 
         return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
@@ -723,20 +721,20 @@ void ip_conntrack_unexpect_related(struct ip_conntrack_expect *exp)
 {
         struct ip_conntrack_expect *i;
 
-        WRITE_LOCK(&ip_conntrack_lock);
+        write_lock_bh(&ip_conntrack_lock);
         /* choose the the oldest expectation to evict */
         list_for_each_entry_reverse(i, &ip_conntrack_expect_list, list) {
                 if (expect_matches(i, exp) && del_timer(&i->timeout)) {
                         unlink_expect(i);
-                        WRITE_UNLOCK(&ip_conntrack_lock);
-                        destroy_expect(i);
+                        write_unlock_bh(&ip_conntrack_lock);
+                        ip_conntrack_expect_put(i);
                         return;
                 }
         }
-        WRITE_UNLOCK(&ip_conntrack_lock);
+        write_unlock_bh(&ip_conntrack_lock);
 }
 
-struct ip_conntrack_expect *ip_conntrack_expect_alloc(void)
+struct ip_conntrack_expect *ip_conntrack_expect_alloc(struct ip_conntrack *me)
 {
         struct ip_conntrack_expect *new;
 
@@ -745,30 +743,31 @@ struct ip_conntrack_expect *ip_conntrack_expect_alloc(void)
                 DEBUGP("expect_related: OOM allocating expect\n");
                 return NULL;
         }
-        new->master = NULL;
+        new->master = me;
+        atomic_inc(&new->master->ct_general.use);
+        atomic_set(&new->use, 1);
         return new;
 }
 
-void ip_conntrack_expect_free(struct ip_conntrack_expect *expect)
+void ip_conntrack_expect_put(struct ip_conntrack_expect *exp)
 {
-        kmem_cache_free(ip_conntrack_expect_cachep, expect);
+        if (atomic_dec_and_test(&exp->use)) {
+                ip_conntrack_put(exp->master);
+                kmem_cache_free(ip_conntrack_expect_cachep, exp);
+        }
 }
 
 static void ip_conntrack_expect_insert(struct ip_conntrack_expect *exp)
 {
-        atomic_inc(&exp->master->ct_general.use);
+        atomic_inc(&exp->use);
         exp->master->expecting++;
         list_add(&exp->list, &ip_conntrack_expect_list);
 
-        if (exp->master->helper->timeout) {
-                init_timer(&exp->timeout);
-                exp->timeout.data = (unsigned long)exp;
-                exp->timeout.function = expectation_timed_out;
-                exp->timeout.expires
-                        = jiffies + exp->master->helper->timeout * HZ;
-                add_timer(&exp->timeout);
-        } else
-                exp->timeout.function = NULL;
+        init_timer(&exp->timeout);
+        exp->timeout.data = (unsigned long)exp;
+        exp->timeout.function = expectation_timed_out;
+        exp->timeout.expires = jiffies + exp->master->helper->timeout * HZ;
+        add_timer(&exp->timeout);
 
         CONNTRACK_STAT_INC(expect_create);
 }
@@ -782,7 +781,7 @@ static void evict_oldest_expect(struct ip_conntrack *master)
                 if (i->master == master) {
                         if (del_timer(&i->timeout)) {
                                 unlink_expect(i);
-                                destroy_expect(i);
+                                ip_conntrack_expect_put(i);
                         }
                         break;
                 }
@@ -808,14 +807,12 @@ int ip_conntrack_expect_related(struct ip_conntrack_expect *expect)
         DEBUGP("tuple: "); DUMP_TUPLE(&expect->tuple);
         DEBUGP("mask:  "); DUMP_TUPLE(&expect->mask);
 
-        WRITE_LOCK(&ip_conntrack_lock);
+        write_lock_bh(&ip_conntrack_lock);
         list_for_each_entry(i, &ip_conntrack_expect_list, list) {
                 if (expect_matches(i, expect)) {
                         /* Refresh timer: if it's dying, ignore.. */
                         if (refresh_timer(i)) {
                                 ret = 0;
-                                /* We don't need the one they've given us. */
-                                ip_conntrack_expect_free(expect);
                                 goto out;
                         }
                 } else if (expect_clash(i, expect)) {
@@ -832,7 +829,7 @@ int ip_conntrack_expect_related(struct ip_conntrack_expect *expect)
         ip_conntrack_expect_insert(expect);
         ret = 0;
 out:
-        WRITE_UNLOCK(&ip_conntrack_lock);
+        write_unlock_bh(&ip_conntrack_lock);
         return ret;
 }
 
@@ -841,7 +838,7 @@ out:
 void ip_conntrack_alter_reply(struct ip_conntrack *conntrack,
                               const struct ip_conntrack_tuple *newreply)
 {
-        WRITE_LOCK(&ip_conntrack_lock);
+        write_lock_bh(&ip_conntrack_lock);
         /* Should be unconfirmed, so not in hash table yet */
         IP_NF_ASSERT(!is_confirmed(conntrack));
 
@@ -851,15 +848,15 @@ void ip_conntrack_alter_reply(struct ip_conntrack *conntrack,
         conntrack->tuplehash[IP_CT_DIR_REPLY].tuple = *newreply;
         if (!conntrack->master && conntrack->expecting == 0)
                 conntrack->helper = ip_ct_find_helper(newreply);
-        WRITE_UNLOCK(&ip_conntrack_lock);
+        write_unlock_bh(&ip_conntrack_lock);
 }
 
 int ip_conntrack_helper_register(struct ip_conntrack_helper *me)
 {
         BUG_ON(me->timeout == 0);
-        WRITE_LOCK(&ip_conntrack_lock);
+        write_lock_bh(&ip_conntrack_lock);
         list_prepend(&helpers, me);
-        WRITE_UNLOCK(&ip_conntrack_lock);
+        write_unlock_bh(&ip_conntrack_lock);
 
         return 0;
 }
@@ -878,14 +875,14 @@ void ip_conntrack_helper_unregister(struct ip_conntrack_helper *me)
         struct ip_conntrack_expect *exp, *tmp;
 
         /* Need write lock here, to delete helper. */
-        WRITE_LOCK(&ip_conntrack_lock);
+        write_lock_bh(&ip_conntrack_lock);
         LIST_DELETE(&helpers, me);
 
         /* Get rid of expectations */
         list_for_each_entry_safe(exp, tmp, &ip_conntrack_expect_list, list) {
                 if (exp->master->helper == me && del_timer(&exp->timeout)) {
                         unlink_expect(exp);
-                        destroy_expect(exp);
+                        ip_conntrack_expect_put(exp);
                 }
         }
         /* Get rid of expecteds, set helpers to NULL. */
@@ -893,7 +890,7 @@ void ip_conntrack_helper_unregister(struct ip_conntrack_helper *me)
         for (i = 0; i < ip_conntrack_htable_size; i++)
                 LIST_FIND_W(&ip_conntrack_hash[i], unhelp,
                             struct ip_conntrack_tuple_hash *, me);
-        WRITE_UNLOCK(&ip_conntrack_lock);
+        write_unlock_bh(&ip_conntrack_lock);
 
         /* Someone could be still looking at the helper in a bh. */
         synchronize_net();
@@ -925,14 +922,14 @@ void ip_ct_refresh_acct(struct ip_conntrack *ct,
                 ct->timeout.expires = extra_jiffies;
                 ct_add_counters(ct, ctinfo, skb);
         } else {
-                WRITE_LOCK(&ip_conntrack_lock);
+                write_lock_bh(&ip_conntrack_lock);
                 /* Need del_timer for race avoidance (may already be dying). */
                 if (del_timer(&ct->timeout)) {
                         ct->timeout.expires = jiffies + extra_jiffies;
                         add_timer(&ct->timeout);
                 }
                 ct_add_counters(ct, ctinfo, skb);
-                WRITE_UNLOCK(&ip_conntrack_lock);
+                write_unlock_bh(&ip_conntrack_lock);
         }
 }
 
@@ -940,10 +937,6 @@ void ip_ct_refresh_acct(struct ip_conntrack *ct,
 struct sk_buff *
 ip_ct_gather_frags(struct sk_buff *skb, u_int32_t user)
 {
-#ifdef CONFIG_NETFILTER_DEBUG
-        unsigned int olddebug = skb->nf_debug;
-#endif
-
         skb_orphan(skb);
 
         local_bh_disable(); 
@@ -953,12 +946,7 @@ ip_ct_gather_frags(struct sk_buff *skb, u_int32_t user)
         if (skb) {
                 ip_send_check(skb->nh.iph);
                 skb->nfcache |= NFC_ALTERED;
-#ifdef CONFIG_NETFILTER_DEBUG
-                /* Packet path as if nothing had happened. */
-                skb->nf_debug = olddebug;
-#endif
         }
-
         return skb;
 }
 
@@ -997,7 +985,7 @@ get_next_corpse(int (*iter)(struct ip_conntrack *i, void *data),
 {
         struct ip_conntrack_tuple_hash *h = NULL;
 
-        WRITE_LOCK(&ip_conntrack_lock);
+        write_lock_bh(&ip_conntrack_lock);
         for (; *bucket < ip_conntrack_htable_size; (*bucket)++) {
                 h = LIST_FIND_W(&ip_conntrack_hash[*bucket], do_iter,
                                 struct ip_conntrack_tuple_hash *, iter, data);
@@ -1009,7 +997,7 @@ get_next_corpse(int (*iter)(struct ip_conntrack *i, void *data),
                                 struct ip_conntrack_tuple_hash *, iter, data);
         if (h)
                 atomic_inc(&tuplehash_to_ctrack(h)->ct_general.use);
-        WRITE_UNLOCK(&ip_conntrack_lock);
+        write_unlock_bh(&ip_conntrack_lock);
 
         return h;
 }
@@ -1124,6 +1112,9 @@ void ip_conntrack_cleanup(void)
                 schedule();
                 goto i_see_dead_people;
         }
+        /* wait until all references to ip_conntrack_untracked are dropped */
+        while (atomic_read(&ip_conntrack_untracked.ct_general.use) > 1)
+                schedule();
 
         kmem_cache_destroy(ip_conntrack_cachep);
         kmem_cache_destroy(ip_conntrack_expect_cachep);
@@ -1201,14 +1192,14 @@ int __init ip_conntrack_init(void)
         }
 
         /* Don't NEED lock here, but good form anyway. */
-        WRITE_LOCK(&ip_conntrack_lock);
+        write_lock_bh(&ip_conntrack_lock);
         for (i = 0; i < MAX_IP_CT_PROTO; i++)
                 ip_ct_protos[i] = &ip_conntrack_generic_protocol;
         /* Sew in builtin protocols. */
         ip_ct_protos[IPPROTO_TCP] = &ip_conntrack_protocol_tcp;
         ip_ct_protos[IPPROTO_UDP] = &ip_conntrack_protocol_udp;
         ip_ct_protos[IPPROTO_ICMP] = &ip_conntrack_protocol_icmp;
-        WRITE_UNLOCK(&ip_conntrack_lock);
+        write_unlock_bh(&ip_conntrack_lock);
 
         for (i = 0; i < ip_conntrack_htable_size; i++)
                 INIT_LIST_HEAD(&ip_conntrack_hash[i]);
diff --git a/net/ipv4/netfilter/ip_conntrack_ftp.c b/net/ipv4/netfilter/ip_conntrack_ftp.c
index dd86503aa788..7a3b773be3f9 100644
--- a/net/ipv4/netfilter/ip_conntrack_ftp.c
+++ b/net/ipv4/netfilter/ip_conntrack_ftp.c
@@ -16,7 +16,6 @@
 #include <net/checksum.h>
 #include <net/tcp.h>
 
-#include <linux/netfilter_ipv4/lockhelp.h>
 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
 #include <linux/netfilter_ipv4/ip_conntrack_ftp.h>
 #include <linux/moduleparam.h>
@@ -28,7 +27,7 @@ MODULE_DESCRIPTION("ftp connection tracking helper");
 /* This is slow, but it's simple. --RR */
 static char ftp_buffer[65536];
 
-static DECLARE_LOCK(ip_ftp_lock);
+static DEFINE_SPINLOCK(ip_ftp_lock);
 
 #define MAX_PORTS 8
 static int ports[MAX_PORTS];
@@ -319,7 +318,7 @@ static int help(struct sk_buff **pskb,
         }
         datalen = (*pskb)->len - dataoff;
 
-        LOCK_BH(&ip_ftp_lock);
+        spin_lock_bh(&ip_ftp_lock);
         fb_ptr = skb_header_pointer(*pskb, dataoff,
                                     (*pskb)->len - dataoff, ftp_buffer);
         BUG_ON(fb_ptr == NULL);
@@ -377,7 +376,7 @@ static int help(struct sk_buff **pskb,
                fb_ptr + matchoff, matchlen, ntohl(th->seq) + matchoff);
                          
         /* Allocate expectation which will be inserted */
-        exp = ip_conntrack_expect_alloc();
+        exp = ip_conntrack_expect_alloc(ct);
         if (exp == NULL) {
                 ret = NF_DROP;
                 goto out;
@@ -404,8 +403,7 @@ static int help(struct sk_buff **pskb,
                    networks, or the packet filter itself). */
                 if (!loose) {
                         ret = NF_ACCEPT;
-                        ip_conntrack_expect_free(exp);
-                        goto out_update_nl;
+                        goto out_put_expect;
                 }
                 exp->tuple.dst.ip = htonl((array[0] << 24) | (array[1] << 16)
                                          | (array[2] << 8) | array[3]);
@@ -420,7 +418,6 @@ static int help(struct sk_buff **pskb,
                   { 0xFFFFFFFF, { .tcp = { 0xFFFF } }, 0xFF }});
 
         exp->expectfn = NULL;
-        exp->master = ct;
 
         /* Now, NAT might want to mangle the packet, and register the
          * (possibly changed) expectation itself. */
@@ -429,20 +426,22 @@ static int help(struct sk_buff **pskb,
                                       matchoff, matchlen, exp, &seq);
         else {
                 /* Can't expect this?  Best to drop packet now. */
-                if (ip_conntrack_expect_related(exp) != 0) {
-                        ip_conntrack_expect_free(exp);
+                if (ip_conntrack_expect_related(exp) != 0)
                         ret = NF_DROP;
-                } else
+                else
                         ret = NF_ACCEPT;
         }
 
+out_put_expect:
+        ip_conntrack_expect_put(exp);
+
 out_update_nl:
         /* Now if this ends in \n, update ftp info.  Seq may have been
          * adjusted by NAT code. */
         if (ends_in_nl)
                 update_nl_seq(seq, ct_ftp_info,dir);
  out:
-        UNLOCK_BH(&ip_ftp_lock);
+        spin_unlock_bh(&ip_ftp_lock);
         return ret;
 }
 
diff --git a/net/ipv4/netfilter/ip_conntrack_irc.c b/net/ipv4/netfilter/ip_conntrack_irc.c
index 33cc7348b6ee..4a28f297d502 100644
--- a/net/ipv4/netfilter/ip_conntrack_irc.c
+++ b/net/ipv4/netfilter/ip_conntrack_irc.c
@@ -29,7 +29,6 @@
 #include <net/checksum.h>
 #include <net/tcp.h>
 
-#include <linux/netfilter_ipv4/lockhelp.h>
 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
 #include <linux/netfilter_ipv4/ip_conntrack_irc.h>
 #include <linux/moduleparam.h>
@@ -41,7 +40,7 @@ static int max_dcc_channels = 8;
 static unsigned int dcc_timeout = 300;
 /* This is slow, but it's simple. --RR */
 static char irc_buffer[65536];
-static DECLARE_LOCK(irc_buffer_lock);
+static DEFINE_SPINLOCK(irc_buffer_lock);
 
 unsigned int (*ip_nat_irc_hook)(struct sk_buff **pskb,
                                 enum ip_conntrack_info ctinfo,
@@ -141,7 +140,7 @@ static int help(struct sk_buff **pskb,
         if (dataoff >= (*pskb)->len)
                 return NF_ACCEPT;
 
-        LOCK_BH(&irc_buffer_lock);
+        spin_lock_bh(&irc_buffer_lock);
         ib_ptr = skb_header_pointer(*pskb, dataoff,
                                     (*pskb)->len - dataoff, irc_buffer);
         BUG_ON(ib_ptr == NULL);
@@ -198,7 +197,7 @@ static int help(struct sk_buff **pskb,
                                 continue;
                         }
 
-                        exp = ip_conntrack_expect_alloc();
+                        exp = ip_conntrack_expect_alloc(ct);
                         if (exp == NULL) {
                                 ret = NF_DROP;
                                 goto out;
@@ -222,22 +221,20 @@ static int help(struct sk_buff **pskb,
                                 { { 0, { 0 } },
                                   { 0xFFFFFFFF, { .tcp = { 0xFFFF } }, 0xFF }});
                         exp->expectfn = NULL;
-                        exp->master = ct;
                         if (ip_nat_irc_hook)
                                 ret = ip_nat_irc_hook(pskb, ctinfo, 
                                                       addr_beg_p - ib_ptr,
                                                       addr_end_p - addr_beg_p,
                                                       exp);
-                        else if (ip_conntrack_expect_related(exp) != 0) {
-                                ip_conntrack_expect_free(exp);
+                        else if (ip_conntrack_expect_related(exp) != 0)
                                 ret = NF_DROP;
-                        }
+                        ip_conntrack_expect_put(exp);
                         goto out;
                 } /* for .. NUM_DCCPROTO */
         } /* while data < ... */
 
  out:
-        UNLOCK_BH(&irc_buffer_lock);
+        spin_unlock_bh(&irc_buffer_lock);
         return ret;
 }
 
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
index ff8c34a860ff..31d75390bf12 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
@@ -26,7 +26,6 @@
 
 #include <linux/netfilter_ipv4/ip_conntrack.h>
 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
-#include <linux/netfilter_ipv4/lockhelp.h>
 
 #if 0
 #define DEBUGP(format, ...) printk(format, ## __VA_ARGS__)
@@ -35,7 +34,7 @@
 #endif
 
 /* Protects conntrack->proto.sctp */
-static DECLARE_RWLOCK(sctp_lock);
+static DEFINE_RWLOCK(sctp_lock);
 
 /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
    closely.  They're more complex. --RR 
@@ -199,9 +198,9 @@ static int sctp_print_conntrack(struct seq_file *s,
         DEBUGP(__FUNCTION__);
         DEBUGP("\n");
 
-        READ_LOCK(&sctp_lock);
+        read_lock_bh(&sctp_lock);
         state = conntrack->proto.sctp.state;
-        READ_UNLOCK(&sctp_lock);
+        read_unlock_bh(&sctp_lock);
 
         return seq_printf(s, "%s ", sctp_conntrack_names[state]);
 }
@@ -343,13 +342,13 @@ static int sctp_packet(struct ip_conntrack *conntrack,
 
         oldsctpstate = newconntrack = SCTP_CONNTRACK_MAX;
         for_each_sctp_chunk (skb, sch, _sch, offset, count) {
-                WRITE_LOCK(&sctp_lock);
+                write_lock_bh(&sctp_lock);
 
                 /* Special cases of Verification tag check (Sec 8.5.1) */
                 if (sch->type == SCTP_CID_INIT) {
                         /* Sec 8.5.1 (A) */
                         if (sh->vtag != 0) {
-                                WRITE_UNLOCK(&sctp_lock);
+                                write_unlock_bh(&sctp_lock);
                                 return -1;
                         }
                 } else if (sch->type == SCTP_CID_ABORT) {
@@ -357,7 +356,7 @@ static int sctp_packet(struct ip_conntrack *conntrack,
                         if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])
                                 && !(sh->vtag == conntrack->proto.sctp.vtag
                                                         [1 - CTINFO2DIR(ctinfo)])) {
-                                WRITE_UNLOCK(&sctp_lock);
+                                write_unlock_bh(&sctp_lock);
                                 return -1;
                         }
                 } else if (sch->type == SCTP_CID_SHUTDOWN_COMPLETE) {
@@ -366,13 +365,13 @@ static int sctp_packet(struct ip_conntrack *conntrack,
                                 && !(sh->vtag == conntrack->proto.sctp.vtag
                                                         [1 - CTINFO2DIR(ctinfo)] 
                                         && (sch->flags & 1))) {
-                                WRITE_UNLOCK(&sctp_lock);
+                                write_unlock_bh(&sctp_lock);
                                 return -1;
                         }
                 } else if (sch->type == SCTP_CID_COOKIE_ECHO) {
                         /* Sec 8.5.1 (D) */
                         if (!(sh->vtag == conntrack->proto.sctp.vtag[CTINFO2DIR(ctinfo)])) {
-                                WRITE_UNLOCK(&sctp_lock);
+                                write_unlock_bh(&sctp_lock);
                                 return -1;
                         }
                 }
@@ -384,7 +383,7 @@ static int sctp_packet(struct ip_conntrack *conntrack,
                 if (newconntrack == SCTP_CONNTRACK_MAX) {
                         DEBUGP("ip_conntrack_sctp: Invalid dir=%i ctype=%u conntrack=%u\n",
                                CTINFO2DIR(ctinfo), sch->type, oldsctpstate);
-                        WRITE_UNLOCK(&sctp_lock);
+                        write_unlock_bh(&sctp_lock);
                         return -1;
                 }
 
@@ -396,7 +395,7 @@ static int sctp_packet(struct ip_conntrack *conntrack,
                         ih = skb_header_pointer(skb, offset + sizeof(sctp_chunkhdr_t),
                                                 sizeof(_inithdr), &_inithdr);
                         if (ih == NULL) {
-                                        WRITE_UNLOCK(&sctp_lock);
+                                        write_unlock_bh(&sctp_lock);
                                         return -1;
                         }
                         DEBUGP("Setting vtag %x for dir %d\n", 
@@ -405,7 +404,7 @@ static int sctp_packet(struct ip_conntrack *conntrack,
                 }
 
                 conntrack->proto.sctp.state = newconntrack;
-                WRITE_UNLOCK(&sctp_lock);
+                write_unlock_bh(&sctp_lock);
         }
 
         ip_ct_refresh_acct(conntrack, ctinfo, skb, *sctp_timeouts[newconntrack]);
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
index 721ddbf522b4..809dfed766d4 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -36,7 +36,6 @@
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter_ipv4/ip_conntrack.h>
 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
-#include <linux/netfilter_ipv4/lockhelp.h>
 
 #if 0
 #define DEBUGP printk
@@ -46,7 +45,7 @@
 #endif
 
 /* Protects conntrack->proto.tcp */
-static DECLARE_RWLOCK(tcp_lock);
+static DEFINE_RWLOCK(tcp_lock);
 
 /* "Be conservative in what you do, 
     be liberal in what you accept from others." 
@@ -330,9 +329,9 @@ static int tcp_print_conntrack(struct seq_file *s,
 {
         enum tcp_conntrack state;
 
-        READ_LOCK(&tcp_lock);
+        read_lock_bh(&tcp_lock);
         state = conntrack->proto.tcp.state;
-        READ_UNLOCK(&tcp_lock);
+        read_unlock_bh(&tcp_lock);
 
         return seq_printf(s, "%s ", tcp_conntrack_names[state]);
 }
@@ -738,14 +737,14 @@ void ip_conntrack_tcp_update(struct sk_buff *skb,
 
         end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, iph, tcph);
         
-        WRITE_LOCK(&tcp_lock);
+        write_lock_bh(&tcp_lock);
         /*
          * We have to worry for the ack in the reply packet only...
          */
         if (after(end, conntrack->proto.tcp.seen[dir].td_end))
                 conntrack->proto.tcp.seen[dir].td_end = end;
         conntrack->proto.tcp.last_end = end;
-        WRITE_UNLOCK(&tcp_lock);
+        write_unlock_bh(&tcp_lock);
         DEBUGP("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
                "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
                 sender->td_end, sender->td_maxend, sender->td_maxwin,
@@ -857,7 +856,7 @@ static int tcp_packet(struct ip_conntrack *conntrack,
                                 sizeof(_tcph), &_tcph);
         BUG_ON(th == NULL);
         
-        WRITE_LOCK(&tcp_lock);
+        write_lock_bh(&tcp_lock);
         old_state = conntrack->proto.tcp.state;
         dir = CTINFO2DIR(ctinfo);
         index = get_conntrack_index(th);
@@ -879,7 +878,7 @@ static int tcp_packet(struct ip_conntrack *conntrack,
                          * that the client cannot but retransmit its SYN and 
                          * thus initiate a clean new session.
                          */
-                        WRITE_UNLOCK(&tcp_lock);
+                        write_unlock_bh(&tcp_lock);
                         if (LOG_INVALID(IPPROTO_TCP))
                                 nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
                                           "ip_ct_tcp: killing out of sync session ");
@@ -894,7 +893,7 @@ static int tcp_packet(struct ip_conntrack *conntrack,
                 conntrack->proto.tcp.last_end = 
                     segment_seq_plus_len(ntohl(th->seq), skb->len, iph, th);
                 
-                WRITE_UNLOCK(&tcp_lock);
+                write_unlock_bh(&tcp_lock);
                 if (LOG_INVALID(IPPROTO_TCP))
                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
                                   "ip_ct_tcp: invalid packet ignored ");
@@ -904,7 +903,7 @@ static int tcp_packet(struct ip_conntrack *conntrack,
                 DEBUGP("ip_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
                        dir, get_conntrack_index(th),
                        old_state);
-                WRITE_UNLOCK(&tcp_lock);
+                write_unlock_bh(&tcp_lock);
                 if (LOG_INVALID(IPPROTO_TCP))
                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
                                   "ip_ct_tcp: invalid state ");
@@ -918,13 +917,13 @@ static int tcp_packet(struct ip_conntrack *conntrack,
                              conntrack->proto.tcp.seen[dir].td_end)) {  
                         /* Attempt to reopen a closed connection.
                         * Delete this connection and look up again. */
-                        WRITE_UNLOCK(&tcp_lock);
+                        write_unlock_bh(&tcp_lock);
                         if (del_timer(&conntrack->timeout))
                                 conntrack->timeout.function((unsigned long)
                                                             conntrack);
                         return -NF_REPEAT;
                 } else {
-                        WRITE_UNLOCK(&tcp_lock);
+                        write_unlock_bh(&tcp_lock);
                         if (LOG_INVALID(IPPROTO_TCP))
                                 nf_log_packet(PF_INET, 0, skb, NULL, NULL,
                                               "ip_ct_tcp: invalid SYN");
@@ -949,7 +948,7 @@ static int tcp_packet(struct ip_conntrack *conntrack,
 
         if (!tcp_in_window(&conntrack->proto.tcp, dir, index, 
                            skb, iph, th)) {
-                WRITE_UNLOCK(&tcp_lock);
+                write_unlock_bh(&tcp_lock);
                 return -NF_ACCEPT;
         }
     in_window:
@@ -972,7 +971,7 @@ static int tcp_packet(struct ip_conntrack *conntrack,
         timeout = conntrack->proto.tcp.retrans >= ip_ct_tcp_max_retrans
                   && *tcp_timeouts[new_state] > ip_ct_tcp_timeout_max_retrans
                   ? ip_ct_tcp_timeout_max_retrans : *tcp_timeouts[new_state];
-        WRITE_UNLOCK(&tcp_lock);
+        write_unlock_bh(&tcp_lock);
 
         if (!test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)) {
                 /* If only reply is a RST, we can consider ourselves not to
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_udp.c b/net/ipv4/netfilter/ip_conntrack_proto_udp.c
index 5bc28a224623..8c1eaba098d4 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_udp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_udp.c
@@ -120,6 +120,7 @@ static int udp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
          * and moreover root might send raw packets.
          * FIXME: Source route IP option packets --RR */
         if (hooknum == NF_IP_PRE_ROUTING
+            && skb->ip_summed != CHECKSUM_UNNECESSARY
             && csum_tcpudp_magic(iph->saddr, iph->daddr, udplen, IPPROTO_UDP,
                                  skb->ip_summed == CHECKSUM_HW ? skb->csum
                                  : skb_checksum(skb, iph->ihl*4, udplen, 0))) {
diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
index 46ca45f74d85..61798c46e91d 100644
--- a/net/ipv4/netfilter/ip_conntrack_standalone.c
+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
@@ -28,8 +28,8 @@
 #include <net/checksum.h>
 #include <net/ip.h>
 
-#define ASSERT_READ_LOCK(x) MUST_BE_READ_LOCKED(&ip_conntrack_lock)
-#define ASSERT_WRITE_LOCK(x) MUST_BE_WRITE_LOCKED(&ip_conntrack_lock)
+#define ASSERT_READ_LOCK(x)
+#define ASSERT_WRITE_LOCK(x)
 
 #include <linux/netfilter_ipv4/ip_conntrack.h>
 #include <linux/netfilter_ipv4/ip_conntrack_protocol.h>
@@ -119,7 +119,7 @@ static struct list_head *ct_get_idx(struct seq_file *seq, loff_t pos)
 
 static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        READ_LOCK(&ip_conntrack_lock);
+        read_lock_bh(&ip_conntrack_lock);
         return ct_get_idx(seq, *pos);
 }
 
@@ -131,7 +131,7 @@ static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
   
 static void ct_seq_stop(struct seq_file *s, void *v)
 {
-        READ_UNLOCK(&ip_conntrack_lock);
+        read_unlock_bh(&ip_conntrack_lock);
 }
  
 static int ct_seq_show(struct seq_file *s, void *v)
@@ -140,7 +140,7 @@ static int ct_seq_show(struct seq_file *s, void *v)
         const struct ip_conntrack *conntrack = tuplehash_to_ctrack(hash);
         struct ip_conntrack_protocol *proto;
 
-        MUST_BE_READ_LOCKED(&ip_conntrack_lock);
+        ASSERT_READ_LOCK(&ip_conntrack_lock);
         IP_NF_ASSERT(conntrack);
 
         /* we only want to print DIR_ORIGINAL */
@@ -239,7 +239,7 @@ static void *exp_seq_start(struct seq_file *s, loff_t *pos)
 
         /* strange seq_file api calls stop even if we fail,
          * thus we need to grab lock since stop unlocks */
-        READ_LOCK(&ip_conntrack_lock);
+        read_lock_bh(&ip_conntrack_lock);
 
         if (list_empty(e))
                 return NULL;
@@ -256,6 +256,7 @@ static void *exp_seq_next(struct seq_file *s, void *v, loff_t *pos)
 {
         struct list_head *e = v;
 
+        ++*pos;
         e = e->next;
 
         if (e == &ip_conntrack_expect_list)
@@ -266,7 +267,7 @@ static void *exp_seq_next(struct seq_file *s, void *v, loff_t *pos)
 
 static void exp_seq_stop(struct seq_file *s, void *v)
 {
-        READ_UNLOCK(&ip_conntrack_lock);
+        read_unlock_bh(&ip_conntrack_lock);
 }
 
 static int exp_seq_show(struct seq_file *s, void *v)
@@ -431,6 +432,13 @@ static unsigned int ip_conntrack_defrag(unsigned int hooknum,
                                         const struct net_device *out,
                                         int (*okfn)(struct sk_buff *))
 {
+#if !defined(CONFIG_IP_NF_NAT) && !defined(CONFIG_IP_NF_NAT_MODULE)
+        /* Previously seen (loopback)?  Ignore.  Do this before
+           fragment check. */
+        if ((*pskb)->nfct)
+                return NF_ACCEPT;
+#endif
+
         /* Gather fragments. */
         if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
                 *pskb = ip_ct_gather_frags(*pskb,
@@ -920,22 +928,22 @@ int ip_conntrack_protocol_register(struct ip_conntrack_protocol *proto)
 {
         int ret = 0;
 
-        WRITE_LOCK(&ip_conntrack_lock);
+        write_lock_bh(&ip_conntrack_lock);
         if (ip_ct_protos[proto->proto] != &ip_conntrack_generic_protocol) {
                 ret = -EBUSY;
                 goto out;
         }
         ip_ct_protos[proto->proto] = proto;
  out:
-        WRITE_UNLOCK(&ip_conntrack_lock);
+        write_unlock_bh(&ip_conntrack_lock);
         return ret;
 }
 
 void ip_conntrack_protocol_unregister(struct ip_conntrack_protocol *proto)
 {
-        WRITE_LOCK(&ip_conntrack_lock);
+        write_lock_bh(&ip_conntrack_lock);
         ip_ct_protos[proto->proto] = &ip_conntrack_generic_protocol;
-        WRITE_UNLOCK(&ip_conntrack_lock);
+        write_unlock_bh(&ip_conntrack_lock);
         
         /* Somebody could be still looking at the proto in bh. */
         synchronize_net();
@@ -977,7 +985,7 @@ EXPORT_SYMBOL(ip_ct_refresh_acct);
 EXPORT_SYMBOL(ip_ct_protos);
 EXPORT_SYMBOL(ip_ct_find_proto);
 EXPORT_SYMBOL(ip_conntrack_expect_alloc);
-EXPORT_SYMBOL(ip_conntrack_expect_free);
+EXPORT_SYMBOL(ip_conntrack_expect_put);
 EXPORT_SYMBOL(ip_conntrack_expect_related);
 EXPORT_SYMBOL(ip_conntrack_unexpect_related);
 EXPORT_SYMBOL(ip_conntrack_tuple_taken);
diff --git a/net/ipv4/netfilter/ip_conntrack_tftp.c b/net/ipv4/netfilter/ip_conntrack_tftp.c
index 992fac3e36ee..f8ff170f390a 100644
--- a/net/ipv4/netfilter/ip_conntrack_tftp.c
+++ b/net/ipv4/netfilter/ip_conntrack_tftp.c
@@ -65,7 +65,7 @@ static int tftp_help(struct sk_buff **pskb,
                 DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
                 DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 
-                exp = ip_conntrack_expect_alloc();
+                exp = ip_conntrack_expect_alloc(ct);
                 if (exp == NULL)
                         return NF_DROP;
 
@@ -75,17 +75,15 @@ static int tftp_help(struct sk_buff **pskb,
                 exp->mask.dst.u.udp.port = 0xffff;
                 exp->mask.dst.protonum = 0xff;
                 exp->expectfn = NULL;
-                exp->master = ct;
 
                 DEBUGP("expect: ");
                 DUMP_TUPLE(&exp->tuple);
                 DUMP_TUPLE(&exp->mask);
                 if (ip_nat_tftp_hook)
                         ret = ip_nat_tftp_hook(pskb, ctinfo, exp);
-                else if (ip_conntrack_expect_related(exp) != 0) {
-                        ip_conntrack_expect_free(exp);
+                else if (ip_conntrack_expect_related(exp) != 0)
                         ret = NF_DROP;
-                }
+                ip_conntrack_expect_put(exp);
                 break;
         case TFTP_OPCODE_DATA:
         case TFTP_OPCODE_ACK:
diff --git a/net/ipv4/netfilter/ip_nat_amanda.c b/net/ipv4/netfilter/ip_nat_amanda.c
index da1f412583ed..706c8074f422 100644
--- a/net/ipv4/netfilter/ip_nat_amanda.c
+++ b/net/ipv4/netfilter/ip_nat_amanda.c
@@ -56,10 +56,8 @@ static unsigned int help(struct sk_buff **pskb,
                         break;
         }
 
-        if (port == 0) {
-                ip_conntrack_expect_free(exp);
+        if (port == 0)
                 return NF_DROP;
-        }
 
         sprintf(buffer, "%u", port);
         ret = ip_nat_mangle_udp_packet(pskb, exp->master, ctinfo,
diff --git a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c
index 9fc6f93af0dd..739b6dde1c82 100644
--- a/net/ipv4/netfilter/ip_nat_core.c
+++ b/net/ipv4/netfilter/ip_nat_core.c
@@ -22,8 +22,8 @@
 #include <linux/udp.h>
 #include <linux/jhash.h>
 
-#define ASSERT_READ_LOCK(x) MUST_BE_READ_LOCKED(&ip_nat_lock)
-#define ASSERT_WRITE_LOCK(x) MUST_BE_WRITE_LOCKED(&ip_nat_lock)
+#define ASSERT_READ_LOCK(x)
+#define ASSERT_WRITE_LOCK(x)
 
 #include <linux/netfilter_ipv4/ip_conntrack.h>
 #include <linux/netfilter_ipv4/ip_conntrack_core.h>
@@ -41,7 +41,7 @@
 #define DEBUGP(format, args...)
 #endif
 
-DECLARE_RWLOCK(ip_nat_lock);
+DEFINE_RWLOCK(ip_nat_lock);
 
 /* Calculated at init based on memory size */
 static unsigned int ip_nat_htable_size;
@@ -65,9 +65,9 @@ static void ip_nat_cleanup_conntrack(struct ip_conntrack *conn)
         if (!(conn->status & IPS_NAT_DONE_MASK))
                 return;
 
-        WRITE_LOCK(&ip_nat_lock);
+        write_lock_bh(&ip_nat_lock);
         list_del(&conn->nat.info.bysource);
-        WRITE_UNLOCK(&ip_nat_lock);
+        write_unlock_bh(&ip_nat_lock);
 }
 
 /* We do checksum mangling, so if they were wrong before they're still
@@ -142,7 +142,7 @@ find_appropriate_src(const struct ip_conntrack_tuple *tuple,
         unsigned int h = hash_by_src(tuple);
         struct ip_conntrack *ct;
 
-        READ_LOCK(&ip_nat_lock);
+        read_lock_bh(&ip_nat_lock);
         list_for_each_entry(ct, &bysource[h], nat.info.bysource) {
                 if (same_src(ct, tuple)) {
                         /* Copy source part from reply tuple. */
@@ -151,12 +151,12 @@ find_appropriate_src(const struct ip_conntrack_tuple *tuple,
                         result->dst = tuple->dst;
 
                         if (in_range(result, range)) {
-                                READ_UNLOCK(&ip_nat_lock);
+                                read_unlock_bh(&ip_nat_lock);
                                 return 1;
                         }
                 }
         }
-        READ_UNLOCK(&ip_nat_lock);
+        read_unlock_bh(&ip_nat_lock);
         return 0;
 }
 
@@ -297,9 +297,9 @@ ip_nat_setup_info(struct ip_conntrack *conntrack,
                 unsigned int srchash
                         = hash_by_src(&conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
                                       .tuple);
-                WRITE_LOCK(&ip_nat_lock);
+                write_lock_bh(&ip_nat_lock);
                 list_add(&info->bysource, &bysource[srchash]);
-                WRITE_UNLOCK(&ip_nat_lock);
+                write_unlock_bh(&ip_nat_lock);
         }
 
         /* It's done. */
@@ -474,23 +474,23 @@ int ip_nat_protocol_register(struct ip_nat_protocol *proto)
 {
         int ret = 0;
 
-        WRITE_LOCK(&ip_nat_lock);
+        write_lock_bh(&ip_nat_lock);
         if (ip_nat_protos[proto->protonum] != &ip_nat_unknown_protocol) {
                 ret = -EBUSY;
                 goto out;
         }
         ip_nat_protos[proto->protonum] = proto;
  out:
-        WRITE_UNLOCK(&ip_nat_lock);
+        write_unlock_bh(&ip_nat_lock);
         return ret;
 }
 
 /* Noone stores the protocol anywhere; simply delete it. */
 void ip_nat_protocol_unregister(struct ip_nat_protocol *proto)
 {
-        WRITE_LOCK(&ip_nat_lock);
+        write_lock_bh(&ip_nat_lock);
         ip_nat_protos[proto->protonum] = &ip_nat_unknown_protocol;
-        WRITE_UNLOCK(&ip_nat_lock);
+        write_unlock_bh(&ip_nat_lock);
 
         /* Someone could be still looking at the proto in a bh. */
         synchronize_net();
@@ -509,13 +509,13 @@ int __init ip_nat_init(void)
                 return -ENOMEM;
 
         /* Sew in builtin protocols. */
-        WRITE_LOCK(&ip_nat_lock);
+        write_lock_bh(&ip_nat_lock);
         for (i = 0; i < MAX_IP_NAT_PROTO; i++)
                 ip_nat_protos[i] = &ip_nat_unknown_protocol;
         ip_nat_protos[IPPROTO_TCP] = &ip_nat_protocol_tcp;
         ip_nat_protos[IPPROTO_UDP] = &ip_nat_protocol_udp;
         ip_nat_protos[IPPROTO_ICMP] = &ip_nat_protocol_icmp;
-        WRITE_UNLOCK(&ip_nat_lock);
+        write_unlock_bh(&ip_nat_lock);
 
         for (i = 0; i < ip_nat_htable_size; i++) {
                 INIT_LIST_HEAD(&bysource[i]);
diff --git a/net/ipv4/netfilter/ip_nat_ftp.c b/net/ipv4/netfilter/ip_nat_ftp.c
index c6000e794ad6..d83757a70d9f 100644
--- a/net/ipv4/netfilter/ip_nat_ftp.c
+++ b/net/ipv4/netfilter/ip_nat_ftp.c
@@ -143,10 +143,8 @@ static unsigned int ip_nat_ftp(struct sk_buff **pskb,
                         break;
         }
 
-        if (port == 0) {
-                ip_conntrack_expect_free(exp);
+        if (port == 0)
                 return NF_DROP;
-        }
 
         if (!mangle[type](pskb, newip, port, matchoff, matchlen, ct, ctinfo,
                           seq)) {
diff --git a/net/ipv4/netfilter/ip_nat_helper.c b/net/ipv4/netfilter/ip_nat_helper.c
index 1637b96d8c01..158f34f32c04 100644
--- a/net/ipv4/netfilter/ip_nat_helper.c
+++ b/net/ipv4/netfilter/ip_nat_helper.c
@@ -28,8 +28,8 @@
 #include <net/tcp.h>
 #include <net/udp.h>
 
-#define ASSERT_READ_LOCK(x) MUST_BE_READ_LOCKED(&ip_nat_lock)
-#define ASSERT_WRITE_LOCK(x) MUST_BE_WRITE_LOCKED(&ip_nat_lock)
+#define ASSERT_READ_LOCK(x)
+#define ASSERT_WRITE_LOCK(x)
 
 #include <linux/netfilter_ipv4/ip_conntrack.h>
 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
@@ -47,7 +47,7 @@
 #define DUMP_OFFSET(x)
 #endif
 
-static DECLARE_LOCK(ip_nat_seqofs_lock);
+static DEFINE_SPINLOCK(ip_nat_seqofs_lock);
 
 /* Setup TCP sequence correction given this change at this sequence */
 static inline void 
@@ -70,7 +70,7 @@ adjust_tcp_sequence(u32 seq,
         DEBUGP("ip_nat_resize_packet: Seq_offset before: ");
         DUMP_OFFSET(this_way);
 
-        LOCK_BH(&ip_nat_seqofs_lock);
+        spin_lock_bh(&ip_nat_seqofs_lock);
 
         /* SYN adjust. If it's uninitialized, or this is after last
          * correction, record it: we don't handle more than one
@@ -82,7 +82,7 @@ adjust_tcp_sequence(u32 seq,
                     this_way->offset_before = this_way->offset_after;
                     this_way->offset_after += sizediff;
         }
-        UNLOCK_BH(&ip_nat_seqofs_lock);
+        spin_unlock_bh(&ip_nat_seqofs_lock);
 
         DEBUGP("ip_nat_resize_packet: Seq_offset after: ");
         DUMP_OFFSET(this_way);
@@ -142,9 +142,6 @@ static int enlarge_skb(struct sk_buff **pskb, unsigned int extra)
         /* Transfer socket to new skb. */
         if ((*pskb)->sk)
                 skb_set_owner_w(nskb, (*pskb)->sk);
-#ifdef CONFIG_NETFILTER_DEBUG
-        nskb->nf_debug = (*pskb)->nf_debug;
-#endif
         kfree_skb(*pskb);
         *pskb = nskb;
         return 1;
diff --git a/net/ipv4/netfilter/ip_nat_irc.c b/net/ipv4/netfilter/ip_nat_irc.c
index 9c1ca3381d56..de31942babe3 100644
--- a/net/ipv4/netfilter/ip_nat_irc.c
+++ b/net/ipv4/netfilter/ip_nat_irc.c
@@ -65,10 +65,8 @@ static unsigned int help(struct sk_buff **pskb,
                         break;
         }
 
-        if (port == 0) {
-                ip_conntrack_expect_free(exp);
+        if (port == 0)
                 return NF_DROP;
-        }
 
         /*      strlen("\1DCC CHAT chat AAAAAAAA P\1\n")=27
          *      strlen("\1DCC SCHAT chat AAAAAAAA P\1\n")=28
diff --git a/net/ipv4/netfilter/ip_nat_proto_icmp.c b/net/ipv4/netfilter/ip_nat_proto_icmp.c
index a558cf0eee8a..6596c9ee1655 100644
--- a/net/ipv4/netfilter/ip_nat_proto_icmp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_icmp.c
@@ -35,16 +35,17 @@ icmp_unique_tuple(struct ip_conntrack_tuple *tuple,
                   const struct ip_conntrack *conntrack)
 {
         static u_int16_t id;
-        unsigned int range_size
-                = (unsigned int)range->max.icmp.id - range->min.icmp.id + 1;
+        unsigned int range_size;
         unsigned int i;
 
+        range_size = ntohs(range->max.icmp.id) - ntohs(range->min.icmp.id) + 1;
         /* If no range specified... */
         if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED))
                 range_size = 0xFFFF;
 
         for (i = 0; i < range_size; i++, id++) {
-                tuple->src.u.icmp.id = range->min.icmp.id + (id % range_size);
+                tuple->src.u.icmp.id = htons(ntohs(range->min.icmp.id) +
+                                             (id % range_size));
                 if (!ip_nat_used_tuple(tuple, conntrack))
                         return 1;
         }
diff --git a/net/ipv4/netfilter/ip_nat_proto_tcp.c b/net/ipv4/netfilter/ip_nat_proto_tcp.c
index a91cfceff272..a98e36d2b3c6 100644
--- a/net/ipv4/netfilter/ip_nat_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_tcp.c
@@ -40,7 +40,8 @@ tcp_unique_tuple(struct ip_conntrack_tuple *tuple,
                  enum ip_nat_manip_type maniptype,
                  const struct ip_conntrack *conntrack)
 {
-        static u_int16_t port, *portptr;
+        static u_int16_t port;
+        u_int16_t *portptr;
         unsigned int range_size, min, i;
 
         if (maniptype == IP_NAT_MANIP_SRC)
diff --git a/net/ipv4/netfilter/ip_nat_proto_udp.c b/net/ipv4/netfilter/ip_nat_proto_udp.c
index c669e3b5f5d0..9f66e5625664 100644
--- a/net/ipv4/netfilter/ip_nat_proto_udp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_udp.c
@@ -41,7 +41,8 @@ udp_unique_tuple(struct ip_conntrack_tuple *tuple,
                  enum ip_nat_manip_type maniptype,
                  const struct ip_conntrack *conntrack)
 {
-        static u_int16_t port, *portptr;
+        static u_int16_t port;
+        u_int16_t *portptr;
         unsigned int range_size, min, i;
 
         if (maniptype == IP_NAT_MANIP_SRC)
diff --git a/net/ipv4/netfilter/ip_nat_rule.c b/net/ipv4/netfilter/ip_nat_rule.c
index 581f097f5a24..60d70fa41a15 100644
--- a/net/ipv4/netfilter/ip_nat_rule.c
+++ b/net/ipv4/netfilter/ip_nat_rule.c
@@ -19,8 +19,8 @@
 #include <net/route.h>
 #include <linux/bitops.h>
 
-#define ASSERT_READ_LOCK(x) MUST_BE_READ_LOCKED(&ip_nat_lock)
-#define ASSERT_WRITE_LOCK(x) MUST_BE_WRITE_LOCKED(&ip_nat_lock)
+#define ASSERT_READ_LOCK(x)
+#define ASSERT_WRITE_LOCK(x)
 
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <linux/netfilter_ipv4/ip_nat.h>
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index 79f56f662b33..91d5ea1dbbc9 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -31,8 +31,8 @@
 #include <net/checksum.h>
 #include <linux/spinlock.h>
 
-#define ASSERT_READ_LOCK(x) MUST_BE_READ_LOCKED(&ip_nat_lock)
-#define ASSERT_WRITE_LOCK(x) MUST_BE_WRITE_LOCKED(&ip_nat_lock)
+#define ASSERT_READ_LOCK(x)
+#define ASSERT_WRITE_LOCK(x)
 
 #include <linux/netfilter_ipv4/ip_nat.h>
 #include <linux/netfilter_ipv4/ip_nat_rule.h>
@@ -102,6 +102,10 @@ ip_nat_fn(unsigned int hooknum,
                 return NF_ACCEPT;
         }
 
+        /* Don't try to NAT if this packet is not conntracked */
+        if (ct == &ip_conntrack_untracked)
+                return NF_ACCEPT;
+
         switch (ctinfo) {
         case IP_CT_RELATED:
         case IP_CT_RELATED+IP_CT_IS_REPLY:
@@ -373,7 +377,6 @@ static int init_or_cleanup(int init)
  cleanup_rule_init:
         ip_nat_rule_cleanup();
  cleanup_nothing:
-        MUST_BE_READ_WRITE_UNLOCKED(&ip_nat_lock);
         return ret;
 }
 
diff --git a/net/ipv4/netfilter/ip_nat_tftp.c b/net/ipv4/netfilter/ip_nat_tftp.c
index 0343e0d64674..2215317c76b7 100644
--- a/net/ipv4/netfilter/ip_nat_tftp.c
+++ b/net/ipv4/netfilter/ip_nat_tftp.c
@@ -45,10 +45,8 @@ static unsigned int help(struct sk_buff **pskb,
         exp->saved_proto.udp.port = exp->tuple.dst.u.tcp.port;
         exp->dir = IP_CT_DIR_REPLY;
         exp->expectfn = ip_nat_follow_master;
-        if (ip_conntrack_expect_related(exp) != 0) {
-                ip_conntrack_expect_free(exp);
+        if (ip_conntrack_expect_related(exp) != 0)
                 return NF_DROP;
-        }
         return NF_ACCEPT;
 }
 
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 8a54f92b8496..c88dfcd38c56 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -67,7 +67,6 @@ static DECLARE_MUTEX(ipt_mutex);
 /* Must have mutex */
 #define ASSERT_READ_LOCK(x) IP_NF_ASSERT(down_trylock(&ipt_mutex) != 0)
 #define ASSERT_WRITE_LOCK(x) IP_NF_ASSERT(down_trylock(&ipt_mutex) != 0)
-#include <linux/netfilter_ipv4/lockhelp.h>
 #include <linux/netfilter_ipv4/listhelp.h>
 
 #if 0
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 0f12e3a3dc73..6706d3a1bc4f 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -29,9 +29,8 @@
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <linux/netfilter_ipv4/ipt_CLUSTERIP.h>
 #include <linux/netfilter_ipv4/ip_conntrack.h>
-#include <linux/netfilter_ipv4/lockhelp.h>
 
-#define CLUSTERIP_VERSION "0.6"
+#define CLUSTERIP_VERSION "0.7"
 
 #define DEBUG_CLUSTERIP
 
@@ -41,6 +40,8 @@
 #define DEBUGP
 #endif
 
+#define ASSERT_READ_LOCK(x)
+
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
 MODULE_DESCRIPTION("iptables target for CLUSTERIP");
@@ -67,7 +68,7 @@ static LIST_HEAD(clusterip_configs);
 
 /* clusterip_lock protects the clusterip_configs list _AND_ the configurable
  * data within all structurses (num_local_nodes, local_nodes[]) */
-static DECLARE_RWLOCK(clusterip_lock);
+static DEFINE_RWLOCK(clusterip_lock);
 
 #ifdef CONFIG_PROC_FS
 static struct file_operations clusterip_proc_fops;
@@ -82,9 +83,9 @@ clusterip_config_get(struct clusterip_config *c) {
 static inline void
 clusterip_config_put(struct clusterip_config *c) {
         if (atomic_dec_and_test(&c->refcount)) {
-                WRITE_LOCK(&clusterip_lock);
+                write_lock_bh(&clusterip_lock);
                 list_del(&c->list);
-                WRITE_UNLOCK(&clusterip_lock);
+                write_unlock_bh(&clusterip_lock);
                 dev_mc_delete(c->dev, c->clustermac, ETH_ALEN, 0);
                 dev_put(c->dev);
                 kfree(c);
@@ -97,7 +98,7 @@ __clusterip_config_find(u_int32_t clusterip)
 {
         struct list_head *pos;
 
-        MUST_BE_READ_LOCKED(&clusterip_lock);
+        ASSERT_READ_LOCK(&clusterip_lock);
         list_for_each(pos, &clusterip_configs) {
                 struct clusterip_config *c = list_entry(pos, 
                                         struct clusterip_config, list);
@@ -114,14 +115,14 @@ clusterip_config_find_get(u_int32_t clusterip)
 {
         struct clusterip_config *c;
 
-        READ_LOCK(&clusterip_lock);
+        read_lock_bh(&clusterip_lock);
         c = __clusterip_config_find(clusterip);
         if (!c) {
-                READ_UNLOCK(&clusterip_lock);
+                read_unlock_bh(&clusterip_lock);
                 return NULL;
         }
         atomic_inc(&c->refcount);
-        READ_UNLOCK(&clusterip_lock);
+        read_unlock_bh(&clusterip_lock);
 
         return c;
 }
@@ -160,9 +161,9 @@ clusterip_config_init(struct ipt_clusterip_tgt_info *i, u_int32_t ip,
         c->pde->data = c;
 #endif
 
-        WRITE_LOCK(&clusterip_lock);
+        write_lock_bh(&clusterip_lock);
         list_add(&c->list, &clusterip_configs);
-        WRITE_UNLOCK(&clusterip_lock);
+        write_unlock_bh(&clusterip_lock);
 
         return c;
 }
@@ -172,25 +173,25 @@ clusterip_add_node(struct clusterip_config *c, u_int16_t nodenum)
 {
         int i;
 
-        WRITE_LOCK(&clusterip_lock);
+        write_lock_bh(&clusterip_lock);
 
         if (c->num_local_nodes >= CLUSTERIP_MAX_NODES
             || nodenum > CLUSTERIP_MAX_NODES) {
-                WRITE_UNLOCK(&clusterip_lock);
+                write_unlock_bh(&clusterip_lock);
                 return 1;
         }
 
         /* check if we alrady have this number in our array */
         for (i = 0; i < c->num_local_nodes; i++) {
                 if (c->local_nodes[i] == nodenum) {
-                        WRITE_UNLOCK(&clusterip_lock);
+                        write_unlock_bh(&clusterip_lock);
                         return 1;
                 }
         }
 
         c->local_nodes[c->num_local_nodes++] = nodenum;
 
-        WRITE_UNLOCK(&clusterip_lock);
+        write_unlock_bh(&clusterip_lock);
         return 0;
 }
 
@@ -199,10 +200,10 @@ clusterip_del_node(struct clusterip_config *c, u_int16_t nodenum)
 {
         int i;
 
-        WRITE_LOCK(&clusterip_lock);
+        write_lock_bh(&clusterip_lock);
 
         if (c->num_local_nodes <= 1 || nodenum > CLUSTERIP_MAX_NODES) {
-                WRITE_UNLOCK(&clusterip_lock);
+                write_unlock_bh(&clusterip_lock);
                 return 1;
         }
                 
@@ -211,12 +212,12 @@ clusterip_del_node(struct clusterip_config *c, u_int16_t nodenum)
                         int size = sizeof(u_int16_t)*(c->num_local_nodes-(i+1));
                         memmove(&c->local_nodes[i], &c->local_nodes[i+1], size);
                         c->num_local_nodes--;
-                        WRITE_UNLOCK(&clusterip_lock);
+                        write_unlock_bh(&clusterip_lock);
                         return 0;
                 }
         }
 
-        WRITE_UNLOCK(&clusterip_lock);
+        write_unlock_bh(&clusterip_lock);
         return 1;
 }
 
@@ -286,21 +287,21 @@ clusterip_responsible(struct clusterip_config *config, u_int32_t hash)
 {
         int i;
 
-        READ_LOCK(&clusterip_lock);
+        read_lock_bh(&clusterip_lock);
 
         if (config->num_local_nodes == 0) {
-                READ_UNLOCK(&clusterip_lock);
+                read_unlock_bh(&clusterip_lock);
                 return 0;
         }
 
         for (i = 0; i < config->num_local_nodes; i++) {
                 if (config->local_nodes[i] == hash) {
-                        READ_UNLOCK(&clusterip_lock);
+                        read_unlock_bh(&clusterip_lock);
                         return 1;
                 }
         }
 
-        READ_UNLOCK(&clusterip_lock);
+        read_unlock_bh(&clusterip_lock);
 
         return 0;
 }
@@ -338,7 +339,7 @@ target(struct sk_buff **pskb,
          * error messages (RELATED) and information requests (see below) */
         if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP
             && (ctinfo == IP_CT_RELATED 
-                || ctinfo == IP_CT_IS_REPLY+IP_CT_IS_REPLY))
+                || ctinfo == IP_CT_RELATED+IP_CT_IS_REPLY))
                 return IPT_CONTINUE;
 
         /* ip_conntrack_icmp guarantees us that we only have ICMP_ECHO, 
@@ -523,8 +524,9 @@ arp_mangle(unsigned int hook,
             || arp->ar_pln != 4 || arp->ar_hln != ETH_ALEN)
                 return NF_ACCEPT;
 
-        /* we only want to mangle arp replies */
-        if (arp->ar_op != htons(ARPOP_REPLY))
+        /* we only want to mangle arp requests and replies */
+        if (arp->ar_op != htons(ARPOP_REPLY)
+            && arp->ar_op != htons(ARPOP_REQUEST))
                 return NF_ACCEPT;
 
         payload = (void *)(arp+1);
@@ -578,7 +580,7 @@ static void *clusterip_seq_start(struct seq_file *s, loff_t *pos)
         struct clusterip_config *c = pde->data;
         unsigned int *nodeidx;
 
-        READ_LOCK(&clusterip_lock);
+        read_lock_bh(&clusterip_lock);
         if (*pos >= c->num_local_nodes)
                 return NULL;
 
@@ -608,7 +610,7 @@ static void clusterip_seq_stop(struct seq_file *s, void *v)
 {
         kfree(v);
 
-        READ_UNLOCK(&clusterip_lock);
+        read_unlock_bh(&clusterip_lock);
 }
 
 static int clusterip_seq_show(struct seq_file *s, void *v)
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index 57e9f6cf1c36..91e74502c3d3 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -33,7 +33,7 @@ MODULE_DESCRIPTION("iptables MASQUERADE target module");
 #endif
 
 /* Lock protects masq region inside conntrack */
-static DECLARE_RWLOCK(masq_lock);
+static DEFINE_RWLOCK(masq_lock);
 
 /* FIXME: Multiple targets. --RR */
 static int
@@ -103,9 +103,9 @@ masquerade_target(struct sk_buff **pskb,
                 return NF_DROP;
         }
 
-        WRITE_LOCK(&masq_lock);
+        write_lock_bh(&masq_lock);
         ct->nat.masq_index = out->ifindex;
-        WRITE_UNLOCK(&masq_lock);
+        write_unlock_bh(&masq_lock);
 
         /* Transfer from original range. */
         newrange = ((struct ip_nat_range)
@@ -122,9 +122,9 @@ device_cmp(struct ip_conntrack *i, void *ifindex)
 {
         int ret;
 
-        READ_LOCK(&masq_lock);
+        read_lock_bh(&masq_lock);
         ret = (i->nat.masq_index == (int)(long)ifindex);
-        READ_UNLOCK(&masq_lock);
+        read_unlock_bh(&masq_lock);
 
         return ret;
 }
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index 266d64979286..915696446020 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -104,10 +104,12 @@ static inline struct rtable *route_reverse(struct sk_buff *skb,
 static void send_reset(struct sk_buff *oldskb, int hook)
 {
         struct sk_buff *nskb;
+        struct iphdr *iph = oldskb->nh.iph;
         struct tcphdr _otcph, *oth, *tcph;
         struct rtable *rt;
         u_int16_t tmp_port;
         u_int32_t tmp_addr;
+        unsigned int tcplen;
         int needs_ack;
         int hh_len;
 
@@ -124,7 +126,16 @@ static void send_reset(struct sk_buff *oldskb, int hook)
         if (oth->rst)
                 return;
 
-        /* FIXME: Check checksum --RR */
+        /* Check checksum */
+        tcplen = oldskb->len - iph->ihl * 4;
+        if (((hook != NF_IP_LOCAL_IN && oldskb->ip_summed != CHECKSUM_HW) ||
+             (hook == NF_IP_LOCAL_IN &&
+              oldskb->ip_summed != CHECKSUM_UNNECESSARY)) &&
+            csum_tcpudp_magic(iph->saddr, iph->daddr, tcplen, IPPROTO_TCP,
+                              oldskb->ip_summed == CHECKSUM_HW ? oldskb->csum :
+                              skb_checksum(oldskb, iph->ihl * 4, tcplen, 0)))
+                return;
+
         if ((rt = route_reverse(oldskb, oth, hook)) == NULL)
                 return;
 
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index 6f2cefbe16cd..52a0076302a7 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -56,7 +56,6 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <linux/netfilter_ipv4/ipt_ULOG.h>
-#include <linux/netfilter_ipv4/lockhelp.h>
 #include <net/sock.h>
 #include <linux/bitops.h>
 
@@ -99,8 +98,8 @@ typedef struct {
 
 static ulog_buff_t ulog_buffers[ULOG_MAXNLGROUPS];      /* array of buffers */
 
-static struct sock *nflognl;    /* our socket */
-static DECLARE_LOCK(ulog_lock); /* spinlock */
+static struct sock *nflognl;            /* our socket */
+static DEFINE_SPINLOCK(ulog_lock);      /* spinlock */
 
 /* send one ulog_buff_t to userspace */
 static void ulog_send(unsigned int nlgroupnum)
@@ -135,9 +134,9 @@ static void ulog_timer(unsigned long data)
 
         /* lock to protect against somebody modifying our structure
          * from ipt_ulog_target at the same time */
-        LOCK_BH(&ulog_lock);
+        spin_lock_bh(&ulog_lock);
         ulog_send(data);
-        UNLOCK_BH(&ulog_lock);
+        spin_unlock_bh(&ulog_lock);
 }
 
 static struct sk_buff *ulog_alloc_skb(unsigned int size)
@@ -193,7 +192,7 @@ static void ipt_ulog_packet(unsigned int hooknum,
 
         ub = &ulog_buffers[groupnum];
         
-        LOCK_BH(&ulog_lock);
+        spin_lock_bh(&ulog_lock);
 
         if (!ub->skb) {
                 if (!(ub->skb = ulog_alloc_skb(size)))
@@ -278,7 +277,7 @@ static void ipt_ulog_packet(unsigned int hooknum,
                 ulog_send(groupnum);
         }
 
-        UNLOCK_BH(&ulog_lock);
+        spin_unlock_bh(&ulog_lock);
 
         return;
 
@@ -288,7 +287,7 @@ nlmsg_failure:
 alloc_failure:
         PRINTR("ipt_ULOG: Error building netlink message\n");
 
-        UNLOCK_BH(&ulog_lock);
+        spin_unlock_bh(&ulog_lock);
 }
 
 static unsigned int ipt_ulog_target(struct sk_buff **pskb,
diff --git a/net/ipv4/netfilter/ipt_hashlimit.c b/net/ipv4/netfilter/ipt_hashlimit.c
index f1937190cd77..564b49bfebcf 100644
--- a/net/ipv4/netfilter/ipt_hashlimit.c
+++ b/net/ipv4/netfilter/ipt_hashlimit.c
@@ -37,7 +37,6 @@
 
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <linux/netfilter_ipv4/ipt_hashlimit.h>
-#include <linux/netfilter_ipv4/lockhelp.h>
 
 /* FIXME: this is just for IP_NF_ASSERRT */
 #include <linux/netfilter_ipv4/ip_conntrack.h>
@@ -92,7 +91,7 @@ struct ipt_hashlimit_htable {
         struct hlist_head hash[0];      /* hashtable itself */
 };
 
-static DECLARE_LOCK(hashlimit_lock);    /* protects htables list */
+static DEFINE_SPINLOCK(hashlimit_lock); /* protects htables list */
 static DECLARE_MUTEX(hlimit_mutex);     /* additional checkentry protection */
 static HLIST_HEAD(hashlimit_htables);
 static kmem_cache_t *hashlimit_cachep;
@@ -233,9 +232,9 @@ static int htable_create(struct ipt_hashlimit_info *minfo)
         hinfo->timer.function = htable_gc;
         add_timer(&hinfo->timer);
 
-        LOCK_BH(&hashlimit_lock);
+        spin_lock_bh(&hashlimit_lock);
         hlist_add_head(&hinfo->node, &hashlimit_htables);
-        UNLOCK_BH(&hashlimit_lock);
+        spin_unlock_bh(&hashlimit_lock);
 
         return 0;
 }
@@ -301,15 +300,15 @@ static struct ipt_hashlimit_htable *htable_find_get(char *name)
         struct ipt_hashlimit_htable *hinfo;
         struct hlist_node *pos;
 
-        LOCK_BH(&hashlimit_lock);
+        spin_lock_bh(&hashlimit_lock);
         hlist_for_each_entry(hinfo, pos, &hashlimit_htables, node) {
                 if (!strcmp(name, hinfo->pde->name)) {
                         atomic_inc(&hinfo->use);
-                        UNLOCK_BH(&hashlimit_lock);
+                        spin_unlock_bh(&hashlimit_lock);
                         return hinfo;
                 }
         }
-        UNLOCK_BH(&hashlimit_lock);
+        spin_unlock_bh(&hashlimit_lock);
 
         return NULL;
 }
@@ -317,9 +316,9 @@ static struct ipt_hashlimit_htable *htable_find_get(char *name)
 static void htable_put(struct ipt_hashlimit_htable *hinfo)
 {
         if (atomic_dec_and_test(&hinfo->use)) {
-                LOCK_BH(&hashlimit_lock);
+                spin_lock_bh(&hashlimit_lock);
                 hlist_del(&hinfo->node);
-                UNLOCK_BH(&hashlimit_lock);
+                spin_unlock_bh(&hashlimit_lock);
                 htable_destroy(hinfo);
         }
 }
diff --git a/net/ipv4/netfilter/ipt_helper.c b/net/ipv4/netfilter/ipt_helper.c
index 33fdf364d3d3..3e7dd014de43 100644
--- a/net/ipv4/netfilter/ipt_helper.c
+++ b/net/ipv4/netfilter/ipt_helper.c
@@ -53,7 +53,7 @@ match(const struct sk_buff *skb,
                 return ret;
         }
 
-        READ_LOCK(&ip_conntrack_lock);
+        read_lock_bh(&ip_conntrack_lock);
         if (!ct->master->helper) {
                 DEBUGP("ipt_helper: master ct %p has no helper\n", 
                         exp->expectant);
@@ -69,7 +69,7 @@ match(const struct sk_buff *skb,
                 ret ^= !strncmp(ct->master->helper->name, info->name, 
                                 strlen(ct->master->helper->name));
 out_unlock:
-        READ_UNLOCK(&ip_conntrack_lock);
+        read_unlock_bh(&ip_conntrack_lock);
         return ret;
 }
 
diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index 25ab9fabdcba..2d44b07688af 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -223,7 +223,7 @@ static int ip_recent_ctrl(struct file *file, const char __user *input, unsigned
                         curr_table->table[count].last_seen = 0;
                         curr_table->table[count].addr = 0;
                         curr_table->table[count].ttl = 0;
-                        memset(curr_table->table[count].last_pkts,0,ip_pkt_list_tot*sizeof(u_int32_t));
+                        memset(curr_table->table[count].last_pkts,0,ip_pkt_list_tot*sizeof(unsigned long));
                         curr_table->table[count].oldest_pkt = 0;
                         curr_table->table[count].time_pos = 0;
                         curr_table->time_info[count].position = count;
@@ -502,7 +502,7 @@ match(const struct sk_buff *skb,
                 location = time_info[curr_table->time_pos].position;
                 hash_table[r_list[location].hash_entry] = -1;
                 hash_table[hash_result] = location;
-                memset(r_list[location].last_pkts,0,ip_pkt_list_tot*sizeof(u_int32_t));
+                memset(r_list[location].last_pkts,0,ip_pkt_list_tot*sizeof(unsigned long));
                 r_list[location].time_pos = curr_table->time_pos;
                 r_list[location].addr = addr;
                 r_list[location].ttl = ttl;
@@ -631,7 +631,7 @@ match(const struct sk_buff *skb,
                         r_list[location].last_seen = 0;
                         r_list[location].addr = 0;
                         r_list[location].ttl = 0;
-                        memset(r_list[location].last_pkts,0,ip_pkt_list_tot*sizeof(u_int32_t));
+                        memset(r_list[location].last_pkts,0,ip_pkt_list_tot*sizeof(unsigned long));
                         r_list[location].oldest_pkt = 0;
                         ans = !info->invert;
                 }
@@ -734,10 +734,10 @@ checkentry(const char *tablename,
         memset(curr_table->table,0,sizeof(struct recent_ip_list)*ip_list_tot);
 #ifdef DEBUG
         if(debug) printk(KERN_INFO RECENT_NAME ": checkentry: Allocating %d for pkt_list.\n",
-                        sizeof(u_int32_t)*ip_pkt_list_tot*ip_list_tot);
+                        sizeof(unsigned long)*ip_pkt_list_tot*ip_list_tot);
 #endif
 
-        hold = vmalloc(sizeof(u_int32_t)*ip_pkt_list_tot*ip_list_tot);
+        hold = vmalloc(sizeof(unsigned long)*ip_pkt_list_tot*ip_list_tot);
 #ifdef DEBUG
         if(debug) printk(KERN_INFO RECENT_NAME ": checkentry: After pkt_list allocation.\n");
 #endif
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 5b1ec586bae6..d1835b1bc8c4 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -259,7 +259,7 @@ int raw_rcv(struct sock *sk, struct sk_buff *skb)
         return 0;
 }
 
-static int raw_send_hdrinc(struct sock *sk, void *from, int length,
+static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
                         struct rtable *rt, 
                         unsigned int flags)
 {
@@ -298,7 +298,7 @@ static int raw_send_hdrinc(struct sock *sk, void *from, int length,
                 goto error_fault;
 
         /* We don't modify invalid header */
-        if (length >= sizeof(*iph) && iph->ihl * 4 <= length) {
+        if (length >= sizeof(*iph) && iph->ihl * 4U <= length) {
                 if (!iph->saddr)
                         iph->saddr = rt->rt_src;
                 iph->check   = 0;
@@ -332,7 +332,7 @@ static void raw_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
         u8 __user *type = NULL;
         u8 __user *code = NULL;
         int probed = 0;
-        int i;
+        unsigned int i;
 
         if (!msg->msg_iov)
                 return;
@@ -384,7 +384,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         int err;
 
         err = -EMSGSIZE;
-        if (len < 0 || len > 0xFFFF)
+        if (len > 0xFFFF)
                 goto out;
 
         /*
@@ -514,7 +514,10 @@ done:
                 kfree(ipc.opt);
         ip_rt_put(rt);
 
-out:    return err < 0 ? err : len;
+out:
+        if (err < 0)
+                return err;
+        return len;
 
 do_confirm:
         dst_confirm(&rt->u.dst);
@@ -610,7 +613,10 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 copied = skb->len;
 done:
         skb_free_datagram(sk, skb);
-out:    return err ? err : copied;
+out:
+        if (err)
+                return err;
+        return copied;
 }
 
 static int raw_init(struct sock *sk)
@@ -691,11 +697,11 @@ static int raw_ioctl(struct sock *sk, int cmd, unsigned long arg)
                         struct sk_buff *skb;
                         int amount = 0;
 
-                        spin_lock_irq(&sk->sk_receive_queue.lock);
+                        spin_lock_bh(&sk->sk_receive_queue.lock);
                         skb = skb_peek(&sk->sk_receive_queue);
                         if (skb != NULL)
                                 amount = skb->len;
-                        spin_unlock_irq(&sk->sk_receive_queue.lock);
+                        spin_unlock_bh(&sk->sk_receive_queue.lock);
                         return put_user(amount, (int __user *)arg);
                 }
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a682d28e247b..d675ff80b04d 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -54,6 +54,7 @@
  *              Marc Boucher    :       routing by fwmark
  *      Robert Olsson           :       Added rt_cache statistics
  *      Arnaldo C. Melo         :       Convert proc stuff to seq_file
+ *      Eric Dumazet            :       hashed spinlocks and rt_check_expire() fixes.
  *
  *              This program is free software; you can redistribute it and/or
  *              modify it under the terms of the GNU General Public License
@@ -70,6 +71,7 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
+#include <linux/bootmem.h>
 #include <linux/string.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
@@ -201,8 +203,37 @@ __u8 ip_tos2prio[16] = {
 
 struct rt_hash_bucket {
         struct rtable   *chain;
-        spinlock_t      lock;
-} __attribute__((__aligned__(8)));
+};
+#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
+/*
+ * Instead of using one spinlock for each rt_hash_bucket, we use a table of spinlocks
+ * The size of this table is a power of two and depends on the number of CPUS.
+ */
+#if NR_CPUS >= 32
+#define RT_HASH_LOCK_SZ 4096
+#elif NR_CPUS >= 16
+#define RT_HASH_LOCK_SZ 2048
+#elif NR_CPUS >= 8
+#define RT_HASH_LOCK_SZ 1024
+#elif NR_CPUS >= 4
+#define RT_HASH_LOCK_SZ 512
+#else
+#define RT_HASH_LOCK_SZ 256
+#endif
+
+static spinlock_t       *rt_hash_locks;
+# define rt_hash_lock_addr(slot) &rt_hash_locks[(slot) & (RT_HASH_LOCK_SZ - 1)]
+# define rt_hash_lock_init()    { \
+                int i; \
+                rt_hash_locks = kmalloc(sizeof(spinlock_t) * RT_HASH_LOCK_SZ, GFP_KERNEL); \
+                if (!rt_hash_locks) panic("IP: failed to allocate rt_hash_locks\n"); \
+                for (i = 0; i < RT_HASH_LOCK_SZ; i++) \
+                        spin_lock_init(&rt_hash_locks[i]); \
+                }
+#else
+# define rt_hash_lock_addr(slot) NULL
+# define rt_hash_lock_init()
+#endif
 
 static struct rt_hash_bucket    *rt_hash_table;
 static unsigned                 rt_hash_mask;
@@ -575,19 +606,26 @@ static struct rtable **rt_remove_balanced_route(struct rtable **chain_head,
 /* This runs via a timer and thus is always in BH context. */
 static void rt_check_expire(unsigned long dummy)
 {
-        static int rover;
-        int i = rover, t;
+        static unsigned int rover;
+        unsigned int i = rover, goal;
         struct rtable *rth, **rthp;
         unsigned long now = jiffies;
-
-        for (t = ip_rt_gc_interval << rt_hash_log; t >= 0;
-             t -= ip_rt_gc_timeout) {
+        u64 mult;
+
+        mult = ((u64)ip_rt_gc_interval) << rt_hash_log;
+        if (ip_rt_gc_timeout > 1)
+                do_div(mult, ip_rt_gc_timeout);
+        goal = (unsigned int)mult;
+        if (goal > rt_hash_mask) goal = rt_hash_mask + 1;
+        for (; goal > 0; goal--) {
                 unsigned long tmo = ip_rt_gc_timeout;
 
                 i = (i + 1) & rt_hash_mask;
                 rthp = &rt_hash_table[i].chain;
 
-                spin_lock(&rt_hash_table[i].lock);
+                if (*rthp == 0)
+                        continue;
+                spin_lock(rt_hash_lock_addr(i));
                 while ((rth = *rthp) != NULL) {
                         if (rth->u.dst.expires) {
                                 /* Entry is expired even if it is in use */
@@ -620,14 +658,14 @@ static void rt_check_expire(unsigned long dummy)
                         rt_free(rth);
 #endif /* CONFIG_IP_ROUTE_MULTIPATH_CACHED */
                 }
-                spin_unlock(&rt_hash_table[i].lock);
+                spin_unlock(rt_hash_lock_addr(i));
 
                 /* Fallback loop breaker. */
                 if (time_after(jiffies, now))
                         break;
         }
         rover = i;
-        mod_timer(&rt_periodic_timer, now + ip_rt_gc_interval);
+        mod_timer(&rt_periodic_timer, jiffies + ip_rt_gc_interval);
 }
 
 /* This can run from both BH and non-BH contexts, the latter
@@ -643,11 +681,11 @@ static void rt_run_flush(unsigned long dummy)
         get_random_bytes(&rt_hash_rnd, 4);
 
         for (i = rt_hash_mask; i >= 0; i--) {
-                spin_lock_bh(&rt_hash_table[i].lock);
+                spin_lock_bh(rt_hash_lock_addr(i));
                 rth = rt_hash_table[i].chain;
                 if (rth)
                         rt_hash_table[i].chain = NULL;
-                spin_unlock_bh(&rt_hash_table[i].lock);
+                spin_unlock_bh(rt_hash_lock_addr(i));
 
                 for (; rth; rth = next) {
                         next = rth->u.rt_next;
@@ -780,7 +818,7 @@ static int rt_garbage_collect(void)
 
                         k = (k + 1) & rt_hash_mask;
                         rthp = &rt_hash_table[k].chain;
-                        spin_lock_bh(&rt_hash_table[k].lock);
+                        spin_lock_bh(rt_hash_lock_addr(k));
                         while ((rth = *rthp) != NULL) {
                                 if (!rt_may_expire(rth, tmo, expire)) {
                                         tmo >>= 1;
@@ -812,7 +850,7 @@ static int rt_garbage_collect(void)
                                 goal--;
 #endif /* CONFIG_IP_ROUTE_MULTIPATH_CACHED */
                         }
-                        spin_unlock_bh(&rt_hash_table[k].lock);
+                        spin_unlock_bh(rt_hash_lock_addr(k));
                         if (goal <= 0)
                                 break;
                 }
@@ -882,7 +920,7 @@ restart:
 
         rthp = &rt_hash_table[hash].chain;
 
-        spin_lock_bh(&rt_hash_table[hash].lock);
+        spin_lock_bh(rt_hash_lock_addr(hash));
         while ((rth = *rthp) != NULL) {
 #ifdef CONFIG_IP_ROUTE_MULTIPATH_CACHED
                 if (!(rth->u.dst.flags & DST_BALANCED) &&
@@ -908,7 +946,7 @@ restart:
                         rth->u.dst.__use++;
                         dst_hold(&rth->u.dst);
                         rth->u.dst.lastuse = now;
-                        spin_unlock_bh(&rt_hash_table[hash].lock);
+                        spin_unlock_bh(rt_hash_lock_addr(hash));
 
                         rt_drop(rt);
                         *rp = rth;
@@ -949,7 +987,7 @@ restart:
         if (rt->rt_type == RTN_UNICAST || rt->fl.iif == 0) {
                 int err = arp_bind_neighbour(&rt->u.dst);
                 if (err) {
-                        spin_unlock_bh(&rt_hash_table[hash].lock);
+                        spin_unlock_bh(rt_hash_lock_addr(hash));
 
                         if (err != -ENOBUFS) {
                                 rt_drop(rt);
@@ -990,7 +1028,7 @@ restart:
         }
 #endif
         rt_hash_table[hash].chain = rt;
-        spin_unlock_bh(&rt_hash_table[hash].lock);
+        spin_unlock_bh(rt_hash_lock_addr(hash));
         *rp = rt;
         return 0;
 }
@@ -1058,7 +1096,7 @@ static void rt_del(unsigned hash, struct rtable *rt)
 {
         struct rtable **rthp;
 
-        spin_lock_bh(&rt_hash_table[hash].lock);
+        spin_lock_bh(rt_hash_lock_addr(hash));
         ip_rt_put(rt);
         for (rthp = &rt_hash_table[hash].chain; *rthp;
              rthp = &(*rthp)->u.rt_next)
@@ -1067,7 +1105,7 @@ static void rt_del(unsigned hash, struct rtable *rt)
                         rt_free(rt);
                         break;
                 }
-        spin_unlock_bh(&rt_hash_table[hash].lock);
+        spin_unlock_bh(rt_hash_lock_addr(hash));
 }
 
 void ip_rt_redirect(u32 old_gw, u32 daddr, u32 new_gw,
@@ -1647,7 +1685,7 @@ static void ip_handle_martian_source(struct net_device *dev,
                 printk(KERN_WARNING "martian source %u.%u.%u.%u from "
                         "%u.%u.%u.%u, on dev %s\n",
                         NIPQUAD(daddr), NIPQUAD(saddr), dev->name);
-                if (dev->hard_header_len) {
+                if (dev->hard_header_len && skb->mac.raw) {
                         int i;
                         unsigned char *p = skb->mac.raw;
                         printk(KERN_WARNING "ll header: ");
@@ -1767,7 +1805,7 @@ static inline int ip_mkroute_input_def(struct sk_buff *skb,
                                        struct in_device *in_dev,
                                        u32 daddr, u32 saddr, u32 tos)
 {
-        struct rtable* rth;
+        struct rtable* rth = NULL;
         int err;
         unsigned hash;
 
@@ -1794,7 +1832,7 @@ static inline int ip_mkroute_input(struct sk_buff *skb,
                                    u32 daddr, u32 saddr, u32 tos)
 {
 #ifdef CONFIG_IP_ROUTE_MULTIPATH_CACHED
-        struct rtable* rth;
+        struct rtable* rth = NULL;
         unsigned char hop, hopcount, lasthop;
         int err = -EINVAL;
         unsigned int hash;
@@ -1909,7 +1947,7 @@ static int ip_route_input_slow(struct sk_buff *skb, u32 daddr, u32 saddr,
          */
         if ((err = fib_lookup(&fl, &res)) != 0) {
                 if (!IN_DEV_FORWARD(in_dev))
-                        goto e_inval;
+                        goto e_hostunreach;
                 goto no_route;
         }
         free_res = 1;
@@ -1933,7 +1971,7 @@ static int ip_route_input_slow(struct sk_buff *skb, u32 daddr, u32 saddr,
         }
 
         if (!IN_DEV_FORWARD(in_dev))
-                goto e_inval;
+                goto e_hostunreach;
         if (res.type != RTN_UNICAST)
                 goto martian_destination;
 
@@ -2025,6 +2063,11 @@ martian_destination:
                         "%u.%u.%u.%u, dev %s\n",
                         NIPQUAD(daddr), NIPQUAD(saddr), dev->name);
 #endif
+
+e_hostunreach:
+        err = -EHOSTUNREACH;
+        goto done;
+
 e_inval:
         err = -EINVAL;
         goto done;
@@ -2239,7 +2282,7 @@ static inline int ip_mkroute_output_def(struct rtable **rp,
                                         struct net_device *dev_out,
                                         unsigned flags)
 {
-        struct rtable *rth;
+        struct rtable *rth = NULL;
         int err = __mkroute_output(&rth, res, fl, oldflp, dev_out, flags);
         unsigned hash;
         if (err == 0) {
@@ -2267,7 +2310,7 @@ static inline int ip_mkroute_output(struct rtable** rp,
         unsigned char hop;
         unsigned hash;
         int err = -EINVAL;
-        struct rtable *rth;
+        struct rtable *rth = NULL;
 
         if (res->fi && res->fi->fib_nhs > 1) {
                 unsigned char hopcount = res->fi->fib_nhs;
@@ -2581,7 +2624,7 @@ int ip_route_output_key(struct rtable **rp, struct flowi *flp)
 }
 
 static int rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
-                        int nowait)
+                        int nowait, unsigned int flags)
 {
         struct rtable *rt = (struct rtable*)skb->dst;
         struct rtmsg *r;
@@ -2591,9 +2634,8 @@ static int rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
 #ifdef CONFIG_IP_MROUTE
         struct rtattr *eptr;
 #endif
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*r));
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*r), flags);
         r = NLMSG_DATA(nlh);
-        nlh->nlmsg_flags = (nowait && pid) ? NLM_F_MULTI : 0;
         r->rtm_family    = AF_INET;
         r->rtm_dst_len  = 32;
         r->rtm_src_len  = 0;
@@ -2744,7 +2786,7 @@ int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void *arg)
         NETLINK_CB(skb).dst_pid = NETLINK_CB(in_skb).pid;
 
         err = rt_fill_info(skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq,
-                                RTM_NEWROUTE, 0);
+                                RTM_NEWROUTE, 0, 0);
         if (!err)
                 goto out_free;
         if (err < 0) {
@@ -2781,8 +2823,8 @@ int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb)
                                 continue;
                         skb->dst = dst_clone(&rt->u.dst);
                         if (rt_fill_info(skb, NETLINK_CB(cb->skb).pid,
-                                         cb->nlh->nlmsg_seq,
-                                         RTM_NEWROUTE, 1) <= 0) {
+                                         cb->nlh->nlmsg_seq, RTM_NEWROUTE, 
+                                         1, NLM_F_MULTI) <= 0) {
                                 dst_release(xchg(&skb->dst, NULL));
                                 rcu_read_unlock_bh();
                                 goto done;
@@ -3069,12 +3111,14 @@ __setup("rhash_entries=", set_rhash_entries);
 
 int __init ip_rt_init(void)
 {
-        int i, order, goal, rc = 0;
+        int rc = 0;
 
         rt_hash_rnd = (int) ((num_physpages ^ (num_physpages>>8)) ^
                              (jiffies ^ (jiffies >> 7)));
 
 #ifdef CONFIG_NET_CLS_ROUTE
+        {
+        int order;
         for (order = 0;
              (PAGE_SIZE << order) < 256 * sizeof(struct ip_rt_acct) * NR_CPUS; order++)
                 /* NOTHING */;
@@ -3082,6 +3126,7 @@ int __init ip_rt_init(void)
         if (!ip_rt_acct)
                 panic("IP: failed to allocate ip_rt_acct\n");
         memset(ip_rt_acct, 0, PAGE_SIZE << order);
+        }
 #endif
 
         ipv4_dst_ops.kmem_cachep = kmem_cache_create("ip_dst_cache",
@@ -3092,36 +3137,19 @@ int __init ip_rt_init(void)
         if (!ipv4_dst_ops.kmem_cachep)
                 panic("IP: failed to allocate ip_dst_cache\n");
 
-        goal = num_physpages >> (26 - PAGE_SHIFT);
-        if (rhash_entries)
-                goal = (rhash_entries * sizeof(struct rt_hash_bucket)) >> PAGE_SHIFT;
-        for (order = 0; (1UL << order) < goal; order++)
-                /* NOTHING */;
-
-        do {
-                rt_hash_mask = (1UL << order) * PAGE_SIZE /
-                        sizeof(struct rt_hash_bucket);
-                while (rt_hash_mask & (rt_hash_mask - 1))
-                        rt_hash_mask--;
-                rt_hash_table = (struct rt_hash_bucket *)
-                        __get_free_pages(GFP_ATOMIC, order);
-        } while (rt_hash_table == NULL && --order > 0);
-
-        if (!rt_hash_table)
-                panic("Failed to allocate IP route cache hash table\n");
-
-        printk(KERN_INFO "IP: routing cache hash table of %u buckets, %ldKbytes\n",
-               rt_hash_mask,
-               (long) (rt_hash_mask * sizeof(struct rt_hash_bucket)) / 1024);
-
-        for (rt_hash_log = 0; (1 << rt_hash_log) != rt_hash_mask; rt_hash_log++)
-                /* NOTHING */;
-
-        rt_hash_mask--;
-        for (i = 0; i <= rt_hash_mask; i++) {
-                spin_lock_init(&rt_hash_table[i].lock);
-                rt_hash_table[i].chain = NULL;
-        }
+        rt_hash_table = (struct rt_hash_bucket *)
+                alloc_large_system_hash("IP route cache",
+                                        sizeof(struct rt_hash_bucket),
+                                        rhash_entries,
+                                        (num_physpages >= 128 * 1024) ?
+                                                (27 - PAGE_SHIFT) :
+                                                (29 - PAGE_SHIFT),
+                                        HASH_HIGHMEM,
+                                        &rt_hash_log,
+                                        &rt_hash_mask,
+                                        0);
+        memset(rt_hash_table, 0, (rt_hash_mask + 1) * sizeof(struct rt_hash_bucket));
+        rt_hash_lock_init();
 
         ipv4_dst_ops.gc_thresh = (rt_hash_mask + 1);
         ip_rt_max_size = (rt_hash_mask + 1) * 16;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index e923d2f021aa..72d014442185 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -169,10 +169,10 @@ static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
         return mssind < NUM_MSS ? msstab[mssind] + 1 : 0;
 }
 
-extern struct or_calltable or_ipv4;
+extern struct request_sock_ops tcp_request_sock_ops;
 
 static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
-                                           struct open_request *req,
+                                           struct request_sock *req,
                                            struct dst_entry *dst)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -182,7 +182,7 @@ static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
         if (child)
                 tcp_acceptq_queue(sk, req, child);
         else
-                tcp_openreq_free(req);
+                reqsk_free(req);
 
         return child;
 }
@@ -190,10 +190,12 @@ static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
 struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                              struct ip_options *opt)
 {
+        struct inet_request_sock *ireq;
+        struct tcp_request_sock *treq;
         struct tcp_sock *tp = tcp_sk(sk);
         __u32 cookie = ntohl(skb->h.th->ack_seq) - 1; 
         struct sock *ret = sk;
-        struct open_request *req; 
+        struct request_sock *req; 
         int mss; 
         struct rtable *rt; 
         __u8 rcv_wscale;
@@ -209,19 +211,20 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 
         NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESRECV);
 
-        req = tcp_openreq_alloc();
         ret = NULL;
+        req = reqsk_alloc(&tcp_request_sock_ops); /* for safety */
         if (!req)
                 goto out;
 
-        req->rcv_isn            = htonl(skb->h.th->seq) - 1;
-        req->snt_isn            = cookie; 
+        ireq = inet_rsk(req);
+        treq = tcp_rsk(req);
+        treq->rcv_isn           = htonl(skb->h.th->seq) - 1;
+        treq->snt_isn           = cookie; 
         req->mss                = mss;
-        req->rmt_port           = skb->h.th->source;
-        req->af.v4_req.loc_addr = skb->nh.iph->daddr;
-        req->af.v4_req.rmt_addr = skb->nh.iph->saddr;
-        req->class              = &or_ipv4; /* for savety */
-        req->af.v4_req.opt      = NULL;
+        ireq->rmt_port          = skb->h.th->source;
+        ireq->loc_addr          = skb->nh.iph->daddr;
+        ireq->rmt_addr          = skb->nh.iph->saddr;
+        ireq->opt               = NULL;
 
         /* We throwed the options of the initial SYN away, so we hope
          * the ACK carries the same options again (see RFC1122 4.2.3.8)
@@ -229,17 +232,15 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         if (opt && opt->optlen) {
                 int opt_size = sizeof(struct ip_options) + opt->optlen;
 
-                req->af.v4_req.opt = kmalloc(opt_size, GFP_ATOMIC);
-                if (req->af.v4_req.opt) {
-                        if (ip_options_echo(req->af.v4_req.opt, skb)) {
-                                kfree(req->af.v4_req.opt);
-                                req->af.v4_req.opt = NULL;
-                        }
+                ireq->opt = kmalloc(opt_size, GFP_ATOMIC);
+                if (ireq->opt != NULL && ip_options_echo(ireq->opt, skb)) {
+                        kfree(ireq->opt);
+                        ireq->opt = NULL;
                 }
         }
 
-        req->snd_wscale = req->rcv_wscale = req->tstamp_ok = 0;
-        req->wscale_ok  = req->sack_ok = 0; 
+        ireq->snd_wscale = ireq->rcv_wscale = ireq->tstamp_ok = 0;
+        ireq->wscale_ok  = ireq->sack_ok = 0; 
         req->expires    = 0UL; 
         req->retrans    = 0; 
         
@@ -253,15 +254,15 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                 struct flowi fl = { .nl_u = { .ip4_u =
                                               { .daddr = ((opt && opt->srr) ?
                                                           opt->faddr :
-                                                          req->af.v4_req.rmt_addr),
-                                                .saddr = req->af.v4_req.loc_addr,
+                                                          ireq->rmt_addr),
+                                                .saddr = ireq->loc_addr,
                                                 .tos = RT_CONN_FLAGS(sk) } },
                                     .proto = IPPROTO_TCP,
                                     .uli_u = { .ports =
                                                { .sport = skb->h.th->dest,
                                                  .dport = skb->h.th->source } } };
                 if (ip_route_output_key(&rt, &fl)) {
-                        tcp_openreq_free(req);
+                        reqsk_free(req);
                         goto out; 
                 }
         }
@@ -272,7 +273,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                                   &req->rcv_wnd, &req->window_clamp, 
                                   0, &rcv_wscale);
         /* BTW win scale with syncookies is 0 by definition */
-        req->rcv_wscale   = rcv_wscale; 
+        ireq->rcv_wscale  = rcv_wscale; 
 
         ret = get_cookie_sock(sk, skb, req, &rt->u.dst);
 out:    return ret;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 3aafb298c1c1..e32894532416 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -23,6 +23,7 @@ extern int sysctl_ip_nonlocal_bind;
 extern int sysctl_icmp_echo_ignore_all;
 extern int sysctl_icmp_echo_ignore_broadcasts;
 extern int sysctl_icmp_ignore_bogus_error_responses;
+extern int sysctl_icmp_errors_use_inbound_ifaddr;
 
 /* From ip_fragment.c */
 extern int sysctl_ipfrag_low_thresh;
@@ -117,6 +118,45 @@ static int ipv4_sysctl_forward_strategy(ctl_table *table,
         return 1;
 }
 
+static int proc_tcp_congestion_control(ctl_table *ctl, int write, struct file * filp,
+                                       void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        char val[TCP_CA_NAME_MAX];
+        ctl_table tbl = {
+                .data = val,
+                .maxlen = TCP_CA_NAME_MAX,
+        };
+        int ret;
+
+        tcp_get_default_congestion_control(val);
+
+        ret = proc_dostring(&tbl, write, filp, buffer, lenp, ppos);
+        if (write && ret == 0)
+                ret = tcp_set_default_congestion_control(val);
+        return ret;
+}
+
+int sysctl_tcp_congestion_control(ctl_table *table, int __user *name, int nlen,
+                                  void __user *oldval, size_t __user *oldlenp,
+                                  void __user *newval, size_t newlen,
+                                  void **context)
+{
+        char val[TCP_CA_NAME_MAX];
+        ctl_table tbl = {
+                .data = val,
+                .maxlen = TCP_CA_NAME_MAX,
+        };
+        int ret;
+
+        tcp_get_default_congestion_control(val);
+        ret = sysctl_string(&tbl, name, nlen, oldval, oldlenp, newval, newlen,
+                            context);
+        if (ret == 0 && newval && newlen)
+                ret = tcp_set_default_congestion_control(val);
+        return ret;
+}
+
+
 ctl_table ipv4_table[] = {
         {
                 .ctl_name       = NET_IPV4_TCP_TIMESTAMPS,
@@ -396,6 +436,14 @@ ctl_table ipv4_table[] = {
                 .proc_handler   = &proc_dointvec
         },
         {
+                .ctl_name       = NET_IPV4_ICMP_ERRORS_USE_INBOUND_IFADDR,
+                .procname       = "icmp_errors_use_inbound_ifaddr",
+                .data           = &sysctl_icmp_errors_use_inbound_ifaddr,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec
+        },
+        {
                 .ctl_name       = NET_IPV4_ROUTE,
                 .procname       = "route",
                 .maxlen         = 0,
@@ -603,70 +651,6 @@ ctl_table ipv4_table[] = {
                 .proc_handler   = &proc_dointvec,
         },
         {
-                .ctl_name       = NET_TCP_WESTWOOD, 
-                .procname       = "tcp_westwood",
-                .data           = &sysctl_tcp_westwood,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
-                .ctl_name       = NET_TCP_VEGAS,
-                .procname       = "tcp_vegas_cong_avoid",
-                .data           = &sysctl_tcp_vegas_cong_avoid,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
-                .ctl_name       = NET_TCP_VEGAS_ALPHA,
-                .procname       = "tcp_vegas_alpha",
-                .data           = &sysctl_tcp_vegas_alpha,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
-                .ctl_name       = NET_TCP_VEGAS_BETA,
-                .procname       = "tcp_vegas_beta",
-                .data           = &sysctl_tcp_vegas_beta,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
-                .ctl_name       = NET_TCP_VEGAS_GAMMA,
-                .procname       = "tcp_vegas_gamma",
-                .data           = &sysctl_tcp_vegas_gamma,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
-                .ctl_name       = NET_TCP_BIC,
-                .procname       = "tcp_bic",
-                .data           = &sysctl_tcp_bic,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
-                .ctl_name       = NET_TCP_BIC_FAST_CONVERGENCE,
-                .procname       = "tcp_bic_fast_convergence",
-                .data           = &sysctl_tcp_bic_fast_convergence,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
-                .ctl_name       = NET_TCP_BIC_LOW_WINDOW,
-                .procname       = "tcp_bic_low_window",
-                .data           = &sysctl_tcp_bic_low_window,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
                 .ctl_name       = NET_TCP_MODERATE_RCVBUF,
                 .procname       = "tcp_moderate_rcvbuf",
                 .data           = &sysctl_tcp_moderate_rcvbuf,
@@ -683,13 +667,14 @@ ctl_table ipv4_table[] = {
                 .proc_handler   = &proc_dointvec,
         },
         {
-                .ctl_name       = NET_TCP_BIC_BETA,
-                .procname       = "tcp_bic_beta",
-                .data           = &sysctl_tcp_bic_beta,
-                .maxlen         = sizeof(int),
+                .ctl_name       = NET_TCP_CONG_CONTROL,
+                .procname       = "tcp_congestion_control",
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .maxlen         = TCP_CA_NAME_MAX,
+                .proc_handler   = &proc_tcp_congestion_control,
+                .strategy       = &sysctl_tcp_congestion_control,
         },
+
         { .ctl_name = 0 }
 };
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index a037bafcba3c..ddb6ce4ecff2 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -271,7 +271,6 @@ int sysctl_tcp_fin_timeout = TCP_FIN_TIMEOUT;
 
 DEFINE_SNMP_STAT(struct tcp_mib, tcp_statistics);
 
-kmem_cache_t *tcp_openreq_cachep;
 kmem_cache_t *tcp_bucket_cachep;
 kmem_cache_t *tcp_timewait_cachep;
 
@@ -317,7 +316,7 @@ EXPORT_SYMBOL(tcp_enter_memory_pressure);
 static __inline__ unsigned int tcp_listen_poll(struct sock *sk,
                                                poll_table *wait)
 {
-        return tcp_sk(sk)->accept_queue ? (POLLIN | POLLRDNORM) : 0;
+        return !reqsk_queue_empty(&tcp_sk(sk)->accept_queue) ? (POLLIN | POLLRDNORM) : 0;
 }
 
 /*
@@ -463,28 +462,15 @@ int tcp_listen_start(struct sock *sk)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
-        struct tcp_listen_opt *lopt;
+        int rc = reqsk_queue_alloc(&tp->accept_queue, TCP_SYNQ_HSIZE);
+
+        if (rc != 0)
+                return rc;
 
         sk->sk_max_ack_backlog = 0;
         sk->sk_ack_backlog = 0;
-        tp->accept_queue = tp->accept_queue_tail = NULL;
-        rwlock_init(&tp->syn_wait_lock);
         tcp_delack_init(tp);
 
-        lopt = kmalloc(sizeof(struct tcp_listen_opt), GFP_KERNEL);
-        if (!lopt)
-                return -ENOMEM;
-
-        memset(lopt, 0, sizeof(struct tcp_listen_opt));
-        for (lopt->max_qlen_log = 6; ; lopt->max_qlen_log++)
-                if ((1 << lopt->max_qlen_log) >= sysctl_max_syn_backlog)
-                        break;
-        get_random_bytes(&lopt->hash_rnd, 4);
-
-        write_lock_bh(&tp->syn_wait_lock);
-        tp->listen_opt = lopt;
-        write_unlock_bh(&tp->syn_wait_lock);
-
         /* There is race window here: we announce ourselves listening,
          * but this transition is still not validated by get_port().
          * It is OK, because this socket enters to hash table only
@@ -501,10 +487,7 @@ int tcp_listen_start(struct sock *sk)
         }
 
         sk->sk_state = TCP_CLOSE;
-        write_lock_bh(&tp->syn_wait_lock);
-        tp->listen_opt = NULL;
-        write_unlock_bh(&tp->syn_wait_lock);
-        kfree(lopt);
+        reqsk_queue_destroy(&tp->accept_queue);
         return -EADDRINUSE;
 }
 
@@ -516,25 +499,23 @@ int tcp_listen_start(struct sock *sk)
 static void tcp_listen_stop (struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct tcp_listen_opt *lopt = tp->listen_opt;
-        struct open_request *acc_req = tp->accept_queue;
-        struct open_request *req;
+        struct listen_sock *lopt;
+        struct request_sock *acc_req;
+        struct request_sock *req;
         int i;
 
         tcp_delete_keepalive_timer(sk);
 
         /* make all the listen_opt local to us */
-        write_lock_bh(&tp->syn_wait_lock);
-        tp->listen_opt = NULL;
-        write_unlock_bh(&tp->syn_wait_lock);
-        tp->accept_queue = tp->accept_queue_tail = NULL;
+        lopt = reqsk_queue_yank_listen_sk(&tp->accept_queue);
+        acc_req = reqsk_queue_yank_acceptq(&tp->accept_queue);
 
         if (lopt->qlen) {
                 for (i = 0; i < TCP_SYNQ_HSIZE; i++) {
                         while ((req = lopt->syn_table[i]) != NULL) {
                                 lopt->syn_table[i] = req->dl_next;
                                 lopt->qlen--;
-                                tcp_openreq_free(req);
+                                reqsk_free(req);
 
                 /* Following specs, it would be better either to send FIN
                  * (and enter FIN-WAIT-1, it is normal close)
@@ -574,7 +555,7 @@ static void tcp_listen_stop (struct sock *sk)
                 sock_put(child);
 
                 sk_acceptq_removed(sk);
-                tcp_openreq_fastfree(req);
+                __reqsk_free(req);
         }
         BUG_TRAP(!sk->sk_ack_backlog);
 }
@@ -634,7 +615,7 @@ static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffse
                          size_t psize, int flags)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        int mss_now;
+        int mss_now, size_goal;
         int err;
         ssize_t copied;
         long timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
@@ -647,6 +628,7 @@ static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffse
         clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
 
         mss_now = tcp_current_mss(sk, !(flags&MSG_OOB));
+        size_goal = tp->xmit_size_goal;
         copied = 0;
 
         err = -EPIPE;
@@ -660,7 +642,7 @@ static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffse
                 int offset = poffset % PAGE_SIZE;
                 int size = min_t(size_t, psize, PAGE_SIZE - offset);
 
-                if (!sk->sk_send_head || (copy = mss_now - skb->len) <= 0) {
+                if (!sk->sk_send_head || (copy = size_goal - skb->len) <= 0) {
 new_segment:
                         if (!sk_stream_memory_free(sk))
                                 goto wait_for_sndbuf;
@@ -671,7 +653,7 @@ new_segment:
                                 goto wait_for_memory;
 
                         skb_entail(sk, tp, skb);
-                        copy = mss_now;
+                        copy = size_goal;
                 }
 
                 if (copy > size)
@@ -712,7 +694,7 @@ new_segment:
                 if (!(psize -= copy))
                         goto out;
 
-                if (skb->len != mss_now || (flags & MSG_OOB))
+                if (skb->len < mss_now || (flags & MSG_OOB))
                         continue;
 
                 if (forced_push(tp)) {
@@ -732,6 +714,7 @@ wait_for_memory:
                         goto do_error;
 
                 mss_now = tcp_current_mss(sk, !(flags&MSG_OOB));
+                size_goal = tp->xmit_size_goal;
         }
 
 out:
@@ -773,15 +756,20 @@ ssize_t tcp_sendpage(struct socket *sock, struct page *page, int offset,
 
 static inline int select_size(struct sock *sk, struct tcp_sock *tp)
 {
-        int tmp = tp->mss_cache_std;
+        int tmp = tp->mss_cache;
 
         if (sk->sk_route_caps & NETIF_F_SG) {
-                int pgbreak = SKB_MAX_HEAD(MAX_TCP_HEADER);
+                if (sk->sk_route_caps & NETIF_F_TSO)
+                        tmp = 0;
+                else {
+                        int pgbreak = SKB_MAX_HEAD(MAX_TCP_HEADER);
 
-                if (tmp >= pgbreak &&
-                    tmp <= pgbreak + (MAX_SKB_FRAGS - 1) * PAGE_SIZE)
-                        tmp = pgbreak;
+                        if (tmp >= pgbreak &&
+                            tmp <= pgbreak + (MAX_SKB_FRAGS - 1) * PAGE_SIZE)
+                                tmp = pgbreak;
+                }
         }
+
         return tmp;
 }
 
@@ -792,7 +780,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
         int iovlen, flags;
-        int mss_now;
+        int mss_now, size_goal;
         int err, copied;
         long timeo;
 
@@ -811,6 +799,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
 
         mss_now = tcp_current_mss(sk, !(flags&MSG_OOB));
+        size_goal = tp->xmit_size_goal;
 
         /* Ok commence sending. */
         iovlen = msg->msg_iovlen;
@@ -833,7 +822,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         skb = sk->sk_write_queue.prev;
 
                         if (!sk->sk_send_head ||
-                            (copy = mss_now - skb->len) <= 0) {
+                            (copy = size_goal - skb->len) <= 0) {
 
 new_segment:
                                 /* Allocate new segment. If the interface is SG,
@@ -856,7 +845,7 @@ new_segment:
                                         skb->ip_summed = CHECKSUM_HW;
 
                                 skb_entail(sk, tp, skb);
-                                copy = mss_now;
+                                copy = size_goal;
                         }
 
                         /* Try to append data to the end of skb. */
@@ -891,11 +880,6 @@ new_segment:
                                         tcp_mark_push(tp, skb);
                                         goto new_segment;
                                 } else if (page) {
-                                        /* If page is cached, align
-                                         * offset to L1 cache boundary
-                                         */
-                                        off = (off + L1_CACHE_BYTES - 1) &
-                                              ~(L1_CACHE_BYTES - 1);
                                         if (off == PAGE_SIZE) {
                                                 put_page(page);
                                                 TCP_PAGE(sk) = page = NULL;
@@ -956,7 +940,7 @@ new_segment:
                         if ((seglen -= copy) == 0 && iovlen == 0)
                                 goto out;
 
-                        if (skb->len != mss_now || (flags & MSG_OOB))
+                        if (skb->len < mss_now || (flags & MSG_OOB))
                                 continue;
 
                         if (forced_push(tp)) {
@@ -976,6 +960,7 @@ wait_for_memory:
                                 goto do_error;
 
                         mss_now = tcp_current_mss(sk, !(flags&MSG_OOB));
+                        size_goal = tp->xmit_size_goal;
                 }
         }
 
@@ -1120,7 +1105,7 @@ static void tcp_prequeue_process(struct sock *sk)
         struct sk_buff *skb;
         struct tcp_sock *tp = tcp_sk(sk);
 
-        NET_ADD_STATS_USER(LINUX_MIB_TCPPREQUEUED, skb_queue_len(&tp->ucopy.prequeue));
+        NET_INC_STATS_USER(LINUX_MIB_TCPPREQUEUED);
 
         /* RX process wants to run with disabled BHs, though it is not
          * necessary */
@@ -1345,7 +1330,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
                 cleanup_rbuf(sk, copied);
 
-                if (tp->ucopy.task == user_recv) {
+                if (!sysctl_tcp_low_latency && tp->ucopy.task == user_recv) {
                         /* Install new reader */
                         if (!user_recv && !(flags & (MSG_TRUNC | MSG_PEEK))) {
                                 user_recv = current;
@@ -1384,7 +1369,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                          * is not empty. It is more elegant, but eats cycles,
                          * unfortunately.
                          */
-                        if (skb_queue_len(&tp->ucopy.prequeue))
+                        if (!skb_queue_empty(&tp->ucopy.prequeue))
                                 goto do_prequeue;
 
                         /* __ Set realtime policy in scheduler __ */
@@ -1409,7 +1394,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         }
 
                         if (tp->rcv_nxt == tp->copied_seq &&
-                            skb_queue_len(&tp->ucopy.prequeue)) {
+                            !skb_queue_empty(&tp->ucopy.prequeue)) {
 do_prequeue:
                                 tcp_prequeue_process(sk);
 
@@ -1491,7 +1476,7 @@ skip_copy:
         } while (len > 0);
 
         if (user_recv) {
-                if (skb_queue_len(&tp->ucopy.prequeue)) {
+                if (!skb_queue_empty(&tp->ucopy.prequeue)) {
                         int chunk;
 
                         tp->ucopy.len = copied > 0 ? len : 0;
@@ -1868,11 +1853,11 @@ static int wait_for_connect(struct sock *sk, long timeo)
                 prepare_to_wait_exclusive(sk->sk_sleep, &wait,
                                           TASK_INTERRUPTIBLE);
                 release_sock(sk);
-                if (!tp->accept_queue)
+                if (reqsk_queue_empty(&tp->accept_queue))
                         timeo = schedule_timeout(timeo);
                 lock_sock(sk);
                 err = 0;
-                if (tp->accept_queue)
+                if (!reqsk_queue_empty(&tp->accept_queue))
                         break;
                 err = -EINVAL;
                 if (sk->sk_state != TCP_LISTEN)
@@ -1895,7 +1880,6 @@ static int wait_for_connect(struct sock *sk, long timeo)
 struct sock *tcp_accept(struct sock *sk, int flags, int *err)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct open_request *req;
         struct sock *newsk;
         int error;
 
@@ -1906,37 +1890,31 @@ struct sock *tcp_accept(struct sock *sk, int flags, int *err)
          */
         error = -EINVAL;
         if (sk->sk_state != TCP_LISTEN)
-                goto out;
+                goto out_err;
 
         /* Find already established connection */
-        if (!tp->accept_queue) {
+        if (reqsk_queue_empty(&tp->accept_queue)) {
                 long timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 
                 /* If this is a non blocking socket don't sleep */
                 error = -EAGAIN;
                 if (!timeo)
-                        goto out;
+                        goto out_err;
 
                 error = wait_for_connect(sk, timeo);
                 if (error)
-                        goto out;
+                        goto out_err;
         }
 
-        req = tp->accept_queue;
-        if ((tp->accept_queue = req->dl_next) == NULL)
-                tp->accept_queue_tail = NULL;
-
-        newsk = req->sk;
-        sk_acceptq_removed(sk);
-        tcp_openreq_fastfree(req);
+        newsk = reqsk_queue_get_child(&tp->accept_queue, sk);
         BUG_TRAP(newsk->sk_state != TCP_SYN_RECV);
-        release_sock(sk);
-        return newsk;
-
 out:
         release_sock(sk);
+        return newsk;
+out_err:
+        newsk = NULL;
         *err = error;
-        return NULL;
+        goto out;
 }
 
 /*
@@ -1953,6 +1931,25 @@ int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
                 return tp->af_specific->setsockopt(sk, level, optname,
                                                    optval, optlen);
 
+        /* This is a string value all the others are int's */
+        if (optname == TCP_CONGESTION) {
+                char name[TCP_CA_NAME_MAX];
+
+                if (optlen < 1)
+                        return -EINVAL;
+
+                val = strncpy_from_user(name, optval,
+                                        min(TCP_CA_NAME_MAX-1, optlen));
+                if (val < 0)
+                        return -EFAULT;
+                name[val] = 0;
+
+                lock_sock(sk);
+                err = tcp_set_congestion_control(tp, name);
+                release_sock(sk);
+                return err;
+        }
+
         if (optlen < sizeof(int))
                 return -EINVAL;
 
@@ -2135,7 +2132,7 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
 
         info->tcpi_rto = jiffies_to_usecs(tp->rto);
         info->tcpi_ato = jiffies_to_usecs(tp->ack.ato);
-        info->tcpi_snd_mss = tp->mss_cache_std;
+        info->tcpi_snd_mss = tp->mss_cache;
         info->tcpi_rcv_mss = tp->ack.rcv_mss;
 
         info->tcpi_unacked = tp->packets_out;
@@ -2185,7 +2182,7 @@ int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
 
         switch (optname) {
         case TCP_MAXSEG:
-                val = tp->mss_cache_std;
+                val = tp->mss_cache;
                 if (!val && ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
                         val = tp->rx_opt.user_mss;
                 break;
@@ -2237,6 +2234,16 @@ int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
         case TCP_QUICKACK:
                 val = !tp->ack.pingpong;
                 break;
+
+        case TCP_CONGESTION:
+                if (get_user(len, optlen))
+                        return -EFAULT;
+                len = min_t(unsigned int, len, TCP_CA_NAME_MAX);
+                if (put_user(len, optlen))
+                        return -EFAULT;
+                if (copy_to_user(optval, tp->ca_ops->name, len))
+                        return -EFAULT;
+                return 0;
         default:
                 return -ENOPROTOOPT;
         };
@@ -2250,7 +2257,7 @@ int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
 
 
 extern void __skb_cb_too_small_for_tcp(int, int);
-extern void tcpdiag_init(void);
+extern struct tcp_congestion_ops tcp_reno;
 
 static __initdata unsigned long thash_entries;
 static int __init set_thash_entries(char *str)
@@ -2271,13 +2278,6 @@ void __init tcp_init(void)
                 __skb_cb_too_small_for_tcp(sizeof(struct tcp_skb_cb),
                                            sizeof(skb->cb));
 
-        tcp_openreq_cachep = kmem_cache_create("tcp_open_request",
-                                                   sizeof(struct open_request),
-                                               0, SLAB_HWCACHE_ALIGN,
-                                               NULL, NULL);
-        if (!tcp_openreq_cachep)
-                panic("tcp_init: Cannot alloc open_request cache.");
-
         tcp_bucket_cachep = kmem_cache_create("tcp_bind_bucket",
                                               sizeof(struct tcp_bind_bucket),
                                               0, SLAB_HWCACHE_ALIGN,
@@ -2338,7 +2338,7 @@ void __init tcp_init(void)
                         (tcp_bhash_size * sizeof(struct tcp_bind_hashbucket));
                         order++)
                 ;
-        if (order > 4) {
+        if (order >= 4) {
                 sysctl_local_port_range[0] = 32768;
                 sysctl_local_port_range[1] = 61000;
                 sysctl_tcp_max_tw_buckets = 180000;
@@ -2366,6 +2366,8 @@ void __init tcp_init(void)
         printk(KERN_INFO "TCP: Hash tables configured "
                "(established %d bind %d)\n",
                tcp_ehash_size << 1, tcp_bhash_size);
+
+        tcp_register_congestion_control(&tcp_reno);
 }
 
 EXPORT_SYMBOL(tcp_accept);
@@ -2374,7 +2376,6 @@ EXPORT_SYMBOL(tcp_destroy_sock);
 EXPORT_SYMBOL(tcp_disconnect);
 EXPORT_SYMBOL(tcp_getsockopt);
 EXPORT_SYMBOL(tcp_ioctl);
-EXPORT_SYMBOL(tcp_openreq_cachep);
 EXPORT_SYMBOL(tcp_poll);
 EXPORT_SYMBOL(tcp_read_sock);
 EXPORT_SYMBOL(tcp_recvmsg);
diff --git a/net/ipv4/tcp_bic.c b/net/ipv4/tcp_bic.c
new file mode 100644
index 000000000000..ec38d45d6649
--- /dev/null
+++ b/net/ipv4/tcp_bic.c
@@ -0,0 +1,331 @@
+/*
+ * Binary Increase Congestion control for TCP
+ *
+ * This is from the implementation of BICTCP in
+ * Lison-Xu, Kahaled Harfoush, and Injong Rhee.
+ *  "Binary Increase Congestion Control for Fast, Long Distance
+ *  Networks" in InfoComm 2004
+ * Available from:
+ *  http://www.csc.ncsu.edu/faculty/rhee/export/bitcp.pdf
+ *
+ * Unless BIC is enabled and congestion window is large
+ * this behaves the same as the original Reno.
+ */
+
+#include <linux/config.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <net/tcp.h>
+
+
+#define BICTCP_BETA_SCALE    1024       /* Scale factor beta calculation
+                                         * max_cwnd = snd_cwnd * beta
+                                         */
+#define BICTCP_B                4        /*
+                                          * In binary search,
+                                          * go to point (max+min)/N
+                                          */
+
+static int fast_convergence = 1;
+static int max_increment = 32;
+static int low_window = 14;
+static int beta = 819;          /* = 819/1024 (BICTCP_BETA_SCALE) */
+static int low_utilization_threshold = 153;
+static int low_utilization_period = 2;
+static int initial_ssthresh = 100;
+static int smooth_part = 20;
+
+module_param(fast_convergence, int, 0644);
+MODULE_PARM_DESC(fast_convergence, "turn on/off fast convergence");
+module_param(max_increment, int, 0644);
+MODULE_PARM_DESC(max_increment, "Limit on increment allowed during binary search");
+module_param(low_window, int, 0644);
+MODULE_PARM_DESC(low_window, "lower bound on congestion window (for TCP friendliness)");
+module_param(beta, int, 0644);
+MODULE_PARM_DESC(beta, "beta for multiplicative increase");
+module_param(low_utilization_threshold, int, 0644);
+MODULE_PARM_DESC(low_utilization_threshold, "percent (scaled by 1024) for low utilization mode");
+module_param(low_utilization_period, int, 0644);
+MODULE_PARM_DESC(low_utilization_period, "if average delay exceeds then goto to low utilization mode (seconds)");
+module_param(initial_ssthresh, int, 0644);
+MODULE_PARM_DESC(initial_ssthresh, "initial value of slow start threshold");
+module_param(smooth_part, int, 0644);
+MODULE_PARM_DESC(smooth_part, "log(B/(B*Smin))/log(B/(B-1))+B, # of RTT from Wmax-B to Wmax");
+
+
+/* BIC TCP Parameters */
+struct bictcp {
+        u32     cnt;            /* increase cwnd by 1 after ACKs */
+        u32     last_max_cwnd;  /* last maximum snd_cwnd */
+        u32     loss_cwnd;      /* congestion window at last loss */
+        u32     last_cwnd;      /* the last snd_cwnd */
+        u32     last_time;      /* time when updated last_cwnd */
+        u32     delay_min;      /* min delay */
+        u32     delay_max;      /* max delay */
+        u32     last_delay;
+        u8      low_utilization;/* 0: high; 1: low */
+        u32     low_utilization_start;  /* starting time of low utilization detection*/
+        u32     epoch_start;    /* beginning of an epoch */
+#define ACK_RATIO_SHIFT 4
+        u32     delayed_ack;    /* estimate the ratio of Packets/ACKs << 4 */
+};
+
+static inline void bictcp_reset(struct bictcp *ca)
+{
+        ca->cnt = 0;
+        ca->last_max_cwnd = 0;
+        ca->loss_cwnd = 0;
+        ca->last_cwnd = 0;
+        ca->last_time = 0;
+        ca->delay_min = 0;
+        ca->delay_max = 0;
+        ca->last_delay = 0;
+        ca->low_utilization = 0;
+        ca->low_utilization_start = 0;
+        ca->epoch_start = 0;
+        ca->delayed_ack = 2 << ACK_RATIO_SHIFT;
+}
+
+static void bictcp_init(struct tcp_sock *tp)
+{
+        bictcp_reset(tcp_ca(tp));
+        if (initial_ssthresh)
+                tp->snd_ssthresh = initial_ssthresh;
+}
+
+/*
+ * Compute congestion window to use.
+ */
+static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
+{
+        if (ca->last_cwnd == cwnd &&
+            (s32)(tcp_time_stamp - ca->last_time) <= HZ / 32)
+                return;
+
+        ca->last_cwnd = cwnd;
+        ca->last_time = tcp_time_stamp;
+
+        if (ca->epoch_start == 0) /* record the beginning of an epoch */
+                ca->epoch_start = tcp_time_stamp;
+
+        /* start off normal */
+        if (cwnd <= low_window) {
+                ca->cnt = cwnd;
+                return;
+        }
+
+        /* binary increase */
+        if (cwnd < ca->last_max_cwnd) {
+                __u32   dist = (ca->last_max_cwnd - cwnd)
+                        / BICTCP_B;
+
+                if (dist > max_increment)
+                        /* linear increase */
+                        ca->cnt = cwnd / max_increment;
+                else if (dist <= 1U)
+                        /* binary search increase */
+                        ca->cnt = (cwnd * smooth_part) / BICTCP_B;
+                else
+                        /* binary search increase */
+                        ca->cnt = cwnd / dist;
+        } else {
+                /* slow start AMD linear increase */
+                if (cwnd < ca->last_max_cwnd + BICTCP_B)
+                        /* slow start */
+                        ca->cnt = (cwnd * smooth_part) / BICTCP_B;
+                else if (cwnd < ca->last_max_cwnd + max_increment*(BICTCP_B-1))
+                        /* slow start */
+                        ca->cnt = (cwnd * (BICTCP_B-1))
+                                / cwnd-ca->last_max_cwnd;
+                else
+                        /* linear increase */
+                        ca->cnt = cwnd / max_increment;
+        }
+
+        /* if in slow start or link utilization is very low */
+        if ( ca->loss_cwnd == 0 ||
+             (cwnd > ca->loss_cwnd && ca->low_utilization)) {
+                if (ca->cnt > 20) /* increase cwnd 5% per RTT */
+                        ca->cnt = 20;
+        }
+
+        ca->cnt = (ca->cnt << ACK_RATIO_SHIFT) / ca->delayed_ack;
+        if (ca->cnt == 0)                       /* cannot be zero */
+                ca->cnt = 1;
+}
+
+
+/* Detect low utilization in congestion avoidance */
+static inline void bictcp_low_utilization(struct tcp_sock *tp, int flag)
+{
+        struct bictcp *ca = tcp_ca(tp);
+        u32 dist, delay;
+
+        /* No time stamp */
+        if (!(tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr) ||
+             /* Discard delay samples right after fast recovery */
+             tcp_time_stamp < ca->epoch_start + HZ ||
+             /* this delay samples may not be accurate */
+             flag == 0) {
+                ca->last_delay = 0;
+                goto notlow;
+        }
+
+        delay = ca->last_delay<<3;      /* use the same scale as tp->srtt*/
+        ca->last_delay = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
+        if (delay == 0)                 /* no previous delay sample */
+                goto notlow;
+
+        /* first time call or link delay decreases */
+        if (ca->delay_min == 0 || ca->delay_min > delay) {
+                ca->delay_min = ca->delay_max = delay;
+                goto notlow;
+        }
+
+        if (ca->delay_max < delay)
+                ca->delay_max = delay;
+
+        /* utilization is low, if avg delay < dist*threshold
+           for checking_period time */
+        dist = ca->delay_max - ca->delay_min;
+        if (dist <= ca->delay_min>>6 ||
+            tp->srtt - ca->delay_min >=  (dist*low_utilization_threshold)>>10)
+                goto notlow;
+
+        if (ca->low_utilization_start == 0) {
+                ca->low_utilization = 0;
+                ca->low_utilization_start = tcp_time_stamp;
+        } else if ((s32)(tcp_time_stamp - ca->low_utilization_start)
+                        > low_utilization_period*HZ) {
+                ca->low_utilization = 1;
+        }
+
+        return;
+
+ notlow:
+        ca->low_utilization = 0;
+        ca->low_utilization_start = 0;
+
+}
+
+static void bictcp_cong_avoid(struct tcp_sock *tp, u32 ack,
+                              u32 seq_rtt, u32 in_flight, int data_acked)
+{
+        struct bictcp *ca = tcp_ca(tp);
+
+        bictcp_low_utilization(tp, data_acked);
+
+        if (in_flight < tp->snd_cwnd)
+                return;
+
+        if (tp->snd_cwnd <= tp->snd_ssthresh) {
+                /* In "safe" area, increase. */
+                if (tp->snd_cwnd < tp->snd_cwnd_clamp)
+                        tp->snd_cwnd++;
+        } else {
+                bictcp_update(ca, tp->snd_cwnd);
+
+                /* In dangerous area, increase slowly.
+                 * In theory this is tp->snd_cwnd += 1 / tp->snd_cwnd
+                 */
+                if (tp->snd_cwnd_cnt >= ca->cnt) {
+                        if (tp->snd_cwnd < tp->snd_cwnd_clamp)
+                                tp->snd_cwnd++;
+                        tp->snd_cwnd_cnt = 0;
+                } else
+                        tp->snd_cwnd_cnt++;
+        }
+
+}
+
+/*
+ *      behave like Reno until low_window is reached,
+ *      then increase congestion window slowly
+ */
+static u32 bictcp_recalc_ssthresh(struct tcp_sock *tp)
+{
+        struct bictcp *ca = tcp_ca(tp);
+
+        ca->epoch_start = 0;    /* end of epoch */
+
+        /* in case of wrong delay_max*/
+        if (ca->delay_min > 0 && ca->delay_max > ca->delay_min)
+                ca->delay_max = ca->delay_min
+                        + ((ca->delay_max - ca->delay_min)* 90) / 100;
+
+        /* Wmax and fast convergence */
+        if (tp->snd_cwnd < ca->last_max_cwnd && fast_convergence)
+                ca->last_max_cwnd = (tp->snd_cwnd * (BICTCP_BETA_SCALE + beta))
+                        / (2 * BICTCP_BETA_SCALE);
+        else
+                ca->last_max_cwnd = tp->snd_cwnd;
+
+        ca->loss_cwnd = tp->snd_cwnd;
+
+
+        if (tp->snd_cwnd <= low_window)
+                return max(tp->snd_cwnd >> 1U, 2U);
+        else
+                return max((tp->snd_cwnd * beta) / BICTCP_BETA_SCALE, 2U);
+}
+
+static u32 bictcp_undo_cwnd(struct tcp_sock *tp)
+{
+        struct bictcp *ca = tcp_ca(tp);
+
+        return max(tp->snd_cwnd, ca->last_max_cwnd);
+}
+
+static u32 bictcp_min_cwnd(struct tcp_sock *tp)
+{
+        return tp->snd_ssthresh;
+}
+
+static void bictcp_state(struct tcp_sock *tp, u8 new_state)
+{
+        if (new_state == TCP_CA_Loss)
+                bictcp_reset(tcp_ca(tp));
+}
+
+/* Track delayed acknowledgement ratio using sliding window
+ * ratio = (15*ratio + sample) / 16
+ */
+static void bictcp_acked(struct tcp_sock *tp, u32 cnt)
+{
+        if (cnt > 0 &&  tp->ca_state == TCP_CA_Open) {
+                struct bictcp *ca = tcp_ca(tp);
+                cnt -= ca->delayed_ack >> ACK_RATIO_SHIFT;
+                ca->delayed_ack += cnt;
+        }
+}
+
+
+static struct tcp_congestion_ops bictcp = {
+        .init           = bictcp_init,
+        .ssthresh       = bictcp_recalc_ssthresh,
+        .cong_avoid     = bictcp_cong_avoid,
+        .set_state      = bictcp_state,
+        .undo_cwnd      = bictcp_undo_cwnd,
+        .min_cwnd       = bictcp_min_cwnd,
+        .pkts_acked     = bictcp_acked,
+        .owner          = THIS_MODULE,
+        .name           = "bic",
+};
+
+static int __init bictcp_register(void)
+{
+        BUG_ON(sizeof(struct bictcp) > TCP_CA_PRIV_SIZE);
+        return tcp_register_congestion_control(&bictcp);
+}
+
+static void __exit bictcp_unregister(void)
+{
+        tcp_unregister_congestion_control(&bictcp);
+}
+
+module_init(bictcp_register);
+module_exit(bictcp_unregister);
+
+MODULE_AUTHOR("Stephen Hemminger");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("BIC TCP");
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
new file mode 100644
index 000000000000..4970d10a7785
--- /dev/null
+++ b/net/ipv4/tcp_cong.c
@@ -0,0 +1,237 @@
+/*
+ * Plugable TCP congestion control support and newReno
+ * congestion control.
+ * Based on ideas from I/O scheduler suport and Web100.
+ *
+ * Copyright (C) 2005 Stephen Hemminger <shemminger@osdl.org>
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/mm.h>
+#include <linux/types.h>
+#include <linux/list.h>
+#include <net/tcp.h>
+
+static DEFINE_SPINLOCK(tcp_cong_list_lock);
+static LIST_HEAD(tcp_cong_list);
+
+/* Simple linear search, don't expect many entries! */
+static struct tcp_congestion_ops *tcp_ca_find(const char *name)
+{
+        struct tcp_congestion_ops *e;
+
+        list_for_each_entry_rcu(e, &tcp_cong_list, list) {
+                if (strcmp(e->name, name) == 0)
+                        return e;
+        }
+
+        return NULL;
+}
+
+/*
+ * Attach new congestion control algorthim to the list
+ * of available options.
+ */
+int tcp_register_congestion_control(struct tcp_congestion_ops *ca)
+{
+        int ret = 0;
+
+        /* all algorithms must implement ssthresh and cong_avoid ops */
+        if (!ca->ssthresh || !ca->cong_avoid || !ca->min_cwnd) {
+                printk(KERN_ERR "TCP %s does not implement required ops\n",
+                       ca->name);
+                return -EINVAL;
+        }
+
+        spin_lock(&tcp_cong_list_lock);
+        if (tcp_ca_find(ca->name)) {
+                printk(KERN_NOTICE "TCP %s already registered\n", ca->name);
+                ret = -EEXIST;
+        } else {
+                list_add_rcu(&ca->list, &tcp_cong_list);
+                printk(KERN_INFO "TCP %s registered\n", ca->name);
+        }
+        spin_unlock(&tcp_cong_list_lock);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(tcp_register_congestion_control);
+
+/*
+ * Remove congestion control algorithm, called from
+ * the module's remove function.  Module ref counts are used
+ * to ensure that this can't be done till all sockets using
+ * that method are closed.
+ */
+void tcp_unregister_congestion_control(struct tcp_congestion_ops *ca)
+{
+        spin_lock(&tcp_cong_list_lock);
+        list_del_rcu(&ca->list);
+        spin_unlock(&tcp_cong_list_lock);
+}
+EXPORT_SYMBOL_GPL(tcp_unregister_congestion_control);
+
+/* Assign choice of congestion control. */
+void tcp_init_congestion_control(struct tcp_sock *tp)
+{
+        struct tcp_congestion_ops *ca;
+
+        if (tp->ca_ops != &tcp_init_congestion_ops)
+                return;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(ca, &tcp_cong_list, list) {
+                if (try_module_get(ca->owner)) {
+                        tp->ca_ops = ca;
+                        break;
+                }
+
+        }
+        rcu_read_unlock();
+
+        if (tp->ca_ops->init)
+                tp->ca_ops->init(tp);
+}
+
+/* Manage refcounts on socket close. */
+void tcp_cleanup_congestion_control(struct tcp_sock *tp)
+{
+        if (tp->ca_ops->release)
+                tp->ca_ops->release(tp);
+        module_put(tp->ca_ops->owner);
+}
+
+/* Used by sysctl to change default congestion control */
+int tcp_set_default_congestion_control(const char *name)
+{
+        struct tcp_congestion_ops *ca;
+        int ret = -ENOENT;
+
+        spin_lock(&tcp_cong_list_lock);
+        ca = tcp_ca_find(name);
+#ifdef CONFIG_KMOD
+        if (!ca) {
+                spin_unlock(&tcp_cong_list_lock);
+
+                request_module("tcp_%s", name);
+                spin_lock(&tcp_cong_list_lock);
+                ca = tcp_ca_find(name);
+        }
+#endif
+
+        if (ca) {
+                list_move(&ca->list, &tcp_cong_list);
+                ret = 0;
+        }
+        spin_unlock(&tcp_cong_list_lock);
+
+        return ret;
+}
+
+/* Get current default congestion control */
+void tcp_get_default_congestion_control(char *name)
+{
+        struct tcp_congestion_ops *ca;
+        /* We will always have reno... */
+        BUG_ON(list_empty(&tcp_cong_list));
+
+        rcu_read_lock();
+        ca = list_entry(tcp_cong_list.next, struct tcp_congestion_ops, list);
+        strncpy(name, ca->name, TCP_CA_NAME_MAX);
+        rcu_read_unlock();
+}
+
+/* Change congestion control for socket */
+int tcp_set_congestion_control(struct tcp_sock *tp, const char *name)
+{
+        struct tcp_congestion_ops *ca;
+        int err = 0;
+
+        rcu_read_lock();
+        ca = tcp_ca_find(name);
+        if (ca == tp->ca_ops)
+                goto out;
+
+        if (!ca)
+                err = -ENOENT;
+
+        else if (!try_module_get(ca->owner))
+                err = -EBUSY;
+
+        else {
+                tcp_cleanup_congestion_control(tp);
+                tp->ca_ops = ca;
+                if (tp->ca_ops->init)
+                        tp->ca_ops->init(tp);
+        }
+ out:
+        rcu_read_unlock();
+        return err;
+}
+
+/*
+ * TCP Reno congestion control
+ * This is special case used for fallback as well.
+ */
+/* This is Jacobson's slow start and congestion avoidance.
+ * SIGCOMM '88, p. 328.
+ */
+void tcp_reno_cong_avoid(struct tcp_sock *tp, u32 ack, u32 rtt, u32 in_flight,
+                         int flag)
+{
+        if (in_flight < tp->snd_cwnd)
+                return;
+
+        if (tp->snd_cwnd <= tp->snd_ssthresh) {
+                /* In "safe" area, increase. */
+                if (tp->snd_cwnd < tp->snd_cwnd_clamp)
+                        tp->snd_cwnd++;
+        } else {
+                /* In dangerous area, increase slowly.
+                 * In theory this is tp->snd_cwnd += 1 / tp->snd_cwnd
+                 */
+                if (tp->snd_cwnd_cnt >= tp->snd_cwnd) {
+                        if (tp->snd_cwnd < tp->snd_cwnd_clamp)
+                                tp->snd_cwnd++;
+                        tp->snd_cwnd_cnt = 0;
+                } else
+                        tp->snd_cwnd_cnt++;
+        }
+}
+EXPORT_SYMBOL_GPL(tcp_reno_cong_avoid);
+
+/* Slow start threshold is half the congestion window (min 2) */
+u32 tcp_reno_ssthresh(struct tcp_sock *tp)
+{
+        return max(tp->snd_cwnd >> 1U, 2U);
+}
+EXPORT_SYMBOL_GPL(tcp_reno_ssthresh);
+
+/* Lower bound on congestion window. */
+u32 tcp_reno_min_cwnd(struct tcp_sock *tp)
+{
+        return tp->snd_ssthresh/2;
+}
+EXPORT_SYMBOL_GPL(tcp_reno_min_cwnd);
+
+struct tcp_congestion_ops tcp_reno = {
+        .name           = "reno",
+        .owner          = THIS_MODULE,
+        .ssthresh       = tcp_reno_ssthresh,
+        .cong_avoid     = tcp_reno_cong_avoid,
+        .min_cwnd       = tcp_reno_min_cwnd,
+};
+
+/* Initial congestion control used (until SYN)
+ * really reno under another name so we can tell difference
+ * during tcp_set_default_congestion_control
+ */
+struct tcp_congestion_ops tcp_init_congestion_ops  = {
+        .name           = "",
+        .owner          = THIS_MODULE,
+        .ssthresh       = tcp_reno_ssthresh,
+        .cong_avoid     = tcp_reno_cong_avoid,
+        .min_cwnd       = tcp_reno_min_cwnd,
+};
+EXPORT_SYMBOL_GPL(tcp_init_congestion_ops);
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index 8faa8948f75c..f66945cb158f 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -42,15 +42,8 @@ struct tcpdiag_entry
 
 static struct sock *tcpnl;
 
-
 #define TCPDIAG_PUT(skb, attrtype, attrlen) \
-({ int rtalen = RTA_LENGTH(attrlen);        \
-   struct rtattr *rta;                      \
-   if (skb_tailroom(skb) < RTA_ALIGN(rtalen)) goto nlmsg_failure; \
-   rta = (void*)__skb_put(skb, RTA_ALIGN(rtalen)); \
-   rta->rta_type = attrtype;                \
-   rta->rta_len = rtalen;                   \
-   RTA_DATA(rta); })
+        RTA_DATA(__RTA_PUT(skb, attrtype, attrlen))
 
 static int tcpdiag_fill(struct sk_buff *skb, struct sock *sk,
                         int ext, u32 pid, u32 seq, u16 nlmsg_flags)
@@ -61,7 +54,6 @@ static int tcpdiag_fill(struct sk_buff *skb, struct sock *sk,
         struct nlmsghdr  *nlh;
         struct tcp_info  *info = NULL;
         struct tcpdiag_meminfo  *minfo = NULL;
-        struct tcpvegas_info *vinfo = NULL;
         unsigned char    *b = skb->tail;
 
         nlh = NLMSG_PUT(skb, pid, seq, TCPDIAG_GETSOCK, sizeof(*r));
@@ -73,9 +65,11 @@ static int tcpdiag_fill(struct sk_buff *skb, struct sock *sk,
                 if (ext & (1<<(TCPDIAG_INFO-1)))
                         info = TCPDIAG_PUT(skb, TCPDIAG_INFO, sizeof(*info));
                 
-                if ((tcp_is_westwood(tp) || tcp_is_vegas(tp))
-                    && (ext & (1<<(TCPDIAG_VEGASINFO-1))))
-                        vinfo = TCPDIAG_PUT(skb, TCPDIAG_VEGASINFO, sizeof(*vinfo));
+                if (ext & (1<<(TCPDIAG_CONG-1))) {
+                        size_t len = strlen(tp->ca_ops->name);
+                        strcpy(TCPDIAG_PUT(skb, TCPDIAG_CONG, len+1),
+                               tp->ca_ops->name);
+                }
         }
         r->tcpdiag_family = sk->sk_family;
         r->tcpdiag_state = sk->sk_state;
@@ -166,23 +160,13 @@ static int tcpdiag_fill(struct sk_buff *skb, struct sock *sk,
         if (info) 
                 tcp_get_info(sk, info);
 
-        if (vinfo) {
-                if (tcp_is_vegas(tp)) {
-                        vinfo->tcpv_enabled = tp->vegas.doing_vegas_now;
-                        vinfo->tcpv_rttcnt = tp->vegas.cntRTT;
-                        vinfo->tcpv_rtt = jiffies_to_usecs(tp->vegas.baseRTT);
-                        vinfo->tcpv_minrtt = jiffies_to_usecs(tp->vegas.minRTT);
-                } else {
-                        vinfo->tcpv_enabled = 0;
-                        vinfo->tcpv_rttcnt = 0;
-                        vinfo->tcpv_rtt = jiffies_to_usecs(tp->westwood.rtt);
-                        vinfo->tcpv_minrtt = jiffies_to_usecs(tp->westwood.rtt_min);
-                }
-        }
+        if (sk->sk_state < TCP_TIME_WAIT && tp->ca_ops->get_info)
+                tp->ca_ops->get_info(tp, ext, skb);
 
         nlh->nlmsg_len = skb->tail - b;
         return skb->len;
 
+rtattr_failure:
 nlmsg_failure:
         skb_trim(skb, b - skb->data);
         return -1;
@@ -455,9 +439,10 @@ static int tcpdiag_dump_sock(struct sk_buff *skb, struct sock *sk,
 }
 
 static int tcpdiag_fill_req(struct sk_buff *skb, struct sock *sk,
-                            struct open_request *req,
+                            struct request_sock *req,
                             u32 pid, u32 seq)
 {
+        const struct inet_request_sock *ireq = inet_rsk(req);
         struct inet_sock *inet = inet_sk(sk);
         unsigned char *b = skb->tail;
         struct tcpdiagmsg *r;
@@ -482,9 +467,9 @@ static int tcpdiag_fill_req(struct sk_buff *skb, struct sock *sk,
                 tmo = 0;
 
         r->id.tcpdiag_sport = inet->sport;
-        r->id.tcpdiag_dport = req->rmt_port;
-        r->id.tcpdiag_src[0] = req->af.v4_req.loc_addr;
-        r->id.tcpdiag_dst[0] = req->af.v4_req.rmt_addr;
+        r->id.tcpdiag_dport = ireq->rmt_port;
+        r->id.tcpdiag_src[0] = ireq->loc_addr;
+        r->id.tcpdiag_dst[0] = ireq->rmt_addr;
         r->tcpdiag_expires = jiffies_to_msecs(tmo),
         r->tcpdiag_rqueue = 0;
         r->tcpdiag_wqueue = 0;
@@ -493,9 +478,9 @@ static int tcpdiag_fill_req(struct sk_buff *skb, struct sock *sk,
 #ifdef CONFIG_IP_TCPDIAG_IPV6
         if (r->tcpdiag_family == AF_INET6) {
                 ipv6_addr_copy((struct in6_addr *)r->id.tcpdiag_src,
-                               &req->af.v6_req.loc_addr);
+                               &tcp6_rsk(req)->loc_addr);
                 ipv6_addr_copy((struct in6_addr *)r->id.tcpdiag_dst,
-                               &req->af.v6_req.rmt_addr);
+                               &tcp6_rsk(req)->rmt_addr);
         }
 #endif
         nlh->nlmsg_len = skb->tail - b;
@@ -513,7 +498,7 @@ static int tcpdiag_dump_reqs(struct sk_buff *skb, struct sock *sk,
         struct tcpdiag_entry entry;
         struct tcpdiagreq *r = NLMSG_DATA(cb->nlh);
         struct tcp_sock *tp = tcp_sk(sk);
-        struct tcp_listen_opt *lopt;
+        struct listen_sock *lopt;
         struct rtattr *bc = NULL;
         struct inet_sock *inet = inet_sk(sk);
         int j, s_j;
@@ -528,9 +513,9 @@ static int tcpdiag_dump_reqs(struct sk_buff *skb, struct sock *sk,
 
         entry.family = sk->sk_family;
 
-        read_lock_bh(&tp->syn_wait_lock);
+        read_lock_bh(&tp->accept_queue.syn_wait_lock);
 
-        lopt = tp->listen_opt;
+        lopt = tp->accept_queue.listen_opt;
         if (!lopt || !lopt->qlen)
                 goto out;
 
@@ -541,13 +526,15 @@ static int tcpdiag_dump_reqs(struct sk_buff *skb, struct sock *sk,
         }
 
         for (j = s_j; j < TCP_SYNQ_HSIZE; j++) {
-                struct open_request *req, *head = lopt->syn_table[j];
+                struct request_sock *req, *head = lopt->syn_table[j];
 
                 reqnum = 0;
                 for (req = head; req; reqnum++, req = req->dl_next) {
+                        struct inet_request_sock *ireq = inet_rsk(req);
+
                         if (reqnum < s_reqnum)
                                 continue;
-                        if (r->id.tcpdiag_dport != req->rmt_port &&
+                        if (r->id.tcpdiag_dport != ireq->rmt_port &&
                             r->id.tcpdiag_dport)
                                 continue;
 
@@ -555,16 +542,16 @@ static int tcpdiag_dump_reqs(struct sk_buff *skb, struct sock *sk,
                                 entry.saddr =
 #ifdef CONFIG_IP_TCPDIAG_IPV6
                                         (entry.family == AF_INET6) ?
-                                        req->af.v6_req.loc_addr.s6_addr32 :
+                                        tcp6_rsk(req)->loc_addr.s6_addr32 :
 #endif
-                                        &req->af.v4_req.loc_addr;
+                                        &ireq->loc_addr;
                                 entry.daddr = 
 #ifdef CONFIG_IP_TCPDIAG_IPV6
                                         (entry.family == AF_INET6) ?
-                                        req->af.v6_req.rmt_addr.s6_addr32 :
+                                        tcp6_rsk(req)->rmt_addr.s6_addr32 :
 #endif
-                                        &req->af.v4_req.rmt_addr;
-                                entry.dport = ntohs(req->rmt_port);
+                                        &ireq->rmt_addr;
+                                entry.dport = ntohs(ireq->rmt_port);
 
                                 if (!tcpdiag_bc_run(RTA_DATA(bc),
                                                     RTA_PAYLOAD(bc), &entry))
@@ -585,7 +572,7 @@ static int tcpdiag_dump_reqs(struct sk_buff *skb, struct sock *sk,
         }
 
 out:
-        read_unlock_bh(&tp->syn_wait_lock);
+        read_unlock_bh(&tp->accept_queue.syn_wait_lock);
 
         return err;
 }
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c
new file mode 100644
index 000000000000..36c51f8136bf
--- /dev/null
+++ b/net/ipv4/tcp_highspeed.c
@@ -0,0 +1,181 @@
+/*
+ * Sally Floyd's High Speed TCP (RFC 3649) congestion control
+ *
+ * See http://www.icir.org/floyd/hstcp.html
+ *
+ * John Heffner <jheffner@psc.edu>
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <net/tcp.h>
+
+
+/* From AIMD tables from RFC 3649 appendix B,
+ * with fixed-point MD scaled <<8.
+ */
+static const struct hstcp_aimd_val {
+        unsigned int cwnd;
+        unsigned int md;
+} hstcp_aimd_vals[] = {
+ {     38,  128, /*  0.50 */ },
+ {    118,  112, /*  0.44 */ },
+ {    221,  104, /*  0.41 */ },
+ {    347,   98, /*  0.38 */ },
+ {    495,   93, /*  0.37 */ },
+ {    663,   89, /*  0.35 */ },
+ {    851,   86, /*  0.34 */ },
+ {   1058,   83, /*  0.33 */ },
+ {   1284,   81, /*  0.32 */ },
+ {   1529,   78, /*  0.31 */ },
+ {   1793,   76, /*  0.30 */ },
+ {   2076,   74, /*  0.29 */ },
+ {   2378,   72, /*  0.28 */ },
+ {   2699,   71, /*  0.28 */ },
+ {   3039,   69, /*  0.27 */ },
+ {   3399,   68, /*  0.27 */ },
+ {   3778,   66, /*  0.26 */ },
+ {   4177,   65, /*  0.26 */ },
+ {   4596,   64, /*  0.25 */ },
+ {   5036,   62, /*  0.25 */ },
+ {   5497,   61, /*  0.24 */ },
+ {   5979,   60, /*  0.24 */ },
+ {   6483,   59, /*  0.23 */ },
+ {   7009,   58, /*  0.23 */ },
+ {   7558,   57, /*  0.22 */ },
+ {   8130,   56, /*  0.22 */ },
+ {   8726,   55, /*  0.22 */ },
+ {   9346,   54, /*  0.21 */ },
+ {   9991,   53, /*  0.21 */ },
+ {  10661,   52, /*  0.21 */ },
+ {  11358,   52, /*  0.20 */ },
+ {  12082,   51, /*  0.20 */ },
+ {  12834,   50, /*  0.20 */ },
+ {  13614,   49, /*  0.19 */ },
+ {  14424,   48, /*  0.19 */ },
+ {  15265,   48, /*  0.19 */ },
+ {  16137,   47, /*  0.19 */ },
+ {  17042,   46, /*  0.18 */ },
+ {  17981,   45, /*  0.18 */ },
+ {  18955,   45, /*  0.18 */ },
+ {  19965,   44, /*  0.17 */ },
+ {  21013,   43, /*  0.17 */ },
+ {  22101,   43, /*  0.17 */ },
+ {  23230,   42, /*  0.17 */ },
+ {  24402,   41, /*  0.16 */ },
+ {  25618,   41, /*  0.16 */ },
+ {  26881,   40, /*  0.16 */ },
+ {  28193,   39, /*  0.16 */ },
+ {  29557,   39, /*  0.15 */ },
+ {  30975,   38, /*  0.15 */ },
+ {  32450,   38, /*  0.15 */ },
+ {  33986,   37, /*  0.15 */ },
+ {  35586,   36, /*  0.14 */ },
+ {  37253,   36, /*  0.14 */ },
+ {  38992,   35, /*  0.14 */ },
+ {  40808,   35, /*  0.14 */ },
+ {  42707,   34, /*  0.13 */ },
+ {  44694,   33, /*  0.13 */ },
+ {  46776,   33, /*  0.13 */ },
+ {  48961,   32, /*  0.13 */ },
+ {  51258,   32, /*  0.13 */ },
+ {  53677,   31, /*  0.12 */ },
+ {  56230,   30, /*  0.12 */ },
+ {  58932,   30, /*  0.12 */ },
+ {  61799,   29, /*  0.12 */ },
+ {  64851,   28, /*  0.11 */ },
+ {  68113,   28, /*  0.11 */ },
+ {  71617,   27, /*  0.11 */ },
+ {  75401,   26, /*  0.10 */ },
+ {  79517,   26, /*  0.10 */ },
+ {  84035,   25, /*  0.10 */ },
+ {  89053,   24, /*  0.10 */ },
+};
+
+#define HSTCP_AIMD_MAX  ARRAY_SIZE(hstcp_aimd_vals)
+
+struct hstcp {
+        u32     ai;
+};
+
+static void hstcp_init(struct tcp_sock *tp)
+{
+        struct hstcp *ca = tcp_ca(tp);
+
+        ca->ai = 0;
+
+        /* Ensure the MD arithmetic works.  This is somewhat pedantic,
+         * since I don't think we will see a cwnd this large. :) */
+        tp->snd_cwnd_clamp = min_t(u32, tp->snd_cwnd_clamp, 0xffffffff/128);
+}
+
+static void hstcp_cong_avoid(struct tcp_sock *tp, u32 adk, u32 rtt,
+                             u32 in_flight, int good)
+{
+        struct hstcp *ca = tcp_ca(tp);
+
+        if (in_flight < tp->snd_cwnd)
+                return;
+
+        if (tp->snd_cwnd <= tp->snd_ssthresh) {
+                if (tp->snd_cwnd < tp->snd_cwnd_clamp)
+                        tp->snd_cwnd++;
+        } else {
+                /* Update AIMD parameters */
+                if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) {
+                        while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
+                               ca->ai < HSTCP_AIMD_MAX)
+                                ca->ai++;
+                } else if (tp->snd_cwnd < hstcp_aimd_vals[ca->ai].cwnd) {
+                        while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
+                               ca->ai > 0)
+                                ca->ai--;
+                }
+
+                /* Do additive increase */
+                if (tp->snd_cwnd < tp->snd_cwnd_clamp) {
+                        tp->snd_cwnd_cnt += ca->ai;
+                        if (tp->snd_cwnd_cnt >= tp->snd_cwnd) {
+                                tp->snd_cwnd++;
+                                tp->snd_cwnd_cnt -= tp->snd_cwnd;
+                        }
+                }
+        }
+}
+
+static u32 hstcp_ssthresh(struct tcp_sock *tp)
+{
+        struct hstcp *ca = tcp_ca(tp);
+
+        /* Do multiplicative decrease */
+        return max(tp->snd_cwnd - ((tp->snd_cwnd * hstcp_aimd_vals[ca->ai].md) >> 8), 2U);
+}
+
+
+static struct tcp_congestion_ops tcp_highspeed = {
+        .init           = hstcp_init,
+        .ssthresh       = hstcp_ssthresh,
+        .cong_avoid     = hstcp_cong_avoid,
+        .min_cwnd       = tcp_reno_min_cwnd,
+
+        .owner          = THIS_MODULE,
+        .name           = "highspeed"
+};
+
+static int __init hstcp_register(void)
+{
+        BUG_ON(sizeof(struct hstcp) > TCP_CA_PRIV_SIZE);
+        return tcp_register_congestion_control(&tcp_highspeed);
+}
+
+static void __exit hstcp_unregister(void)
+{
+        tcp_unregister_congestion_control(&tcp_highspeed);
+}
+
+module_init(hstcp_register);
+module_exit(hstcp_unregister);
+
+MODULE_AUTHOR("John Heffner");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("High Speed TCP");
diff --git a/net/ipv4/tcp_htcp.c b/net/ipv4/tcp_htcp.c
new file mode 100644
index 000000000000..40168275acf9
--- /dev/null
+++ b/net/ipv4/tcp_htcp.c
@@ -0,0 +1,289 @@
+/*
+ * H-TCP congestion control. The algorithm is detailed in:
+ * R.N.Shorten, D.J.Leith:
+ *   "H-TCP: TCP for high-speed and long-distance networks"
+ *   Proc. PFLDnet, Argonne, 2004.
+ * http://www.hamilton.ie/net/htcp3.pdf
+ */
+
+#include <linux/config.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <net/tcp.h>
+
+#define ALPHA_BASE      (1<<7)  /* 1.0 with shift << 7 */
+#define BETA_MIN        (1<<6)  /* 0.5 with shift << 7 */
+#define BETA_MAX        102     /* 0.8 with shift << 7 */
+
+static int use_rtt_scaling = 1;
+module_param(use_rtt_scaling, int, 0644);
+MODULE_PARM_DESC(use_rtt_scaling, "turn on/off RTT scaling");
+
+static int use_bandwidth_switch = 1;
+module_param(use_bandwidth_switch, int, 0644);
+MODULE_PARM_DESC(use_bandwidth_switch, "turn on/off bandwidth switcher");
+
+struct htcp {
+        u16     alpha;          /* Fixed point arith, << 7 */
+        u8      beta;           /* Fixed point arith, << 7 */
+        u8      modeswitch;     /* Delay modeswitch until we had at least one congestion event */
+        u8      ccount;         /* Number of RTTs since last congestion event */
+        u8      undo_ccount;
+        u16     packetcount;
+        u32     minRTT;
+        u32     maxRTT;
+        u32     snd_cwnd_cnt2;
+
+        u32     undo_maxRTT;
+        u32     undo_old_maxB;
+
+        /* Bandwidth estimation */
+        u32     minB;
+        u32     maxB;
+        u32     old_maxB;
+        u32     Bi;
+        u32     lasttime;
+};
+
+static inline void htcp_reset(struct htcp *ca)
+{
+        ca->undo_ccount = ca->ccount;
+        ca->undo_maxRTT = ca->maxRTT;
+        ca->undo_old_maxB = ca->old_maxB;
+
+        ca->ccount = 0;
+        ca->snd_cwnd_cnt2 = 0;
+}
+
+static u32 htcp_cwnd_undo(struct tcp_sock *tp)
+{
+        struct htcp *ca = tcp_ca(tp);
+        ca->ccount = ca->undo_ccount;
+        ca->maxRTT = ca->undo_maxRTT;
+        ca->old_maxB = ca->undo_old_maxB;
+        return max(tp->snd_cwnd, (tp->snd_ssthresh<<7)/ca->beta);
+}
+
+static inline void measure_rtt(struct tcp_sock *tp)
+{
+        struct htcp *ca = tcp_ca(tp);
+        u32 srtt = tp->srtt>>3;
+
+        /* keep track of minimum RTT seen so far, minRTT is zero at first */
+        if (ca->minRTT > srtt || !ca->minRTT)
+                ca->minRTT = srtt;
+
+        /* max RTT */
+        if (tp->ca_state == TCP_CA_Open && tp->snd_ssthresh < 0xFFFF && ca->ccount > 3) {
+                if (ca->maxRTT < ca->minRTT)
+                        ca->maxRTT = ca->minRTT;
+                if (ca->maxRTT < srtt && srtt <= ca->maxRTT+HZ/50)
+                        ca->maxRTT = srtt;
+        }
+}
+
+static void measure_achieved_throughput(struct tcp_sock *tp, u32 pkts_acked)
+{
+        struct htcp *ca = tcp_ca(tp);
+        u32 now = tcp_time_stamp;
+
+        /* achieved throughput calculations */
+        if (tp->ca_state != TCP_CA_Open && tp->ca_state != TCP_CA_Disorder) {
+                ca->packetcount = 0;
+                ca->lasttime = now;
+                return;
+        }
+
+        ca->packetcount += pkts_acked;
+
+        if (ca->packetcount >= tp->snd_cwnd - (ca->alpha>>7? : 1)
+                        && now - ca->lasttime >= ca->minRTT
+                        && ca->minRTT > 0) {
+                __u32 cur_Bi = ca->packetcount*HZ/(now - ca->lasttime);
+                if (ca->ccount <= 3) {
+                        /* just after backoff */
+                        ca->minB = ca->maxB = ca->Bi = cur_Bi;
+                } else {
+                        ca->Bi = (3*ca->Bi + cur_Bi)/4;
+                        if (ca->Bi > ca->maxB)
+                                ca->maxB = ca->Bi;
+                        if (ca->minB > ca->maxB)
+                                ca->minB = ca->maxB;
+                }
+                ca->packetcount = 0;
+                ca->lasttime = now;
+        }
+}
+
+static inline void htcp_beta_update(struct htcp *ca, u32 minRTT, u32 maxRTT)
+{
+        if (use_bandwidth_switch) {
+                u32 maxB = ca->maxB;
+                u32 old_maxB = ca->old_maxB;
+                ca->old_maxB = ca->maxB;
+
+                if (!between(5*maxB, 4*old_maxB, 6*old_maxB)) {
+                        ca->beta = BETA_MIN;
+                        ca->modeswitch = 0;
+                        return;
+                }
+        }
+
+        if (ca->modeswitch && minRTT > max(HZ/100, 1) && maxRTT) {
+                ca->beta = (minRTT<<7)/maxRTT;
+                if (ca->beta < BETA_MIN)
+                        ca->beta = BETA_MIN;
+                else if (ca->beta > BETA_MAX)
+                        ca->beta = BETA_MAX;
+        } else {
+                ca->beta = BETA_MIN;
+                ca->modeswitch = 1;
+        }
+}
+
+static inline void htcp_alpha_update(struct htcp *ca)
+{
+        u32 minRTT = ca->minRTT;
+        u32 factor = 1;
+        u32 diff = ca->ccount * minRTT; /* time since last backoff */
+
+        if (diff > HZ) {
+                diff -= HZ;
+                factor = 1+ ( 10*diff + ((diff/2)*(diff/2)/HZ) )/HZ;
+        }
+
+        if (use_rtt_scaling && minRTT) {
+                u32 scale = (HZ<<3)/(10*minRTT);
+                scale = min(max(scale, 1U<<2), 10U<<3); /* clamping ratio to interval [0.5,10]<<3 */
+                factor = (factor<<3)/scale;
+                if (!factor)
+                        factor = 1;
+        }
+
+        ca->alpha = 2*factor*((1<<7)-ca->beta);
+        if (!ca->alpha)
+                ca->alpha = ALPHA_BASE;
+}
+
+/* After we have the rtt data to calculate beta, we'd still prefer to wait one
+ * rtt before we adjust our beta to ensure we are working from a consistent
+ * data.
+ *
+ * This function should be called when we hit a congestion event since only at
+ * that point do we really have a real sense of maxRTT (the queues en route
+ * were getting just too full now).
+ */
+static void htcp_param_update(struct tcp_sock *tp)
+{
+        struct htcp *ca = tcp_ca(tp);
+        u32 minRTT = ca->minRTT;
+        u32 maxRTT = ca->maxRTT;
+
+        htcp_beta_update(ca, minRTT, maxRTT);
+        htcp_alpha_update(ca);
+
+        /* add slowly fading memory for maxRTT to accommodate routing changes etc */
+        if (minRTT > 0 && maxRTT > minRTT)
+                ca->maxRTT = minRTT + ((maxRTT-minRTT)*95)/100;
+}
+
+static u32 htcp_recalc_ssthresh(struct tcp_sock *tp)
+{
+        struct htcp *ca = tcp_ca(tp);
+        htcp_param_update(tp);
+        return max((tp->snd_cwnd * ca->beta) >> 7, 2U);
+}
+
+static void htcp_cong_avoid(struct tcp_sock *tp, u32 ack, u32 rtt,
+                            u32 in_flight, int data_acked)
+{
+        struct htcp *ca = tcp_ca(tp);
+
+        if (in_flight < tp->snd_cwnd)
+                return;
+
+        if (tp->snd_cwnd <= tp->snd_ssthresh) {
+                /* In "safe" area, increase. */
+                if (tp->snd_cwnd < tp->snd_cwnd_clamp)
+                        tp->snd_cwnd++;
+        } else {
+                measure_rtt(tp);
+
+                /* keep track of number of round-trip times since last backoff event */
+                if (ca->snd_cwnd_cnt2++ > tp->snd_cwnd) {
+                        ca->ccount++;
+                        ca->snd_cwnd_cnt2 = 0;
+                        htcp_alpha_update(ca);
+                }
+
+                /* In dangerous area, increase slowly.
+                 * In theory this is tp->snd_cwnd += alpha / tp->snd_cwnd
+                 */
+                if ((tp->snd_cwnd_cnt++ * ca->alpha)>>7 >= tp->snd_cwnd) {
+                        if (tp->snd_cwnd < tp->snd_cwnd_clamp)
+                                tp->snd_cwnd++;
+                        tp->snd_cwnd_cnt = 0;
+                        ca->ccount++;
+                }
+        }
+}
+
+/* Lower bound on congestion window. */
+static u32 htcp_min_cwnd(struct tcp_sock *tp)
+{
+        return tp->snd_ssthresh;
+}
+
+
+static void htcp_init(struct tcp_sock *tp)
+{
+        struct htcp *ca = tcp_ca(tp);
+
+        memset(ca, 0, sizeof(struct htcp));
+        ca->alpha = ALPHA_BASE;
+        ca->beta = BETA_MIN;
+}
+
+static void htcp_state(struct tcp_sock *tp, u8 new_state)
+{
+        switch (new_state) {
+        case TCP_CA_CWR:
+        case TCP_CA_Recovery:
+        case TCP_CA_Loss:
+                htcp_reset(tcp_ca(tp));
+                break;
+        }
+}
+
+static struct tcp_congestion_ops htcp = {
+        .init           = htcp_init,
+        .ssthresh       = htcp_recalc_ssthresh,
+        .min_cwnd       = htcp_min_cwnd,
+        .cong_avoid     = htcp_cong_avoid,
+        .set_state      = htcp_state,
+        .undo_cwnd      = htcp_cwnd_undo,
+        .pkts_acked     = measure_achieved_throughput,
+        .owner          = THIS_MODULE,
+        .name           = "htcp",
+};
+
+static int __init htcp_register(void)
+{
+        BUG_ON(sizeof(struct htcp) > TCP_CA_PRIV_SIZE);
+        BUILD_BUG_ON(BETA_MIN >= BETA_MAX);
+        if (!use_bandwidth_switch)
+                htcp.pkts_acked = NULL;
+        return tcp_register_congestion_control(&htcp);
+}
+
+static void __exit htcp_unregister(void)
+{
+        tcp_unregister_congestion_control(&htcp);
+}
+
+module_init(htcp_register);
+module_exit(htcp_unregister);
+
+MODULE_AUTHOR("Baruch Even");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("H-TCP");
diff --git a/net/ipv4/tcp_hybla.c b/net/ipv4/tcp_hybla.c
new file mode 100644
index 000000000000..13a66342c304
--- /dev/null
+++ b/net/ipv4/tcp_hybla.c
@@ -0,0 +1,187 @@
+/*
+ * TCP HYBLA
+ *
+ * TCP-HYBLA Congestion control algorithm, based on:
+ *   C.Caini, R.Firrincieli, "TCP-Hybla: A TCP Enhancement
+ *   for Heterogeneous Networks",
+ *   International Journal on satellite Communications,
+ *                                     September 2004
+ *    Daniele Lacamera
+ *    root at danielinux.net
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <net/tcp.h>
+
+/* Tcp Hybla structure. */
+struct hybla {
+        u8    hybla_en;
+        u32   snd_cwnd_cents; /* Keeps increment values when it is <1, <<7 */
+        u32   rho;            /* Rho parameter, integer part  */
+        u32   rho2;           /* Rho * Rho, integer part */
+        u32   rho_3ls;        /* Rho parameter, <<3 */
+        u32   rho2_7ls;       /* Rho^2, <<7     */
+        u32   minrtt;         /* Minimum smoothed round trip time value seen */
+};
+
+/* Hybla reference round trip time (default= 1/40 sec = 25 ms),
+   expressed in jiffies */
+static int rtt0 = 25;
+module_param(rtt0, int, 0644);
+MODULE_PARM_DESC(rtt0, "reference rout trip time (ms)");
+
+
+/* This is called to refresh values for hybla parameters */
+static inline void hybla_recalc_param (struct tcp_sock *tp)
+{
+        struct hybla *ca = tcp_ca(tp);
+
+        ca->rho_3ls = max_t(u32, tp->srtt / msecs_to_jiffies(rtt0), 8);
+        ca->rho = ca->rho_3ls >> 3;
+        ca->rho2_7ls = (ca->rho_3ls * ca->rho_3ls) << 1;
+        ca->rho2 = ca->rho2_7ls >>7;
+}
+
+static void hybla_init(struct tcp_sock *tp)
+{
+        struct hybla *ca = tcp_ca(tp);
+
+        ca->rho = 0;
+        ca->rho2 = 0;
+        ca->rho_3ls = 0;
+        ca->rho2_7ls = 0;
+        ca->snd_cwnd_cents = 0;
+        ca->hybla_en = 1;
+        tp->snd_cwnd = 2;
+        tp->snd_cwnd_clamp = 65535;
+
+        /* 1st Rho measurement based on initial srtt */
+        hybla_recalc_param(tp);
+
+        /* set minimum rtt as this is the 1st ever seen */
+        ca->minrtt = tp->srtt;
+        tp->snd_cwnd = ca->rho;
+}
+
+static void hybla_state(struct tcp_sock *tp, u8 ca_state)
+{
+        struct hybla *ca = tcp_ca(tp);
+
+        ca->hybla_en = (ca_state == TCP_CA_Open);
+}
+
+static inline u32 hybla_fraction(u32 odds)
+{
+        static const u32 fractions[] = {
+                128, 139, 152, 165, 181, 197, 215, 234,
+        };
+
+        return (odds < ARRAY_SIZE(fractions)) ? fractions[odds] : 128;
+}
+
+/* TCP Hybla main routine.
+ * This is the algorithm behavior:
+ *     o Recalc Hybla parameters if min_rtt has changed
+ *     o Give cwnd a new value based on the model proposed
+ *     o remember increments <1
+ */
+static void hybla_cong_avoid(struct tcp_sock *tp, u32 ack, u32 rtt,
+                            u32 in_flight, int flag)
+{
+        struct hybla *ca = tcp_ca(tp);
+        u32 increment, odd, rho_fractions;
+        int is_slowstart = 0;
+
+        /*  Recalculate rho only if this srtt is the lowest */
+        if (tp->srtt < ca->minrtt){
+                hybla_recalc_param(tp);
+                ca->minrtt = tp->srtt;
+        }
+
+        if (!ca->hybla_en)
+                return tcp_reno_cong_avoid(tp, ack, rtt, in_flight, flag);
+
+        if (in_flight < tp->snd_cwnd)
+                return;
+
+        if (ca->rho == 0)
+                hybla_recalc_param(tp);
+
+        rho_fractions = ca->rho_3ls - (ca->rho << 3);
+
+        if (tp->snd_cwnd < tp->snd_ssthresh) {
+                /*
+                 * slow start
+                 *      INC = 2^RHO - 1
+                 * This is done by splitting the rho parameter
+                 * into 2 parts: an integer part and a fraction part.
+                 * Inrement<<7 is estimated by doing:
+                 *             [2^(int+fract)]<<7
+                 * that is equal to:
+                 *             (2^int)  *  [(2^fract) <<7]
+                 * 2^int is straightly computed as 1<<int,
+                 * while we will use hybla_slowstart_fraction_increment() to
+                 * calculate 2^fract in a <<7 value.
+                 */
+                is_slowstart = 1;
+                increment = ((1 << ca->rho) * hybla_fraction(rho_fractions))
+                        - 128;
+        } else {
+                /*
+                 * congestion avoidance
+                 * INC = RHO^2 / W
+                 * as long as increment is estimated as (rho<<7)/window
+                 * it already is <<7 and we can easily count its fractions.
+                 */
+                increment = ca->rho2_7ls / tp->snd_cwnd;
+                if (increment < 128)
+                        tp->snd_cwnd_cnt++;
+        }
+
+        odd = increment % 128;
+        tp->snd_cwnd += increment >> 7;
+        ca->snd_cwnd_cents += odd;
+
+        /* check when fractions goes >=128 and increase cwnd by 1. */
+        while(ca->snd_cwnd_cents >= 128) {
+                tp->snd_cwnd++;
+                ca->snd_cwnd_cents -= 128;
+                tp->snd_cwnd_cnt = 0;
+        }
+
+        /* clamp down slowstart cwnd to ssthresh value. */
+        if (is_slowstart)
+                tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
+
+        tp->snd_cwnd = min_t(u32, tp->snd_cwnd, tp->snd_cwnd_clamp);
+}
+
+static struct tcp_congestion_ops tcp_hybla = {
+        .init           = hybla_init,
+        .ssthresh       = tcp_reno_ssthresh,
+        .min_cwnd       = tcp_reno_min_cwnd,
+        .cong_avoid     = hybla_cong_avoid,
+        .set_state      = hybla_state,
+
+        .owner          = THIS_MODULE,
+        .name           = "hybla"
+};
+
+static int __init hybla_register(void)
+{
+        BUG_ON(sizeof(struct hybla) > TCP_CA_PRIV_SIZE);
+        return tcp_register_congestion_control(&tcp_hybla);
+}
+
+static void __exit hybla_unregister(void)
+{
+        tcp_unregister_congestion_control(&tcp_hybla);
+}
+
+module_init(hybla_register);
+module_exit(hybla_unregister);
+
+MODULE_AUTHOR("Daniele Lacamera");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("TCP Hybla");
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 5bad504630a3..53a8a5399f1e 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -61,7 +61,6 @@
  *              Panu Kuhlberg:          Experimental audit of TCP (re)transmission
  *                                      engine. Lots of bugs are found.
  *              Pasi Sarolahti:         F-RTO for dealing with spurious RTOs
- *              Angelo Dell'Aera:       TCP Westwood+ support
  */
 
 #include <linux/config.h>
@@ -88,23 +87,9 @@ int sysctl_tcp_rfc1337;
 int sysctl_tcp_max_orphans = NR_FILE;
 int sysctl_tcp_frto;
 int sysctl_tcp_nometrics_save;
-int sysctl_tcp_westwood;
-int sysctl_tcp_vegas_cong_avoid;
 
 int sysctl_tcp_moderate_rcvbuf = 1;
 
-/* Default values of the Vegas variables, in fixed-point representation
- * with V_PARAM_SHIFT bits to the right of the binary point.
- */
-#define V_PARAM_SHIFT 1
-int sysctl_tcp_vegas_alpha = 1<<V_PARAM_SHIFT;
-int sysctl_tcp_vegas_beta  = 3<<V_PARAM_SHIFT;
-int sysctl_tcp_vegas_gamma = 1<<V_PARAM_SHIFT;
-int sysctl_tcp_bic = 1;
-int sysctl_tcp_bic_fast_convergence = 1;
-int sysctl_tcp_bic_low_window = 14;
-int sysctl_tcp_bic_beta = 819;          /* = 819/1024 (BICTCP_BETA_SCALE) */
-
 #define FLAG_DATA               0x01 /* Incoming frame contained data.          */
 #define FLAG_WIN_UPDATE         0x02 /* Incoming ACK was a window update.       */
 #define FLAG_DATA_ACKED         0x04 /* This ACK acknowledged new data.         */
@@ -333,15 +318,6 @@ static void tcp_init_buffer_space(struct sock *sk)
         tp->snd_cwnd_stamp = tcp_time_stamp;
 }
 
-static void init_bictcp(struct tcp_sock *tp)
-{
-        tp->bictcp.cnt = 0;
-
-        tp->bictcp.last_max_cwnd = 0;
-        tp->bictcp.last_cwnd = 0;
-        tp->bictcp.last_stamp = 0;
-}
-
 /* 5. Recalculate window clamp after socket hit its memory bounds. */
 static void tcp_clamp_window(struct sock *sk, struct tcp_sock *tp)
 {
@@ -558,45 +534,6 @@ static void tcp_event_data_recv(struct sock *sk, struct tcp_sock *tp, struct sk_
                 tcp_grow_window(sk, tp, skb);
 }
 
-/* When starting a new connection, pin down the current choice of 
- * congestion algorithm.
- */
-void tcp_ca_init(struct tcp_sock *tp)
-{
-        if (sysctl_tcp_westwood) 
-                tp->adv_cong = TCP_WESTWOOD;
-        else if (sysctl_tcp_bic)
-                tp->adv_cong = TCP_BIC;
-        else if (sysctl_tcp_vegas_cong_avoid) {
-                tp->adv_cong = TCP_VEGAS;
-                tp->vegas.baseRTT = 0x7fffffff;
-                tcp_vegas_enable(tp);
-        } 
-}
-
-/* Do RTT sampling needed for Vegas.
- * Basically we:
- *   o min-filter RTT samples from within an RTT to get the current
- *     propagation delay + queuing delay (we are min-filtering to try to
- *     avoid the effects of delayed ACKs)
- *   o min-filter RTT samples from a much longer window (forever for now)
- *     to find the propagation delay (baseRTT)
- */
-static inline void vegas_rtt_calc(struct tcp_sock *tp, __u32 rtt)
-{
-        __u32 vrtt = rtt + 1; /* Never allow zero rtt or baseRTT */
-
-        /* Filter to find propagation delay: */
-        if (vrtt < tp->vegas.baseRTT) 
-                tp->vegas.baseRTT = vrtt;
-
-        /* Find the min RTT during the last RTT to find
-         * the current prop. delay + queuing delay:
-         */
-        tp->vegas.minRTT = min(tp->vegas.minRTT, vrtt);
-        tp->vegas.cntRTT++;
-}
-
 /* Called to compute a smoothed rtt estimate. The data fed to this
  * routine either comes from timestamps, or from segments that were
  * known _not_ to have been retransmitted [see Karn/Partridge
@@ -606,13 +543,10 @@ static inline void vegas_rtt_calc(struct tcp_sock *tp, __u32 rtt)
  * To save cycles in the RFC 1323 implementation it was better to break
  * it up into three procedures. -- erics
  */
-static void tcp_rtt_estimator(struct tcp_sock *tp, __u32 mrtt)
+static void tcp_rtt_estimator(struct tcp_sock *tp, __u32 mrtt, u32 *usrtt)
 {
         long m = mrtt; /* RTT */
 
-        if (tcp_vegas_enabled(tp))
-                vegas_rtt_calc(tp, mrtt);
-
         /*      The following amusing code comes from Jacobson's
          *      article in SIGCOMM '88.  Note that rtt and mdev
          *      are scaled versions of rtt and mean deviation.
@@ -670,7 +604,8 @@ static void tcp_rtt_estimator(struct tcp_sock *tp, __u32 mrtt)
                 tp->rtt_seq = tp->snd_nxt;
         }
 
-        tcp_westwood_update_rtt(tp, tp->srtt >> 3);
+        if (tp->ca_ops->rtt_sample)
+                tp->ca_ops->rtt_sample(tp, *usrtt);
 }
 
 /* Calculate rto without backoff.  This is the second half of Van Jacobson's
@@ -805,10 +740,10 @@ __u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst)
         __u32 cwnd = (dst ? dst_metric(dst, RTAX_INITCWND) : 0);
 
         if (!cwnd) {
-                if (tp->mss_cache_std > 1460)
+                if (tp->mss_cache > 1460)
                         cwnd = 2;
                 else
-                        cwnd = (tp->mss_cache_std > 1095) ? 3 : 4;
+                        cwnd = (tp->mss_cache > 1095) ? 3 : 4;
         }
         return min_t(__u32, cwnd, tp->snd_cwnd_clamp);
 }
@@ -979,7 +914,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
         if (sk->sk_route_caps & NETIF_F_TSO) {
                 sk->sk_route_caps &= ~NETIF_F_TSO;
                 sock_set_flag(sk, SOCK_NO_LARGESEND);
-                tp->mss_cache = tp->mss_cache_std;
+                tp->mss_cache = tp->mss_cache;
         }
 
         if (!tp->sacked_out)
@@ -1142,7 +1077,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                             (IsFack(tp) ||
                              !before(lost_retrans,
                                      TCP_SKB_CB(skb)->ack_seq + tp->reordering *
-                                     tp->mss_cache_std))) {
+                                     tp->mss_cache))) {
                                 TCP_SKB_CB(skb)->sacked &= ~TCPCB_SACKED_RETRANS;
                                 tp->retrans_out -= tcp_skb_pcount(skb);
 
@@ -1185,8 +1120,8 @@ void tcp_enter_frto(struct sock *sk)
             tp->snd_una == tp->high_seq ||
             (tp->ca_state == TCP_CA_Loss && !tp->retransmits)) {
                 tp->prior_ssthresh = tcp_current_ssthresh(tp);
-                if (!tcp_westwood_ssthresh(tp))
-                        tp->snd_ssthresh = tcp_recalc_ssthresh(tp);
+                tp->snd_ssthresh = tp->ca_ops->ssthresh(tp);
+                tcp_ca_event(tp, CA_EVENT_FRTO);
         }
 
         /* Have to clear retransmission markers here to keep the bookkeeping
@@ -1252,8 +1187,6 @@ static void tcp_enter_frto_loss(struct sock *sk)
         tcp_set_ca_state(tp, TCP_CA_Loss);
         tp->high_seq = tp->frto_highmark;
         TCP_ECN_queue_cwr(tp);
-
-        init_bictcp(tp);
 }
 
 void tcp_clear_retrans(struct tcp_sock *tp)
@@ -1283,7 +1216,8 @@ void tcp_enter_loss(struct sock *sk, int how)
         if (tp->ca_state <= TCP_CA_Disorder || tp->snd_una == tp->high_seq ||
             (tp->ca_state == TCP_CA_Loss && !tp->retransmits)) {
                 tp->prior_ssthresh = tcp_current_ssthresh(tp);
-                tp->snd_ssthresh = tcp_recalc_ssthresh(tp);
+                tp->snd_ssthresh = tp->ca_ops->ssthresh(tp);
+                tcp_ca_event(tp, CA_EVENT_LOSS);
         }
         tp->snd_cwnd       = 1;
         tp->snd_cwnd_cnt   = 0;
@@ -1596,28 +1530,14 @@ static inline void tcp_moderate_cwnd(struct tcp_sock *tp)
 }
 
 /* Decrease cwnd each second ack. */
-
 static void tcp_cwnd_down(struct tcp_sock *tp)
 {
         int decr = tp->snd_cwnd_cnt + 1;
-        __u32 limit;
-
-        /*
-         * TCP Westwood
-         * Here limit is evaluated as BWestimation*RTTmin (for obtaining it
-         * in packets we use mss_cache). If sysctl_tcp_westwood is off
-         * tcp_westwood_bw_rttmin() returns 0. In such case snd_ssthresh is
-         * still used as usual. It prevents other strange cases in which
-         * BWE*RTTmin could assume value 0. It should not happen but...
-         */
-
-        if (!(limit = tcp_westwood_bw_rttmin(tp)))
-                limit = tp->snd_ssthresh/2;
 
         tp->snd_cwnd_cnt = decr&1;
         decr >>= 1;
 
-        if (decr && tp->snd_cwnd > limit)
+        if (decr && tp->snd_cwnd > tp->ca_ops->min_cwnd(tp))
                 tp->snd_cwnd -= decr;
 
         tp->snd_cwnd = min(tp->snd_cwnd, tcp_packets_in_flight(tp)+1);
@@ -1654,8 +1574,8 @@ static void DBGUNDO(struct sock *sk, struct tcp_sock *tp, const char *msg)
 static void tcp_undo_cwr(struct tcp_sock *tp, int undo)
 {
         if (tp->prior_ssthresh) {
-                if (tcp_is_bic(tp))
-                        tp->snd_cwnd = max(tp->snd_cwnd, tp->bictcp.last_max_cwnd);
+                if (tp->ca_ops->undo_cwnd)
+                        tp->snd_cwnd = tp->ca_ops->undo_cwnd(tp);
                 else
                         tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh<<1);
 
@@ -1767,11 +1687,9 @@ static int tcp_try_undo_loss(struct sock *sk, struct tcp_sock *tp)
 
 static inline void tcp_complete_cwr(struct tcp_sock *tp)
 {
-        if (tcp_westwood_cwnd(tp)) 
-                tp->snd_ssthresh = tp->snd_cwnd;
-        else
-                tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
+        tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
         tp->snd_cwnd_stamp = tcp_time_stamp;
+        tcp_ca_event(tp, CA_EVENT_COMPLETE_CWR);
 }
 
 static void tcp_try_to_open(struct sock *sk, struct tcp_sock *tp, int flag)
@@ -1946,7 +1864,7 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
                 if (tp->ca_state < TCP_CA_CWR) {
                         if (!(flag&FLAG_ECE))
                                 tp->prior_ssthresh = tcp_current_ssthresh(tp);
-                        tp->snd_ssthresh = tcp_recalc_ssthresh(tp);
+                        tp->snd_ssthresh = tp->ca_ops->ssthresh(tp);
                         TCP_ECN_queue_cwr(tp);
                 }
 
@@ -1963,7 +1881,7 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
 /* Read draft-ietf-tcplw-high-performance before mucking
  * with this code. (Superceeds RFC1323)
  */
-static void tcp_ack_saw_tstamp(struct tcp_sock *tp, int flag)
+static void tcp_ack_saw_tstamp(struct tcp_sock *tp, u32 *usrtt, int flag)
 {
         __u32 seq_rtt;
 
@@ -1983,13 +1901,13 @@ static void tcp_ack_saw_tstamp(struct tcp_sock *tp, int flag)
          * in window is lost... Voila.                          --ANK (010210)
          */
         seq_rtt = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
-        tcp_rtt_estimator(tp, seq_rtt);
+        tcp_rtt_estimator(tp, seq_rtt, usrtt);
         tcp_set_rto(tp);
         tp->backoff = 0;
         tcp_bound_rto(tp);
 }
 
-static void tcp_ack_no_tstamp(struct tcp_sock *tp, u32 seq_rtt, int flag)
+static void tcp_ack_no_tstamp(struct tcp_sock *tp, u32 seq_rtt, u32 *usrtt, int flag)
 {
         /* We don't have a timestamp. Can only use
          * packets that are not retransmitted to determine
@@ -2003,338 +1921,29 @@ static void tcp_ack_no_tstamp(struct tcp_sock *tp, u32 seq_rtt, int flag)
         if (flag & FLAG_RETRANS_DATA_ACKED)
                 return;
 
-        tcp_rtt_estimator(tp, seq_rtt);
+        tcp_rtt_estimator(tp, seq_rtt, usrtt);
         tcp_set_rto(tp);
         tp->backoff = 0;
         tcp_bound_rto(tp);
 }
 
 static inline void tcp_ack_update_rtt(struct tcp_sock *tp,
-                                      int flag, s32 seq_rtt)
+                                      int flag, s32 seq_rtt, u32 *usrtt)
 {
         /* Note that peer MAY send zero echo. In this case it is ignored. (rfc1323) */
         if (tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr)
-                tcp_ack_saw_tstamp(tp, flag);
+                tcp_ack_saw_tstamp(tp, usrtt, flag);
         else if (seq_rtt >= 0)
-                tcp_ack_no_tstamp(tp, seq_rtt, flag);
-}
-
-/*
- * Compute congestion window to use.
- *
- * This is from the implementation of BICTCP in
- * Lison-Xu, Kahaled Harfoush, and Injog Rhee.
- *  "Binary Increase Congestion Control for Fast, Long Distance
- *  Networks" in InfoComm 2004
- * Available from:
- *  http://www.csc.ncsu.edu/faculty/rhee/export/bitcp.pdf
- *
- * Unless BIC is enabled and congestion window is large
- * this behaves the same as the original Reno.
- */
-static inline __u32 bictcp_cwnd(struct tcp_sock *tp)
-{
-        /* orignal Reno behaviour */
-        if (!tcp_is_bic(tp))
-                return tp->snd_cwnd;
-
-        if (tp->bictcp.last_cwnd == tp->snd_cwnd &&
-           (s32)(tcp_time_stamp - tp->bictcp.last_stamp) <= (HZ>>5))
-                return tp->bictcp.cnt;
-
-        tp->bictcp.last_cwnd = tp->snd_cwnd;
-        tp->bictcp.last_stamp = tcp_time_stamp;
-      
-        /* start off normal */
-        if (tp->snd_cwnd <= sysctl_tcp_bic_low_window)
-                tp->bictcp.cnt = tp->snd_cwnd;
-
-        /* binary increase */
-        else if (tp->snd_cwnd < tp->bictcp.last_max_cwnd) {
-                __u32   dist = (tp->bictcp.last_max_cwnd - tp->snd_cwnd)
-                        / BICTCP_B;
-
-                if (dist > BICTCP_MAX_INCREMENT)
-                        /* linear increase */
-                        tp->bictcp.cnt = tp->snd_cwnd / BICTCP_MAX_INCREMENT;
-                else if (dist <= 1U)
-                        /* binary search increase */
-                        tp->bictcp.cnt = tp->snd_cwnd * BICTCP_FUNC_OF_MIN_INCR
-                                / BICTCP_B;
-                else
-                        /* binary search increase */
-                        tp->bictcp.cnt = tp->snd_cwnd / dist;
-        } else {
-                /* slow start amd linear increase */
-                if (tp->snd_cwnd < tp->bictcp.last_max_cwnd + BICTCP_B)
-                        /* slow start */
-                        tp->bictcp.cnt = tp->snd_cwnd * BICTCP_FUNC_OF_MIN_INCR
-                                / BICTCP_B;
-                else if (tp->snd_cwnd < tp->bictcp.last_max_cwnd
-                                        + BICTCP_MAX_INCREMENT*(BICTCP_B-1))
-                        /* slow start */
-                        tp->bictcp.cnt = tp->snd_cwnd * (BICTCP_B-1)
-                                / (tp->snd_cwnd-tp->bictcp.last_max_cwnd);
-                else
-                        /* linear increase */
-                        tp->bictcp.cnt = tp->snd_cwnd / BICTCP_MAX_INCREMENT;
-        }
-        return tp->bictcp.cnt;
+                tcp_ack_no_tstamp(tp, seq_rtt, usrtt, flag);
 }
 
-/* This is Jacobson's slow start and congestion avoidance. 
- * SIGCOMM '88, p. 328.
- */
-static inline void reno_cong_avoid(struct tcp_sock *tp)
+static inline void tcp_cong_avoid(struct tcp_sock *tp, u32 ack, u32 rtt,
+                                  u32 in_flight, int good)
 {
-        if (tp->snd_cwnd <= tp->snd_ssthresh) {
-                /* In "safe" area, increase. */
-                if (tp->snd_cwnd < tp->snd_cwnd_clamp)
-                        tp->snd_cwnd++;
-        } else {
-                /* In dangerous area, increase slowly.
-                 * In theory this is tp->snd_cwnd += 1 / tp->snd_cwnd
-                 */
-                if (tp->snd_cwnd_cnt >= bictcp_cwnd(tp)) {
-                        if (tp->snd_cwnd < tp->snd_cwnd_clamp)
-                                tp->snd_cwnd++;
-                        tp->snd_cwnd_cnt=0;
-                } else
-                        tp->snd_cwnd_cnt++;
-        }
+        tp->ca_ops->cong_avoid(tp, ack, rtt, in_flight, good);
         tp->snd_cwnd_stamp = tcp_time_stamp;
 }
 
-/* This is based on the congestion detection/avoidance scheme described in
- *    Lawrence S. Brakmo and Larry L. Peterson.
- *    "TCP Vegas: End to end congestion avoidance on a global internet."
- *    IEEE Journal on Selected Areas in Communication, 13(8):1465--1480,
- *    October 1995. Available from:
- *      ftp://ftp.cs.arizona.edu/xkernel/Papers/jsac.ps
- *
- * See http://www.cs.arizona.edu/xkernel/ for their implementation.
- * The main aspects that distinguish this implementation from the
- * Arizona Vegas implementation are:
- *   o We do not change the loss detection or recovery mechanisms of
- *     Linux in any way. Linux already recovers from losses quite well,
- *     using fine-grained timers, NewReno, and FACK.
- *   o To avoid the performance penalty imposed by increasing cwnd
- *     only every-other RTT during slow start, we increase during
- *     every RTT during slow start, just like Reno.
- *   o Largely to allow continuous cwnd growth during slow start,
- *     we use the rate at which ACKs come back as the "actual"
- *     rate, rather than the rate at which data is sent.
- *   o To speed convergence to the right rate, we set the cwnd
- *     to achieve the right ("actual") rate when we exit slow start.
- *   o To filter out the noise caused by delayed ACKs, we use the
- *     minimum RTT sample observed during the last RTT to calculate
- *     the actual rate.
- *   o When the sender re-starts from idle, it waits until it has
- *     received ACKs for an entire flight of new data before making
- *     a cwnd adjustment decision. The original Vegas implementation
- *     assumed senders never went idle.
- */
-static void vegas_cong_avoid(struct tcp_sock *tp, u32 ack, u32 seq_rtt)
-{
-        /* The key players are v_beg_snd_una and v_beg_snd_nxt.
-         *
-         * These are so named because they represent the approximate values
-         * of snd_una and snd_nxt at the beginning of the current RTT. More
-         * precisely, they represent the amount of data sent during the RTT.
-         * At the end of the RTT, when we receive an ACK for v_beg_snd_nxt,
-         * we will calculate that (v_beg_snd_nxt - v_beg_snd_una) outstanding
-         * bytes of data have been ACKed during the course of the RTT, giving
-         * an "actual" rate of:
-         *
-         *     (v_beg_snd_nxt - v_beg_snd_una) / (rtt duration)
-         *
-         * Unfortunately, v_beg_snd_una is not exactly equal to snd_una,
-         * because delayed ACKs can cover more than one segment, so they
-         * don't line up nicely with the boundaries of RTTs.
-         *
-         * Another unfortunate fact of life is that delayed ACKs delay the
-         * advance of the left edge of our send window, so that the number
-         * of bytes we send in an RTT is often less than our cwnd will allow.
-         * So we keep track of our cwnd separately, in v_beg_snd_cwnd.
-         */
-
-        if (after(ack, tp->vegas.beg_snd_nxt)) {
-                /* Do the Vegas once-per-RTT cwnd adjustment. */
-                u32 old_wnd, old_snd_cwnd;
-
-                
-                /* Here old_wnd is essentially the window of data that was
-                 * sent during the previous RTT, and has all
-                 * been acknowledged in the course of the RTT that ended
-                 * with the ACK we just received. Likewise, old_snd_cwnd
-                 * is the cwnd during the previous RTT.
-                 */
-                old_wnd = (tp->vegas.beg_snd_nxt - tp->vegas.beg_snd_una) /
-                        tp->mss_cache_std;
-                old_snd_cwnd = tp->vegas.beg_snd_cwnd;
-
-                /* Save the extent of the current window so we can use this
-                 * at the end of the next RTT.
-                 */
-                tp->vegas.beg_snd_una  = tp->vegas.beg_snd_nxt;
-                tp->vegas.beg_snd_nxt  = tp->snd_nxt;
-                tp->vegas.beg_snd_cwnd = tp->snd_cwnd;
-
-                /* Take into account the current RTT sample too, to
-                 * decrease the impact of delayed acks. This double counts
-                 * this sample since we count it for the next window as well,
-                 * but that's not too awful, since we're taking the min,
-                 * rather than averaging.
-                 */
-                vegas_rtt_calc(tp, seq_rtt);
-
-                /* We do the Vegas calculations only if we got enough RTT
-                 * samples that we can be reasonably sure that we got
-                 * at least one RTT sample that wasn't from a delayed ACK.
-                 * If we only had 2 samples total,
-                 * then that means we're getting only 1 ACK per RTT, which
-                 * means they're almost certainly delayed ACKs.
-                 * If  we have 3 samples, we should be OK.
-                 */
-
-                if (tp->vegas.cntRTT <= 2) {
-                        /* We don't have enough RTT samples to do the Vegas
-                         * calculation, so we'll behave like Reno.
-                         */
-                        if (tp->snd_cwnd > tp->snd_ssthresh)
-                                tp->snd_cwnd++;
-                } else {
-                        u32 rtt, target_cwnd, diff;
-
-                        /* We have enough RTT samples, so, using the Vegas
-                         * algorithm, we determine if we should increase or
-                         * decrease cwnd, and by how much.
-                         */
-
-                        /* Pluck out the RTT we are using for the Vegas
-                         * calculations. This is the min RTT seen during the
-                         * last RTT. Taking the min filters out the effects
-                         * of delayed ACKs, at the cost of noticing congestion
-                         * a bit later.
-                         */
-                        rtt = tp->vegas.minRTT;
-
-                        /* Calculate the cwnd we should have, if we weren't
-                         * going too fast.
-                         *
-                         * This is:
-                         *     (actual rate in segments) * baseRTT
-                         * We keep it as a fixed point number with
-                         * V_PARAM_SHIFT bits to the right of the binary point.
-                         */
-                        target_cwnd = ((old_wnd * tp->vegas.baseRTT)
-                                       << V_PARAM_SHIFT) / rtt;
-
-                        /* Calculate the difference between the window we had,
-                         * and the window we would like to have. This quantity
-                         * is the "Diff" from the Arizona Vegas papers.
-                         *
-                         * Again, this is a fixed point number with
-                         * V_PARAM_SHIFT bits to the right of the binary
-                         * point.
-                         */
-                        diff = (old_wnd << V_PARAM_SHIFT) - target_cwnd;
-
-                        if (tp->snd_cwnd < tp->snd_ssthresh) {
-                                /* Slow start.  */
-                                if (diff > sysctl_tcp_vegas_gamma) {
-                                        /* Going too fast. Time to slow down
-                                         * and switch to congestion avoidance.
-                                         */
-                                        tp->snd_ssthresh = 2;
-
-                                        /* Set cwnd to match the actual rate
-                                         * exactly:
-                                         *   cwnd = (actual rate) * baseRTT
-                                         * Then we add 1 because the integer
-                                         * truncation robs us of full link
-                                         * utilization.
-                                         */
-                                        tp->snd_cwnd = min(tp->snd_cwnd,
-                                                           (target_cwnd >>
-                                                            V_PARAM_SHIFT)+1);
-
-                                }
-                        } else {
-                                /* Congestion avoidance. */
-                                u32 next_snd_cwnd;
-
-                                /* Figure out where we would like cwnd
-                                 * to be.
-                                 */
-                                if (diff > sysctl_tcp_vegas_beta) {
-                                        /* The old window was too fast, so
-                                         * we slow down.
-                                         */
-                                        next_snd_cwnd = old_snd_cwnd - 1;
-                                } else if (diff < sysctl_tcp_vegas_alpha) {
-                                        /* We don't have enough extra packets
-                                         * in the network, so speed up.
-                                         */
-                                        next_snd_cwnd = old_snd_cwnd + 1;
-                                } else {
-                                        /* Sending just as fast as we
-                                         * should be.
-                                         */
-                                        next_snd_cwnd = old_snd_cwnd;
-                                }
-
-                                /* Adjust cwnd upward or downward, toward the
-                                 * desired value.
-                                 */
-                                if (next_snd_cwnd > tp->snd_cwnd)
-                                        tp->snd_cwnd++;
-                                else if (next_snd_cwnd < tp->snd_cwnd)
-                                        tp->snd_cwnd--;
-                        }
-                }
-
-                /* Wipe the slate clean for the next RTT. */
-                tp->vegas.cntRTT = 0;
-                tp->vegas.minRTT = 0x7fffffff;
-        }
-
-        /* The following code is executed for every ack we receive,
-         * except for conditions checked in should_advance_cwnd()
-         * before the call to tcp_cong_avoid(). Mainly this means that
-         * we only execute this code if the ack actually acked some
-         * data.
-         */
-
-        /* If we are in slow start, increase our cwnd in response to this ACK.
-         * (If we are not in slow start then we are in congestion avoidance,
-         * and adjust our congestion window only once per RTT. See the code
-         * above.)
-         */
-        if (tp->snd_cwnd <= tp->snd_ssthresh) 
-                tp->snd_cwnd++;
-
-        /* to keep cwnd from growing without bound */
-        tp->snd_cwnd = min_t(u32, tp->snd_cwnd, tp->snd_cwnd_clamp);
-
-        /* Make sure that we are never so timid as to reduce our cwnd below
-         * 2 MSS.
-         *
-         * Going below 2 MSS would risk huge delayed ACKs from our receiver.
-         */
-        tp->snd_cwnd = max(tp->snd_cwnd, 2U);
-
-        tp->snd_cwnd_stamp = tcp_time_stamp;
-}
-
-static inline void tcp_cong_avoid(struct tcp_sock *tp, u32 ack, u32 seq_rtt)
-{
-        if (tcp_vegas_enabled(tp))
-                vegas_cong_avoid(tp, ack, seq_rtt);
-        else
-                reno_cong_avoid(tp);
-}
-
 /* Restart timer after forward progress on connection.
  * RFC2988 recommends to restart timer to now+rto.
  */
@@ -2348,15 +1957,6 @@ static inline void tcp_ack_packets_out(struct sock *sk, struct tcp_sock *tp)
         }
 }
 
-/* There is one downside to this scheme.  Although we keep the
- * ACK clock ticking, adjusting packet counters and advancing
- * congestion window, we do not liberate socket send buffer
- * space.
- *
- * Mucking with skb->truesize and sk->sk_wmem_alloc et al.
- * then making a write space wakeup callback is a possible
- * future enhancement.  WARNING: it is not trivial to make.
- */
 static int tcp_tso_acked(struct sock *sk, struct sk_buff *skb,
                          __u32 now, __s32 *seq_rtt)
 {
@@ -2415,13 +2015,18 @@ static int tcp_tso_acked(struct sock *sk, struct sk_buff *skb,
 
 
 /* Remove acknowledged frames from the retransmission queue. */
-static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
+static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p, s32 *seq_usrtt)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
         __u32 now = tcp_time_stamp;
         int acked = 0;
         __s32 seq_rtt = -1;
+        struct timeval usnow;
+        u32 pkts_acked = 0;
+
+        if (seq_usrtt)
+                do_gettimeofday(&usnow);
 
         while ((skb = skb_peek(&sk->sk_write_queue)) &&
                skb != sk->sk_send_head) {
@@ -2433,7 +2038,8 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
                  * the other end.
                  */
                 if (after(scb->end_seq, tp->snd_una)) {
-                        if (tcp_skb_pcount(skb) > 1)
+                        if (tcp_skb_pcount(skb) > 1 &&
+                            after(tp->snd_una, scb->seq))
                                 acked |= tcp_tso_acked(sk, skb,
                                                        now, &seq_rtt);
                         break;
@@ -2448,6 +2054,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
                  */
                 if (!(scb->flags & TCPCB_FLAG_SYN)) {
                         acked |= FLAG_DATA_ACKED;
+                        ++pkts_acked;
                 } else {
                         acked |= FLAG_SYN_ACKED;
                         tp->retrans_stamp = 0;
@@ -2461,6 +2068,10 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
                                 seq_rtt = -1;
                         } else if (seq_rtt < 0)
                                 seq_rtt = now - scb->when;
+                        if (seq_usrtt)
+                                *seq_usrtt = (usnow.tv_sec - skb->stamp.tv_sec) * 1000000
+                                        + (usnow.tv_usec - skb->stamp.tv_usec);
+
                         if (sacked & TCPCB_SACKED_ACKED)
                                 tp->sacked_out -= tcp_skb_pcount(skb);
                         if (sacked & TCPCB_LOST)
@@ -2479,8 +2090,11 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
         }
 
         if (acked&FLAG_ACKED) {
-                tcp_ack_update_rtt(tp, acked, seq_rtt);
+                tcp_ack_update_rtt(tp, acked, seq_rtt, seq_usrtt);
                 tcp_ack_packets_out(sk, tp);
+
+                if (tp->ca_ops->pkts_acked)
+                        tp->ca_ops->pkts_acked(tp, pkts_acked);
         }
 
 #if FASTRETRANS_DEBUG > 0
@@ -2624,257 +2238,6 @@ static void tcp_process_frto(struct sock *sk, u32 prior_snd_una)
         tp->frto_counter = (tp->frto_counter + 1) % 3;
 }
 
-/*
- * TCP Westwood+
- */
-
-/*
- * @init_westwood
- * This function initializes fields used in TCP Westwood+. We can't
- * get no information about RTTmin at this time so we simply set it to
- * TCP_WESTWOOD_INIT_RTT. This value was chosen to be too conservative
- * since in this way we're sure it will be updated in a consistent
- * way as soon as possible. It will reasonably happen within the first
- * RTT period of the connection lifetime.
- */
-
-static void init_westwood(struct sock *sk)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        tp->westwood.bw_ns_est = 0;
-        tp->westwood.bw_est = 0;
-        tp->westwood.accounted = 0;
-        tp->westwood.cumul_ack = 0;
-        tp->westwood.rtt_win_sx = tcp_time_stamp;
-        tp->westwood.rtt = TCP_WESTWOOD_INIT_RTT;
-        tp->westwood.rtt_min = TCP_WESTWOOD_INIT_RTT;
-        tp->westwood.snd_una = tp->snd_una;
-}
-
-/*
- * @westwood_do_filter
- * Low-pass filter. Implemented using constant coeffients.
- */
-
-static inline __u32 westwood_do_filter(__u32 a, __u32 b)
-{
-        return (((7 * a) + b) >> 3);
-}
-
-static void westwood_filter(struct sock *sk, __u32 delta)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        tp->westwood.bw_ns_est =
-                westwood_do_filter(tp->westwood.bw_ns_est, 
-                                   tp->westwood.bk / delta);
-        tp->westwood.bw_est =
-                westwood_do_filter(tp->westwood.bw_est,
-                                   tp->westwood.bw_ns_est);
-}
-
-/* 
- * @westwood_update_rttmin
- * It is used to update RTTmin. In this case we MUST NOT use
- * WESTWOOD_RTT_MIN minimum bound since we could be on a LAN!
- */
-
-static inline __u32 westwood_update_rttmin(const struct sock *sk)
-{
-        const struct tcp_sock *tp = tcp_sk(sk);
-        __u32 rttmin = tp->westwood.rtt_min;
-
-        if (tp->westwood.rtt != 0 &&
-            (tp->westwood.rtt < tp->westwood.rtt_min || !rttmin))
-                rttmin = tp->westwood.rtt;
-
-        return rttmin;
-}
-
-/*
- * @westwood_acked
- * Evaluate increases for dk. 
- */
-
-static inline __u32 westwood_acked(const struct sock *sk)
-{
-        const struct tcp_sock *tp = tcp_sk(sk);
-
-        return tp->snd_una - tp->westwood.snd_una;
-}
-
-/*
- * @westwood_new_window
- * It evaluates if we are receiving data inside the same RTT window as
- * when we started.
- * Return value:
- * It returns 0 if we are still evaluating samples in the same RTT
- * window, 1 if the sample has to be considered in the next window.
- */
-
-static int westwood_new_window(const struct sock *sk)
-{
-        const struct tcp_sock *tp = tcp_sk(sk);
-        __u32 left_bound;
-        __u32 rtt;
-        int ret = 0;
-
-        left_bound = tp->westwood.rtt_win_sx;
-        rtt = max(tp->westwood.rtt, (u32) TCP_WESTWOOD_RTT_MIN);
-
-        /*
-         * A RTT-window has passed. Be careful since if RTT is less than
-         * 50ms we don't filter but we continue 'building the sample'.
-         * This minimum limit was choosen since an estimation on small
-         * time intervals is better to avoid...
-         * Obvioulsy on a LAN we reasonably will always have
-         * right_bound = left_bound + WESTWOOD_RTT_MIN
-         */
-
-        if ((left_bound + rtt) < tcp_time_stamp)
-                ret = 1;
-
-        return ret;
-}
-
-/*
- * @westwood_update_window
- * It updates RTT evaluation window if it is the right moment to do
- * it. If so it calls filter for evaluating bandwidth. 
- */
-
-static void __westwood_update_window(struct sock *sk, __u32 now)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-        __u32 delta = now - tp->westwood.rtt_win_sx;
-
-        if (delta) {
-                if (tp->westwood.rtt)
-                        westwood_filter(sk, delta);
-
-                tp->westwood.bk = 0;
-                tp->westwood.rtt_win_sx = tcp_time_stamp;
-        }
-}
-
-
-static void westwood_update_window(struct sock *sk, __u32 now)
-{
-        if (westwood_new_window(sk)) 
-                __westwood_update_window(sk, now);
-}
-
-/*
- * @__tcp_westwood_fast_bw
- * It is called when we are in fast path. In particular it is called when
- * header prediction is successfull. In such case infact update is
- * straight forward and doesn't need any particular care.
- */
-
-static void __tcp_westwood_fast_bw(struct sock *sk, struct sk_buff *skb)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        westwood_update_window(sk, tcp_time_stamp);
-
-        tp->westwood.bk += westwood_acked(sk);
-        tp->westwood.snd_una = tp->snd_una;
-        tp->westwood.rtt_min = westwood_update_rttmin(sk);
-}
-
-static inline void tcp_westwood_fast_bw(struct sock *sk, struct sk_buff *skb)
-{
-        if (tcp_is_westwood(tcp_sk(sk)))
-                __tcp_westwood_fast_bw(sk, skb);
-}
-
-
-/*
- * @westwood_dupack_update
- * It updates accounted and cumul_ack when receiving a dupack.
- */
-
-static void westwood_dupack_update(struct sock *sk)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        tp->westwood.accounted += tp->mss_cache_std;
-        tp->westwood.cumul_ack = tp->mss_cache_std;
-}
-
-static inline int westwood_may_change_cumul(struct tcp_sock *tp)
-{
-        return (tp->westwood.cumul_ack > tp->mss_cache_std);
-}
-
-static inline void westwood_partial_update(struct tcp_sock *tp)
-{
-        tp->westwood.accounted -= tp->westwood.cumul_ack;
-        tp->westwood.cumul_ack = tp->mss_cache_std;
-}
-
-static inline void westwood_complete_update(struct tcp_sock *tp)
-{
-        tp->westwood.cumul_ack -= tp->westwood.accounted;
-        tp->westwood.accounted = 0;
-}
-
-/*
- * @westwood_acked_count
- * This function evaluates cumul_ack for evaluating dk in case of
- * delayed or partial acks.
- */
-
-static inline __u32 westwood_acked_count(struct sock *sk)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        tp->westwood.cumul_ack = westwood_acked(sk);
-
-        /* If cumul_ack is 0 this is a dupack since it's not moving
-         * tp->snd_una.
-         */
-        if (!(tp->westwood.cumul_ack))
-                westwood_dupack_update(sk);
-
-        if (westwood_may_change_cumul(tp)) {
-                /* Partial or delayed ack */
-                if (tp->westwood.accounted >= tp->westwood.cumul_ack)
-                        westwood_partial_update(tp);
-                else
-                        westwood_complete_update(tp);
-        }
-
-        tp->westwood.snd_una = tp->snd_una;
-
-        return tp->westwood.cumul_ack;
-}
-
-
-/*
- * @__tcp_westwood_slow_bw
- * It is called when something is going wrong..even if there could
- * be no problems! Infact a simple delayed packet may trigger a
- * dupack. But we need to be careful in such case.
- */
-
-static void __tcp_westwood_slow_bw(struct sock *sk, struct sk_buff *skb)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        westwood_update_window(sk, tcp_time_stamp);
-
-        tp->westwood.bk += westwood_acked_count(sk);
-        tp->westwood.rtt_min = westwood_update_rttmin(sk);
-}
-
-static inline void tcp_westwood_slow_bw(struct sock *sk, struct sk_buff *skb)
-{
-        if (tcp_is_westwood(tcp_sk(sk)))
-                __tcp_westwood_slow_bw(sk, skb);
-}
-
 /* This routine deals with incoming acks, but not outgoing ones. */
 static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
 {
@@ -2884,6 +2247,7 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
         u32 ack = TCP_SKB_CB(skb)->ack_seq;
         u32 prior_in_flight;
         s32 seq_rtt;
+        s32 seq_usrtt = 0;
         int prior_packets;
 
         /* If the ack is newer than sent or older than previous acks
@@ -2902,9 +2266,10 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
                  */
                 tcp_update_wl(tp, ack, ack_seq);
                 tp->snd_una = ack;
-                tcp_westwood_fast_bw(sk, skb);
                 flag |= FLAG_WIN_UPDATE;
 
+                tcp_ca_event(tp, CA_EVENT_FAST_ACK);
+
                 NET_INC_STATS_BH(LINUX_MIB_TCPHPACKS);
         } else {
                 if (ack_seq != TCP_SKB_CB(skb)->end_seq)
@@ -2920,7 +2285,7 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
                 if (TCP_ECN_rcv_ecn_echo(tp, skb->h.th))
                         flag |= FLAG_ECE;
 
-                tcp_westwood_slow_bw(sk,skb);
+                tcp_ca_event(tp, CA_EVENT_SLOW_ACK);
         }
 
         /* We passed data and got it acked, remove any soft error
@@ -2935,22 +2300,20 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
         prior_in_flight = tcp_packets_in_flight(tp);
 
         /* See if we can take anything off of the retransmit queue. */
-        flag |= tcp_clean_rtx_queue(sk, &seq_rtt);
+        flag |= tcp_clean_rtx_queue(sk, &seq_rtt,
+                                    tp->ca_ops->rtt_sample ? &seq_usrtt : NULL);
 
         if (tp->frto_counter)
                 tcp_process_frto(sk, prior_snd_una);
 
         if (tcp_ack_is_dubious(tp, flag)) {
                 /* Advanve CWND, if state allows this. */
-                if ((flag & FLAG_DATA_ACKED) &&
-                    (tcp_vegas_enabled(tp) || prior_in_flight >= tp->snd_cwnd) &&
-                    tcp_may_raise_cwnd(tp, flag))
-                        tcp_cong_avoid(tp, ack, seq_rtt);
+                if ((flag & FLAG_DATA_ACKED) && tcp_may_raise_cwnd(tp, flag))
+                        tcp_cong_avoid(tp, ack,  seq_rtt, prior_in_flight, 0);
                 tcp_fastretrans_alert(sk, prior_snd_una, prior_packets, flag);
         } else {
-                if ((flag & FLAG_DATA_ACKED) && 
-                    (tcp_vegas_enabled(tp) || prior_in_flight >= tp->snd_cwnd))
-                        tcp_cong_avoid(tp, ack, seq_rtt);
+                if ((flag & FLAG_DATA_ACKED))
+                        tcp_cong_avoid(tp, ack, seq_rtt, prior_in_flight, 1);
         }
 
         if ((flag & FLAG_FORWARD_PROGRESS) || !(flag&FLAG_NOT_DUP))
@@ -3439,7 +2802,7 @@ static void tcp_sack_remove(struct tcp_sock *tp)
         int this_sack;
 
         /* Empty ofo queue, hence, all the SACKs are eaten. Clear. */
-        if (skb_queue_len(&tp->out_of_order_queue) == 0) {
+        if (skb_queue_empty(&tp->out_of_order_queue)) {
                 tp->rx_opt.num_sacks = 0;
                 tp->rx_opt.eff_sacks = tp->rx_opt.dsack;
                 return;
@@ -3572,13 +2935,13 @@ queue_and_out:
                 if(th->fin)
                         tcp_fin(skb, sk, th);
 
-                if (skb_queue_len(&tp->out_of_order_queue)) {
+                if (!skb_queue_empty(&tp->out_of_order_queue)) {
                         tcp_ofo_queue(sk);
 
                         /* RFC2581. 4.2. SHOULD send immediate ACK, when
                          * gap in queue is filled.
                          */
-                        if (!skb_queue_len(&tp->out_of_order_queue))
+                        if (skb_queue_empty(&tp->out_of_order_queue))
                                 tp->ack.pingpong = 0;
                 }
 
@@ -3886,9 +3249,8 @@ static int tcp_prune_queue(struct sock *sk)
          * This must not ever occur. */
 
         /* First, purge the out_of_order queue. */
-        if (skb_queue_len(&tp->out_of_order_queue)) {
-                NET_ADD_STATS_BH(LINUX_MIB_OFOPRUNED, 
-                                 skb_queue_len(&tp->out_of_order_queue));
+        if (!skb_queue_empty(&tp->out_of_order_queue)) {
+                NET_INC_STATS_BH(LINUX_MIB_OFOPRUNED);
                 __skb_queue_purge(&tp->out_of_order_queue);
 
                 /* Reset SACK state.  A conforming SACK implementation will
@@ -3937,6 +3299,28 @@ void tcp_cwnd_application_limited(struct sock *sk)
         tp->snd_cwnd_stamp = tcp_time_stamp;
 }
 
+static inline int tcp_should_expand_sndbuf(struct sock *sk, struct tcp_sock *tp)
+{
+        /* If the user specified a specific send buffer setting, do
+         * not modify it.
+         */
+        if (sk->sk_userlocks & SOCK_SNDBUF_LOCK)
+                return 0;
+
+        /* If we are under global TCP memory pressure, do not expand.  */
+        if (tcp_memory_pressure)
+                return 0;
+
+        /* If we are under soft global TCP memory pressure, do not expand.  */
+        if (atomic_read(&tcp_memory_allocated) >= sysctl_tcp_mem[0])
+                return 0;
+
+        /* If we filled the congestion window, do not expand.  */
+        if (tp->packets_out >= tp->snd_cwnd)
+                return 0;
+
+        return 1;
+}
 
 /* When incoming ACK allowed to free some skb from write_queue,
  * we remember this event in flag SOCK_QUEUE_SHRUNK and wake up socket
@@ -3948,11 +3332,8 @@ static void tcp_new_space(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
-        if (tp->packets_out < tp->snd_cwnd &&
-            !(sk->sk_userlocks & SOCK_SNDBUF_LOCK) &&
-            !tcp_memory_pressure &&
-            atomic_read(&tcp_memory_allocated) < sysctl_tcp_mem[0]) {
-                int sndmem = max_t(u32, tp->rx_opt.mss_clamp, tp->mss_cache_std) +
+        if (tcp_should_expand_sndbuf(sk, tp)) {
+                int sndmem = max_t(u32, tp->rx_opt.mss_clamp, tp->mss_cache) +
                         MAX_TCP_HEADER + 16 + sizeof(struct sk_buff),
                     demanded = max_t(unsigned int, tp->snd_cwnd,
                                                    tp->reordering + 1);
@@ -3975,22 +3356,9 @@ static inline void tcp_check_space(struct sock *sk)
         }
 }
 
-static void __tcp_data_snd_check(struct sock *sk, struct sk_buff *skb)
+static __inline__ void tcp_data_snd_check(struct sock *sk, struct tcp_sock *tp)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        if (after(TCP_SKB_CB(skb)->end_seq, tp->snd_una + tp->snd_wnd) ||
-            tcp_packets_in_flight(tp) >= tp->snd_cwnd ||
-            tcp_write_xmit(sk, tp->nonagle))
-                tcp_check_probe_timer(sk, tp);
-}
-
-static __inline__ void tcp_data_snd_check(struct sock *sk)
-{
-        struct sk_buff *skb = sk->sk_send_head;
-
-        if (skb != NULL)
-                __tcp_data_snd_check(sk, skb);
+        tcp_push_pending_frames(sk, tp);
         tcp_check_space(sk);
 }
 
@@ -4284,7 +3652,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                                  */
                                 tcp_ack(sk, skb, 0);
                                 __kfree_skb(skb); 
-                                tcp_data_snd_check(sk);
+                                tcp_data_snd_check(sk, tp);
                                 return 0;
                         } else { /* Header too small */
                                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
@@ -4350,7 +3718,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                         if (TCP_SKB_CB(skb)->ack_seq != tp->snd_una) {
                                 /* Well, only one small jumplet in fast path... */
                                 tcp_ack(sk, skb, FLAG_DATA);
-                                tcp_data_snd_check(sk);
+                                tcp_data_snd_check(sk, tp);
                                 if (!tcp_ack_scheduled(tp))
                                         goto no_ack;
                         }
@@ -4428,7 +3796,7 @@ step5:
         /* step 7: process the segment text */
         tcp_data_queue(sk, skb);
 
-        tcp_data_snd_check(sk);
+        tcp_data_snd_check(sk, tp);
         tcp_ack_snd_check(sk);
         return 0;
 
@@ -4552,6 +3920,8 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
 
                 tcp_init_metrics(sk);
 
+                tcp_init_congestion_control(tp);
+
                 /* Prevent spurious tcp_cwnd_restart() on first data
                  * packet.
                  */
@@ -4708,9 +4078,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                         if(tp->af_specific->conn_request(sk, skb) < 0)
                                 return 1;
 
-                        init_westwood(sk);
-                        init_bictcp(tp);
-
                         /* Now we have several options: In theory there is 
                          * nothing else in the frame. KA9Q has an option to 
                          * send data with the syn, BSD accepts data with the
@@ -4732,9 +4099,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 goto discard;
 
         case TCP_SYN_SENT:
-                init_westwood(sk);
-                init_bictcp(tp);
-
                 queued = tcp_rcv_synsent_state_process(sk, skb, th, len);
                 if (queued >= 0)
                         return queued;
@@ -4742,7 +4106,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 /* Do step6 onward by hand. */
                 tcp_urg(sk, skb, th);
                 __kfree_skb(skb);
-                tcp_data_snd_check(sk);
+                tcp_data_snd_check(sk, tp);
                 return 0;
         }
 
@@ -4816,7 +4180,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                                  */
                                 if (tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr &&
                                     !tp->srtt)
-                                        tcp_ack_saw_tstamp(tp, 0);
+                                        tcp_ack_saw_tstamp(tp, 0, 0);
 
                                 if (tp->rx_opt.tstamp_ok)
                                         tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
@@ -4828,6 +4192,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 
                                 tcp_init_metrics(sk);
 
+                                tcp_init_congestion_control(tp);
+
                                 /* Prevent spurious tcp_cwnd_restart() on
                                  * first data packet.
                                  */
@@ -4931,7 +4297,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 
         /* tcp_data could move socket to TIME-WAIT */
         if (sk->sk_state != TCP_CLOSE) {
-                tcp_data_snd_check(sk);
+                tcp_data_snd_check(sk, tp);
                 tcp_ack_snd_check(sk);
         }
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index dad98e4a5043..5d91213d34c0 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -36,7 +36,7 @@
  *                                      ACK bit.
  *              Andi Kleen :            Implemented fast path mtu discovery.
  *                                      Fixed many serious bugs in the
- *                                      open_request handling and moved
+ *                                      request_sock handling and moved
  *                                      most of it into the af independent code.
  *                                      Added tail drop and some other bugfixes.
  *                                      Added new listen sematics.
@@ -869,21 +869,23 @@ static __inline__ u32 tcp_v4_synq_hash(u32 raddr, u16 rport, u32 rnd)
         return (jhash_2words(raddr, (u32) rport, rnd) & (TCP_SYNQ_HSIZE - 1));
 }
 
-static struct open_request *tcp_v4_search_req(struct tcp_sock *tp,
-                                              struct open_request ***prevp,
+static struct request_sock *tcp_v4_search_req(struct tcp_sock *tp,
+                                              struct request_sock ***prevp,
                                               __u16 rport,
                                               __u32 raddr, __u32 laddr)
 {
-        struct tcp_listen_opt *lopt = tp->listen_opt;
-        struct open_request *req, **prev;
+        struct listen_sock *lopt = tp->accept_queue.listen_opt;
+        struct request_sock *req, **prev;
 
         for (prev = &lopt->syn_table[tcp_v4_synq_hash(raddr, rport, lopt->hash_rnd)];
              (req = *prev) != NULL;
              prev = &req->dl_next) {
-                if (req->rmt_port == rport &&
-                    req->af.v4_req.rmt_addr == raddr &&
-                    req->af.v4_req.loc_addr == laddr &&
-                    TCP_INET_FAMILY(req->class->family)) {
+                const struct inet_request_sock *ireq = inet_rsk(req);
+
+                if (ireq->rmt_port == rport &&
+                    ireq->rmt_addr == raddr &&
+                    ireq->loc_addr == laddr &&
+                    TCP_INET_FAMILY(req->rsk_ops->family)) {
                         BUG_TRAP(!req->sk);
                         *prevp = prev;
                         break;
@@ -893,21 +895,13 @@ static struct open_request *tcp_v4_search_req(struct tcp_sock *tp,
         return req;
 }
 
-static void tcp_v4_synq_add(struct sock *sk, struct open_request *req)
+static void tcp_v4_synq_add(struct sock *sk, struct request_sock *req)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct tcp_listen_opt *lopt = tp->listen_opt;
-        u32 h = tcp_v4_synq_hash(req->af.v4_req.rmt_addr, req->rmt_port, lopt->hash_rnd);
-
-        req->expires = jiffies + TCP_TIMEOUT_INIT;
-        req->retrans = 0;
-        req->sk = NULL;
-        req->dl_next = lopt->syn_table[h];
-
-        write_lock(&tp->syn_wait_lock);
-        lopt->syn_table[h] = req;
-        write_unlock(&tp->syn_wait_lock);
+        struct listen_sock *lopt = tp->accept_queue.listen_opt;
+        u32 h = tcp_v4_synq_hash(inet_rsk(req)->rmt_addr, inet_rsk(req)->rmt_port, lopt->hash_rnd);
 
+        reqsk_queue_hash_req(&tp->accept_queue, h, req, TCP_TIMEOUT_INIT);
         tcp_synq_added(sk);
 }
 
@@ -1050,7 +1044,7 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
         }
 
         switch (sk->sk_state) {
-                struct open_request *req, **prev;
+                struct request_sock *req, **prev;
         case TCP_LISTEN:
                 if (sock_owned_by_user(sk))
                         goto out;
@@ -1065,7 +1059,7 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
                  */
                 BUG_TRAP(!req->sk);
 
-                if (seq != req->snt_isn) {
+                if (seq != tcp_rsk(req)->snt_isn) {
                         NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
                         goto out;
                 }
@@ -1254,28 +1248,29 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
         tcp_tw_put(tw);
 }
 
-static void tcp_v4_or_send_ack(struct sk_buff *skb, struct open_request *req)
+static void tcp_v4_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
 {
-        tcp_v4_send_ack(skb, req->snt_isn + 1, req->rcv_isn + 1, req->rcv_wnd,
+        tcp_v4_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd,
                         req->ts_recent);
 }
 
 static struct dst_entry* tcp_v4_route_req(struct sock *sk,
-                                          struct open_request *req)
+                                          struct request_sock *req)
 {
         struct rtable *rt;
-        struct ip_options *opt = req->af.v4_req.opt;
+        const struct inet_request_sock *ireq = inet_rsk(req);
+        struct ip_options *opt = inet_rsk(req)->opt;
         struct flowi fl = { .oif = sk->sk_bound_dev_if,
                             .nl_u = { .ip4_u =
                                       { .daddr = ((opt && opt->srr) ?
                                                   opt->faddr :
-                                                  req->af.v4_req.rmt_addr),
-                                        .saddr = req->af.v4_req.loc_addr,
+                                                  ireq->rmt_addr),
+                                        .saddr = ireq->loc_addr,
                                         .tos = RT_CONN_FLAGS(sk) } },
                             .proto = IPPROTO_TCP,
                             .uli_u = { .ports =
                                        { .sport = inet_sk(sk)->sport,
-                                         .dport = req->rmt_port } } };
+                                         .dport = ireq->rmt_port } } };
 
         if (ip_route_output_flow(&rt, &fl, sk, 0)) {
                 IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
@@ -1291,12 +1286,13 @@ static struct dst_entry* tcp_v4_route_req(struct sock *sk,
 
 /*
  *      Send a SYN-ACK after having received an ACK.
- *      This still operates on a open_request only, not on a big
+ *      This still operates on a request_sock only, not on a big
  *      socket.
  */
-static int tcp_v4_send_synack(struct sock *sk, struct open_request *req,
+static int tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
                               struct dst_entry *dst)
 {
+        const struct inet_request_sock *ireq = inet_rsk(req);
         int err = -1;
         struct sk_buff * skb;
 
@@ -1310,14 +1306,14 @@ static int tcp_v4_send_synack(struct sock *sk, struct open_request *req,
                 struct tcphdr *th = skb->h.th;
 
                 th->check = tcp_v4_check(th, skb->len,
-                                         req->af.v4_req.loc_addr,
-                                         req->af.v4_req.rmt_addr,
+                                         ireq->loc_addr,
+                                         ireq->rmt_addr,
                                          csum_partial((char *)th, skb->len,
                                                       skb->csum));
 
-                err = ip_build_and_send_pkt(skb, sk, req->af.v4_req.loc_addr,
-                                            req->af.v4_req.rmt_addr,
-                                            req->af.v4_req.opt);
+                err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
+                                            ireq->rmt_addr,
+                                            ireq->opt);
                 if (err == NET_XMIT_CN)
                         err = 0;
         }
@@ -1328,12 +1324,12 @@ out:
 }
 
 /*
- *      IPv4 open_request destructor.
+ *      IPv4 request_sock destructor.
  */
-static void tcp_v4_or_free(struct open_request *req)
+static void tcp_v4_reqsk_destructor(struct request_sock *req)
 {
-        if (req->af.v4_req.opt)
-                kfree(req->af.v4_req.opt);
+        if (inet_rsk(req)->opt)
+                kfree(inet_rsk(req)->opt);
 }
 
 static inline void syn_flood_warning(struct sk_buff *skb)
@@ -1349,7 +1345,7 @@ static inline void syn_flood_warning(struct sk_buff *skb)
 }
 
 /*
- * Save and compile IPv4 options into the open_request if needed.
+ * Save and compile IPv4 options into the request_sock if needed.
  */
 static inline struct ip_options *tcp_v4_save_options(struct sock *sk,
                                                      struct sk_buff *skb)
@@ -1370,33 +1366,20 @@ static inline struct ip_options *tcp_v4_save_options(struct sock *sk,
         return dopt;
 }
 
-/*
- * Maximum number of SYN_RECV sockets in queue per LISTEN socket.
- * One SYN_RECV socket costs about 80bytes on a 32bit machine.
- * It would be better to replace it with a global counter for all sockets
- * but then some measure against one socket starving all other sockets
- * would be needed.
- *
- * It was 128 by default. Experiments with real servers show, that
- * it is absolutely not enough even at 100conn/sec. 256 cures most
- * of problems. This value is adjusted to 128 for very small machines
- * (<=32Mb of memory) and to 1024 on normal or better ones (>=256Mb).
- * Further increasing requires to change hash table size.
- */
-int sysctl_max_syn_backlog = 256;
-
-struct or_calltable or_ipv4 = {
+struct request_sock_ops tcp_request_sock_ops = {
         .family         =       PF_INET,
+        .obj_size       =       sizeof(struct tcp_request_sock),
         .rtx_syn_ack    =       tcp_v4_send_synack,
-        .send_ack       =       tcp_v4_or_send_ack,
-        .destructor     =       tcp_v4_or_free,
+        .send_ack       =       tcp_v4_reqsk_send_ack,
+        .destructor     =       tcp_v4_reqsk_destructor,
         .send_reset     =       tcp_v4_send_reset,
 };
 
 int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 {
+        struct inet_request_sock *ireq;
         struct tcp_options_received tmp_opt;
-        struct open_request *req;
+        struct request_sock *req;
         __u32 saddr = skb->nh.iph->saddr;
         __u32 daddr = skb->nh.iph->daddr;
         __u32 isn = TCP_SKB_CB(skb)->when;
@@ -1433,7 +1416,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         if (sk_acceptq_is_full(sk) && tcp_synq_young(sk) > 1)
                 goto drop;
 
-        req = tcp_openreq_alloc();
+        req = reqsk_alloc(&tcp_request_sock_ops);
         if (!req)
                 goto drop;
 
@@ -1461,10 +1444,10 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 
         tcp_openreq_init(req, &tmp_opt, skb);
 
-        req->af.v4_req.loc_addr = daddr;
-        req->af.v4_req.rmt_addr = saddr;
-        req->af.v4_req.opt = tcp_v4_save_options(sk, skb);
-        req->class = &or_ipv4;
+        ireq = inet_rsk(req);
+        ireq->loc_addr = daddr;
+        ireq->rmt_addr = saddr;
+        ireq->opt = tcp_v4_save_options(sk, skb);
         if (!want_cookie)
                 TCP_ECN_create_request(req, skb->h.th);
 
@@ -1511,32 +1494,31 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                          * to destinations, already remembered
                          * to the moment of synflood.
                          */
-                        NETDEBUG(if (net_ratelimit()) \
-                                        printk(KERN_DEBUG "TCP: drop open "
-                                                          "request from %u.%u."
-                                                          "%u.%u/%u\n", \
-                                               NIPQUAD(saddr),
-                                               ntohs(skb->h.th->source)));
+                        LIMIT_NETDEBUG(printk(KERN_DEBUG "TCP: drop open "
+                                              "request from %u.%u."
+                                              "%u.%u/%u\n",
+                                              NIPQUAD(saddr),
+                                              ntohs(skb->h.th->source)));
                         dst_release(dst);
                         goto drop_and_free;
                 }
 
                 isn = tcp_v4_init_sequence(sk, skb);
         }
-        req->snt_isn = isn;
+        tcp_rsk(req)->snt_isn = isn;
 
         if (tcp_v4_send_synack(sk, req, dst))
                 goto drop_and_free;
 
         if (want_cookie) {
-                tcp_openreq_free(req);
+                reqsk_free(req);
         } else {
                 tcp_v4_synq_add(sk, req);
         }
         return 0;
 
 drop_and_free:
-        tcp_openreq_free(req);
+        reqsk_free(req);
 drop:
         TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
         return 0;
@@ -1548,9 +1530,10 @@ drop:
  * now create the new socket.
  */
 struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
-                                  struct open_request *req,
+                                  struct request_sock *req,
                                   struct dst_entry *dst)
 {
+        struct inet_request_sock *ireq;
         struct inet_sock *newinet;
         struct tcp_sock *newtp;
         struct sock *newsk;
@@ -1570,11 +1553,12 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
         newtp                 = tcp_sk(newsk);
         newinet               = inet_sk(newsk);
-        newinet->daddr        = req->af.v4_req.rmt_addr;
-        newinet->rcv_saddr    = req->af.v4_req.loc_addr;
-        newinet->saddr        = req->af.v4_req.loc_addr;
-        newinet->opt          = req->af.v4_req.opt;
-        req->af.v4_req.opt    = NULL;
+        ireq                  = inet_rsk(req);
+        newinet->daddr        = ireq->rmt_addr;
+        newinet->rcv_saddr    = ireq->loc_addr;
+        newinet->saddr        = ireq->loc_addr;
+        newinet->opt          = ireq->opt;
+        ireq->opt             = NULL;
         newinet->mc_index     = tcp_v4_iif(skb);
         newinet->mc_ttl       = skb->nh.iph->ttl;
         newtp->ext_header_len = 0;
@@ -1605,9 +1589,9 @@ static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
         struct iphdr *iph = skb->nh.iph;
         struct tcp_sock *tp = tcp_sk(sk);
         struct sock *nsk;
-        struct open_request **prev;
+        struct request_sock **prev;
         /* Find possible connection requests. */
-        struct open_request *req = tcp_v4_search_req(tp, &prev, th->source,
+        struct request_sock *req = tcp_v4_search_req(tp, &prev, th->source,
                                                      iph->saddr, iph->daddr);
         if (req)
                 return tcp_check_req(sk, skb, req, prev);
@@ -1642,8 +1626,7 @@ static int tcp_v4_checksum_init(struct sk_buff *skb)
                                   skb->nh.iph->daddr, skb->csum))
                         return 0;
 
-                NETDEBUG(if (net_ratelimit())
-                                printk(KERN_DEBUG "hw tcp v4 csum failed\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "hw tcp v4 csum failed\n"));
                 skb->ip_summed = CHECKSUM_NONE;
         }
         if (skb->len <= 76) {
@@ -2060,9 +2043,10 @@ static int tcp_v4_init_sock(struct sock *sk)
          */
         tp->snd_ssthresh = 0x7fffffff;  /* Infinity */
         tp->snd_cwnd_clamp = ~0;
-        tp->mss_cache_std = tp->mss_cache = 536;
+        tp->mss_cache = 536;
 
         tp->reordering = sysctl_tcp_reordering;
+        tp->ca_ops = &tcp_init_congestion_ops;
 
         sk->sk_state = TCP_CLOSE;
 
@@ -2085,6 +2069,8 @@ int tcp_v4_destroy_sock(struct sock *sk)
 
         tcp_clear_xmit_timers(sk);
 
+        tcp_cleanup_congestion_control(tp);
+
         /* Cleanup up the write buffer. */
         sk_stream_writequeue_purge(sk);
 
@@ -2144,13 +2130,13 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
         ++st->num;
 
         if (st->state == TCP_SEQ_STATE_OPENREQ) {
-                struct open_request *req = cur;
+                struct request_sock *req = cur;
 
                 tp = tcp_sk(st->syn_wait_sk);
                 req = req->dl_next;
                 while (1) {
                         while (req) {
-                                if (req->class->family == st->family) {
+                                if (req->rsk_ops->family == st->family) {
                                         cur = req;
                                         goto out;
                                 }
@@ -2159,17 +2145,17 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
                         if (++st->sbucket >= TCP_SYNQ_HSIZE)
                                 break;
 get_req:
-                        req = tp->listen_opt->syn_table[st->sbucket];
+                        req = tp->accept_queue.listen_opt->syn_table[st->sbucket];
                 }
                 sk        = sk_next(st->syn_wait_sk);
                 st->state = TCP_SEQ_STATE_LISTENING;
-                read_unlock_bh(&tp->syn_wait_lock);
+                read_unlock_bh(&tp->accept_queue.syn_wait_lock);
         } else {
                 tp = tcp_sk(sk);
-                read_lock_bh(&tp->syn_wait_lock);
-                if (tp->listen_opt && tp->listen_opt->qlen)
+                read_lock_bh(&tp->accept_queue.syn_wait_lock);
+                if (reqsk_queue_len(&tp->accept_queue))
                         goto start_req;
-                read_unlock_bh(&tp->syn_wait_lock);
+                read_unlock_bh(&tp->accept_queue.syn_wait_lock);
                 sk = sk_next(sk);
         }
 get_sk:
@@ -2179,8 +2165,8 @@ get_sk:
                         goto out;
                 }
                 tp = tcp_sk(sk);
-                read_lock_bh(&tp->syn_wait_lock);
-                if (tp->listen_opt && tp->listen_opt->qlen) {
+                read_lock_bh(&tp->accept_queue.syn_wait_lock);
+                if (reqsk_queue_len(&tp->accept_queue)) {
 start_req:
                         st->uid         = sock_i_uid(sk);
                         st->syn_wait_sk = sk;
@@ -2188,7 +2174,7 @@ start_req:
                         st->sbucket     = 0;
                         goto get_req;
                 }
-                read_unlock_bh(&tp->syn_wait_lock);
+                read_unlock_bh(&tp->accept_queue.syn_wait_lock);
         }
         if (++st->bucket < TCP_LHTABLE_SIZE) {
                 sk = sk_head(&tcp_listening_hash[st->bucket]);
@@ -2375,7 +2361,7 @@ static void tcp_seq_stop(struct seq_file *seq, void *v)
         case TCP_SEQ_STATE_OPENREQ:
                 if (v) {
                         struct tcp_sock *tp = tcp_sk(st->syn_wait_sk);
-                        read_unlock_bh(&tp->syn_wait_lock);
+                        read_unlock_bh(&tp->accept_queue.syn_wait_lock);
                 }
         case TCP_SEQ_STATE_LISTENING:
                 if (v != SEQ_START_TOKEN)
@@ -2451,18 +2437,19 @@ void tcp_proc_unregister(struct tcp_seq_afinfo *afinfo)
         memset(afinfo->seq_fops, 0, sizeof(*afinfo->seq_fops)); 
 }
 
-static void get_openreq4(struct sock *sk, struct open_request *req,
+static void get_openreq4(struct sock *sk, struct request_sock *req,
                          char *tmpbuf, int i, int uid)
 {
+        const struct inet_request_sock *ireq = inet_rsk(req);
         int ttd = req->expires - jiffies;
 
         sprintf(tmpbuf, "%4d: %08X:%04X %08X:%04X"
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %p",
                 i,
-                req->af.v4_req.loc_addr,
+                ireq->loc_addr,
                 ntohs(inet_sk(sk)->sport),
-                req->af.v4_req.rmt_addr,
-                ntohs(req->rmt_port),
+                ireq->rmt_addr,
+                ntohs(ireq->rmt_port),
                 TCP_SYN_RECV,
                 0, 0, /* could print option size, but that is af dependent. */
                 1,    /* timers active (only the expire timer) */
@@ -2618,6 +2605,7 @@ struct proto tcp_prot = {
         .sysctl_rmem            = sysctl_tcp_rmem,
         .max_header             = MAX_TCP_HEADER,
         .obj_size               = sizeof(struct tcp_sock),
+        .rsk_prot               = &tcp_request_sock_ops,
 };
 
 
@@ -2660,7 +2648,6 @@ EXPORT_SYMBOL(tcp_proc_register);
 EXPORT_SYMBOL(tcp_proc_unregister);
 #endif
 EXPORT_SYMBOL(sysctl_local_port_range);
-EXPORT_SYMBOL(sysctl_max_syn_backlog);
 EXPORT_SYMBOL(sysctl_tcp_low_latency);
 EXPORT_SYMBOL(sysctl_tcp_tw_reuse);
 
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index eea1a17a9ac2..f42a284164b7 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -684,7 +684,7 @@ out:
  * Actually, we could lots of memory writes here. tp of listening
  * socket contains all necessary default parameters.
  */
-struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req, struct sk_buff *skb)
+struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req, struct sk_buff *skb)
 {
         /* allocate the newsk from the same slab of the master sock,
          * if not, at sk_free time we'll try to free it from the wrong
@@ -692,6 +692,8 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req,
         struct sock *newsk = sk_alloc(PF_INET, GFP_ATOMIC, sk->sk_prot, 0);
 
         if(newsk != NULL) {
+                struct inet_request_sock *ireq = inet_rsk(req);
+                struct tcp_request_sock *treq = tcp_rsk(req);
                 struct tcp_sock *newtp;
                 struct sk_filter *filter;
 
@@ -703,7 +705,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req,
                 tcp_sk(newsk)->bind_hash = NULL;
 
                 /* Clone the TCP header template */
-                inet_sk(newsk)->dport = req->rmt_port;
+                inet_sk(newsk)->dport = ireq->rmt_port;
 
                 sock_lock_init(newsk);
                 bh_lock_sock(newsk);
@@ -739,14 +741,14 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req,
                 /* Now setup tcp_sock */
                 newtp = tcp_sk(newsk);
                 newtp->pred_flags = 0;
-                newtp->rcv_nxt = req->rcv_isn + 1;
-                newtp->snd_nxt = req->snt_isn + 1;
-                newtp->snd_una = req->snt_isn + 1;
-                newtp->snd_sml = req->snt_isn + 1;
+                newtp->rcv_nxt = treq->rcv_isn + 1;
+                newtp->snd_nxt = treq->snt_isn + 1;
+                newtp->snd_una = treq->snt_isn + 1;
+                newtp->snd_sml = treq->snt_isn + 1;
 
                 tcp_prequeue_init(newtp);
 
-                tcp_init_wl(newtp, req->snt_isn, req->rcv_isn);
+                tcp_init_wl(newtp, treq->snt_isn, treq->rcv_isn);
 
                 newtp->retransmits = 0;
                 newtp->backoff = 0;
@@ -772,13 +774,15 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req,
                 newtp->frto_counter = 0;
                 newtp->frto_highmark = 0;
 
+                newtp->ca_ops = &tcp_reno;
+
                 tcp_set_ca_state(newtp, TCP_CA_Open);
                 tcp_init_xmit_timers(newsk);
                 skb_queue_head_init(&newtp->out_of_order_queue);
-                newtp->rcv_wup = req->rcv_isn + 1;
-                newtp->write_seq = req->snt_isn + 1;
+                newtp->rcv_wup = treq->rcv_isn + 1;
+                newtp->write_seq = treq->snt_isn + 1;
                 newtp->pushed_seq = newtp->write_seq;
-                newtp->copied_seq = req->rcv_isn + 1;
+                newtp->copied_seq = treq->rcv_isn + 1;
 
                 newtp->rx_opt.saw_tstamp = 0;
 
@@ -788,10 +792,8 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req,
                 newtp->probes_out = 0;
                 newtp->rx_opt.num_sacks = 0;
                 newtp->urg_data = 0;
-                newtp->listen_opt = NULL;
-                newtp->accept_queue = newtp->accept_queue_tail = NULL;
-                /* Deinitialize syn_wait_lock to trap illegal accesses. */
-                memset(&newtp->syn_wait_lock, 0, sizeof(newtp->syn_wait_lock));
+                /* Deinitialize accept_queue to trap illegal accesses. */
+                memset(&newtp->accept_queue, 0, sizeof(newtp->accept_queue));
 
                 /* Back to base struct sock members. */
                 newsk->sk_err = 0;
@@ -808,18 +810,18 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req,
                 newsk->sk_socket = NULL;
                 newsk->sk_sleep = NULL;
 
-                newtp->rx_opt.tstamp_ok = req->tstamp_ok;
-                if((newtp->rx_opt.sack_ok = req->sack_ok) != 0) {
+                newtp->rx_opt.tstamp_ok = ireq->tstamp_ok;
+                if((newtp->rx_opt.sack_ok = ireq->sack_ok) != 0) {
                         if (sysctl_tcp_fack)
                                 newtp->rx_opt.sack_ok |= 2;
                 }
                 newtp->window_clamp = req->window_clamp;
                 newtp->rcv_ssthresh = req->rcv_wnd;
                 newtp->rcv_wnd = req->rcv_wnd;
-                newtp->rx_opt.wscale_ok = req->wscale_ok;
+                newtp->rx_opt.wscale_ok = ireq->wscale_ok;
                 if (newtp->rx_opt.wscale_ok) {
-                        newtp->rx_opt.snd_wscale = req->snd_wscale;
-                        newtp->rx_opt.rcv_wscale = req->rcv_wscale;
+                        newtp->rx_opt.snd_wscale = ireq->snd_wscale;
+                        newtp->rx_opt.rcv_wscale = ireq->rcv_wscale;
                 } else {
                         newtp->rx_opt.snd_wscale = newtp->rx_opt.rcv_wscale = 0;
                         newtp->window_clamp = min(newtp->window_clamp, 65535U);
@@ -842,8 +844,6 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req,
                 if (newtp->ecn_flags&TCP_ECN_OK)
                         sock_set_flag(newsk, SOCK_NO_LARGESEND);
 
-                tcp_ca_init(newtp);
-
                 TCP_INC_STATS_BH(TCP_MIB_PASSIVEOPENS);
         }
         return newsk;
@@ -851,12 +851,12 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct open_request *req,
 
 /* 
  *      Process an incoming packet for SYN_RECV sockets represented
- *      as an open_request.
+ *      as a request_sock.
  */
 
 struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
-                           struct open_request *req,
-                           struct open_request **prev)
+                           struct request_sock *req,
+                           struct request_sock **prev)
 {
         struct tcphdr *th = skb->h.th;
         struct tcp_sock *tp = tcp_sk(sk);
@@ -881,7 +881,7 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
         }
 
         /* Check for pure retransmitted SYN. */
-        if (TCP_SKB_CB(skb)->seq == req->rcv_isn &&
+        if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn &&
             flg == TCP_FLAG_SYN &&
             !paws_reject) {
                 /*
@@ -901,7 +901,7 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
                  * Enforce "SYN-ACK" according to figure 8, figure 6
                  * of RFC793, fixed by RFC1122.
                  */
-                req->class->rtx_syn_ack(sk, req, NULL);
+                req->rsk_ops->rtx_syn_ack(sk, req, NULL);
                 return NULL;
         }
 
@@ -959,7 +959,7 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
          * Invalid ACK: reset will be sent by listening socket
          */
         if ((flg & TCP_FLAG_ACK) &&
-            (TCP_SKB_CB(skb)->ack_seq != req->snt_isn+1))
+            (TCP_SKB_CB(skb)->ack_seq != tcp_rsk(req)->snt_isn + 1))
                 return sk;
 
         /* Also, it would be not so bad idea to check rcv_tsecr, which
@@ -970,10 +970,10 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
         /* RFC793: "first check sequence number". */
 
         if (paws_reject || !tcp_in_window(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
-                                          req->rcv_isn+1, req->rcv_isn+1+req->rcv_wnd)) {
+                                          tcp_rsk(req)->rcv_isn + 1, tcp_rsk(req)->rcv_isn + 1 + req->rcv_wnd)) {
                 /* Out of window: send ACK and drop. */
                 if (!(flg & TCP_FLAG_RST))
-                        req->class->send_ack(skb, req);
+                        req->rsk_ops->send_ack(skb, req);
                 if (paws_reject)
                         NET_INC_STATS_BH(LINUX_MIB_PAWSESTABREJECTED);
                 return NULL;
@@ -981,12 +981,12 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
 
         /* In sequence, PAWS is OK. */
 
-        if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, req->rcv_isn+1))
+        if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_isn + 1))
                         req->ts_recent = tmp_opt.rcv_tsval;
 
-                if (TCP_SKB_CB(skb)->seq == req->rcv_isn) {
+                if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) {
                         /* Truncate SYN, it is out of window starting
-                           at req->rcv_isn+1. */
+                           at tcp_rsk(req)->rcv_isn + 1. */
                         flg &= ~TCP_FLAG_SYN;
                 }
 
@@ -1003,8 +1003,8 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
                         return NULL;
 
                 /* If TCP_DEFER_ACCEPT is set, drop bare ACK. */
-                if (tp->defer_accept && TCP_SKB_CB(skb)->end_seq == req->rcv_isn+1) {
-                        req->acked = 1;
+                if (tp->defer_accept && TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
+                        inet_rsk(req)->acked = 1;
                         return NULL;
                 }
 
@@ -1026,14 +1026,14 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
 
         listen_overflow:
                 if (!sysctl_tcp_abort_on_overflow) {
-                        req->acked = 1;
+                        inet_rsk(req)->acked = 1;
                         return NULL;
                 }
 
         embryonic_reset:
                 NET_INC_STATS_BH(LINUX_MIB_EMBRYONICRSTS);
                 if (!(flg & TCP_FLAG_RST))
-                        req->class->send_reset(skb);
+                        req->rsk_ops->send_reset(skb);
 
                 tcp_synq_drop(sk, req, prev);
                 return NULL;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index fa24e7ae1f40..566045e58437 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -49,7 +49,7 @@ int sysctl_tcp_retrans_collapse = 1;
  * will allow a single TSO frame to consume.  Building TSO frames
  * which are too large can cause TCP streams to be bursty.
  */
-int sysctl_tcp_tso_win_divisor = 8;
+int sysctl_tcp_tso_win_divisor = 3;
 
 static inline void update_send_head(struct sock *sk, struct tcp_sock *tp,
                                     struct sk_buff *skb)
@@ -111,8 +111,7 @@ static void tcp_cwnd_restart(struct tcp_sock *tp, struct dst_entry *dst)
         u32 restart_cwnd = tcp_init_cwnd(tp, dst);
         u32 cwnd = tp->snd_cwnd;
 
-        if (tcp_is_vegas(tp)) 
-                tcp_vegas_enable(tp);
+        tcp_ca_event(tp, CA_EVENT_CWND_RESTART);
 
         tp->snd_ssthresh = tcp_current_ssthresh(tp);
         restart_cwnd = min(restart_cwnd, cwnd);
@@ -141,11 +140,11 @@ static inline void tcp_event_data_sent(struct tcp_sock *tp,
                 tp->ack.pingpong = 1;
 }
 
-static __inline__ void tcp_event_ack_sent(struct sock *sk)
+static __inline__ void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
-        tcp_dec_quickack_mode(tp);
+        tcp_dec_quickack_mode(tp, pkts);
         tcp_clear_xmit_timer(sk, TCP_TIME_DACK);
 }
 
@@ -280,6 +279,10 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb)
 #define SYSCTL_FLAG_WSCALE      0x2
 #define SYSCTL_FLAG_SACK        0x4
 
+                /* If congestion control is doing timestamping */
+                if (tp->ca_ops->rtt_sample)
+                        do_gettimeofday(&skb->stamp);
+
                 sysctl_flags = 0;
                 if (tcb->flags & TCPCB_FLAG_SYN) {
                         tcp_header_size = sizeof(struct tcphdr) + TCPOLEN_MSS;
@@ -304,17 +307,8 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                                             (tp->rx_opt.eff_sacks * TCPOLEN_SACK_PERBLOCK));
                 }
                 
-                /*
-                 * If the connection is idle and we are restarting,
-                 * then we don't want to do any Vegas calculations
-                 * until we get fresh RTT samples.  So when we
-                 * restart, we reset our Vegas state to a clean
-                 * slate. After we get acks for this flight of
-                 * packets, _then_ we can make Vegas calculations
-                 * again.
-                 */
-                if (tcp_is_vegas(tp) && tcp_packets_in_flight(tp) == 0)
-                        tcp_vegas_enable(tp);
+                if (tcp_packets_in_flight(tp) == 0)
+                        tcp_ca_event(tp, CA_EVENT_TX_START);
 
                 th = (struct tcphdr *) skb_push(skb, tcp_header_size);
                 skb->h.th = th;
@@ -361,7 +355,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                 tp->af_specific->send_check(sk, th, skb->len, skb);
 
                 if (tcb->flags & TCPCB_FLAG_ACK)
-                        tcp_event_ack_sent(sk);
+                        tcp_event_ack_sent(sk, tcp_skb_pcount(skb));
 
                 if (skb->len != tcp_header_size)
                         tcp_event_data_sent(tp, skb, sk);
@@ -409,42 +403,9 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
                 sk->sk_send_head = skb;
 }
 
-static inline void tcp_tso_set_push(struct sk_buff *skb)
-{
-        /* Force push to be on for any TSO frames to workaround
-         * problems with busted implementations like Mac OS-X that
-         * hold off socket receive wakeups until push is seen.
-         */
-        if (tcp_skb_pcount(skb) > 1)
-                TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_PSH;
-}
-
-/* Send _single_ skb sitting at the send head. This function requires
- * true push pending frames to setup probe timer etc.
- */
-void tcp_push_one(struct sock *sk, unsigned cur_mss)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-        struct sk_buff *skb = sk->sk_send_head;
-
-        if (tcp_snd_test(sk, skb, cur_mss, TCP_NAGLE_PUSH)) {
-                /* Send it out now. */
-                TCP_SKB_CB(skb)->when = tcp_time_stamp;
-                tcp_tso_set_push(skb);
-                if (!tcp_transmit_skb(sk, skb_clone(skb, sk->sk_allocation))) {
-                        sk->sk_send_head = NULL;
-                        tp->snd_nxt = TCP_SKB_CB(skb)->end_seq;
-                        tcp_packets_out_inc(sk, tp, skb);
-                        return;
-                }
-        }
-}
-
-void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb)
+static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb, unsigned int mss_now)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        if (skb->len <= tp->mss_cache_std ||
+        if (skb->len <= mss_now ||
             !(sk->sk_route_caps & NETIF_F_TSO)) {
                 /* Avoid the costly divide in the normal
                  * non-TSO case.
@@ -454,10 +415,10 @@ void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb)
         } else {
                 unsigned int factor;
 
-                factor = skb->len + (tp->mss_cache_std - 1);
-                factor /= tp->mss_cache_std;
+                factor = skb->len + (mss_now - 1);
+                factor /= mss_now;
                 skb_shinfo(skb)->tso_segs = factor;
-                skb_shinfo(skb)->tso_size = tp->mss_cache_std;
+                skb_shinfo(skb)->tso_size = mss_now;
         }
 }
 
@@ -466,7 +427,7 @@ void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb)
  * packet to the list.  This won't be called frequently, I hope. 
  * Remember, these are still headerless SKBs at this point.
  */
-static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len)
+static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss_now)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *buff;
@@ -521,6 +482,7 @@ static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len)
          * skbs, which it never sent before. --ANK
          */
         TCP_SKB_CB(buff)->when = TCP_SKB_CB(skb)->when;
+        buff->stamp = skb->stamp;
 
         if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST) {
                 tp->lost_out -= tcp_skb_pcount(skb);
@@ -528,8 +490,8 @@ static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len)
         }
 
         /* Fix up tso_factor for both original and new SKB.  */
-        tcp_set_skb_tso_segs(sk, skb);
-        tcp_set_skb_tso_segs(sk, buff);
+        tcp_set_skb_tso_segs(sk, skb, mss_now);
+        tcp_set_skb_tso_segs(sk, buff, mss_now);
 
         if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST) {
                 tp->lost_out += tcp_skb_pcount(skb);
@@ -542,6 +504,7 @@ static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len)
         }
 
         /* Link BUFF into the send queue. */
+        skb_header_release(buff);
         __skb_append(skb, buff);
 
         return 0;
@@ -604,7 +567,7 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
          * factor and mss.
          */
         if (tcp_skb_pcount(skb) > 1)
-                tcp_set_skb_tso_segs(sk, skb);
+                tcp_set_skb_tso_segs(sk, skb, tcp_current_mss(sk, 1));
 
         return 0;
 }
@@ -662,7 +625,7 @@ unsigned int tcp_sync_mss(struct sock *sk, u32 pmtu)
 
         /* And store cached results */
         tp->pmtu_cookie = pmtu;
-        tp->mss_cache = tp->mss_cache_std = mss_now;
+        tp->mss_cache = mss_now;
 
         return mss_now;
 }
@@ -674,57 +637,319 @@ unsigned int tcp_sync_mss(struct sock *sk, u32 pmtu)
  * cannot be large. However, taking into account rare use of URG, this
  * is not a big flaw.
  */
-
-unsigned int tcp_current_mss(struct sock *sk, int large)
+unsigned int tcp_current_mss(struct sock *sk, int large_allowed)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct dst_entry *dst = __sk_dst_get(sk);
-        unsigned int do_large, mss_now;
+        u32 mss_now;
+        u16 xmit_size_goal;
+        int doing_tso = 0;
+
+        mss_now = tp->mss_cache;
+
+        if (large_allowed &&
+            (sk->sk_route_caps & NETIF_F_TSO) &&
+            !tp->urg_mode)
+                doing_tso = 1;
 
-        mss_now = tp->mss_cache_std;
         if (dst) {
                 u32 mtu = dst_mtu(dst);
                 if (mtu != tp->pmtu_cookie)
                         mss_now = tcp_sync_mss(sk, mtu);
         }
 
-        do_large = (large &&
-                    (sk->sk_route_caps & NETIF_F_TSO) &&
-                    !tp->urg_mode);
+        if (tp->rx_opt.eff_sacks)
+                mss_now -= (TCPOLEN_SACK_BASE_ALIGNED +
+                            (tp->rx_opt.eff_sacks * TCPOLEN_SACK_PERBLOCK));
 
-        if (do_large) {
-                unsigned int large_mss, factor, limit;
+        xmit_size_goal = mss_now;
 
-                large_mss = 65535 - tp->af_specific->net_header_len -
+        if (doing_tso) {
+                xmit_size_goal = 65535 -
+                        tp->af_specific->net_header_len -
                         tp->ext_header_len - tp->tcp_header_len;
 
-                if (tp->max_window && large_mss > (tp->max_window>>1))
-                        large_mss = max((tp->max_window>>1),
-                                        68U - tp->tcp_header_len);
+                if (tp->max_window &&
+                    (xmit_size_goal > (tp->max_window >> 1)))
+                        xmit_size_goal = max((tp->max_window >> 1),
+                                             68U - tp->tcp_header_len);
 
-                factor = large_mss / mss_now;
+                xmit_size_goal -= (xmit_size_goal % mss_now);
+        }
+        tp->xmit_size_goal = xmit_size_goal;
 
-                /* Always keep large mss multiple of real mss, but
-                 * do not exceed 1/tso_win_divisor of the congestion window
-                 * so we can keep the ACK clock ticking and minimize
-                 * bursting.
-                 */
-                limit = tp->snd_cwnd;
-                if (sysctl_tcp_tso_win_divisor)
-                        limit /= sysctl_tcp_tso_win_divisor;
-                limit = max(1U, limit);
-                if (factor > limit)
-                        factor = limit;
+        return mss_now;
+}
+
+/* Congestion window validation. (RFC2861) */
 
-                tp->mss_cache = mss_now * factor;
+static inline void tcp_cwnd_validate(struct sock *sk, struct tcp_sock *tp)
+{
+        __u32 packets_out = tp->packets_out;
+
+        if (packets_out >= tp->snd_cwnd) {
+                /* Network is feed fully. */
+                tp->snd_cwnd_used = 0;
+                tp->snd_cwnd_stamp = tcp_time_stamp;
+        } else {
+                /* Network starves. */
+                if (tp->packets_out > tp->snd_cwnd_used)
+                        tp->snd_cwnd_used = tp->packets_out;
 
-                mss_now = tp->mss_cache;
+                if ((s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= tp->rto)
+                        tcp_cwnd_application_limited(sk);
         }
+}
 
-        if (tp->rx_opt.eff_sacks)
-                mss_now -= (TCPOLEN_SACK_BASE_ALIGNED +
-                            (tp->rx_opt.eff_sacks * TCPOLEN_SACK_PERBLOCK));
-        return mss_now;
+static unsigned int tcp_window_allows(struct tcp_sock *tp, struct sk_buff *skb, unsigned int mss_now, unsigned int cwnd)
+{
+        u32 window, cwnd_len;
+
+        window = (tp->snd_una + tp->snd_wnd - TCP_SKB_CB(skb)->seq);
+        cwnd_len = mss_now * cwnd;
+        return min(window, cwnd_len);
+}
+
+/* Can at least one segment of SKB be sent right now, according to the
+ * congestion window rules?  If so, return how many segments are allowed.
+ */
+static inline unsigned int tcp_cwnd_test(struct tcp_sock *tp, struct sk_buff *skb)
+{
+        u32 in_flight, cwnd;
+
+        /* Don't be strict about the congestion window for the final FIN.  */
+        if (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN)
+                return 1;
+
+        in_flight = tcp_packets_in_flight(tp);
+        cwnd = tp->snd_cwnd;
+        if (in_flight < cwnd)
+                return (cwnd - in_flight);
+
+        return 0;
+}
+
+/* This must be invoked the first time we consider transmitting
+ * SKB onto the wire.
+ */
+static inline int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb, unsigned int mss_now)
+{
+        int tso_segs = tcp_skb_pcount(skb);
+
+        if (!tso_segs ||
+            (tso_segs > 1 &&
+             skb_shinfo(skb)->tso_size != mss_now)) {
+                tcp_set_skb_tso_segs(sk, skb, mss_now);
+                tso_segs = tcp_skb_pcount(skb);
+        }
+        return tso_segs;
+}
+
+static inline int tcp_minshall_check(const struct tcp_sock *tp)
+{
+        return after(tp->snd_sml,tp->snd_una) &&
+                !after(tp->snd_sml, tp->snd_nxt);
+}
+
+/* Return 0, if packet can be sent now without violation Nagle's rules:
+ * 1. It is full sized.
+ * 2. Or it contains FIN. (already checked by caller)
+ * 3. Or TCP_NODELAY was set.
+ * 4. Or TCP_CORK is not set, and all sent packets are ACKed.
+ *    With Minshall's modification: all sent small packets are ACKed.
+ */
+
+static inline int tcp_nagle_check(const struct tcp_sock *tp,
+                                  const struct sk_buff *skb, 
+                                  unsigned mss_now, int nonagle)
+{
+        return (skb->len < mss_now &&
+                ((nonagle&TCP_NAGLE_CORK) ||
+                 (!nonagle &&
+                  tp->packets_out &&
+                  tcp_minshall_check(tp))));
+}
+
+/* Return non-zero if the Nagle test allows this packet to be
+ * sent now.
+ */
+static inline int tcp_nagle_test(struct tcp_sock *tp, struct sk_buff *skb,
+                                 unsigned int cur_mss, int nonagle)
+{
+        /* Nagle rule does not apply to frames, which sit in the middle of the
+         * write_queue (they have no chances to get new data).
+         *
+         * This is implemented in the callers, where they modify the 'nonagle'
+         * argument based upon the location of SKB in the send queue.
+         */
+        if (nonagle & TCP_NAGLE_PUSH)
+                return 1;
+
+        /* Don't use the nagle rule for urgent data (or for the final FIN).  */
+        if (tp->urg_mode ||
+            (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN))
+                return 1;
+
+        if (!tcp_nagle_check(tp, skb, cur_mss, nonagle))
+                return 1;
+
+        return 0;
+}
+
+/* Does at least the first segment of SKB fit into the send window? */
+static inline int tcp_snd_wnd_test(struct tcp_sock *tp, struct sk_buff *skb, unsigned int cur_mss)
+{
+        u32 end_seq = TCP_SKB_CB(skb)->end_seq;
+
+        if (skb->len > cur_mss)
+                end_seq = TCP_SKB_CB(skb)->seq + cur_mss;
+
+        return !after(end_seq, tp->snd_una + tp->snd_wnd);
+}
+
+/* This checks if the data bearing packet SKB (usually sk->sk_send_head)
+ * should be put on the wire right now.  If so, it returns the number of
+ * packets allowed by the congestion window.
+ */
+static unsigned int tcp_snd_test(struct sock *sk, struct sk_buff *skb,
+                                 unsigned int cur_mss, int nonagle)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        unsigned int cwnd_quota;
+
+        tcp_init_tso_segs(sk, skb, cur_mss);
+
+        if (!tcp_nagle_test(tp, skb, cur_mss, nonagle))
+                return 0;
+
+        cwnd_quota = tcp_cwnd_test(tp, skb);
+        if (cwnd_quota &&
+            !tcp_snd_wnd_test(tp, skb, cur_mss))
+                cwnd_quota = 0;
+
+        return cwnd_quota;
+}
+
+static inline int tcp_skb_is_last(const struct sock *sk, 
+                                  const struct sk_buff *skb)
+{
+        return skb->next == (struct sk_buff *)&sk->sk_write_queue;
+}
+
+int tcp_may_send_now(struct sock *sk, struct tcp_sock *tp)
+{
+        struct sk_buff *skb = sk->sk_send_head;
+
+        return (skb &&
+                tcp_snd_test(sk, skb, tcp_current_mss(sk, 1),
+                             (tcp_skb_is_last(sk, skb) ?
+                              TCP_NAGLE_PUSH :
+                              tp->nonagle)));
+}
+
+/* Trim TSO SKB to LEN bytes, put the remaining data into a new packet
+ * which is put after SKB on the list.  It is very much like
+ * tcp_fragment() except that it may make several kinds of assumptions
+ * in order to speed up the splitting operation.  In particular, we
+ * know that all the data is in scatter-gather pages, and that the
+ * packet has never been sent out before (and thus is not cloned).
+ */
+static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len, unsigned int mss_now)
+{
+        struct sk_buff *buff;
+        int nlen = skb->len - len;
+        u16 flags;
+
+        /* All of a TSO frame must be composed of paged data.  */
+        if (skb->len != skb->data_len)
+                return tcp_fragment(sk, skb, len, mss_now);
+
+        buff = sk_stream_alloc_pskb(sk, 0, 0, GFP_ATOMIC);
+        if (unlikely(buff == NULL))
+                return -ENOMEM;
+
+        buff->truesize = nlen;
+        skb->truesize -= nlen;
+
+        /* Correct the sequence numbers. */
+        TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
+        TCP_SKB_CB(buff)->end_seq = TCP_SKB_CB(skb)->end_seq;
+        TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(buff)->seq;
+
+        /* PSH and FIN should only be set in the second packet. */
+        flags = TCP_SKB_CB(skb)->flags;
+        TCP_SKB_CB(skb)->flags = flags & ~(TCPCB_FLAG_FIN|TCPCB_FLAG_PSH);
+        TCP_SKB_CB(buff)->flags = flags;
+
+        /* This packet was never sent out yet, so no SACK bits. */
+        TCP_SKB_CB(buff)->sacked = 0;
+
+        buff->ip_summed = skb->ip_summed = CHECKSUM_HW;
+        skb_split(skb, buff, len);
+
+        /* Fix up tso_factor for both original and new SKB.  */
+        tcp_set_skb_tso_segs(sk, skb, mss_now);
+        tcp_set_skb_tso_segs(sk, buff, mss_now);
+
+        /* Link BUFF into the send queue. */
+        skb_header_release(buff);
+        __skb_append(skb, buff);
+
+        return 0;
+}
+
+/* Try to defer sending, if possible, in order to minimize the amount
+ * of TSO splitting we do.  View it as a kind of TSO Nagle test.
+ *
+ * This algorithm is from John Heffner.
+ */
+static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_buff *skb)
+{
+        u32 send_win, cong_win, limit, in_flight;
+
+        if (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN)
+                return 0;
+
+        if (tp->ca_state != TCP_CA_Open)
+                return 0;
+
+        in_flight = tcp_packets_in_flight(tp);
+
+        BUG_ON(tcp_skb_pcount(skb) <= 1 ||
+               (tp->snd_cwnd <= in_flight));
+
+        send_win = (tp->snd_una + tp->snd_wnd) - TCP_SKB_CB(skb)->seq;
+
+        /* From in_flight test above, we know that cwnd > in_flight.  */
+        cong_win = (tp->snd_cwnd - in_flight) * tp->mss_cache;
+
+        limit = min(send_win, cong_win);
+
+        /* If sk_send_head can be sent fully now, just do it.  */
+        if (skb->len <= limit)
+                return 0;
+
+        if (sysctl_tcp_tso_win_divisor) {
+                u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
+
+                /* If at least some fraction of a window is available,
+                 * just use it.
+                 */
+                chunk /= sysctl_tcp_tso_win_divisor;
+                if (limit >= chunk)
+                        return 0;
+        } else {
+                /* Different approach, try not to defer past a single
+                 * ACK.  Receiver should ACK every other full sized
+                 * frame, so if we have space for more than 3 frames
+                 * then send now.
+                 */
+                if (limit > tcp_max_burst(tp) * tp->mss_cache)
+                        return 0;
+        }
+
+        /* Ok, it looks like it is advisable to defer.  */
+        return 1;
 }
 
 /* This routine writes packets to the network.  It advances the
@@ -734,57 +959,142 @@ unsigned int tcp_current_mss(struct sock *sk, int large)
  * Returns 1, if no segments are in flight and we have queued segments, but
  * cannot send anything now because of SWS or another problem.
  */
-int tcp_write_xmit(struct sock *sk, int nonagle)
+static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        unsigned int mss_now;
+        struct sk_buff *skb;
+        unsigned int tso_segs, sent_pkts;
+        int cwnd_quota;
 
         /* If we are closed, the bytes will have to remain here.
          * In time closedown will finish, we empty the write queue and all
          * will be happy.
          */
-        if (sk->sk_state != TCP_CLOSE) {
-                struct sk_buff *skb;
-                int sent_pkts = 0;
+        if (unlikely(sk->sk_state == TCP_CLOSE))
+                return 0;
 
-                /* Account for SACKS, we may need to fragment due to this.
-                 * It is just like the real MSS changing on us midstream.
-                 * We also handle things correctly when the user adds some
-                 * IP options mid-stream.  Silly to do, but cover it.
-                 */
-                mss_now = tcp_current_mss(sk, 1);
-
-                while ((skb = sk->sk_send_head) &&
-                       tcp_snd_test(sk, skb, mss_now,
-                                    tcp_skb_is_last(sk, skb) ? nonagle :
-                                                               TCP_NAGLE_PUSH)) {
-                        if (skb->len > mss_now) {
-                                if (tcp_fragment(sk, skb, mss_now))
-                                        break;
-                        }
+        sent_pkts = 0;
+        while ((skb = sk->sk_send_head)) {
+                unsigned int limit;
 
-                        TCP_SKB_CB(skb)->when = tcp_time_stamp;
-                        tcp_tso_set_push(skb);
-                        if (tcp_transmit_skb(sk, skb_clone(skb, GFP_ATOMIC)))
+                tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
+                BUG_ON(!tso_segs);
+
+                cwnd_quota = tcp_cwnd_test(tp, skb);
+                if (!cwnd_quota)
+                        break;
+
+                if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now)))
+                        break;
+
+                if (tso_segs == 1) {
+                        if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
+                                                     (tcp_skb_is_last(sk, skb) ?
+                                                      nonagle : TCP_NAGLE_PUSH))))
                                 break;
+                } else {
+                        if (tcp_tso_should_defer(sk, tp, skb))
+                                break;
+                }
 
-                        /* Advance the send_head.  This one is sent out.
-                         * This call will increment packets_out.
-                         */
-                        update_send_head(sk, tp, skb);
+                limit = mss_now;
+                if (tso_segs > 1) {
+                        limit = tcp_window_allows(tp, skb,
+                                                  mss_now, cwnd_quota);
+
+                        if (skb->len < limit) {
+                                unsigned int trim = skb->len % mss_now;
 
-                        tcp_minshall_update(tp, mss_now, skb);
-                        sent_pkts = 1;
+                                if (trim)
+                                        limit = skb->len - trim;
+                        }
                 }
 
-                if (sent_pkts) {
-                        tcp_cwnd_validate(sk, tp);
-                        return 0;
+                if (skb->len > limit &&
+                    unlikely(tso_fragment(sk, skb, limit, mss_now)))
+                        break;
+
+                TCP_SKB_CB(skb)->when = tcp_time_stamp;
+
+                if (unlikely(tcp_transmit_skb(sk, skb_clone(skb, GFP_ATOMIC))))
+                        break;
+
+                /* Advance the send_head.  This one is sent out.
+                 * This call will increment packets_out.
+                 */
+                update_send_head(sk, tp, skb);
+
+                tcp_minshall_update(tp, mss_now, skb);
+                sent_pkts++;
+        }
+
+        if (likely(sent_pkts)) {
+                tcp_cwnd_validate(sk, tp);
+                return 0;
+        }
+        return !tp->packets_out && sk->sk_send_head;
+}
+
+/* Push out any pending frames which were held back due to
+ * TCP_CORK or attempt at coalescing tiny packets.
+ * The socket must be locked by the caller.
+ */
+void __tcp_push_pending_frames(struct sock *sk, struct tcp_sock *tp,
+                               unsigned int cur_mss, int nonagle)
+{
+        struct sk_buff *skb = sk->sk_send_head;
+
+        if (skb) {
+                if (tcp_write_xmit(sk, cur_mss, nonagle))
+                        tcp_check_probe_timer(sk, tp);
+        }
+}
+
+/* Send _single_ skb sitting at the send head. This function requires
+ * true push pending frames to setup probe timer etc.
+ */
+void tcp_push_one(struct sock *sk, unsigned int mss_now)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct sk_buff *skb = sk->sk_send_head;
+        unsigned int tso_segs, cwnd_quota;
+
+        BUG_ON(!skb || skb->len < mss_now);
+
+        tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
+        cwnd_quota = tcp_snd_test(sk, skb, mss_now, TCP_NAGLE_PUSH);
+
+        if (likely(cwnd_quota)) {
+                unsigned int limit;
+
+                BUG_ON(!tso_segs);
+
+                limit = mss_now;
+                if (tso_segs > 1) {
+                        limit = tcp_window_allows(tp, skb,
+                                                  mss_now, cwnd_quota);
+
+                        if (skb->len < limit) {
+                                unsigned int trim = skb->len % mss_now;
+
+                                if (trim)
+                                        limit = skb->len - trim;
+                        }
                 }
 
-                return !tp->packets_out && sk->sk_send_head;
+                if (skb->len > limit &&
+                    unlikely(tso_fragment(sk, skb, limit, mss_now)))
+                        return;
+
+                /* Send it out now. */
+                TCP_SKB_CB(skb)->when = tcp_time_stamp;
+
+                if (likely(!tcp_transmit_skb(sk, skb_clone(skb, sk->sk_allocation)))) {
+                        update_send_head(sk, tp, skb);
+                        tcp_cwnd_validate(sk, tp);
+                        return;
+                }
         }
-        return 0;
 }
 
 /* This function returns the amount that we can raise the
@@ -1044,7 +1354,6 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
                 if (sk->sk_route_caps & NETIF_F_TSO) {
                         sk->sk_route_caps &= ~NETIF_F_TSO;
                         sock_set_flag(sk, SOCK_NO_LARGESEND);
-                        tp->mss_cache = tp->mss_cache_std;
                 }
 
                 if (tcp_trim_head(sk, skb, tp->snd_una - TCP_SKB_CB(skb)->seq))
@@ -1062,15 +1371,21 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
 
         if (skb->len > cur_mss) {
                 int old_factor = tcp_skb_pcount(skb);
-                int new_factor;
+                int diff;
 
-                if (tcp_fragment(sk, skb, cur_mss))
+                if (tcp_fragment(sk, skb, cur_mss, cur_mss))
                         return -ENOMEM; /* We'll try again later. */
 
                 /* New SKB created, account for it. */
-                new_factor = tcp_skb_pcount(skb);
-                tp->packets_out -= old_factor - new_factor;
-                tp->packets_out += tcp_skb_pcount(skb->next);
+                diff = old_factor - tcp_skb_pcount(skb) -
+                       tcp_skb_pcount(skb->next);
+                tp->packets_out -= diff;
+
+                if (diff > 0) {
+                        tp->fackets_out -= diff;
+                        if ((int)tp->fackets_out < 0)
+                                tp->fackets_out = 0;
+                }
         }
 
         /* Collapse two adjacent packets if worthwhile and we can. */
@@ -1106,7 +1421,6 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
          * is still in somebody's hands, else make a clone.
          */
         TCP_SKB_CB(skb)->when = tcp_time_stamp;
-        tcp_tso_set_push(skb);
 
         err = tcp_transmit_skb(sk, (skb_cloned(skb) ?
                                     pskb_copy(skb, GFP_ATOMIC):
@@ -1290,7 +1604,7 @@ void tcp_send_fin(struct sock *sk)
  * was unread data in the receive queue.  This behavior is recommended
  * by draft-ietf-tcpimpl-prob-03.txt section 3.10.  -DaveM
  */
-void tcp_send_active_reset(struct sock *sk, int priority)
+void tcp_send_active_reset(struct sock *sk, unsigned int __nocast priority)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
@@ -1356,8 +1670,9 @@ int tcp_send_synack(struct sock *sk)
  * Prepare a SYN-ACK.
  */
 struct sk_buff * tcp_make_synack(struct sock *sk, struct dst_entry *dst,
-                                 struct open_request *req)
+                                 struct request_sock *req)
 {
+        struct inet_request_sock *ireq = inet_rsk(req);
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcphdr *th;
         int tcp_header_size;
@@ -1373,47 +1688,47 @@ struct sk_buff * tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         skb->dst = dst_clone(dst);
 
         tcp_header_size = (sizeof(struct tcphdr) + TCPOLEN_MSS +
-                           (req->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0) +
-                           (req->wscale_ok ? TCPOLEN_WSCALE_ALIGNED : 0) +
+                           (ireq->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0) +
+                           (ireq->wscale_ok ? TCPOLEN_WSCALE_ALIGNED : 0) +
                            /* SACK_PERM is in the place of NOP NOP of TS */
-                           ((req->sack_ok && !req->tstamp_ok) ? TCPOLEN_SACKPERM_ALIGNED : 0));
+                           ((ireq->sack_ok && !ireq->tstamp_ok) ? TCPOLEN_SACKPERM_ALIGNED : 0));
         skb->h.th = th = (struct tcphdr *) skb_push(skb, tcp_header_size);
 
         memset(th, 0, sizeof(struct tcphdr));
         th->syn = 1;
         th->ack = 1;
         if (dst->dev->features&NETIF_F_TSO)
-                req->ecn_ok = 0;
+                ireq->ecn_ok = 0;
         TCP_ECN_make_synack(req, th);
         th->source = inet_sk(sk)->sport;
-        th->dest = req->rmt_port;
-        TCP_SKB_CB(skb)->seq = req->snt_isn;
+        th->dest = ireq->rmt_port;
+        TCP_SKB_CB(skb)->seq = tcp_rsk(req)->snt_isn;
         TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(skb)->seq + 1;
         TCP_SKB_CB(skb)->sacked = 0;
         skb_shinfo(skb)->tso_segs = 1;
         skb_shinfo(skb)->tso_size = 0;
         th->seq = htonl(TCP_SKB_CB(skb)->seq);
-        th->ack_seq = htonl(req->rcv_isn + 1);
+        th->ack_seq = htonl(tcp_rsk(req)->rcv_isn + 1);
         if (req->rcv_wnd == 0) { /* ignored for retransmitted syns */
                 __u8 rcv_wscale; 
                 /* Set this up on the first call only */
                 req->window_clamp = tp->window_clamp ? : dst_metric(dst, RTAX_WINDOW);
                 /* tcp_full_space because it is guaranteed to be the first packet */
                 tcp_select_initial_window(tcp_full_space(sk), 
-                        dst_metric(dst, RTAX_ADVMSS) - (req->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0),
+                        dst_metric(dst, RTAX_ADVMSS) - (ireq->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0),
                         &req->rcv_wnd,
                         &req->window_clamp,
-                        req->wscale_ok,
+                        ireq->wscale_ok,
                         &rcv_wscale);
-                req->rcv_wscale = rcv_wscale; 
+                ireq->rcv_wscale = rcv_wscale; 
         }
 
         /* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */
         th->window = htons(req->rcv_wnd);
 
         TCP_SKB_CB(skb)->when = tcp_time_stamp;
-        tcp_syn_build_options((__u32 *)(th + 1), dst_metric(dst, RTAX_ADVMSS), req->tstamp_ok,
-                              req->sack_ok, req->wscale_ok, req->rcv_wscale,
+        tcp_syn_build_options((__u32 *)(th + 1), dst_metric(dst, RTAX_ADVMSS), ireq->tstamp_ok,
+                              ireq->sack_ok, ireq->wscale_ok, ireq->rcv_wscale,
                               TCP_SKB_CB(skb)->when,
                               req->ts_recent);
 
@@ -1448,7 +1763,6 @@ static inline void tcp_connect_init(struct sock *sk)
                 tp->window_clamp = dst_metric(dst, RTAX_WINDOW);
         tp->advmss = dst_metric(dst, RTAX_ADVMSS);
         tcp_initialize_rcv_mss(sk);
-        tcp_ca_init(tp);
 
         tcp_select_initial_window(tcp_full_space(sk),
                                   tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
@@ -1502,7 +1816,6 @@ int tcp_connect(struct sock *sk)
         TCP_SKB_CB(buff)->end_seq = tp->write_seq;
         tp->snd_nxt = tp->write_seq;
         tp->pushed_seq = tp->write_seq;
-        tcp_ca_init(tp);
 
         /* Send it off. */
         TCP_SKB_CB(buff)->when = tcp_time_stamp;
@@ -1669,21 +1982,19 @@ int tcp_write_wakeup(struct sock *sk)
                             skb->len > mss) {
                                 seg_size = min(seg_size, mss);
                                 TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_PSH;
-                                if (tcp_fragment(sk, skb, seg_size))
+                                if (tcp_fragment(sk, skb, seg_size, mss))
                                         return -1;
                                 /* SWS override triggered forced fragmentation.
                                  * Disable TSO, the connection is too sick. */
                                 if (sk->sk_route_caps & NETIF_F_TSO) {
                                         sock_set_flag(sk, SOCK_NO_LARGESEND);
                                         sk->sk_route_caps &= ~NETIF_F_TSO;
-                                        tp->mss_cache = tp->mss_cache_std;
                                 }
                         } else if (!tcp_skb_pcount(skb))
-                                tcp_set_skb_tso_segs(sk, skb);
+                                tcp_set_skb_tso_segs(sk, skb, mss);
 
                         TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_PSH;
                         TCP_SKB_CB(skb)->when = tcp_time_stamp;
-                        tcp_tso_set_push(skb);
                         err = tcp_transmit_skb(sk, skb_clone(skb, GFP_ATOMIC));
                         if (!err) {
                                 update_send_head(sk, tp, skb);
diff --git a/net/ipv4/tcp_scalable.c b/net/ipv4/tcp_scalable.c
new file mode 100644
index 000000000000..70e108e15c71
--- /dev/null
+++ b/net/ipv4/tcp_scalable.c
@@ -0,0 +1,68 @@
+/* Tom Kelly's Scalable TCP
+ *
+ * See htt://www-lce.eng.cam.ac.uk/~ctk21/scalable/
+ *
+ * John Heffner <jheffner@sc.edu>
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <net/tcp.h>
+
+/* These factors derived from the recommended values in the aer:
+ * .01 and and 7/8. We use 50 instead of 100 to account for
+ * delayed ack.
+ */
+#define TCP_SCALABLE_AI_CNT     50U
+#define TCP_SCALABLE_MD_SCALE   3
+
+static void tcp_scalable_cong_avoid(struct tcp_sock *tp, u32 ack, u32 rtt,
+                                    u32 in_flight, int flag)
+{
+        if (in_flight < tp->snd_cwnd)
+                return;
+
+        if (tp->snd_cwnd <= tp->snd_ssthresh) {
+                tp->snd_cwnd++;
+        } else {
+                tp->snd_cwnd_cnt++;
+                if (tp->snd_cwnd_cnt > min(tp->snd_cwnd, TCP_SCALABLE_AI_CNT)){
+                        tp->snd_cwnd++;
+                        tp->snd_cwnd_cnt = 0;
+                }
+        }
+        tp->snd_cwnd = min_t(u32, tp->snd_cwnd, tp->snd_cwnd_clamp);
+        tp->snd_cwnd_stamp = tcp_time_stamp;
+}
+
+static u32 tcp_scalable_ssthresh(struct tcp_sock *tp)
+{
+        return max(tp->snd_cwnd - (tp->snd_cwnd>>TCP_SCALABLE_MD_SCALE), 2U);
+}
+
+
+static struct tcp_congestion_ops tcp_scalable = {
+        .ssthresh       = tcp_scalable_ssthresh,
+        .cong_avoid     = tcp_scalable_cong_avoid,
+        .min_cwnd       = tcp_reno_min_cwnd,
+
+        .owner          = THIS_MODULE,
+        .name           = "scalable",
+};
+
+static int __init tcp_scalable_register(void)
+{
+        return tcp_register_congestion_control(&tcp_scalable);
+}
+
+static void __exit tcp_scalable_unregister(void)
+{
+        tcp_unregister_congestion_control(&tcp_scalable);
+}
+
+module_init(tcp_scalable_register);
+module_exit(tcp_scalable_unregister);
+
+MODULE_AUTHOR("John Heffner");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Scalable TCP");
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 799ebe061e2c..0084227438c2 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -231,11 +231,10 @@ static void tcp_delack_timer(unsigned long data)
         }
         tp->ack.pending &= ~TCP_ACK_TIMER;
 
-        if (skb_queue_len(&tp->ucopy.prequeue)) {
+        if (!skb_queue_empty(&tp->ucopy.prequeue)) {
                 struct sk_buff *skb;
 
-                NET_ADD_STATS_BH(LINUX_MIB_TCPSCHEDULERFAILED, 
-                                 skb_queue_len(&tp->ucopy.prequeue));
+                NET_INC_STATS_BH(LINUX_MIB_TCPSCHEDULERFAILED);
 
                 while ((skb = __skb_dequeue(&tp->ucopy.prequeue)) != NULL)
                         sk->sk_backlog_rcv(sk, skb);
@@ -464,11 +463,11 @@ out_unlock:
 static void tcp_synack_timer(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct tcp_listen_opt *lopt = tp->listen_opt;
+        struct listen_sock *lopt = tp->accept_queue.listen_opt;
         int max_retries = tp->syn_retries ? : sysctl_tcp_synack_retries;
         int thresh = max_retries;
         unsigned long now = jiffies;
-        struct open_request **reqp, *req;
+        struct request_sock **reqp, *req;
         int i, budget;
 
         if (lopt == NULL || lopt->qlen == 0)
@@ -513,8 +512,8 @@ static void tcp_synack_timer(struct sock *sk)
                 while ((req = *reqp) != NULL) {
                         if (time_after_eq(now, req->expires)) {
                                 if ((req->retrans < thresh ||
-                                     (req->acked && req->retrans < max_retries))
-                                    && !req->class->rtx_syn_ack(sk, req, NULL)) {
+                                     (inet_rsk(req)->acked && req->retrans < max_retries))
+                                    && !req->rsk_ops->rtx_syn_ack(sk, req, NULL)) {
                                         unsigned long timeo;
 
                                         if (req->retrans++ == 0)
@@ -527,13 +526,9 @@ static void tcp_synack_timer(struct sock *sk)
                                 }
 
                                 /* Drop this request */
-                                write_lock(&tp->syn_wait_lock);
-                                *reqp = req->dl_next;
-                                write_unlock(&tp->syn_wait_lock);
-                                lopt->qlen--;
-                                if (req->retrans == 0)
-                                        lopt->qlen_young--;
-                                tcp_openreq_free(req);
+                                tcp_synq_unlink(tp, req, reqp);
+                                reqsk_queue_removed(&tp->accept_queue, req);
+                                reqsk_free(req);
                                 continue;
                         }
                         reqp = &req->dl_next;
diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
new file mode 100644
index 000000000000..9bd443db5193
--- /dev/null
+++ b/net/ipv4/tcp_vegas.c
@@ -0,0 +1,411 @@
+/*
+ * TCP Vegas congestion control
+ *
+ * This is based on the congestion detection/avoidance scheme described in
+ *    Lawrence S. Brakmo and Larry L. Peterson.
+ *    "TCP Vegas: End to end congestion avoidance on a global internet."
+ *    IEEE Journal on Selected Areas in Communication, 13(8):1465--1480,
+ *    October 1995. Available from:
+ *      ftp://ftp.cs.arizona.edu/xkernel/Papers/jsac.ps
+ *
+ * See http://www.cs.arizona.edu/xkernel/ for their implementation.
+ * The main aspects that distinguish this implementation from the
+ * Arizona Vegas implementation are:
+ *   o We do not change the loss detection or recovery mechanisms of
+ *     Linux in any way. Linux already recovers from losses quite well,
+ *     using fine-grained timers, NewReno, and FACK.
+ *   o To avoid the performance penalty imposed by increasing cwnd
+ *     only every-other RTT during slow start, we increase during
+ *     every RTT during slow start, just like Reno.
+ *   o Largely to allow continuous cwnd growth during slow start,
+ *     we use the rate at which ACKs come back as the "actual"
+ *     rate, rather than the rate at which data is sent.
+ *   o To speed convergence to the right rate, we set the cwnd
+ *     to achieve the right ("actual") rate when we exit slow start.
+ *   o To filter out the noise caused by delayed ACKs, we use the
+ *     minimum RTT sample observed during the last RTT to calculate
+ *     the actual rate.
+ *   o When the sender re-starts from idle, it waits until it has
+ *     received ACKs for an entire flight of new data before making
+ *     a cwnd adjustment decision. The original Vegas implementation
+ *     assumed senders never went idle.
+ */
+
+#include <linux/config.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/tcp_diag.h>
+
+#include <net/tcp.h>
+
+/* Default values of the Vegas variables, in fixed-point representation
+ * with V_PARAM_SHIFT bits to the right of the binary point.
+ */
+#define V_PARAM_SHIFT 1
+static int alpha = 1<<V_PARAM_SHIFT;
+static int beta  = 3<<V_PARAM_SHIFT;
+static int gamma = 1<<V_PARAM_SHIFT;
+
+module_param(alpha, int, 0644);
+MODULE_PARM_DESC(alpha, "lower bound of packets in network (scale by 2)");
+module_param(beta, int, 0644);
+MODULE_PARM_DESC(beta, "upper bound of packets in network (scale by 2)");
+module_param(gamma, int, 0644);
+MODULE_PARM_DESC(gamma, "limit on increase (scale by 2)");
+
+
+/* Vegas variables */
+struct vegas {
+        u32     beg_snd_nxt;    /* right edge during last RTT */
+        u32     beg_snd_una;    /* left edge  during last RTT */
+        u32     beg_snd_cwnd;   /* saves the size of the cwnd */
+        u8      doing_vegas_now;/* if true, do vegas for this RTT */
+        u16     cntRTT;         /* # of RTTs measured within last RTT */
+        u32     minRTT;         /* min of RTTs measured within last RTT (in usec) */
+        u32     baseRTT;        /* the min of all Vegas RTT measurements seen (in usec) */
+};
+
+/* There are several situations when we must "re-start" Vegas:
+ *
+ *  o when a connection is established
+ *  o after an RTO
+ *  o after fast recovery
+ *  o when we send a packet and there is no outstanding
+ *    unacknowledged data (restarting an idle connection)
+ *
+ * In these circumstances we cannot do a Vegas calculation at the
+ * end of the first RTT, because any calculation we do is using
+ * stale info -- both the saved cwnd and congestion feedback are
+ * stale.
+ *
+ * Instead we must wait until the completion of an RTT during
+ * which we actually receive ACKs.
+ */
+static inline void vegas_enable(struct tcp_sock *tp)
+{
+        struct vegas *vegas = tcp_ca(tp);
+
+        /* Begin taking Vegas samples next time we send something. */
+        vegas->doing_vegas_now = 1;
+
+        /* Set the beginning of the next send window. */
+        vegas->beg_snd_nxt = tp->snd_nxt;
+
+        vegas->cntRTT = 0;
+        vegas->minRTT = 0x7fffffff;
+}
+
+/* Stop taking Vegas samples for now. */
+static inline void vegas_disable(struct tcp_sock *tp)
+{
+        struct vegas *vegas = tcp_ca(tp);
+
+        vegas->doing_vegas_now = 0;
+}
+
+static void tcp_vegas_init(struct tcp_sock *tp)
+{
+        struct vegas *vegas = tcp_ca(tp);
+
+        vegas->baseRTT = 0x7fffffff;
+        vegas_enable(tp);
+}
+
+/* Do RTT sampling needed for Vegas.
+ * Basically we:
+ *   o min-filter RTT samples from within an RTT to get the current
+ *     propagation delay + queuing delay (we are min-filtering to try to
+ *     avoid the effects of delayed ACKs)
+ *   o min-filter RTT samples from a much longer window (forever for now)
+ *     to find the propagation delay (baseRTT)
+ */
+static void tcp_vegas_rtt_calc(struct tcp_sock *tp, u32 usrtt)
+{
+        struct vegas *vegas = tcp_ca(tp);
+        u32 vrtt = usrtt + 1; /* Never allow zero rtt or baseRTT */
+
+        /* Filter to find propagation delay: */
+        if (vrtt < vegas->baseRTT)
+                vegas->baseRTT = vrtt;
+
+        /* Find the min RTT during the last RTT to find
+         * the current prop. delay + queuing delay:
+         */
+        vegas->minRTT = min(vegas->minRTT, vrtt);
+        vegas->cntRTT++;
+}
+
+static void tcp_vegas_state(struct tcp_sock *tp, u8 ca_state)
+{
+
+        if (ca_state == TCP_CA_Open)
+                vegas_enable(tp);
+        else
+                vegas_disable(tp);
+}
+
+/*
+ * If the connection is idle and we are restarting,
+ * then we don't want to do any Vegas calculations
+ * until we get fresh RTT samples.  So when we
+ * restart, we reset our Vegas state to a clean
+ * slate. After we get acks for this flight of
+ * packets, _then_ we can make Vegas calculations
+ * again.
+ */
+static void tcp_vegas_cwnd_event(struct tcp_sock *tp, enum tcp_ca_event event)
+{
+        if (event == CA_EVENT_CWND_RESTART ||
+            event == CA_EVENT_TX_START)
+                tcp_vegas_init(tp);
+}
+
+static void tcp_vegas_cong_avoid(struct tcp_sock *tp, u32 ack,
+                                 u32 seq_rtt, u32 in_flight, int flag)
+{
+        struct vegas *vegas = tcp_ca(tp);
+
+        if (!vegas->doing_vegas_now)
+                return tcp_reno_cong_avoid(tp, ack, seq_rtt, in_flight, flag);
+
+        /* The key players are v_beg_snd_una and v_beg_snd_nxt.
+         *
+         * These are so named because they represent the approximate values
+         * of snd_una and snd_nxt at the beginning of the current RTT. More
+         * precisely, they represent the amount of data sent during the RTT.
+         * At the end of the RTT, when we receive an ACK for v_beg_snd_nxt,
+         * we will calculate that (v_beg_snd_nxt - v_beg_snd_una) outstanding
+         * bytes of data have been ACKed during the course of the RTT, giving
+         * an "actual" rate of:
+         *
+         *     (v_beg_snd_nxt - v_beg_snd_una) / (rtt duration)
+         *
+         * Unfortunately, v_beg_snd_una is not exactly equal to snd_una,
+         * because delayed ACKs can cover more than one segment, so they
+         * don't line up nicely with the boundaries of RTTs.
+         *
+         * Another unfortunate fact of life is that delayed ACKs delay the
+         * advance of the left edge of our send window, so that the number
+         * of bytes we send in an RTT is often less than our cwnd will allow.
+         * So we keep track of our cwnd separately, in v_beg_snd_cwnd.
+         */
+
+        if (after(ack, vegas->beg_snd_nxt)) {
+                /* Do the Vegas once-per-RTT cwnd adjustment. */
+                u32 old_wnd, old_snd_cwnd;
+
+
+                /* Here old_wnd is essentially the window of data that was
+                 * sent during the previous RTT, and has all
+                 * been acknowledged in the course of the RTT that ended
+                 * with the ACK we just received. Likewise, old_snd_cwnd
+                 * is the cwnd during the previous RTT.
+                 */
+                old_wnd = (vegas->beg_snd_nxt - vegas->beg_snd_una) /
+                        tp->mss_cache;
+                old_snd_cwnd = vegas->beg_snd_cwnd;
+
+                /* Save the extent of the current window so we can use this
+                 * at the end of the next RTT.
+                 */
+                vegas->beg_snd_una  = vegas->beg_snd_nxt;
+                vegas->beg_snd_nxt  = tp->snd_nxt;
+                vegas->beg_snd_cwnd = tp->snd_cwnd;
+
+                /* Take into account the current RTT sample too, to
+                 * decrease the impact of delayed acks. This double counts
+                 * this sample since we count it for the next window as well,
+                 * but that's not too awful, since we're taking the min,
+                 * rather than averaging.
+                 */
+                tcp_vegas_rtt_calc(tp, seq_rtt*1000);
+
+                /* We do the Vegas calculations only if we got enough RTT
+                 * samples that we can be reasonably sure that we got
+                 * at least one RTT sample that wasn't from a delayed ACK.
+                 * If we only had 2 samples total,
+                 * then that means we're getting only 1 ACK per RTT, which
+                 * means they're almost certainly delayed ACKs.
+                 * If  we have 3 samples, we should be OK.
+                 */
+
+                if (vegas->cntRTT <= 2) {
+                        /* We don't have enough RTT samples to do the Vegas
+                         * calculation, so we'll behave like Reno.
+                         */
+                        if (tp->snd_cwnd > tp->snd_ssthresh)
+                                tp->snd_cwnd++;
+                } else {
+                        u32 rtt, target_cwnd, diff;
+
+                        /* We have enough RTT samples, so, using the Vegas
+                         * algorithm, we determine if we should increase or
+                         * decrease cwnd, and by how much.
+                         */
+
+                        /* Pluck out the RTT we are using for the Vegas
+                         * calculations. This is the min RTT seen during the
+                         * last RTT. Taking the min filters out the effects
+                         * of delayed ACKs, at the cost of noticing congestion
+                         * a bit later.
+                         */
+                        rtt = vegas->minRTT;
+
+                        /* Calculate the cwnd we should have, if we weren't
+                         * going too fast.
+                         *
+                         * This is:
+                         *     (actual rate in segments) * baseRTT
+                         * We keep it as a fixed point number with
+                         * V_PARAM_SHIFT bits to the right of the binary point.
+                         */
+                        target_cwnd = ((old_wnd * vegas->baseRTT)
+                                       << V_PARAM_SHIFT) / rtt;
+
+                        /* Calculate the difference between the window we had,
+                         * and the window we would like to have. This quantity
+                         * is the "Diff" from the Arizona Vegas papers.
+                         *
+                         * Again, this is a fixed point number with
+                         * V_PARAM_SHIFT bits to the right of the binary
+                         * point.
+                         */
+                        diff = (old_wnd << V_PARAM_SHIFT) - target_cwnd;
+
+                        if (tp->snd_cwnd < tp->snd_ssthresh) {
+                                /* Slow start.  */
+                                if (diff > gamma) {
+                                        /* Going too fast. Time to slow down
+                                         * and switch to congestion avoidance.
+                                         */
+                                        tp->snd_ssthresh = 2;
+
+                                        /* Set cwnd to match the actual rate
+                                         * exactly:
+                                         *   cwnd = (actual rate) * baseRTT
+                                         * Then we add 1 because the integer
+                                         * truncation robs us of full link
+                                         * utilization.
+                                         */
+                                        tp->snd_cwnd = min(tp->snd_cwnd,
+                                                           (target_cwnd >>
+                                                            V_PARAM_SHIFT)+1);
+
+                                }
+                        } else {
+                                /* Congestion avoidance. */
+                                u32 next_snd_cwnd;
+
+                                /* Figure out where we would like cwnd
+                                 * to be.
+                                 */
+                                if (diff > beta) {
+                                        /* The old window was too fast, so
+                                         * we slow down.
+                                         */
+                                        next_snd_cwnd = old_snd_cwnd - 1;
+                                } else if (diff < alpha) {
+                                        /* We don't have enough extra packets
+                                         * in the network, so speed up.
+                                         */
+                                        next_snd_cwnd = old_snd_cwnd + 1;
+                                } else {
+                                        /* Sending just as fast as we
+                                         * should be.
+                                         */
+                                        next_snd_cwnd = old_snd_cwnd;
+                                }
+
+                                /* Adjust cwnd upward or downward, toward the
+                                 * desired value.
+                                 */
+                                if (next_snd_cwnd > tp->snd_cwnd)
+                                        tp->snd_cwnd++;
+                                else if (next_snd_cwnd < tp->snd_cwnd)
+                                        tp->snd_cwnd--;
+                        }
+                }
+
+                /* Wipe the slate clean for the next RTT. */
+                vegas->cntRTT = 0;
+                vegas->minRTT = 0x7fffffff;
+        }
+
+        /* The following code is executed for every ack we receive,
+         * except for conditions checked in should_advance_cwnd()
+         * before the call to tcp_cong_avoid(). Mainly this means that
+         * we only execute this code if the ack actually acked some
+         * data.
+         */
+
+        /* If we are in slow start, increase our cwnd in response to this ACK.
+         * (If we are not in slow start then we are in congestion avoidance,
+         * and adjust our congestion window only once per RTT. See the code
+         * above.)
+         */
+        if (tp->snd_cwnd <= tp->snd_ssthresh)
+                tp->snd_cwnd++;
+
+        /* to keep cwnd from growing without bound */
+        tp->snd_cwnd = min_t(u32, tp->snd_cwnd, tp->snd_cwnd_clamp);
+
+        /* Make sure that we are never so timid as to reduce our cwnd below
+         * 2 MSS.
+         *
+         * Going below 2 MSS would risk huge delayed ACKs from our receiver.
+         */
+        tp->snd_cwnd = max(tp->snd_cwnd, 2U);
+}
+
+/* Extract info for Tcp socket info provided via netlink. */
+static void tcp_vegas_get_info(struct tcp_sock *tp, u32 ext,
+                               struct sk_buff *skb)
+{
+        const struct vegas *ca = tcp_ca(tp);
+        if (ext & (1<<(TCPDIAG_VEGASINFO-1))) {
+                struct tcpvegas_info *info;
+
+                info = RTA_DATA(__RTA_PUT(skb, TCPDIAG_VEGASINFO,
+                                          sizeof(*info)));
+
+                info->tcpv_enabled = ca->doing_vegas_now;
+                info->tcpv_rttcnt = ca->cntRTT;
+                info->tcpv_rtt = ca->baseRTT;
+                info->tcpv_minrtt = ca->minRTT;
+        rtattr_failure: ;
+        }
+}
+
+static struct tcp_congestion_ops tcp_vegas = {
+        .init           = tcp_vegas_init,
+        .ssthresh       = tcp_reno_ssthresh,
+        .cong_avoid     = tcp_vegas_cong_avoid,
+        .min_cwnd       = tcp_reno_min_cwnd,
+        .rtt_sample     = tcp_vegas_rtt_calc,
+        .set_state      = tcp_vegas_state,
+        .cwnd_event     = tcp_vegas_cwnd_event,
+        .get_info       = tcp_vegas_get_info,
+
+        .owner          = THIS_MODULE,
+        .name           = "vegas",
+};
+
+static int __init tcp_vegas_register(void)
+{
+        BUG_ON(sizeof(struct vegas) > TCP_CA_PRIV_SIZE);
+        tcp_register_congestion_control(&tcp_vegas);
+        return 0;
+}
+
+static void __exit tcp_vegas_unregister(void)
+{
+        tcp_unregister_congestion_control(&tcp_vegas);
+}
+
+module_init(tcp_vegas_register);
+module_exit(tcp_vegas_unregister);
+
+MODULE_AUTHOR("Stephen Hemminger");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("TCP Vegas");
diff --git a/net/ipv4/tcp_westwood.c b/net/ipv4/tcp_westwood.c
new file mode 100644
index 000000000000..ef827242c940
--- /dev/null
+++ b/net/ipv4/tcp_westwood.c
@@ -0,0 +1,259 @@
+/*
+ * TCP Westwood+
+ *
+ *      Angelo Dell'Aera:       TCP Westwood+ support
+ */
+
+#include <linux/config.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/tcp_diag.h>
+#include <net/tcp.h>
+
+/* TCP Westwood structure */
+struct westwood {
+        u32    bw_ns_est;        /* first bandwidth estimation..not too smoothed 8) */
+        u32    bw_est;           /* bandwidth estimate */
+        u32    rtt_win_sx;       /* here starts a new evaluation... */
+        u32    bk;
+        u32    snd_una;          /* used for evaluating the number of acked bytes */
+        u32    cumul_ack;
+        u32    accounted;
+        u32    rtt;
+        u32    rtt_min;          /* minimum observed RTT */
+};
+
+
+/* TCP Westwood functions and constants */
+#define TCP_WESTWOOD_RTT_MIN   (HZ/20)  /* 50ms */
+#define TCP_WESTWOOD_INIT_RTT  (20*HZ)  /* maybe too conservative?! */
+
+/*
+ * @tcp_westwood_create
+ * This function initializes fields used in TCP Westwood+,
+ * it is called after the initial SYN, so the sequence numbers
+ * are correct but new passive connections we have no
+ * information about RTTmin at this time so we simply set it to
+ * TCP_WESTWOOD_INIT_RTT. This value was chosen to be too conservative
+ * since in this way we're sure it will be updated in a consistent
+ * way as soon as possible. It will reasonably happen within the first
+ * RTT period of the connection lifetime.
+ */
+static void tcp_westwood_init(struct tcp_sock *tp)
+{
+        struct westwood *w = tcp_ca(tp);
+
+        w->bk = 0;
+        w->bw_ns_est = 0;
+        w->bw_est = 0;
+        w->accounted = 0;
+        w->cumul_ack = 0;
+        w->rtt_min = w->rtt = TCP_WESTWOOD_INIT_RTT;
+        w->rtt_win_sx = tcp_time_stamp;
+        w->snd_una = tp->snd_una;
+}
+
+/*
+ * @westwood_do_filter
+ * Low-pass filter. Implemented using constant coefficients.
+ */
+static inline u32 westwood_do_filter(u32 a, u32 b)
+{
+        return (((7 * a) + b) >> 3);
+}
+
+static inline void westwood_filter(struct westwood *w, u32 delta)
+{
+        w->bw_ns_est = westwood_do_filter(w->bw_ns_est, w->bk / delta);
+        w->bw_est = westwood_do_filter(w->bw_est, w->bw_ns_est);
+}
+
+/*
+ * @westwood_pkts_acked
+ * Called after processing group of packets.
+ * but all westwood needs is the last sample of srtt.
+ */
+static void tcp_westwood_pkts_acked(struct tcp_sock *tp, u32 cnt)
+{
+        struct westwood *w = tcp_ca(tp);
+        if (cnt > 0)
+                w->rtt = tp->srtt >> 3;
+}
+
+/*
+ * @westwood_update_window
+ * It updates RTT evaluation window if it is the right moment to do
+ * it. If so it calls filter for evaluating bandwidth.
+ */
+static void westwood_update_window(struct tcp_sock *tp)
+{
+        struct westwood *w = tcp_ca(tp);
+        s32 delta = tcp_time_stamp - w->rtt_win_sx;
+
+        /*
+         * See if a RTT-window has passed.
+         * Be careful since if RTT is less than
+         * 50ms we don't filter but we continue 'building the sample'.
+         * This minimum limit was chosen since an estimation on small
+         * time intervals is better to avoid...
+         * Obviously on a LAN we reasonably will always have
+         * right_bound = left_bound + WESTWOOD_RTT_MIN
+         */
+        if (w->rtt && delta > max_t(u32, w->rtt, TCP_WESTWOOD_RTT_MIN)) {
+                westwood_filter(w, delta);
+
+                w->bk = 0;
+                w->rtt_win_sx = tcp_time_stamp;
+        }
+}
+
+/*
+ * @westwood_fast_bw
+ * It is called when we are in fast path. In particular it is called when
+ * header prediction is successful. In such case in fact update is
+ * straight forward and doesn't need any particular care.
+ */
+static inline void westwood_fast_bw(struct tcp_sock *tp)
+{
+        struct westwood *w = tcp_ca(tp);
+
+        westwood_update_window(tp);
+
+        w->bk += tp->snd_una - w->snd_una;
+        w->snd_una = tp->snd_una;
+        w->rtt_min = min(w->rtt, w->rtt_min);
+}
+
+/*
+ * @westwood_acked_count
+ * This function evaluates cumul_ack for evaluating bk in case of
+ * delayed or partial acks.
+ */
+static inline u32 westwood_acked_count(struct tcp_sock *tp)
+{
+        struct westwood *w = tcp_ca(tp);
+
+        w->cumul_ack = tp->snd_una - w->snd_una;
+
+        /* If cumul_ack is 0 this is a dupack since it's not moving
+         * tp->snd_una.
+         */
+        if (!w->cumul_ack) {
+                w->accounted += tp->mss_cache;
+                w->cumul_ack = tp->mss_cache;
+        }
+
+        if (w->cumul_ack > tp->mss_cache) {
+                /* Partial or delayed ack */
+                if (w->accounted >= w->cumul_ack) {
+                        w->accounted -= w->cumul_ack;
+                        w->cumul_ack = tp->mss_cache;
+                } else {
+                        w->cumul_ack -= w->accounted;
+                        w->accounted = 0;
+                }
+        }
+
+        w->snd_una = tp->snd_una;
+
+        return w->cumul_ack;
+}
+
+static inline u32 westwood_bw_rttmin(const struct tcp_sock *tp)
+{
+        struct westwood *w = tcp_ca(tp);
+        return max_t(u32, (w->bw_est * w->rtt_min) / tp->mss_cache, 2);
+}
+
+/*
+ * TCP Westwood
+ * Here limit is evaluated as Bw estimation*RTTmin (for obtaining it
+ * in packets we use mss_cache). Rttmin is guaranteed to be >= 2
+ * so avoids ever returning 0.
+ */
+static u32 tcp_westwood_cwnd_min(struct tcp_sock *tp)
+{
+        return westwood_bw_rttmin(tp);
+}
+
+static void tcp_westwood_event(struct tcp_sock *tp, enum tcp_ca_event event)
+{
+        struct westwood *w = tcp_ca(tp);
+
+        switch(event) {
+        case CA_EVENT_FAST_ACK:
+                westwood_fast_bw(tp);
+                break;
+
+        case CA_EVENT_COMPLETE_CWR:
+                tp->snd_cwnd = tp->snd_ssthresh = westwood_bw_rttmin(tp);
+                break;
+
+        case CA_EVENT_FRTO:
+                tp->snd_ssthresh = westwood_bw_rttmin(tp);
+                break;
+
+        case CA_EVENT_SLOW_ACK:
+                westwood_update_window(tp);
+                w->bk += westwood_acked_count(tp);
+                w->rtt_min = min(w->rtt, w->rtt_min);
+                break;
+
+        default:
+                /* don't care */
+                break;
+        }
+}
+
+
+/* Extract info for Tcp socket info provided via netlink. */
+static void tcp_westwood_info(struct tcp_sock *tp, u32 ext,
+                              struct sk_buff *skb)
+{
+        const struct westwood *ca = tcp_ca(tp);
+        if (ext & (1<<(TCPDIAG_VEGASINFO-1))) {
+                struct rtattr *rta;
+                struct tcpvegas_info *info;
+
+                rta = __RTA_PUT(skb, TCPDIAG_VEGASINFO, sizeof(*info));
+                info = RTA_DATA(rta);
+                info->tcpv_enabled = 1;
+                info->tcpv_rttcnt = 0;
+                info->tcpv_rtt = jiffies_to_usecs(ca->rtt);
+                info->tcpv_minrtt = jiffies_to_usecs(ca->rtt_min);
+        rtattr_failure: ;
+        }
+}
+
+
+static struct tcp_congestion_ops tcp_westwood = {
+        .init           = tcp_westwood_init,
+        .ssthresh       = tcp_reno_ssthresh,
+        .cong_avoid     = tcp_reno_cong_avoid,
+        .min_cwnd       = tcp_westwood_cwnd_min,
+        .cwnd_event     = tcp_westwood_event,
+        .get_info       = tcp_westwood_info,
+        .pkts_acked     = tcp_westwood_pkts_acked,
+
+        .owner          = THIS_MODULE,
+        .name           = "westwood"
+};
+
+static int __init tcp_westwood_register(void)
+{
+        BUG_ON(sizeof(struct westwood) > TCP_CA_PRIV_SIZE);
+        return tcp_register_congestion_control(&tcp_westwood);
+}
+
+static void __exit tcp_westwood_unregister(void)
+{
+        tcp_unregister_congestion_control(&tcp_westwood);
+}
+
+module_init(tcp_westwood_register);
+module_exit(tcp_westwood_unregister);
+
+MODULE_AUTHOR("Stephen Hemminger, Angelo Dell'Aera");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("TCP Westwood+");
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 7c24e64b443f..dc4d07357e3a 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -628,7 +628,7 @@ back_from_confirm:
                 /* ... which is an evident application bug. --ANK */
                 release_sock(sk);
 
-                NETDEBUG(if (net_ratelimit()) printk(KERN_DEBUG "udp cork app bug 2\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "udp cork app bug 2\n"));
                 err = -EINVAL;
                 goto out;
         }
@@ -693,7 +693,7 @@ static int udp_sendpage(struct sock *sk, struct page *page, int offset,
         if (unlikely(!up->pending)) {
                 release_sock(sk);
 
-                NETDEBUG(if (net_ratelimit()) printk(KERN_DEBUG "udp cork app bug 3\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "udp cork app bug 3\n"));
                 return -EINVAL;
         }
 
@@ -1102,7 +1102,7 @@ static int udp_checksum_init(struct sk_buff *skb, struct udphdr *uh,
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
                 if (!udp_check(uh, ulen, saddr, daddr, skb->csum))
                         return 0;
-                NETDEBUG(if (net_ratelimit()) printk(KERN_DEBUG "udp v4 hw csum failure.\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "udp v4 hw csum failure.\n"));
                 skb->ip_summed = CHECKSUM_NONE;
         }
         if (skb->ip_summed != CHECKSUM_UNNECESSARY)
@@ -1181,14 +1181,13 @@ int udp_rcv(struct sk_buff *skb)
         return(0);
 
 short_packet:
-        NETDEBUG(if (net_ratelimit())
-                printk(KERN_DEBUG "UDP: short packet: From %u.%u.%u.%u:%u %d/%d to %u.%u.%u.%u:%u\n",
-                        NIPQUAD(saddr),
-                        ntohs(uh->source),
-                        ulen,
-                        len,
-                        NIPQUAD(daddr),
-                        ntohs(uh->dest)));
+        LIMIT_NETDEBUG(printk(KERN_DEBUG "UDP: short packet: From %u.%u.%u.%u:%u %d/%d to %u.%u.%u.%u:%u\n",
+                              NIPQUAD(saddr),
+                              ntohs(uh->source),
+                              ulen,
+                              len,
+                              NIPQUAD(daddr),
+                              ntohs(uh->dest)));
 no_header:
         UDP_INC_STATS_BH(UDP_MIB_INERRORS);
         kfree_skb(skb);
@@ -1199,13 +1198,12 @@ csum_error:
          * RFC1122: OK.  Discards the bad packet silently (as far as 
          * the network is concerned, anyway) as per 4.1.3.4 (MUST). 
          */
-        NETDEBUG(if (net_ratelimit())
-                 printk(KERN_DEBUG "UDP: bad checksum. From %d.%d.%d.%d:%d to %d.%d.%d.%d:%d ulen %d\n",
-                        NIPQUAD(saddr),
-                        ntohs(uh->source),
-                        NIPQUAD(daddr),
-                        ntohs(uh->dest),
-                        ulen));
+        LIMIT_NETDEBUG(printk(KERN_DEBUG "UDP: bad checksum. From %d.%d.%d.%d:%d to %d.%d.%d.%d:%d ulen %d\n",
+                              NIPQUAD(saddr),
+                              ntohs(uh->source),
+                              NIPQUAD(daddr),
+                              ntohs(uh->dest),
+                              ulen));
 drop:
         UDP_INC_STATS_BH(UDP_MIB_INERRORS);
         kfree_skb(skb);
diff --git a/net/ipv4/utils.c b/net/ipv4/utils.c
deleted file mode 100644
index 6aecd7a43534..000000000000
--- a/net/ipv4/utils.c
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * INET         An implementation of the TCP/IP protocol suite for the LINUX
- *              operating system.  INET is implemented using the  BSD Socket
- *              interface as the means of communication with the user level.
- *
- *              Various kernel-resident INET utility functions; mainly
- *              for format conversion and debugging output.
- *
- * Version:     $Id: utils.c,v 1.8 2000/10/03 07:29:01 anton Exp $
- *
- * Author:      Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
- *
- * Fixes:
- *              Alan Cox        :       verify_area check.
- *              Alan Cox        :       removed old debugging.
- *              Andi Kleen      :       add net_ratelimit()  
- *
- *              This program is free software; you can redistribute it and/or
- *              modify it under the terms of the GNU General Public License
- *              as published by the Free Software Foundation; either version
- *              2 of the License, or (at your option) any later version.
- */
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <asm/byteorder.h>
-
-/*
- *      Convert an ASCII string to binary IP. 
- */
- 
-__u32 in_aton(const char *str)
-{
-        unsigned long l;
-        unsigned int val;
-        int i;
-
-        l = 0;
-        for (i = 0; i < 4; i++) 
-        {
-                l <<= 8;
-                if (*str != '\0') 
-                {
-                        val = 0;
-                        while (*str != '\0' && *str != '.') 
-                        {
-                                val *= 10;
-                                val += *str - '0';
-                                str++;
-                        }
-                        l |= val;
-                        if (*str != '\0') 
-                                str++;
-                }
-        }
-        return(htonl(l));
-}
-
-EXPORT_SYMBOL(in_aton);
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index af2392ae5769..66620a95942a 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -33,6 +33,7 @@ static void xfrm4_encap(struct sk_buff *skb)
         struct dst_entry *dst = skb->dst;
         struct xfrm_state *x = dst->xfrm;
         struct iphdr *iph, *top_iph;
+        int flags;
 
         iph = skb->nh.iph;
         skb->h.ipiph = iph;
@@ -51,10 +52,13 @@ static void xfrm4_encap(struct sk_buff *skb)
 
         /* DS disclosed */
         top_iph->tos = INET_ECN_encapsulate(iph->tos, iph->tos);
-        if (x->props.flags & XFRM_STATE_NOECN)
+
+        flags = x->props.flags;
+        if (flags & XFRM_STATE_NOECN)
                 IP_ECN_clear(top_iph);
 
-        top_iph->frag_off = iph->frag_off & htons(IP_DF);
+        top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
+                0 : (iph->frag_off & htons(IP_DF));
         if (!top_iph->frag_off)
                 __ip_select_ident(top_iph, dst, 0);
 
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 223a2e83853f..050611d7a967 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -7,12 +7,20 @@
  *
  */
 
+#include <net/ip.h>
 #include <net/xfrm.h>
 #include <linux/pfkeyv2.h>
 #include <linux/ipsec.h>
 
 static struct xfrm_state_afinfo xfrm4_state_afinfo;
 
+static int xfrm4_init_flags(struct xfrm_state *x)
+{
+        if (ipv4_config.no_pmtu_disc)
+                x->props.flags |= XFRM_STATE_NOPMTUDISC;
+        return 0;
+}
+
 static void
 __xfrm4_init_tempsel(struct xfrm_state *x, struct flowi *fl,
                      struct xfrm_tmpl *tmpl,
@@ -109,6 +117,7 @@ __xfrm4_find_acq(u8 mode, u32 reqid, u8 proto,
 static struct xfrm_state_afinfo xfrm4_state_afinfo = {
         .family                 = AF_INET,
         .lock                   = RW_LOCK_UNLOCKED,
+        .init_flags             = xfrm4_init_flags,
         .init_tempsel           = __xfrm4_init_tempsel,
         .state_lookup           = __xfrm4_state_lookup,
         .find_acq               = __xfrm4_find_acq,
diff --git a/net/ipv4/xfrm4_tunnel.c b/net/ipv4/xfrm4_tunnel.c
index 413191f585f6..afbb0d4cc305 100644
--- a/net/ipv4/xfrm4_tunnel.c
+++ b/net/ipv4/xfrm4_tunnel.c
@@ -78,13 +78,12 @@ static int ipip_rcv(struct sk_buff *skb)
 static void ipip_err(struct sk_buff *skb, u32 info)
 {
         struct xfrm_tunnel *handler = ipip_handler;
-        u32 arg = info;
 
         if (handler)
-                handler->err_handler(skb, &arg);
+                handler->err_handler(skb, info);
 }
 
-static int ipip_init_state(struct xfrm_state *x, void *args)
+static int ipip_init_state(struct xfrm_state *x)
 {
         if (!x->props.mode)
                 return -EINVAL;
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index e66ca9381cfd..ab7a9124f985 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -1,6 +1,26 @@
 #
 # IPv6 configuration
-# 
+#
+
+#   IPv6 as module will cause a CRASH if you try to unload it
+config IPV6
+        tristate "The IPv6 protocol"
+        default m
+        select CRYPTO if IPV6_PRIVACY
+        select CRYPTO_MD5 if IPV6_PRIVACY
+        ---help---
+          This is complemental support for the IP version 6.
+          You will still be able to do traditional IPv4 networking as well.
+
+          For general information about IPv6, see
+          <http://playground.sun.com/pub/ipng/html/ipng-main.html>.
+          For Linux IPv6 development information, see <http://www.linux-ipv6.org>.
+          For specific information about IPv6 under Linux, read the HOWTO at
+          <http://www.bieringer.de/linux/IPv6/>.
+
+          To compile this protocol support as a module, choose M here: the 
+          module will be called ipv6.
+
 config IPV6_PRIVACY
         bool "IPv6: Privacy Extensions (RFC 3041) support"
         depends on IPV6
@@ -71,7 +91,6 @@ config INET6_TUNNEL
 config IPV6_TUNNEL
         tristate "IPv6: IPv6-in-IPv6 tunnel"
         depends on IPV6
-        select INET6_TUNNEL
         ---help---
           Support for IPv6-in-IPv6 tunnels described in RFC 2473.
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 7744a2592693..77004b9456c0 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -57,6 +57,7 @@
 #endif
 #include <linux/delay.h>
 #include <linux/notifier.h>
+#include <linux/string.h>
 
 #include <net/sock.h>
 #include <net/snmp.h>
@@ -131,7 +132,7 @@ static void addrconf_leave_anycast(struct inet6_ifaddr *ifp);
 
 static int addrconf_ifdown(struct net_device *dev, int how);
 
-static void addrconf_dad_start(struct inet6_ifaddr *ifp, int flags);
+static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags);
 static void addrconf_dad_timer(unsigned long data);
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp);
 static void addrconf_rs_timer(unsigned long data);
@@ -372,6 +373,7 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
                 ndev->regen_timer.data = (unsigned long) ndev;
                 if ((dev->flags&IFF_LOOPBACK) ||
                     dev->type == ARPHRD_TUNNEL ||
+                    dev->type == ARPHRD_NONE ||
                     dev->type == ARPHRD_SIT) {
                         printk(KERN_INFO
                                 "Disabled Privacy Extensions on device %p(%s)\n",
@@ -491,7 +493,7 @@ void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
 
 static struct inet6_ifaddr *
 ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
-              int scope, unsigned flags)
+              int scope, u32 flags)
 {
         struct inet6_ifaddr *ifa = NULL;
         struct rt6_info *rt;
@@ -694,7 +696,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
 
                 if (rt && ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
                         if (onlink == 0) {
-                                ip6_del_rt(rt, NULL, NULL);
+                                ip6_del_rt(rt, NULL, NULL, NULL);
                                 rt = NULL;
                         } else if (!(rt->rt6i_flags & RTF_EXPIRES)) {
                                 rt->rt6i_expires = expires;
@@ -1319,7 +1321,7 @@ static int __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpad
 
 static void
 addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
-                      unsigned long expires, unsigned flags)
+                      unsigned long expires, u32 flags)
 {
         struct in6_rtmsg rtmsg;
 
@@ -1339,7 +1341,7 @@ addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
         if (dev->type == ARPHRD_SIT && (dev->flags&IFF_POINTOPOINT))
                 rtmsg.rtmsg_flags |= RTF_NONEXTHOP;
 
-        ip6_route_add(&rtmsg, NULL, NULL);
+        ip6_route_add(&rtmsg, NULL, NULL, NULL);
 }
 
 /* Create "default" multicast route to the interface */
@@ -1356,7 +1358,7 @@ static void addrconf_add_mroute(struct net_device *dev)
         rtmsg.rtmsg_ifindex = dev->ifindex;
         rtmsg.rtmsg_flags = RTF_UP;
         rtmsg.rtmsg_type = RTMSG_NEWROUTE;
-        ip6_route_add(&rtmsg, NULL, NULL);
+        ip6_route_add(&rtmsg, NULL, NULL, NULL);
 }
 
 static void sit_route_add(struct net_device *dev)
@@ -1373,7 +1375,7 @@ static void sit_route_add(struct net_device *dev)
         rtmsg.rtmsg_flags       = RTF_UP|RTF_NONEXTHOP;
         rtmsg.rtmsg_ifindex     = dev->ifindex;
 
-        ip6_route_add(&rtmsg, NULL, NULL);
+        ip6_route_add(&rtmsg, NULL, NULL, NULL);
 }
 
 static void addrconf_add_lroute(struct net_device *dev)
@@ -1466,7 +1468,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
                 if (rt && ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
                         if (rt->rt6i_flags&RTF_EXPIRES) {
                                 if (valid_lft == 0) {
-                                        ip6_del_rt(rt, NULL, NULL);
+                                        ip6_del_rt(rt, NULL, NULL, NULL);
                                         rt = NULL;
                                 } else {
                                         rt->rt6i_expires = rt_expires;
@@ -2228,7 +2230,7 @@ out:
 /*
  *      Duplicate Address Detection
  */
-static void addrconf_dad_start(struct inet6_ifaddr *ifp, int flags)
+static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
 {
         struct inet6_dev *idev = ifp->idev;
         struct net_device *dev = idev->dev;
@@ -2621,15 +2623,14 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 }
 
 static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
-                             u32 pid, u32 seq, int event)
+                             u32 pid, u32 seq, int event, unsigned int flags)
 {
         struct ifaddrmsg *ifm;
         struct nlmsghdr  *nlh;
         struct ifa_cacheinfo ci;
         unsigned char    *b = skb->tail;
 
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*ifm));
-        if (pid) nlh->nlmsg_flags |= NLM_F_MULTI;
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*ifm), flags);
         ifm = NLMSG_DATA(nlh);
         ifm->ifa_family = AF_INET6;
         ifm->ifa_prefixlen = ifa->prefix_len;
@@ -2671,15 +2672,14 @@ rtattr_failure:
 }
 
 static int inet6_fill_ifmcaddr(struct sk_buff *skb, struct ifmcaddr6 *ifmca,
-                                u32 pid, u32 seq, int event)
+                                u32 pid, u32 seq, int event, u16 flags)
 {
         struct ifaddrmsg *ifm;
         struct nlmsghdr  *nlh;
         struct ifa_cacheinfo ci;
         unsigned char    *b = skb->tail;
 
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*ifm));
-        if (pid) nlh->nlmsg_flags |= NLM_F_MULTI;
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*ifm), flags);
         ifm = NLMSG_DATA(nlh);
         ifm->ifa_family = AF_INET6;     
         ifm->ifa_prefixlen = 128;
@@ -2708,15 +2708,14 @@ rtattr_failure:
 }
 
 static int inet6_fill_ifacaddr(struct sk_buff *skb, struct ifacaddr6 *ifaca,
-                                u32 pid, u32 seq, int event)
+                                u32 pid, u32 seq, int event, unsigned int flags)
 {
         struct ifaddrmsg *ifm;
         struct nlmsghdr  *nlh;
         struct ifa_cacheinfo ci;
         unsigned char    *b = skb->tail;
 
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*ifm));
-        if (pid) nlh->nlmsg_flags |= NLM_F_MULTI;
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*ifm), flags);
         ifm = NLMSG_DATA(nlh);
         ifm->ifa_family = AF_INET6;     
         ifm->ifa_prefixlen = 128;
@@ -2778,28 +2777,17 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                 read_lock_bh(&idev->lock);
                 switch (type) {
                 case UNICAST_ADDR:
-                        /* unicast address */
+                        /* unicast address incl. temp addr */
                         for (ifa = idev->addr_list; ifa;
                              ifa = ifa->if_next, ip_idx++) {
                                 if (ip_idx < s_ip_idx)
                                         continue;
                                 if ((err = inet6_fill_ifaddr(skb, ifa, 
                                     NETLINK_CB(cb->skb).pid, 
-                                    cb->nlh->nlmsg_seq, RTM_NEWADDR)) <= 0)
+                                    cb->nlh->nlmsg_seq, RTM_NEWADDR,
+                                    NLM_F_MULTI)) <= 0)
                                         goto done;
                         }
-                        /* temp addr */
-#ifdef CONFIG_IPV6_PRIVACY
-                        for (ifa = idev->tempaddr_list; ifa; 
-                             ifa = ifa->tmp_next, ip_idx++) {
-                                if (ip_idx < s_ip_idx)
-                                        continue;
-                                if ((err = inet6_fill_ifaddr(skb, ifa, 
-                                    NETLINK_CB(cb->skb).pid, 
-                                    cb->nlh->nlmsg_seq, RTM_NEWADDR)) <= 0) 
-                                        goto done;
-                        }
-#endif
                         break;
                 case MULTICAST_ADDR:
                         /* multicast address */
@@ -2809,7 +2797,8 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                                         continue;
                                 if ((err = inet6_fill_ifmcaddr(skb, ifmca, 
                                     NETLINK_CB(cb->skb).pid, 
-                                    cb->nlh->nlmsg_seq, RTM_GETMULTICAST)) <= 0)
+                                    cb->nlh->nlmsg_seq, RTM_GETMULTICAST,
+                                    NLM_F_MULTI)) <= 0)
                                         goto done;
                         }
                         break;
@@ -2821,7 +2810,8 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                                         continue;
                                 if ((err = inet6_fill_ifacaddr(skb, ifaca, 
                                     NETLINK_CB(cb->skb).pid, 
-                                    cb->nlh->nlmsg_seq, RTM_GETANYCAST)) <= 0) 
+                                    cb->nlh->nlmsg_seq, RTM_GETANYCAST,
+                                    NLM_F_MULTI)) <= 0) 
                                         goto done;
                         }
                         break;
@@ -2871,7 +2861,7 @@ static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
                 netlink_set_err(rtnl, 0, RTMGRP_IPV6_IFADDR, ENOBUFS);
                 return;
         }
-        if (inet6_fill_ifaddr(skb, ifa, 0, 0, event) < 0) {
+        if (inet6_fill_ifaddr(skb, ifa, current->pid, 0, event, 0) < 0) {
                 kfree_skb(skb);
                 netlink_set_err(rtnl, 0, RTMGRP_IPV6_IFADDR, EINVAL);
                 return;
@@ -2906,7 +2896,7 @@ static void inline ipv6_store_devconf(struct ipv6_devconf *cnf,
 }
 
 static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev, 
-                             u32 pid, u32 seq, int event)
+                             u32 pid, u32 seq, int event, unsigned int flags)
 {
         struct net_device       *dev = idev->dev;
         __s32                   *array = NULL;
@@ -2917,10 +2907,10 @@ static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
         __u32                   mtu = dev->mtu;
         struct ifla_cacheinfo   ci;
 
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*r));
-        if (pid) nlh->nlmsg_flags |= NLM_F_MULTI;
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*r), flags);
         r = NLMSG_DATA(nlh);
         r->ifi_family = AF_INET6;
+        r->__ifi_pad = 0;
         r->ifi_type = dev->type;
         r->ifi_index = dev->ifindex;
         r->ifi_flags = dev_get_flags(dev);
@@ -2985,7 +2975,7 @@ static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                 if ((idev = in6_dev_get(dev)) == NULL)
                         continue;
                 err = inet6_fill_ifinfo(skb, idev, NETLINK_CB(cb->skb).pid, 
-                                cb->nlh->nlmsg_seq, RTM_NEWLINK);
+                                cb->nlh->nlmsg_seq, RTM_NEWLINK, NLM_F_MULTI);
                 in6_dev_put(idev);
                 if (err <= 0)
                         break;
@@ -3007,7 +2997,7 @@ void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
                 netlink_set_err(rtnl, 0, RTMGRP_IPV6_IFINFO, ENOBUFS);
                 return;
         }
-        if (inet6_fill_ifinfo(skb, idev, 0, 0, event) < 0) {
+        if (inet6_fill_ifinfo(skb, idev, current->pid, 0, event, 0) < 0) {
                 kfree_skb(skb);
                 netlink_set_err(rtnl, 0, RTMGRP_IPV6_IFINFO, EINVAL);
                 return;
@@ -3017,23 +3007,23 @@ void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
 }
 
 static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
-                        struct prefix_info *pinfo, u32 pid, u32 seq, int event)
+                        struct prefix_info *pinfo, u32 pid, u32 seq, 
+                        int event, unsigned int flags)
 {
         struct prefixmsg        *pmsg;
         struct nlmsghdr         *nlh;
         unsigned char           *b = skb->tail;
         struct prefix_cacheinfo ci;
 
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*pmsg));
-        
-        if (pid) 
-                nlh->nlmsg_flags |= NLM_F_MULTI;
-        
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*pmsg), flags);
         pmsg = NLMSG_DATA(nlh);
         pmsg->prefix_family = AF_INET6;
+        pmsg->prefix_pad1 = 0;
+        pmsg->prefix_pad2 = 0;
         pmsg->prefix_ifindex = idev->dev->ifindex;
         pmsg->prefix_len = pinfo->prefix_len;
         pmsg->prefix_type = pinfo->type;
+        pmsg->prefix_pad3 = 0;
         
         pmsg->prefix_flags = 0;
         if (pinfo->onlink)
@@ -3067,7 +3057,7 @@ static void inet6_prefix_notify(int event, struct inet6_dev *idev,
                 netlink_set_err(rtnl, 0, RTMGRP_IPV6_PREFIX, ENOBUFS);
                 return;
         }
-        if (inet6_fill_prefix(skb, idev, pinfo, 0, 0, event) < 0) {
+        if (inet6_fill_prefix(skb, idev, pinfo, current->pid, 0, event, 0) < 0) {
                 kfree_skb(skb);
                 netlink_set_err(rtnl, 0, RTMGRP_IPV6_PREFIX, EINVAL);
                 return;
@@ -3096,7 +3086,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
         switch (event) {
         case RTM_NEWADDR:
                 dst_hold(&ifp->rt->u.dst);
-                if (ip6_ins_rt(ifp->rt, NULL, NULL))
+                if (ip6_ins_rt(ifp->rt, NULL, NULL, NULL))
                         dst_release(&ifp->rt->u.dst);
                 if (ifp->idev->cnf.forwarding)
                         addrconf_join_anycast(ifp);
@@ -3106,7 +3096,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                         addrconf_leave_anycast(ifp);
                 addrconf_leave_solict(ifp->idev, &ifp->addr);
                 dst_hold(&ifp->rt->u.dst);
-                if (ip6_del_rt(ifp->rt, NULL, NULL))
+                if (ip6_del_rt(ifp->rt, NULL, NULL, NULL))
                         dst_free(&ifp->rt->u.dst);
                 else
                         dst_release(&ifp->rt->u.dst);
@@ -3439,7 +3429,7 @@ static void addrconf_sysctl_register(struct inet6_dev *idev, struct ipv6_devconf
          * by sysctl and we wouldn't want anyone to change it under our feet
          * (see SIOCSIFNAME).
          */     
-        dev_name = net_sysctl_strdup(dev_name);
+        dev_name = kstrdup(dev_name, GFP_KERNEL);
         if (!dev_name)
             goto free;
 
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 2b193e3df49a..28d9bcab0970 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -774,7 +774,6 @@ static int __init inet6_init(void)
         if (if6_proc_init())
                 goto proc_if6_fail;
 #endif
-        ipv6_packet_init();
         ip6_route_init();
         ip6_flowlabel_init();
         err = addrconf_init();
@@ -791,6 +790,8 @@ static int __init inet6_init(void)
         /* Init v6 transport protocols. */
         udpv6_init();
         tcpv6_init();
+
+        ipv6_packet_init();
         err = 0;
 out:
         return err;
@@ -798,7 +799,6 @@ out:
 addrconf_fail:
         ip6_flowlabel_cleanup();
         ip6_route_cleanup();
-        ipv6_packet_cleanup();
 #ifdef CONFIG_PROC_FS
         if6_proc_exit();
 proc_if6_fail:
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index e3ecf626cbf7..986fdfdccbcd 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -339,7 +339,7 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         xfrm_state_put(x);
 }
 
-static int ah6_init_state(struct xfrm_state *x, void *args)
+static int ah6_init_state(struct xfrm_state *x)
 {
         struct ah_data *ahp = NULL;
         struct xfrm_algo_desc *aalg_desc;
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 5d22ca3cca2e..6b7294047238 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -337,7 +337,7 @@ int ipv6_dev_ac_inc(struct net_device *dev, struct in6_addr *addr)
         write_unlock_bh(&idev->lock);
 
         dst_hold(&rt->u.dst);
-        if (ip6_ins_rt(rt, NULL, NULL))
+        if (ip6_ins_rt(rt, NULL, NULL, NULL))
                 dst_release(&rt->u.dst);
 
         addrconf_join_solict(dev, &aca->aca_addr);
@@ -380,7 +380,7 @@ int __ipv6_dev_ac_dec(struct inet6_dev *idev, struct in6_addr *addr)
         addrconf_leave_solict(idev, &aca->aca_addr);
 
         dst_hold(&aca->aca_rt->u.dst);
-        if (ip6_del_rt(aca->aca_rt, NULL, NULL))
+        if (ip6_del_rt(aca->aca_rt, NULL, NULL, NULL))
                 dst_free(&aca->aca_rt->u.dst);
         else
                 dst_release(&aca->aca_rt->u.dst);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 65b9375df57d..5229365cd8b4 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -353,14 +353,14 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
         err = copied;
 
         /* Reset and regenerate socket error */
-        spin_lock_irq(&sk->sk_error_queue.lock);
+        spin_lock_bh(&sk->sk_error_queue.lock);
         sk->sk_err = 0;
         if ((skb2 = skb_peek(&sk->sk_error_queue)) != NULL) {
                 sk->sk_err = SKB_EXT_ERR(skb2)->ee.ee_errno;
-                spin_unlock_irq(&sk->sk_error_queue.lock);
+                spin_unlock_bh(&sk->sk_error_queue.lock);
                 sk->sk_error_report(sk);
         } else {
-                spin_unlock_irq(&sk->sk_error_queue.lock);
+                spin_unlock_bh(&sk->sk_error_queue.lock);
         }
 
 out_free_skb:   
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index be7095d6babe..324db62515a2 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -296,7 +296,7 @@ static void esp6_destroy(struct xfrm_state *x)
         kfree(esp);
 }
 
-static int esp6_init_state(struct xfrm_state *x, void *args)
+static int esp6_init_state(struct xfrm_state *x)
 {
         struct esp_data *esp = NULL;
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 8e0f569b883e..ff3ec9822e36 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -277,8 +277,8 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
 {
         struct inet6_dev *idev = NULL;
         struct ipv6hdr *hdr = skb->nh.ipv6h;
-        struct sock *sk = icmpv6_socket->sk;
-        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct sock *sk;
+        struct ipv6_pinfo *np;
         struct in6_addr *saddr = NULL;
         struct dst_entry *dst;
         struct icmp6hdr tmp_hdr;
@@ -358,6 +358,9 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         if (icmpv6_xmit_lock())
                 return;
 
+        sk = icmpv6_socket->sk;
+        np = inet6_sk(sk);
+
         if (!icmpv6_xrlim_allow(sk, type, &fl))
                 goto out;
 
@@ -423,9 +426,9 @@ out:
 
 static void icmpv6_echo_reply(struct sk_buff *skb)
 {
-        struct sock *sk = icmpv6_socket->sk;
+        struct sock *sk;
         struct inet6_dev *idev;
-        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct ipv6_pinfo *np;
         struct in6_addr *saddr = NULL;
         struct icmp6hdr *icmph = (struct icmp6hdr *) skb->h.raw;
         struct icmp6hdr tmp_hdr;
@@ -454,6 +457,9 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         if (icmpv6_xmit_lock())
                 return;
 
+        sk = icmpv6_socket->sk;
+        np = inet6_sk(sk);
+
         if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst))
                 fl.oif = np->mcast_oif;
 
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 405740b75abb..1b354aa97934 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -394,7 +394,7 @@ insert_above:
  */
 
 static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
-    struct nlmsghdr *nlh)
+                struct nlmsghdr *nlh,  struct netlink_skb_parms *req)
 {
         struct rt6_info *iter = NULL;
         struct rt6_info **ins;
@@ -449,7 +449,7 @@ out:
         *ins = rt;
         rt->rt6i_node = fn;
         atomic_inc(&rt->rt6i_ref);
-        inet6_rt_notify(RTM_NEWROUTE, rt, nlh);
+        inet6_rt_notify(RTM_NEWROUTE, rt, nlh, req);
         rt6_stats.fib_rt_entries++;
 
         if ((fn->fn_flags & RTN_RTINFO) == 0) {
@@ -479,7 +479,8 @@ void fib6_force_start_gc(void)
  *      with source addr info in sub-trees
  */
 
-int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr)
+int fib6_add(struct fib6_node *root, struct rt6_info *rt, 
+                struct nlmsghdr *nlh, void *_rtattr, struct netlink_skb_parms *req)
 {
         struct fib6_node *fn;
         int err = -ENOMEM;
@@ -552,7 +553,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nlmsghdr *nlh,
         }
 #endif
 
-        err = fib6_add_rt2node(fn, rt, nlh);
+        err = fib6_add_rt2node(fn, rt, nlh, req);
 
         if (err == 0) {
                 fib6_start_gc(rt);
@@ -859,7 +860,7 @@ static struct fib6_node * fib6_repair_tree(struct fib6_node *fn)
 }
 
 static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
-    struct nlmsghdr *nlh, void *_rtattr)
+    struct nlmsghdr *nlh, void *_rtattr, struct netlink_skb_parms *req)
 {
         struct fib6_walker_t *w;
         struct rt6_info *rt = *rtp;
@@ -915,11 +916,11 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
                 if (atomic_read(&rt->rt6i_ref) != 1) BUG();
         }
 
-        inet6_rt_notify(RTM_DELROUTE, rt, nlh);
+        inet6_rt_notify(RTM_DELROUTE, rt, nlh, req);
         rt6_release(rt);
 }
 
-int fib6_del(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr)
+int fib6_del(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr, struct netlink_skb_parms *req)
 {
         struct fib6_node *fn = rt->rt6i_node;
         struct rt6_info **rtp;
@@ -944,7 +945,7 @@ int fib6_del(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr)
 
         for (rtp = &fn->leaf; *rtp; rtp = &(*rtp)->u.next) {
                 if (*rtp == rt) {
-                        fib6_del_route(fn, rtp, nlh, _rtattr);
+                        fib6_del_route(fn, rtp, nlh, _rtattr, req);
                         return 0;
                 }
         }
@@ -1073,7 +1074,7 @@ static int fib6_clean_node(struct fib6_walker_t *w)
                 res = c->func(rt, c->arg);
                 if (res < 0) {
                         w->leaf = rt;
-                        res = fib6_del(rt, NULL, NULL);
+                        res = fib6_del(rt, NULL, NULL, NULL);
                         if (res) {
 #if RT6_DEBUG >= 2
                                 printk(KERN_DEBUG "fib6_clean_node: del failed: rt=%p@%p err=%d\n", rt, rt->rt6i_node, res);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 0e5f7499debb..b6c73da5ff35 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -244,7 +244,6 @@ struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions * opt_space,
                 opt_space->opt_nflen = 0;
         }
         opt_space->dst1opt = fopt->dst1opt;
-        opt_space->auth = fopt->auth;
         opt_space->opt_flen = fopt->opt_flen;
         return opt_space;
 }
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 866f10726c58..10fbb50daea4 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -198,12 +198,13 @@ resubmit:
                 if (!raw_sk) {
                         if (xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
                                 IP6_INC_STATS_BH(IPSTATS_MIB_INUNKNOWNPROTOS);
-                                icmpv6_param_prob(skb, ICMPV6_UNK_NEXTHDR, nhoff);
+                                icmpv6_send(skb, ICMPV6_PARAMPROB,
+                                            ICMPV6_UNK_NEXTHDR, nhoff,
+                                            skb->dev);
                         }
-                } else {
+                } else
                         IP6_INC_STATS_BH(IPSTATS_MIB_INDELIVERS);
-                        kfree_skb(skb);
-                }
+                kfree_skb(skb);
         }
         rcu_read_unlock();
         return 0;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index b78a53586804..ae652ca14bc9 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -465,7 +465,6 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->pkt_type = from->pkt_type;
         to->priority = from->priority;
         to->protocol = from->protocol;
-        to->security = from->security;
         dst_release(to->dst);
         to->dst = dst_clone(from->dst);
         to->dev = from->dev;
@@ -484,9 +483,6 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->nf_bridge = from->nf_bridge;
         nf_bridge_get(to->nf_bridge);
 #endif
-#ifdef CONFIG_NETFILTER_DEBUG
-        to->nf_debug = from->nf_debug;
-#endif
 #endif
 }
 
@@ -796,13 +792,8 @@ int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
         if (ipv6_addr_any(&fl->fl6_src)) {
                 err = ipv6_get_saddr(*dst, &fl->fl6_dst, &fl->fl6_src);
 
-                if (err) {
-#if IP6_DEBUG >= 2
-                        printk(KERN_DEBUG "ip6_dst_lookup: "
-                               "no available source address\n");
-#endif
+                if (err)
                         goto out_err_release;
-                }
         }
 
         return 0;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 3b1c9fa184ae..09613729404c 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -882,6 +882,7 @@ ip6ip6_tnl_change(struct ip6_tnl *t, struct ip6_tnl_parm *p)
         t->parms.hop_limit = p->hop_limit;
         t->parms.encap_limit = p->encap_limit;
         t->parms.flowinfo = p->flowinfo;
+        t->parms.link = p->link;
         ip6ip6_tnl_link_config(t);
         return 0;
 }
@@ -1109,11 +1110,39 @@ ip6ip6_fb_tnl_dev_init(struct net_device *dev)
         return 0;
 }
 
+#ifdef CONFIG_INET6_TUNNEL
 static struct xfrm6_tunnel ip6ip6_handler = {
-        .handler = ip6ip6_rcv,
-        .err_handler = ip6ip6_err,
+        .handler        = ip6ip6_rcv,
+        .err_handler    = ip6ip6_err,
 };
 
+static inline int ip6ip6_register(void)
+{
+        return xfrm6_tunnel_register(&ip6ip6_handler);
+}
+
+static inline int ip6ip6_unregister(void)
+{
+        return xfrm6_tunnel_deregister(&ip6ip6_handler);
+}
+#else
+static struct inet6_protocol xfrm6_tunnel_protocol = {
+        .handler        = ip6ip6_rcv,
+        .err_handler    = ip6ip6_err,
+        .flags          = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
+};
+
+static inline int ip6ip6_register(void)
+{
+        return inet6_add_protocol(&xfrm6_tunnel_protocol, IPPROTO_IPV6);
+}
+
+static inline int ip6ip6_unregister(void)
+{
+        return inet6_del_protocol(&xfrm6_tunnel_protocol, IPPROTO_IPV6);
+}
+#endif
+
 /**
  * ip6_tunnel_init - register protocol and reserve needed resources
  *
@@ -1124,7 +1153,7 @@ static int __init ip6_tunnel_init(void)
 {
         int  err;
 
-        if (xfrm6_tunnel_register(&ip6ip6_handler) < 0) {
+        if (ip6ip6_register() < 0) {
                 printk(KERN_ERR "ip6ip6 init: can't register tunnel\n");
                 return -EAGAIN;
         }
@@ -1143,7 +1172,7 @@ static int __init ip6_tunnel_init(void)
         }
         return 0;
 fail:
-        xfrm6_tunnel_deregister(&ip6ip6_handler);
+        ip6ip6_unregister();
         return err;
 }
 
@@ -1153,7 +1182,7 @@ fail:
 
 static void __exit ip6_tunnel_cleanup(void)
 {
-        if (xfrm6_tunnel_deregister(&ip6ip6_handler) < 0)
+        if (ip6ip6_unregister() < 0)
                 printk(KERN_INFO "ip6ip6 close: can't deregister tunnel\n");
 
         unregister_netdev(ip6ip6_fb_tnl_dev);
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 6cde5310cd76..423feb46ccc0 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -234,14 +234,9 @@ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
         t->props.mode = 1;
         memcpy(t->props.saddr.a6, x->props.saddr.a6, sizeof(struct in6_addr));
 
-        t->type = xfrm_get_type(IPPROTO_IPV6, t->props.family);
-        if (t->type == NULL)
+        if (xfrm_init_state(t))
                 goto error;
 
-        if (t->type->init_state(t, NULL))
-                goto error;
-
-        t->km.state = XFRM_STATE_VALID;
         atomic_set(&t->tunnel_users, 1);
 
 out:
@@ -420,7 +415,7 @@ static void ipcomp6_destroy(struct xfrm_state *x)
         xfrm6_tunnel_free_spi((xfrm_address_t *)&x->props.saddr);
 }
 
-static int ipcomp6_init_state(struct xfrm_state *x, void *args)
+static int ipcomp6_init_state(struct xfrm_state *x)
 {
         int err;
         struct ipcomp_data *ipcd;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 279ab86be662..3bc144a79fa5 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -423,11 +423,12 @@ done:
                         psin6 = (struct sockaddr_in6 *)&greqs.gsr_group;
                         retv = ipv6_sock_mc_join(sk, greqs.gsr_interface,
                                 &psin6->sin6_addr);
-                        if (retv)
+                        /* prior join w/ different source is ok */
+                        if (retv && retv != -EADDRINUSE)
                                 break;
                         omode = MCAST_INCLUDE;
                         add = 1;
-                } else /*IP_DROP_SOURCE_MEMBERSHIP */ {
+                } else /* MCAST_LEAVE_SOURCE_GROUP */ {
                         omode = MCAST_INCLUDE;
                         add = 0;
                 }
@@ -503,6 +504,9 @@ done:
                 break;
         case IPV6_IPSEC_POLICY:
         case IPV6_XFRM_POLICY:
+                retv = -EPERM;
+                if (!capable(CAP_NET_ADMIN))
+                        break;
                 retv = xfrm_user_policy(sk, optname, optval, optlen);
                 break;
 
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 393b6e6f50a9..29fed6e58d0a 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -188,6 +188,16 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, struct in6_addr *addr)
         if (!ipv6_addr_is_multicast(addr))
                 return -EINVAL;
 
+        read_lock_bh(&ipv6_sk_mc_lock);
+        for (mc_lst=np->ipv6_mc_list; mc_lst; mc_lst=mc_lst->next) {
+                if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
+                    ipv6_addr_equal(&mc_lst->addr, addr)) {
+                        read_unlock_bh(&ipv6_sk_mc_lock);
+                        return -EADDRINUSE;
+                }
+        }
+        read_unlock_bh(&ipv6_sk_mc_lock);
+
         mc_lst = sock_kmalloc(sk, sizeof(struct ipv6_mc_socklist), GFP_KERNEL);
 
         if (mc_lst == NULL)
@@ -271,7 +281,7 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, struct in6_addr *addr)
         }
         write_unlock_bh(&ipv6_sk_mc_lock);
 
-        return -ENOENT;
+        return -EADDRNOTAVAIL;
 }
 
 static struct inet6_dev *ip6_mc_find_dev(struct in6_addr *group, int ifindex)
@@ -349,6 +359,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
         struct ipv6_pinfo *inet6 = inet6_sk(sk);
         struct ip6_sf_socklist *psl;
         int i, j, rv;
+        int leavegroup = 0;
         int err;
 
         if (pgsr->gsr_group.ss_family != AF_INET6 ||
@@ -368,18 +379,23 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
 
         err = -EADDRNOTAVAIL;
 
+        read_lock_bh(&ipv6_sk_mc_lock);
         for (pmc=inet6->ipv6_mc_list; pmc; pmc=pmc->next) {
                 if (pgsr->gsr_interface && pmc->ifindex != pgsr->gsr_interface)
                         continue;
                 if (ipv6_addr_equal(&pmc->addr, group))
                         break;
         }
-        if (!pmc)               /* must have a prior join */
+        if (!pmc) {             /* must have a prior join */
+                err = -EINVAL;
                 goto done;
+        }
         /* if a source filter was set, must be the same mode as before */
         if (pmc->sflist) {
-                if (pmc->sfmode != omode)
+                if (pmc->sfmode != omode) {
+                        err = -EINVAL;
                         goto done;
+                }
         } else if (pmc->sfmode != omode) {
                 /* allow mode switches for empty-set filters */
                 ip6_mc_add_src(idev, group, omode, 0, NULL, 0);
@@ -390,7 +406,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
         psl = pmc->sflist;
         if (!add) {
                 if (!psl)
-                        goto done;
+                        goto done;      /* err = -EADDRNOTAVAIL */
                 rv = !0;
                 for (i=0; i<psl->sl_count; i++) {
                         rv = memcmp(&psl->sl_addr[i], source,
@@ -399,7 +415,13 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
                                 break;
                 }
                 if (rv)         /* source not found */
+                        goto done;      /* err = -EADDRNOTAVAIL */
+
+                /* special case - (INCLUDE, empty) == LEAVE_GROUP */
+                if (psl->sl_count == 1 && omode == MCAST_INCLUDE) {
+                        leavegroup = 1;
                         goto done;
+                }
 
                 /* update the interface filter */
                 ip6_mc_del_src(idev, group, omode, 1, source, 1);
@@ -453,9 +475,12 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
         /* update the interface list */
         ip6_mc_add_src(idev, group, omode, 1, source, 1);
 done:
+        read_unlock_bh(&ipv6_sk_mc_lock);
         read_unlock_bh(&idev->lock);
         in6_dev_put(idev);
         dev_put(dev);
+        if (leavegroup)
+                return ipv6_sock_mc_drop(sk, pgsr->gsr_interface, group);
         return err;
 }
 
@@ -467,6 +492,7 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
         struct inet6_dev *idev;
         struct ipv6_pinfo *inet6 = inet6_sk(sk);
         struct ip6_sf_socklist *newpsl, *psl;
+        int leavegroup = 0;
         int i, err;
 
         group = &((struct sockaddr_in6 *)&gsf->gf_group)->sin6_addr;
@@ -482,7 +508,12 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
         if (!idev)
                 return -ENODEV;
         dev = idev->dev;
-        err = -EADDRNOTAVAIL;
+
+        err = 0;
+        if (gsf->gf_fmode == MCAST_INCLUDE && gsf->gf_numsrc == 0) {
+                leavegroup = 1;
+                goto done;
+        }
 
         for (pmc=inet6->ipv6_mc_list; pmc; pmc=pmc->next) {
                 if (pmc->ifindex != gsf->gf_interface)
@@ -490,8 +521,10 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
                 if (ipv6_addr_equal(&pmc->addr, group))
                         break;
         }
-        if (!pmc)               /* must have a prior join */
+        if (!pmc) {             /* must have a prior join */
+                err = -EINVAL;
                 goto done;
+        }
         if (gsf->gf_numsrc) {
                 newpsl = (struct ip6_sf_socklist *)sock_kmalloc(sk,
                                 IP6_SFLSIZE(gsf->gf_numsrc), GFP_ATOMIC);
@@ -523,10 +556,13 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
                 (void) ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
         pmc->sflist = newpsl;
         pmc->sfmode = gsf->gf_fmode;
+        err = 0;
 done:
         read_unlock_bh(&idev->lock);
         in6_dev_put(idev);
         dev_put(dev);
+        if (leavegroup)
+                err = ipv6_sock_mc_drop(sk, gsf->gf_interface, group);
         return err;
 }
 
@@ -1280,15 +1316,6 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
                 return NULL;
 
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
-        if (dev->hard_header) {
-                unsigned char ha[MAX_ADDR_LEN];
-
-                ndisc_mc_map(&mld2_all_mcr, ha, dev, 1);
-                if (dev->hard_header(skb, dev, ETH_P_IPV6,ha,NULL,size) < 0) {
-                        kfree_skb(skb);
-                        return NULL;
-                }
-        }
 
         if (ipv6_get_lladdr(dev, &addr_buf)) {
                 /* <draft-ietf-magma-mld-source-05.txt>:
@@ -1312,6 +1339,30 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
         return skb;
 }
 
+static inline int mld_dev_queue_xmit2(struct sk_buff *skb)
+{
+        struct net_device *dev = skb->dev;
+
+        if (dev->hard_header) {
+                unsigned char ha[MAX_ADDR_LEN];
+                int err;
+
+                ndisc_mc_map(&skb->nh.ipv6h->daddr, ha, dev, 1);
+                err = dev->hard_header(skb, dev, ETH_P_IPV6, ha, NULL, skb->len);
+                if (err < 0) {
+                        kfree_skb(skb);
+                        return err;
+                }
+        }
+        return dev_queue_xmit(skb);
+}
+
+static inline int mld_dev_queue_xmit(struct sk_buff *skb)
+{
+        return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, skb->dev,
+                       mld_dev_queue_xmit2);
+}
+
 static void mld_sendpack(struct sk_buff *skb)
 {
         struct ipv6hdr *pip6 = skb->nh.ipv6h;
@@ -1329,7 +1380,7 @@ static void mld_sendpack(struct sk_buff *skb)
         pmr->csum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
                 IPPROTO_ICMPV6, csum_partial(skb->h.raw, mldlen, 0));
         err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, skb->dev,
-                dev_queue_xmit);
+                mld_dev_queue_xmit);
         if (!err) {
                 ICMP6_INC_STATS(idev,ICMP6_MIB_OUTMSGS);
                 IP6_INC_STATS(IPSTATS_MIB_OUTMCASTPKTS);
@@ -1635,12 +1686,6 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
         }
 
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
-        if (dev->hard_header) {
-                unsigned char ha[MAX_ADDR_LEN];
-                ndisc_mc_map(snd_addr, ha, dev, 1);
-                if (dev->hard_header(skb, dev, ETH_P_IPV6, ha, NULL, full_len) < 0)
-                        goto out;
-        }
 
         if (ipv6_get_lladdr(dev, &addr_buf)) {
                 /* <draft-ietf-magma-mld-source-05.txt>:
@@ -1668,7 +1713,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
         idev = in6_dev_get(skb->dev);
 
         err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, skb->dev,
-                dev_queue_xmit);
+                mld_dev_queue_xmit);
         if (!err) {
                 if (type == ICMPV6_MGM_REDUCTION)
                         ICMP6_INC_STATS(idev, ICMP6_MIB_OUTGROUPMEMBREDUCTIONS);
@@ -1682,10 +1727,6 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
         if (likely(idev != NULL))
                 in6_dev_put(idev);
         return;
-
-out:
-        IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
-        kfree_skb(skb);
 }
 
 static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 7c291f4e9edc..7ae72d4c9bd2 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -955,7 +955,7 @@ static void ndisc_recv_na(struct sk_buff *skb)
                         struct rt6_info *rt;
                         rt = rt6_get_dflt_router(saddr, dev);
                         if (rt)
-                                ip6_del_rt(rt, NULL, NULL);
+                                ip6_del_rt(rt, NULL, NULL, NULL);
                 }
 
 out:
@@ -1096,7 +1096,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 
         if (rt && lifetime == 0) {
                 neigh_clone(neigh);
-                ip6_del_rt(rt, NULL, NULL);
+                ip6_del_rt(rt, NULL, NULL, NULL);
                 rt = NULL;
         }
 
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 750943e2d34e..5493180f0d44 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -76,7 +76,9 @@ static DECLARE_MUTEX(ipqnl_sem);
 static void
 ipq_issue_verdict(struct ipq_queue_entry *entry, int verdict)
 {
+        local_bh_disable();
         nf_reinject(entry->skb, entry->info, verdict);
+        local_bh_enable();
         kfree(entry);
 }
 
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index c735276fdd5f..73034511c8db 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -71,7 +71,6 @@ static DECLARE_MUTEX(ip6t_mutex);
 /* Must have mutex */
 #define ASSERT_READ_LOCK(x) IP_NF_ASSERT(down_trylock(&ip6t_mutex) != 0)
 #define ASSERT_WRITE_LOCK(x) IP_NF_ASSERT(down_trylock(&ip6t_mutex) != 0)
-#include <linux/netfilter_ipv4/lockhelp.h>
 #include <linux/netfilter_ipv4/listhelp.h>
 
 #if 0
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index bfc3d0185d19..a692e26a4fa3 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -366,8 +366,6 @@ ip6t_log_packet(unsigned int hooknum,
                 const char *level_string,
                 const char *prefix)
 {
-        struct ipv6hdr *ipv6h = skb->nh.ipv6h;
-
         spin_lock_bh(&log_lock);
         printk(level_string);
         printk("%sIN=%s OUT=%s ",
@@ -375,41 +373,30 @@ ip6t_log_packet(unsigned int hooknum,
                 in ? in->name : "",
                 out ? out->name : "");
         if (in && !out) {
+                unsigned int len;
                 /* MAC logging for input chain only. */
                 printk("MAC=");
-                if (skb->dev && skb->dev->hard_header_len && skb->mac.raw != (void*)ipv6h) {
-                        if (skb->dev->type != ARPHRD_SIT){
-                          int i;
-                          unsigned char *p = skb->mac.raw;
-                          for (i = 0; i < skb->dev->hard_header_len; i++,p++)
-                                printk("%02x%c", *p,
-                                        i==skb->dev->hard_header_len - 1
-                                        ? ' ':':');
-                        } else {
-                          int i;
-                          unsigned char *p = skb->mac.raw;
-                          if ( p - (ETH_ALEN*2+2) > skb->head ){
-                            p -= (ETH_ALEN+2);
-                            for (i = 0; i < (ETH_ALEN); i++,p++)
-                                printk("%02x%s", *p,
-                                        i == ETH_ALEN-1 ? "->" : ":");
-                            p -= (ETH_ALEN*2);
-                            for (i = 0; i < (ETH_ALEN); i++,p++)
-                                printk("%02x%c", *p,
-                                        i == ETH_ALEN-1 ? ' ' : ':');
-                          }
-                          
-                          if ((skb->dev->addr_len == 4) &&
-                              skb->dev->hard_header_len > 20){
-                            printk("TUNNEL=");
-                            p = skb->mac.raw + 12;
-                            for (i = 0; i < 4; i++,p++)
-                                printk("%3d%s", *p,
-                                        i == 3 ? "->" : ".");
-                            for (i = 0; i < 4; i++,p++)
-                                printk("%3d%c", *p,
-                                        i == 3 ? ' ' : '.');
-                          }
+                if (skb->dev && (len = skb->dev->hard_header_len) &&
+                    skb->mac.raw != skb->nh.raw) {
+                        unsigned char *p = skb->mac.raw;
+                        int i;
+
+                        if (skb->dev->type == ARPHRD_SIT &&
+                            (p -= ETH_HLEN) < skb->head)
+                                p = NULL;
+
+                        if (p != NULL) {
+                                for (i = 0; i < len; i++)
+                                        printk("%02x%s", p[i],
+                                               i == len - 1 ? "" : ":");
+                        }
+                        printk(" ");
+
+                        if (skb->dev->type == ARPHRD_SIT) {
+                                struct iphdr *iph = (struct iphdr *)skb->mac.raw;
+                                printk("TUNNEL=%u.%u.%u.%u->%u.%u.%u.%u ",
+                                       NIPQUAD(iph->saddr),
+                                       NIPQUAD(iph->daddr));
                         }
                 } else
                         printk(" ");
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 71407beaf790..c2982efd14af 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -129,13 +129,15 @@ static struct nf_hook_ops ip6t_ops[] = {
           .hook = ip6t_hook, 
           .pf = PF_INET6,
           .hooknum = NF_IP6_PRE_ROUTING,
-          .priority = NF_IP6_PRI_FIRST
+          .priority = NF_IP6_PRI_FIRST,
+          .owner = THIS_MODULE,
         },
         {
           .hook = ip6t_hook, 
           .pf = PF_INET6, 
           .hooknum = NF_IP6_LOCAL_OUT,
-          .priority = NF_IP6_PRI_FIRST
+          .priority = NF_IP6_PRI_FIRST,
+          .owner = THIS_MODULE,
         },
 };
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 617645bc5ed6..1d4d75b34d32 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -328,6 +328,8 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
 
         if (skb->ip_summed != CHECKSUM_UNNECESSARY) {
                 if (skb->ip_summed == CHECKSUM_HW) {
+                        skb_postpull_rcsum(skb, skb->nh.raw,
+                                           skb->h.raw - skb->nh.raw);
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
                         if (csum_ipv6_magic(&skb->nh.ipv6h->saddr,
                                             &skb->nh.ipv6h->daddr,
@@ -434,12 +436,12 @@ csum_copy_err:
         /* Clear queue. */
         if (flags&MSG_PEEK) {
                 int clear = 0;
-                spin_lock_irq(&sk->sk_receive_queue.lock);
+                spin_lock_bh(&sk->sk_receive_queue.lock);
                 if (skb == skb_peek(&sk->sk_receive_queue)) {
                         __skb_unlink(skb, &sk->sk_receive_queue);
                         clear = 1;
                 }
-                spin_unlock_irq(&sk->sk_receive_queue.lock);
+                spin_unlock_bh(&sk->sk_receive_queue.lock);
                 if (clear)
                         kfree_skb(skb);
         }
@@ -971,11 +973,11 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
                         struct sk_buff *skb;
                         int amount = 0;
 
-                        spin_lock_irq(&sk->sk_receive_queue.lock);
+                        spin_lock_bh(&sk->sk_receive_queue.lock);
                         skb = skb_peek(&sk->sk_receive_queue);
                         if (skb != NULL)
                                 amount = skb->tail - skb->h.raw;
-                        spin_unlock_irq(&sk->sk_receive_queue.lock);
+                        spin_unlock_bh(&sk->sk_receive_queue.lock);
                         return put_user(amount, (int __user *)arg);
                 }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 3bf8a0254f81..878789b3122d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -384,12 +384,13 @@ struct rt6_info *rt6_lookup(struct in6_addr *daddr, struct in6_addr *saddr,
    be destroyed.
  */
 
-int ip6_ins_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr)
+int ip6_ins_rt(struct rt6_info *rt, struct nlmsghdr *nlh,
+                void *_rtattr, struct netlink_skb_parms *req)
 {
         int err;
 
         write_lock_bh(&rt6_lock);
-        err = fib6_add(&ip6_routing_table, rt, nlh, _rtattr);
+        err = fib6_add(&ip6_routing_table, rt, nlh, _rtattr, req);
         write_unlock_bh(&rt6_lock);
 
         return err;
@@ -400,7 +401,7 @@ int ip6_ins_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr)
  */
 
 static struct rt6_info *rt6_cow(struct rt6_info *ort, struct in6_addr *daddr,
-                                struct in6_addr *saddr)
+                                struct in6_addr *saddr, struct netlink_skb_parms *req)
 {
         int err;
         struct rt6_info *rt;
@@ -432,7 +433,7 @@ static struct rt6_info *rt6_cow(struct rt6_info *ort, struct in6_addr *daddr,
 
                 dst_hold(&rt->u.dst);
 
-                err = ip6_ins_rt(rt, NULL, NULL);
+                err = ip6_ins_rt(rt, NULL, NULL, req);
                 if (err == 0)
                         return rt;
 
@@ -491,7 +492,8 @@ restart:
                 read_unlock_bh(&rt6_lock);
 
                 nrt = rt6_cow(rt, &skb->nh.ipv6h->daddr,
-                              &skb->nh.ipv6h->saddr);
+                              &skb->nh.ipv6h->saddr,
+                              &NETLINK_CB(skb));
 
                 dst_release(&rt->u.dst);
                 rt = nrt;
@@ -551,7 +553,7 @@ restart:
                 dst_hold(&rt->u.dst);
                 read_unlock_bh(&rt6_lock);
 
-                nrt = rt6_cow(rt, &fl->fl6_dst, &fl->fl6_src);
+                nrt = rt6_cow(rt, &fl->fl6_dst, &fl->fl6_src, NULL);
 
                 dst_release(&rt->u.dst);
                 rt = nrt;
@@ -598,7 +600,7 @@ static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
 
         if (rt) {
                 if (rt->rt6i_flags & RTF_CACHE)
-                        ip6_del_rt(rt, NULL, NULL);
+                        ip6_del_rt(rt, NULL, NULL, NULL);
                 else
                         dst_release(dst);
         }
@@ -787,7 +789,8 @@ int ipv6_get_hoplimit(struct net_device *dev)
  *
  */
 
-int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh, void *_rtattr)
+int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh, 
+                void *_rtattr, struct netlink_skb_parms *req)
 {
         int err;
         struct rtmsg *r;
@@ -974,7 +977,7 @@ install_route:
                 rt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(dst_mtu(&rt->u.dst));
         rt->u.dst.dev = dev;
         rt->rt6i_idev = idev;
-        return ip6_ins_rt(rt, nlh, _rtattr);
+        return ip6_ins_rt(rt, nlh, _rtattr, req);
 
 out:
         if (dev)
@@ -986,7 +989,7 @@ out:
         return err;
 }
 
-int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr)
+int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr, struct netlink_skb_parms *req)
 {
         int err;
 
@@ -994,7 +997,7 @@ int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr)
 
         rt6_reset_dflt_pointer(NULL);
 
-        err = fib6_del(rt, nlh, _rtattr);
+        err = fib6_del(rt, nlh, _rtattr, req);
         dst_release(&rt->u.dst);
 
         write_unlock_bh(&rt6_lock);
@@ -1002,7 +1005,7 @@ int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr)
         return err;
 }
 
-static int ip6_route_del(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh, void *_rtattr)
+static int ip6_route_del(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh, void *_rtattr, struct netlink_skb_parms *req)
 {
         struct fib6_node *fn;
         struct rt6_info *rt;
@@ -1029,7 +1032,7 @@ static int ip6_route_del(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh, void *_r
                         dst_hold(&rt->u.dst);
                         read_unlock_bh(&rt6_lock);
 
-                        return ip6_del_rt(rt, nlh, _rtattr);
+                        return ip6_del_rt(rt, nlh, _rtattr, req);
                 }
         }
         read_unlock_bh(&rt6_lock);
@@ -1136,11 +1139,11 @@ source_ok:
         nrt->u.dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(neigh->dev);
         nrt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(dst_mtu(&nrt->u.dst));
 
-        if (ip6_ins_rt(nrt, NULL, NULL))
+        if (ip6_ins_rt(nrt, NULL, NULL, NULL))
                 goto out;
 
         if (rt->rt6i_flags&RTF_CACHE) {
-                ip6_del_rt(rt, NULL, NULL);
+                ip6_del_rt(rt, NULL, NULL, NULL);
                 return;
         }
 
@@ -1204,7 +1207,7 @@ void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
            2. It is gatewayed route or NONEXTHOP route. Action: clone it.
          */
         if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP)) {
-                nrt = rt6_cow(rt, daddr, saddr);
+                nrt = rt6_cow(rt, daddr, saddr, NULL);
                 if (!nrt->u.dst.error) {
                         nrt->u.dst.metrics[RTAX_MTU-1] = pmtu;
                         if (allfrag)
@@ -1232,7 +1235,7 @@ void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
                 nrt->u.dst.metrics[RTAX_MTU-1] = pmtu;
                 if (allfrag)
                         nrt->u.dst.metrics[RTAX_FEATURES-1] |= RTAX_FEATURE_ALLFRAG;
-                ip6_ins_rt(nrt, NULL, NULL);
+                ip6_ins_rt(nrt, NULL, NULL, NULL);
         }
 
 out:
@@ -1305,7 +1308,7 @@ struct rt6_info *rt6_add_dflt_router(struct in6_addr *gwaddr,
 
         rtmsg.rtmsg_ifindex = dev->ifindex;
 
-        ip6_route_add(&rtmsg, NULL, NULL);
+        ip6_route_add(&rtmsg, NULL, NULL, NULL);
         return rt6_get_dflt_router(gwaddr, dev);
 }
 
@@ -1323,7 +1326,7 @@ restart:
 
                         read_unlock_bh(&rt6_lock);
 
-                        ip6_del_rt(rt, NULL, NULL);
+                        ip6_del_rt(rt, NULL, NULL, NULL);
 
                         goto restart;
                 }
@@ -1349,10 +1352,10 @@ int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
                 rtnl_lock();
                 switch (cmd) {
                 case SIOCADDRT:
-                        err = ip6_route_add(&rtmsg, NULL, NULL);
+                        err = ip6_route_add(&rtmsg, NULL, NULL, NULL);
                         break;
                 case SIOCDELRT:
-                        err = ip6_route_del(&rtmsg, NULL, NULL);
+                        err = ip6_route_del(&rtmsg, NULL, NULL, NULL);
                         break;
                 default:
                         err = -EINVAL;
@@ -1546,7 +1549,7 @@ int inet6_rtm_delroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 
         if (inet6_rtm_to_rtmsg(r, arg, &rtmsg))
                 return -EINVAL;
-        return ip6_route_del(&rtmsg, nlh, arg);
+        return ip6_route_del(&rtmsg, nlh, arg, &NETLINK_CB(skb));
 }
 
 int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
@@ -1556,7 +1559,7 @@ int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 
         if (inet6_rtm_to_rtmsg(r, arg, &rtmsg))
                 return -EINVAL;
-        return ip6_route_add(&rtmsg, nlh, arg);
+        return ip6_route_add(&rtmsg, nlh, arg, &NETLINK_CB(skb));
 }
 
 struct rt6_rtnl_dump_arg
@@ -1566,11 +1569,9 @@ struct rt6_rtnl_dump_arg
 };
 
 static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
-                         struct in6_addr *dst,
-                         struct in6_addr *src,
-                         int iif,
-                         int type, u32 pid, u32 seq,
-                         struct nlmsghdr *in_nlh, int prefix)
+                         struct in6_addr *dst, struct in6_addr *src,
+                         int iif, int type, u32 pid, u32 seq,
+                         int prefix, unsigned int flags)
 {
         struct rtmsg *rtm;
         struct nlmsghdr  *nlh;
@@ -1584,11 +1585,7 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
                 }
         }
 
-        if (!pid && in_nlh) {
-                pid = in_nlh->nlmsg_pid;
-        }
-
-        nlh = NLMSG_PUT(skb, pid, seq, type, sizeof(*rtm));
+        nlh = NLMSG_NEW(skb, pid, seq, type, sizeof(*rtm), flags);
         rtm = NLMSG_DATA(nlh);
         rtm->rtm_family = AF_INET6;
         rtm->rtm_dst_len = rt->rt6i_dst.plen;
@@ -1674,7 +1671,7 @@ static int rt6_dump_route(struct rt6_info *rt, void *p_arg)
 
         return rt6_fill_node(arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
                      NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq,
-                     NULL, prefix);
+                     prefix, NLM_F_MULTI);
 }
 
 static int fib6_dump_node(struct fib6_walker_t *w)
@@ -1822,7 +1819,7 @@ int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void *arg)
                             &fl.fl6_dst, &fl.fl6_src,
                             iif,
                             RTM_NEWROUTE, NETLINK_CB(in_skb).pid,
-                            nlh->nlmsg_seq, nlh, 0);
+                            nlh->nlmsg_seq, 0, 0);
         if (err < 0) {
                 err = -EMSGSIZE;
                 goto out_free;
@@ -1838,17 +1835,25 @@ out_free:
         goto out;       
 }
 
-void inet6_rt_notify(int event, struct rt6_info *rt, struct nlmsghdr *nlh)
+void inet6_rt_notify(int event, struct rt6_info *rt, struct nlmsghdr *nlh, 
+                        struct netlink_skb_parms *req)
 {
         struct sk_buff *skb;
         int size = NLMSG_SPACE(sizeof(struct rtmsg)+256);
+        u32 pid = current->pid;
+        u32 seq = 0;
 
+        if (req)
+                pid = req->pid;
+        if (nlh)
+                seq = nlh->nlmsg_seq;
+        
         skb = alloc_skb(size, gfp_any());
         if (!skb) {
                 netlink_set_err(rtnl, 0, RTMGRP_IPV6_ROUTE, ENOBUFS);
                 return;
         }
-        if (rt6_fill_node(skb, rt, NULL, NULL, 0, event, 0, 0, nlh, 0) < 0) {
+        if (rt6_fill_node(skb, rt, NULL, NULL, 0, event, pid, seq, 0, 0) < 0) {
                 kfree_skb(skb);
                 netlink_set_err(rtnl, 0, RTMGRP_IPV6_ROUTE, EINVAL);
                 return;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index b788f55e139b..e553e5b80d6e 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -195,7 +195,6 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct ip_tunnel_parm *parms, int
         dev_hold(dev);
 
         ipip6_tunnel_link(nt);
-        /* Do not decrement MOD_USE_COUNT here. */
         return nt;
 
 failed:
@@ -794,10 +793,28 @@ static struct net_protocol sit_protocol = {
         .err_handler    =       ipip6_err,
 };
 
+static void __exit sit_destroy_tunnels(void)
+{
+        int prio;
+
+        for (prio = 1; prio < 4; prio++) {
+                int h;
+                for (h = 0; h < HASH_SIZE; h++) {
+                        struct ip_tunnel *t;
+                        while ((t = tunnels[prio][h]) != NULL)
+                                unregister_netdevice(t->dev);
+                }
+        }
+}
+
 void __exit sit_cleanup(void)
 {
         inet_del_protocol(&sit_protocol, IPPROTO_IPV6);
-        unregister_netdev(ipip6_fb_tunnel_dev);
+
+        rtnl_lock();
+        sit_destroy_tunnels();
+        unregister_netdevice(ipip6_fb_tunnel_dev);
+        rtnl_unlock();
 }
 
 int __init sit_init(void)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 0f69e800a0ad..f6e288dc116e 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -65,7 +65,7 @@
 #include <linux/seq_file.h>
 
 static void     tcp_v6_send_reset(struct sk_buff *skb);
-static void     tcp_v6_or_send_ack(struct sk_buff *skb, struct open_request *req);
+static void     tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req);
 static void     tcp_v6_send_check(struct sock *sk, struct tcphdr *th, int len, 
                                   struct sk_buff *skb);
 
@@ -394,24 +394,26 @@ static u32 tcp_v6_synq_hash(struct in6_addr *raddr, u16 rport, u32 rnd)
         return c & (TCP_SYNQ_HSIZE - 1);
 }
 
-static struct open_request *tcp_v6_search_req(struct tcp_sock *tp,
-                                              struct open_request ***prevp,
+static struct request_sock *tcp_v6_search_req(struct tcp_sock *tp,
+                                              struct request_sock ***prevp,
                                               __u16 rport,
                                               struct in6_addr *raddr,
                                               struct in6_addr *laddr,
                                               int iif)
 {
-        struct tcp_listen_opt *lopt = tp->listen_opt;
-        struct open_request *req, **prev;  
+        struct listen_sock *lopt = tp->accept_queue.listen_opt;
+        struct request_sock *req, **prev;  
 
         for (prev = &lopt->syn_table[tcp_v6_synq_hash(raddr, rport, lopt->hash_rnd)];
              (req = *prev) != NULL;
              prev = &req->dl_next) {
-                if (req->rmt_port == rport &&
-                    req->class->family == AF_INET6 &&
-                    ipv6_addr_equal(&req->af.v6_req.rmt_addr, raddr) &&
-                    ipv6_addr_equal(&req->af.v6_req.loc_addr, laddr) &&
-                    (!req->af.v6_req.iif || req->af.v6_req.iif == iif)) {
+                const struct tcp6_request_sock *treq = tcp6_rsk(req);
+
+                if (inet_rsk(req)->rmt_port == rport &&
+                    req->rsk_ops->family == AF_INET6 &&
+                    ipv6_addr_equal(&treq->rmt_addr, raddr) &&
+                    ipv6_addr_equal(&treq->loc_addr, laddr) &&
+                    (!treq->iif || treq->iif == iif)) {
                         BUG_TRAP(req->sk == NULL);
                         *prevp = prev;
                         return req;
@@ -906,9 +908,9 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         icmpv6_err_convert(type, code, &err);
 
-        /* Might be for an open_request */
+        /* Might be for an request_sock */
         switch (sk->sk_state) {
-                struct open_request *req, **prev;
+                struct request_sock *req, **prev;
         case TCP_LISTEN:
                 if (sock_owned_by_user(sk))
                         goto out;
@@ -923,7 +925,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                  */
                 BUG_TRAP(req->sk == NULL);
 
-                if (seq != req->snt_isn) {
+                if (seq != tcp_rsk(req)->snt_isn) {
                         NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
                         goto out;
                 }
@@ -957,9 +959,10 @@ out:
 }
 
 
-static int tcp_v6_send_synack(struct sock *sk, struct open_request *req,
+static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
                               struct dst_entry *dst)
 {
+        struct tcp6_request_sock *treq = tcp6_rsk(req);
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct sk_buff * skb;
         struct ipv6_txoptions *opt = NULL;
@@ -969,19 +972,19 @@ static int tcp_v6_send_synack(struct sock *sk, struct open_request *req,
 
         memset(&fl, 0, sizeof(fl));
         fl.proto = IPPROTO_TCP;
-        ipv6_addr_copy(&fl.fl6_dst, &req->af.v6_req.rmt_addr);
-        ipv6_addr_copy(&fl.fl6_src, &req->af.v6_req.loc_addr);
+        ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
+        ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
         fl.fl6_flowlabel = 0;
-        fl.oif = req->af.v6_req.iif;
-        fl.fl_ip_dport = req->rmt_port;
+        fl.oif = treq->iif;
+        fl.fl_ip_dport = inet_rsk(req)->rmt_port;
         fl.fl_ip_sport = inet_sk(sk)->sport;
 
         if (dst == NULL) {
                 opt = np->opt;
                 if (opt == NULL &&
                     np->rxopt.bits.srcrt == 2 &&
-                    req->af.v6_req.pktopts) {
-                        struct sk_buff *pktopts = req->af.v6_req.pktopts;
+                    treq->pktopts) {
+                        struct sk_buff *pktopts = treq->pktopts;
                         struct inet6_skb_parm *rxopt = IP6CB(pktopts);
                         if (rxopt->srcrt)
                                 opt = ipv6_invert_rthdr(sk, (struct ipv6_rt_hdr*)(pktopts->nh.raw + rxopt->srcrt));
@@ -1008,10 +1011,10 @@ static int tcp_v6_send_synack(struct sock *sk, struct open_request *req,
                 struct tcphdr *th = skb->h.th;
 
                 th->check = tcp_v6_check(th, skb->len,
-                                         &req->af.v6_req.loc_addr, &req->af.v6_req.rmt_addr,
+                                         &treq->loc_addr, &treq->rmt_addr,
                                          csum_partial((char *)th, skb->len, skb->csum));
 
-                ipv6_addr_copy(&fl.fl6_dst, &req->af.v6_req.rmt_addr);
+                ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
                 err = ip6_xmit(sk, skb, &fl, opt, 0);
                 if (err == NET_XMIT_CN)
                         err = 0;
@@ -1024,17 +1027,18 @@ done:
         return err;
 }
 
-static void tcp_v6_or_free(struct open_request *req)
+static void tcp_v6_reqsk_destructor(struct request_sock *req)
 {
-        if (req->af.v6_req.pktopts)
-                kfree_skb(req->af.v6_req.pktopts);
+        if (tcp6_rsk(req)->pktopts)
+                kfree_skb(tcp6_rsk(req)->pktopts);
 }
 
-static struct or_calltable or_ipv6 = {
+static struct request_sock_ops tcp6_request_sock_ops = {
         .family         =       AF_INET6,
+        .obj_size       =       sizeof(struct tcp6_request_sock),
         .rtx_syn_ack    =       tcp_v6_send_synack,
-        .send_ack       =       tcp_v6_or_send_ack,
-        .destructor     =       tcp_v6_or_free,
+        .send_ack       =       tcp_v6_reqsk_send_ack,
+        .destructor     =       tcp_v6_reqsk_destructor,
         .send_reset     =       tcp_v6_send_reset
 };
 
@@ -1219,15 +1223,15 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
         tcp_tw_put(tw);
 }
 
-static void tcp_v6_or_send_ack(struct sk_buff *skb, struct open_request *req)
+static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
 {
-        tcp_v6_send_ack(skb, req->snt_isn+1, req->rcv_isn+1, req->rcv_wnd, req->ts_recent);
+        tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent);
 }
 
 
 static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 {
-        struct open_request *req, **prev;
+        struct request_sock *req, **prev;
         struct tcphdr *th = skb->h.th;
         struct tcp_sock *tp = tcp_sk(sk);
         struct sock *nsk;
@@ -1260,21 +1264,13 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
         return sk;
 }
 
-static void tcp_v6_synq_add(struct sock *sk, struct open_request *req)
+static void tcp_v6_synq_add(struct sock *sk, struct request_sock *req)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct tcp_listen_opt *lopt = tp->listen_opt;
-        u32 h = tcp_v6_synq_hash(&req->af.v6_req.rmt_addr, req->rmt_port, lopt->hash_rnd);
-
-        req->sk = NULL;
-        req->expires = jiffies + TCP_TIMEOUT_INIT;
-        req->retrans = 0;
-        req->dl_next = lopt->syn_table[h];
-
-        write_lock(&tp->syn_wait_lock);
-        lopt->syn_table[h] = req;
-        write_unlock(&tp->syn_wait_lock);
+        struct listen_sock *lopt = tp->accept_queue.listen_opt;
+        u32 h = tcp_v6_synq_hash(&tcp6_rsk(req)->rmt_addr, inet_rsk(req)->rmt_port, lopt->hash_rnd);
 
+        reqsk_queue_hash_req(&tp->accept_queue, h, req, TCP_TIMEOUT_INIT);
         tcp_synq_added(sk);
 }
 
@@ -1284,10 +1280,11 @@ static void tcp_v6_synq_add(struct sock *sk, struct open_request *req)
  */
 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 {
+        struct tcp6_request_sock *treq;
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct tcp_options_received tmp_opt;
         struct tcp_sock *tp = tcp_sk(sk);
-        struct open_request *req = NULL;
+        struct request_sock *req = NULL;
         __u32 isn = TCP_SKB_CB(skb)->when;
 
         if (skb->protocol == htons(ETH_P_IP))
@@ -1308,7 +1305,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         if (sk_acceptq_is_full(sk) && tcp_synq_young(sk) > 1)
                 goto drop;
 
-        req = tcp_openreq_alloc();
+        req = reqsk_alloc(&tcp6_request_sock_ops);
         if (req == NULL)
                 goto drop;
 
@@ -1321,28 +1318,28 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
         tcp_openreq_init(req, &tmp_opt, skb);
 
-        req->class = &or_ipv6;
-        ipv6_addr_copy(&req->af.v6_req.rmt_addr, &skb->nh.ipv6h->saddr);
-        ipv6_addr_copy(&req->af.v6_req.loc_addr, &skb->nh.ipv6h->daddr);
+        treq = tcp6_rsk(req);
+        ipv6_addr_copy(&treq->rmt_addr, &skb->nh.ipv6h->saddr);
+        ipv6_addr_copy(&treq->loc_addr, &skb->nh.ipv6h->daddr);
         TCP_ECN_create_request(req, skb->h.th);
-        req->af.v6_req.pktopts = NULL;
+        treq->pktopts = NULL;
         if (ipv6_opt_accepted(sk, skb) ||
             np->rxopt.bits.rxinfo ||
             np->rxopt.bits.rxhlim) {
                 atomic_inc(&skb->users);
-                req->af.v6_req.pktopts = skb;
+                treq->pktopts = skb;
         }
-        req->af.v6_req.iif = sk->sk_bound_dev_if;
+        treq->iif = sk->sk_bound_dev_if;
 
         /* So that link locals have meaning */
         if (!sk->sk_bound_dev_if &&
-            ipv6_addr_type(&req->af.v6_req.rmt_addr) & IPV6_ADDR_LINKLOCAL)
-                req->af.v6_req.iif = tcp_v6_iif(skb);
+            ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
+                treq->iif = tcp_v6_iif(skb);
 
         if (isn == 0) 
                 isn = tcp_v6_init_sequence(sk,skb);
 
-        req->snt_isn = isn;
+        tcp_rsk(req)->snt_isn = isn;
 
         if (tcp_v6_send_synack(sk, req, NULL))
                 goto drop;
@@ -1353,16 +1350,17 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 
 drop:
         if (req)
-                tcp_openreq_free(req);
+                reqsk_free(req);
 
         TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
         return 0; /* don't send reset */
 }
 
 static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
-                                          struct open_request *req,
+                                          struct request_sock *req,
                                           struct dst_entry *dst)
 {
+        struct tcp6_request_sock *treq = tcp6_rsk(req);
         struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
         struct tcp6_sock *newtcp6sk;
         struct inet_sock *newinet;
@@ -1426,10 +1424,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 goto out_overflow;
 
         if (np->rxopt.bits.srcrt == 2 &&
-            opt == NULL && req->af.v6_req.pktopts) {
-                struct inet6_skb_parm *rxopt = IP6CB(req->af.v6_req.pktopts);
+            opt == NULL && treq->pktopts) {
+                struct inet6_skb_parm *rxopt = IP6CB(treq->pktopts);
                 if (rxopt->srcrt)
-                        opt = ipv6_invert_rthdr(sk, (struct ipv6_rt_hdr*)(req->af.v6_req.pktopts->nh.raw+rxopt->srcrt));
+                        opt = ipv6_invert_rthdr(sk, (struct ipv6_rt_hdr *)(treq->pktopts->nh.raw + rxopt->srcrt));
         }
 
         if (dst == NULL) {
@@ -1438,16 +1436,16 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
                 memset(&fl, 0, sizeof(fl));
                 fl.proto = IPPROTO_TCP;
-                ipv6_addr_copy(&fl.fl6_dst, &req->af.v6_req.rmt_addr);
+                ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
                 if (opt && opt->srcrt) {
                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
                         ipv6_addr_copy(&final, &fl.fl6_dst);
                         ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
                         final_p = &final;
                 }
-                ipv6_addr_copy(&fl.fl6_src, &req->af.v6_req.loc_addr);
+                ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
                 fl.oif = sk->sk_bound_dev_if;
-                fl.fl_ip_dport = req->rmt_port;
+                fl.fl_ip_dport = inet_rsk(req)->rmt_port;
                 fl.fl_ip_sport = inet_sk(sk)->sport;
 
                 if (ip6_dst_lookup(sk, &dst, &fl))
@@ -1482,10 +1480,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 
-        ipv6_addr_copy(&newnp->daddr, &req->af.v6_req.rmt_addr);
-        ipv6_addr_copy(&newnp->saddr, &req->af.v6_req.loc_addr);
-        ipv6_addr_copy(&newnp->rcv_saddr, &req->af.v6_req.loc_addr);
-        newsk->sk_bound_dev_if = req->af.v6_req.iif;
+        ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
+        ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
+        ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
+        newsk->sk_bound_dev_if = treq->iif;
 
         /* Now IPv6 options... 
 
@@ -1498,11 +1496,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
         /* Clone pktoptions received with SYN */
         newnp->pktoptions = NULL;
-        if (req->af.v6_req.pktopts) {
-                newnp->pktoptions = skb_clone(req->af.v6_req.pktopts,
-                                              GFP_ATOMIC);
-                kfree_skb(req->af.v6_req.pktopts);
-                req->af.v6_req.pktopts = NULL;
+        if (treq->pktopts != NULL) {
+                newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
+                kfree_skb(treq->pktopts);
+                treq->pktopts = NULL;
                 if (newnp->pktoptions)
                         skb_set_owner_r(newnp->pktoptions, newsk);
         }
@@ -2021,14 +2018,14 @@ static int tcp_v6_init_sock(struct sock *sk)
          */
         tp->snd_ssthresh = 0x7fffffff;
         tp->snd_cwnd_clamp = ~0;
-        tp->mss_cache_std = tp->mss_cache = 536;
+        tp->mss_cache = 536;
 
         tp->reordering = sysctl_tcp_reordering;
 
         sk->sk_state = TCP_CLOSE;
 
         tp->af_specific = &ipv6_specific;
-
+        tp->ca_ops = &tcp_init_congestion_ops;
         sk->sk_write_space = sk_stream_write_space;
         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
 
@@ -2050,7 +2047,7 @@ static int tcp_v6_destroy_sock(struct sock *sk)
 
 /* Proc filesystem TCPv6 sock list dumping. */
 static void get_openreq6(struct seq_file *seq, 
-                         struct sock *sk, struct open_request *req, int i, int uid)
+                         struct sock *sk, struct request_sock *req, int i, int uid)
 {
         struct in6_addr *dest, *src;
         int ttd = req->expires - jiffies;
@@ -2058,8 +2055,8 @@ static void get_openreq6(struct seq_file *seq,
         if (ttd < 0)
                 ttd = 0;
 
-        src = &req->af.v6_req.loc_addr;
-        dest = &req->af.v6_req.rmt_addr;
+        src = &tcp6_rsk(req)->loc_addr;
+        dest = &tcp6_rsk(req)->rmt_addr;
         seq_printf(seq,
                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
                    "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
@@ -2069,7 +2066,7 @@ static void get_openreq6(struct seq_file *seq,
                    ntohs(inet_sk(sk)->sport),
                    dest->s6_addr32[0], dest->s6_addr32[1],
                    dest->s6_addr32[2], dest->s6_addr32[3],
-                   ntohs(req->rmt_port),
+                   ntohs(inet_rsk(req)->rmt_port),
                    TCP_SYN_RECV,
                    0,0, /* could print option size, but that is af dependent. */
                    1,   /* timers active (only the expire timer) */  
@@ -2239,6 +2236,7 @@ struct proto tcpv6_prot = {
         .sysctl_rmem            = sysctl_tcp_rmem,
         .max_header             = MAX_TCP_HEADER,
         .obj_size               = sizeof(struct tcp6_sock),
+        .rsk_prot               = &tcp6_request_sock_ops,
 };
 
 static struct inet6_protocol tcpv6_protocol = {
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index e251d0ba4f39..eff050ac7049 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -300,12 +300,12 @@ csum_copy_err:
         /* Clear queue. */
         if (flags&MSG_PEEK) {
                 int clear = 0;
-                spin_lock_irq(&sk->sk_receive_queue.lock);
+                spin_lock_bh(&sk->sk_receive_queue.lock);
                 if (skb == skb_peek(&sk->sk_receive_queue)) {
                         __skb_unlink(skb, &sk->sk_receive_queue);
                         clear = 1;
                 }
-                spin_unlock_irq(&sk->sk_receive_queue.lock);
+                spin_unlock_bh(&sk->sk_receive_queue.lock);
                 if (clear)
                         kfree_skb(skb);
         }
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index ffcadd68b951..60c26c87277e 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -466,7 +466,7 @@ static void xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         return;
 }
 
-static int xfrm6_tunnel_init_state(struct xfrm_state *x, void *args)
+static int xfrm6_tunnel_init_state(struct xfrm_state *x)
 {
         if (!x->props.mode)
                 return -EINVAL;
diff --git a/net/ipx/Kconfig b/net/ipx/Kconfig
index a16237c0e783..980a826f5d02 100644
--- a/net/ipx/Kconfig
+++ b/net/ipx/Kconfig
@@ -1,6 +1,39 @@
 #
 # IPX configuration
 #
+config IPX
+        tristate "The IPX protocol"
+        select LLC
+        ---help---
+          This is support for the Novell networking protocol, IPX, commonly
+          used for local networks of Windows machines.  You need it if you
+          want to access Novell NetWare file or print servers using the Linux
+          Novell client ncpfs (available from
+          <ftp://platan.vc.cvut.cz/pub/linux/ncpfs/>) or from
+          within the Linux DOS emulator DOSEMU (read the DOSEMU-HOWTO,
+          available from <http://www.tldp.org/docs.html#howto>).  In order
+          to do the former, you'll also have to say Y to "NCP file system
+          support", below.
+
+          IPX is similar in scope to IP, while SPX, which runs on top of IPX,
+          is similar to TCP. There is also experimental support for SPX in
+          Linux (see "SPX networking", below).
+
+          To turn your Linux box into a fully featured NetWare file server and
+          IPX router, say Y here and fetch either lwared from
+          <ftp://ibiblio.org/pub/Linux/system/network/daemons/> or
+          mars_nwe from <ftp://www.compu-art.de/mars_nwe/>. For more
+          information, read the IPX-HOWTO available from
+          <http://www.tldp.org/docs.html#howto>.
+
+          General information about how to connect Linux, Windows machines and
+          Macs is on the WWW at <http://www.eats.com/linux_mac_win.html>.
+
+          The IPX driver would enlarge your kernel by about 16 KB. To compile
+          this driver as a module, choose M here: the module will be called ipx.
+          Unless you want to integrate your Linux box with a local Novell
+          network, say N.
+
 config IPX_INTERN
         bool "IPX: Full internal IPX network"
         depends on IPX
diff --git a/net/irda/irlap.c b/net/irda/irlap.c
index 046ad0750e48..7029618f5719 100644
--- a/net/irda/irlap.c
+++ b/net/irda/irlap.c
@@ -445,9 +445,8 @@ void irlap_disconnect_request(struct irlap_cb *self)
         IRDA_ASSERT(self->magic == LAP_MAGIC, return;);
 
         /* Don't disconnect until all data frames are successfully sent */
-        if (skb_queue_len(&self->txq) > 0) {
+        if (!skb_queue_empty(&self->txq)) {
                 self->disconnect_pending = TRUE;
-
                 return;
         }
 
diff --git a/net/irda/irlap_event.c b/net/irda/irlap_event.c
index 1cd89f5f3b75..a505b5457608 100644
--- a/net/irda/irlap_event.c
+++ b/net/irda/irlap_event.c
@@ -191,7 +191,7 @@ static void irlap_start_poll_timer(struct irlap_cb *self, int timeout)
          * Send out the RR frames faster if our own transmit queue is empty, or
          * if the peer is busy. The effect is a much faster conversation
          */
-        if ((skb_queue_len(&self->txq) == 0) || (self->remote_busy)) {
+        if (skb_queue_empty(&self->txq) || self->remote_busy) {
                 if (self->fast_RR == TRUE) {
                         /*
                          *  Assert that the fast poll timer has not reached the
@@ -263,7 +263,7 @@ void irlap_do_event(struct irlap_cb *self, IRLAP_EVENT event,
                 IRDA_DEBUG(2, "%s() : queue len = %d\n", __FUNCTION__,
                            skb_queue_len(&self->txq));
 
-                if (skb_queue_len(&self->txq)) {
+                if (!skb_queue_empty(&self->txq)) {
                         /* Prevent race conditions with irlap_data_request() */
                         self->local_busy = TRUE;
 
@@ -1074,7 +1074,7 @@ static int irlap_state_xmit_p(struct irlap_cb *self, IRLAP_EVENT event,
 #else   /* CONFIG_IRDA_DYNAMIC_WINDOW */
                         /* Window has been adjusted for the max packet
                          * size, so much simpler... - Jean II */
-                        nextfit = (skb_queue_len(&self->txq) > 0);
+                        nextfit = !skb_queue_empty(&self->txq);
 #endif  /* CONFIG_IRDA_DYNAMIC_WINDOW */
                         /*
                          *  Send data with poll bit cleared only if window > 1
@@ -1814,7 +1814,7 @@ static int irlap_state_xmit_s(struct irlap_cb *self, IRLAP_EVENT event,
 #else   /* CONFIG_IRDA_DYNAMIC_WINDOW */
                         /* Window has been adjusted for the max packet
                          * size, so much simpler... - Jean II */
-                        nextfit = (skb_queue_len(&self->txq) > 0);
+                        nextfit = !skb_queue_empty(&self->txq);
 #endif /* CONFIG_IRDA_DYNAMIC_WINDOW */
                         /*
                          *  Send data with final bit cleared only if window > 1
@@ -1937,7 +1937,7 @@ static int irlap_state_nrm_s(struct irlap_cb *self, IRLAP_EVENT event,
                                 irlap_data_indication(self, skb, FALSE);
 
                                 /* Any pending data requests?  */
-                                if ((skb_queue_len(&self->txq) > 0) &&
+                                if (!skb_queue_empty(&self->txq) &&
                                     (self->window > 0))
                                 {
                                         self->ack_required = TRUE;
@@ -2038,7 +2038,7 @@ static int irlap_state_nrm_s(struct irlap_cb *self, IRLAP_EVENT event,
                         /*
                          *  Any pending data requests?
                          */
-                        if ((skb_queue_len(&self->txq) > 0) &&
+                        if (!skb_queue_empty(&self->txq) &&
                             (self->window > 0) && !self->remote_busy)
                         {
                                 irlap_data_indication(self, skb, TRUE);
@@ -2069,7 +2069,7 @@ static int irlap_state_nrm_s(struct irlap_cb *self, IRLAP_EVENT event,
                  */
                 nr_status = irlap_validate_nr_received(self, info->nr);
                 if (nr_status == NR_EXPECTED) {
-                        if ((skb_queue_len( &self->txq) > 0) &&
+                        if (!skb_queue_empty(&self->txq) &&
                             (self->window > 0)) {
                                 self->remote_busy = FALSE;
 
diff --git a/net/irda/irlap_frame.c b/net/irda/irlap_frame.c
index 040abe714aa3..6dafbb43b529 100644
--- a/net/irda/irlap_frame.c
+++ b/net/irda/irlap_frame.c
@@ -1018,11 +1018,10 @@ void irlap_resend_rejected_frames(struct irlap_cb *self, int command)
         /*
          *  We can now fill the window with additional data frames
          */
-        while (skb_queue_len( &self->txq) > 0) {
+        while (!skb_queue_empty(&self->txq)) {
 
                 IRDA_DEBUG(0, "%s(), sending additional frames!\n", __FUNCTION__);
-                if ((skb_queue_len( &self->txq) > 0) &&
-                    (self->window > 0)) {
+                if (self->window > 0) {
                         skb = skb_dequeue( &self->txq);
                         IRDA_ASSERT(skb != NULL, return;);
 
@@ -1031,8 +1030,7 @@ void irlap_resend_rejected_frames(struct irlap_cb *self, int command)
                          *  bit cleared
                          */
                         if ((self->window > 1) &&
-                            skb_queue_len(&self->txq) > 0)
-                        {
+                            !skb_queue_empty(&self->txq)) {
                                 irlap_send_data_primary(self, skb);
                         } else {
                                 irlap_send_data_primary_poll(self, skb);
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index d091ccf773b3..6602d901f8b1 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -1513,7 +1513,7 @@ int irttp_disconnect_request(struct tsap_cb *self, struct sk_buff *userdata,
         /*
          *  Check if there is still data segments in the transmit queue
          */
-        if (skb_queue_len(&self->tx_queue) > 0) {
+        if (!skb_queue_empty(&self->tx_queue)) {
                 if (priority == P_HIGH) {
                         /*
                          *  No need to send the queued data, if we are
diff --git a/net/key/af_key.c b/net/key/af_key.c
index ce980aa94ed8..4879743b945a 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -656,13 +656,18 @@ static struct sk_buff * pfkey_xfrm_state2msg(struct xfrm_state *x, int add_keys,
         sa->sadb_sa_exttype = SADB_EXT_SA;
         sa->sadb_sa_spi = x->id.spi;
         sa->sadb_sa_replay = x->props.replay_window;
-        sa->sadb_sa_state = SADB_SASTATE_DYING;
-        if (x->km.state == XFRM_STATE_VALID && !x->km.dying)
-                sa->sadb_sa_state = SADB_SASTATE_MATURE;
-        else if (x->km.state == XFRM_STATE_ACQ)
+        switch (x->km.state) {
+        case XFRM_STATE_VALID:
+                sa->sadb_sa_state = x->km.dying ?
+                        SADB_SASTATE_DYING : SADB_SASTATE_MATURE;
+                break;
+        case XFRM_STATE_ACQ:
                 sa->sadb_sa_state = SADB_SASTATE_LARVAL;
-        else if (x->km.state == XFRM_STATE_EXPIRED)
+                break;
+        default:
                 sa->sadb_sa_state = SADB_SASTATE_DEAD;
+                break;
+        }
         sa->sadb_sa_auth = 0;
         if (x->aalg) {
                 struct xfrm_algo_desc *a = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
@@ -685,6 +690,8 @@ static struct sk_buff * pfkey_xfrm_state2msg(struct xfrm_state *x, int add_keys,
                 sa->sadb_sa_flags |= SADB_SAFLAGS_NOECN;
         if (x->props.flags & XFRM_STATE_DECAP_DSCP)
                 sa->sadb_sa_flags |= SADB_SAFLAGS_DECAP_DSCP;
+        if (x->props.flags & XFRM_STATE_NOPMTUDISC)
+                sa->sadb_sa_flags |= SADB_SAFLAGS_NOPMTUDISC;
 
         /* hard time */
         if (hsc & 2) {
@@ -969,6 +976,8 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr,
                 x->props.flags |= XFRM_STATE_NOECN;
         if (sa->sadb_sa_flags & SADB_SAFLAGS_DECAP_DSCP)
                 x->props.flags |= XFRM_STATE_DECAP_DSCP;
+        if (sa->sadb_sa_flags & SADB_SAFLAGS_NOPMTUDISC)
+                x->props.flags |= XFRM_STATE_NOPMTUDISC;
 
         lifetime = (struct sadb_lifetime*) ext_hdrs[SADB_EXT_LIFETIME_HARD-1];
         if (lifetime != NULL) {
@@ -1091,17 +1100,11 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr,
                 }
         }
 
-        x->type = xfrm_get_type(proto, x->props.family);
-        if (x->type == NULL) {
-                err = -ENOPROTOOPT;
-                goto out;
-        }
-        if (x->type->init_state(x, NULL)) {
-                err = -EINVAL;
+        err = xfrm_init_state(x);
+        if (err)
                 goto out;
-        }
+
         x->km.seq = hdr->sadb_msg_seq;
-        x->km.state = XFRM_STATE_VALID;
         return x;
 
 out:
@@ -1240,13 +1243,78 @@ static int pfkey_acquire(struct sock *sk, struct sk_buff *skb, struct sadb_msg *
         return 0;
 }
 
+static inline int event2poltype(int event)
+{
+        switch (event) {
+        case XFRM_MSG_DELPOLICY:
+                return SADB_X_SPDDELETE;
+        case XFRM_MSG_NEWPOLICY:
+                return SADB_X_SPDADD;
+        case XFRM_MSG_UPDPOLICY:
+                return SADB_X_SPDUPDATE;
+        case XFRM_MSG_POLEXPIRE:
+        //      return SADB_X_SPDEXPIRE;
+        default:
+                printk("pfkey: Unknown policy event %d\n", event);
+                break;
+        }
+
+        return 0;
+}
+
+static inline int event2keytype(int event)
+{
+        switch (event) {
+        case XFRM_MSG_DELSA:
+                return SADB_DELETE;
+        case XFRM_MSG_NEWSA:
+                return SADB_ADD;
+        case XFRM_MSG_UPDSA:
+                return SADB_UPDATE;
+        case XFRM_MSG_EXPIRE:
+                return SADB_EXPIRE;
+        default:
+                printk("pfkey: Unknown SA event %d\n", event);
+                break;
+        }
+
+        return 0;
+}
+
+/* ADD/UPD/DEL */
+static int key_notify_sa(struct xfrm_state *x, struct km_event *c)
+{
+        struct sk_buff *skb;
+        struct sadb_msg *hdr;
+        int hsc = 3;
+
+        if (c->event == XFRM_MSG_DELSA)
+                hsc = 0;
+
+        skb = pfkey_xfrm_state2msg(x, 0, hsc);
+
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        hdr = (struct sadb_msg *) skb->data;
+        hdr->sadb_msg_version = PF_KEY_V2;
+        hdr->sadb_msg_type = event2keytype(c->event);
+        hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto);
+        hdr->sadb_msg_errno = 0;
+        hdr->sadb_msg_reserved = 0;
+        hdr->sadb_msg_seq = c->seq;
+        hdr->sadb_msg_pid = c->pid;
+
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL);
+
+        return 0;
+}
 
 static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
 {
-        struct sk_buff *out_skb;
-        struct sadb_msg *out_hdr;
         struct xfrm_state *x;
         int err;
+        struct km_event c;
 
         xfrm_probe_algs();
         
@@ -1254,6 +1322,7 @@ static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr,
         if (IS_ERR(x))
                 return PTR_ERR(x);
 
+        xfrm_state_hold(x);
         if (hdr->sadb_msg_type == SADB_ADD)
                 err = xfrm_state_add(x);
         else
@@ -1262,30 +1331,26 @@ static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr,
         if (err < 0) {
                 x->km.state = XFRM_STATE_DEAD;
                 xfrm_state_put(x);
-                return err;
+                goto out;
         }
 
-        out_skb = pfkey_xfrm_state2msg(x, 0, 3);
-        if (IS_ERR(out_skb))
-                return  PTR_ERR(out_skb); /* XXX Should we return 0 here ? */
-
-        out_hdr = (struct sadb_msg *) out_skb->data;
-        out_hdr->sadb_msg_version = hdr->sadb_msg_version;
-        out_hdr->sadb_msg_type = hdr->sadb_msg_type;
-        out_hdr->sadb_msg_satype = pfkey_proto2satype(x->id.proto);
-        out_hdr->sadb_msg_errno = 0;
-        out_hdr->sadb_msg_reserved = 0;
-        out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
-        out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-
-        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, sk);
-
-        return 0;
+        if (hdr->sadb_msg_type == SADB_ADD)
+                c.event = XFRM_MSG_NEWSA;
+        else
+                c.event = XFRM_MSG_UPDSA;
+        c.seq = hdr->sadb_msg_seq;
+        c.pid = hdr->sadb_msg_pid;
+        km_state_notify(x, &c);
+out:
+        xfrm_state_put(x);
+        return err;
 }
 
 static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
 {
         struct xfrm_state *x;
+        struct km_event c;
+        int err;
 
         if (!ext_hdrs[SADB_EXT_SA-1] ||
             !present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
@@ -1301,13 +1366,19 @@ static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
                 return -EPERM;
         }
         
-        xfrm_state_delete(x);
-        xfrm_state_put(x);
+        err = xfrm_state_delete(x);
+        if (err < 0) {
+                xfrm_state_put(x);
+                return err;
+        }
 
-        pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, 
-                        BROADCAST_ALL, sk);
+        c.seq = hdr->sadb_msg_seq;
+        c.pid = hdr->sadb_msg_pid;
+        c.event = XFRM_MSG_DELSA;
+        km_state_notify(x, &c);
+        xfrm_state_put(x);
 
-        return 0;
+        return err;
 }
 
 static int pfkey_get(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
@@ -1445,28 +1516,42 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, struct sadb_msg
         return 0;
 }
 
+static int key_notify_sa_flush(struct km_event *c)
+{
+        struct sk_buff *skb;
+        struct sadb_msg *hdr;
+
+        skb = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_ATOMIC);
+        if (!skb)
+                return -ENOBUFS;
+        hdr = (struct sadb_msg *) skb_put(skb, sizeof(struct sadb_msg));
+        hdr->sadb_msg_satype = pfkey_proto2satype(c->data.proto);
+        hdr->sadb_msg_seq = c->seq;
+        hdr->sadb_msg_pid = c->pid;
+        hdr->sadb_msg_version = PF_KEY_V2;
+        hdr->sadb_msg_errno = (uint8_t) 0;
+        hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL);
+
+        return 0;
+}
+
 static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
 {
         unsigned proto;
-        struct sk_buff *skb_out;
-        struct sadb_msg *hdr_out;
+        struct km_event c;
 
         proto = pfkey_satype2proto(hdr->sadb_msg_satype);
         if (proto == 0)
                 return -EINVAL;
 
-        skb_out = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_KERNEL);
-        if (!skb_out)
-                return -ENOBUFS;
-
         xfrm_state_flush(proto);
-
-        hdr_out = (struct sadb_msg *) skb_put(skb_out, sizeof(struct sadb_msg));
-        pfkey_hdr_dup(hdr_out, hdr);
-        hdr_out->sadb_msg_errno = (uint8_t) 0;
-        hdr_out->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
-
-        pfkey_broadcast(skb_out, GFP_KERNEL, BROADCAST_ALL, NULL);
+        c.data.proto = proto;
+        c.seq = hdr->sadb_msg_seq;
+        c.pid = hdr->sadb_msg_pid;
+        c.event = XFRM_MSG_FLUSHSA;
+        km_state_notify(NULL, &c);
 
         return 0;
 }
@@ -1859,6 +1944,35 @@ static void pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, i
         hdr->sadb_msg_reserved = atomic_read(&xp->refcnt);
 }
 
+static int key_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c)
+{
+        struct sk_buff *out_skb;
+        struct sadb_msg *out_hdr;
+        int err;
+
+        out_skb = pfkey_xfrm_policy2msg_prep(xp);
+        if (IS_ERR(out_skb)) {
+                err = PTR_ERR(out_skb);
+                goto out;
+        }
+        pfkey_xfrm_policy2msg(out_skb, xp, dir);
+
+        out_hdr = (struct sadb_msg *) out_skb->data;
+        out_hdr->sadb_msg_version = PF_KEY_V2;
+
+        if (c->data.byid && c->event == XFRM_MSG_DELPOLICY)
+                out_hdr->sadb_msg_type = SADB_X_SPDDELETE2;
+        else
+                out_hdr->sadb_msg_type = event2poltype(c->event);
+        out_hdr->sadb_msg_errno = 0;
+        out_hdr->sadb_msg_seq = c->seq;
+        out_hdr->sadb_msg_pid = c->pid;
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL);
+out:
+        return 0;
+
+}
+
 static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
 {
         int err;
@@ -1866,8 +1980,7 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
         struct sadb_address *sa;
         struct sadb_x_policy *pol;
         struct xfrm_policy *xp;
-        struct sk_buff *out_skb;
-        struct sadb_msg *out_hdr;
+        struct km_event c;
 
         if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
                                      ext_hdrs[SADB_EXT_ADDRESS_DST-1]) ||
@@ -1935,31 +2048,23 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
             (err = parse_ipsecrequests(xp, pol)) < 0)
                 goto out;
 
-        out_skb = pfkey_xfrm_policy2msg_prep(xp);
-        if (IS_ERR(out_skb)) {
-                err =  PTR_ERR(out_skb);
-                goto out;
-        }
-
         err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp,
                                  hdr->sadb_msg_type != SADB_X_SPDUPDATE);
         if (err) {
-                kfree_skb(out_skb);
-                goto out;
+                kfree(xp);
+                return err;
         }
 
-        pfkey_xfrm_policy2msg(out_skb, xp, pol->sadb_x_policy_dir-1);
+        if (hdr->sadb_msg_type == SADB_X_SPDUPDATE)
+                c.event = XFRM_MSG_UPDPOLICY;
+        else 
+                c.event = XFRM_MSG_NEWPOLICY;
 
-        xfrm_pol_put(xp);
+        c.seq = hdr->sadb_msg_seq;
+        c.pid = hdr->sadb_msg_pid;
 
-        out_hdr = (struct sadb_msg *) out_skb->data;
-        out_hdr->sadb_msg_version = hdr->sadb_msg_version;
-        out_hdr->sadb_msg_type = hdr->sadb_msg_type;
-        out_hdr->sadb_msg_satype = 0;
-        out_hdr->sadb_msg_errno = 0;
-        out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
-        out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, sk);
+        km_policy_notify(xp, pol->sadb_x_policy_dir-1, &c);
+        xfrm_pol_put(xp);
         return 0;
 
 out:
@@ -1973,9 +2078,8 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
         struct sadb_address *sa;
         struct sadb_x_policy *pol;
         struct xfrm_policy *xp;
-        struct sk_buff *out_skb;
-        struct sadb_msg *out_hdr;
         struct xfrm_selector sel;
+        struct km_event c;
 
         if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
                                      ext_hdrs[SADB_EXT_ADDRESS_DST-1]) ||
@@ -2010,25 +2114,40 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
 
         err = 0;
 
+        c.seq = hdr->sadb_msg_seq;
+        c.pid = hdr->sadb_msg_pid;
+        c.event = XFRM_MSG_DELPOLICY;
+        km_policy_notify(xp, pol->sadb_x_policy_dir-1, &c);
+
+        xfrm_pol_put(xp);
+        return err;
+}
+
+static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, struct sadb_msg *hdr, int dir)
+{
+        int err;
+        struct sk_buff *out_skb;
+        struct sadb_msg *out_hdr;
+        err = 0;
+
         out_skb = pfkey_xfrm_policy2msg_prep(xp);
         if (IS_ERR(out_skb)) {
                 err =  PTR_ERR(out_skb);
                 goto out;
         }
-        pfkey_xfrm_policy2msg(out_skb, xp, pol->sadb_x_policy_dir-1);
+        pfkey_xfrm_policy2msg(out_skb, xp, dir);
 
         out_hdr = (struct sadb_msg *) out_skb->data;
         out_hdr->sadb_msg_version = hdr->sadb_msg_version;
-        out_hdr->sadb_msg_type = SADB_X_SPDDELETE;
+        out_hdr->sadb_msg_type = hdr->sadb_msg_type;
         out_hdr->sadb_msg_satype = 0;
         out_hdr->sadb_msg_errno = 0;
         out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
         out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, sk);
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk);
         err = 0;
 
 out:
-        xfrm_pol_put(xp);
         return err;
 }
 
@@ -2037,8 +2156,7 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
         int err;
         struct sadb_x_policy *pol;
         struct xfrm_policy *xp;
-        struct sk_buff *out_skb;
-        struct sadb_msg *out_hdr;
+        struct km_event c;
 
         if ((pol = ext_hdrs[SADB_X_EXT_POLICY-1]) == NULL)
                 return -EINVAL;
@@ -2050,24 +2168,16 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
 
         err = 0;
 
-        out_skb = pfkey_xfrm_policy2msg_prep(xp);
-        if (IS_ERR(out_skb)) {
-                err =  PTR_ERR(out_skb);
-                goto out;
+        c.seq = hdr->sadb_msg_seq;
+        c.pid = hdr->sadb_msg_pid;
+        if (hdr->sadb_msg_type == SADB_X_SPDDELETE2) {
+                c.data.byid = 1;
+                c.event = XFRM_MSG_DELPOLICY;
+                km_policy_notify(xp, pol->sadb_x_policy_dir-1, &c);
+        } else {
+                err = key_pol_get_resp(sk, xp, hdr, pol->sadb_x_policy_dir-1);
         }
-        pfkey_xfrm_policy2msg(out_skb, xp, pol->sadb_x_policy_dir-1);
 
-        out_hdr = (struct sadb_msg *) out_skb->data;
-        out_hdr->sadb_msg_version = hdr->sadb_msg_version;
-        out_hdr->sadb_msg_type = hdr->sadb_msg_type;
-        out_hdr->sadb_msg_satype = 0;
-        out_hdr->sadb_msg_errno = 0;
-        out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
-        out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, sk);
-        err = 0;
-
-out:
         xfrm_pol_put(xp);
         return err;
 }
@@ -2102,22 +2212,34 @@ static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, struct sadb_msg *
         return xfrm_policy_walk(dump_sp, &data);
 }
 
-static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
+static int key_notify_policy_flush(struct km_event *c)
 {
         struct sk_buff *skb_out;
-        struct sadb_msg *hdr_out;
+        struct sadb_msg *hdr;
 
-        skb_out = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_KERNEL);
+        skb_out = alloc_skb(sizeof(struct sadb_msg) + 16, GFP_ATOMIC);
         if (!skb_out)
                 return -ENOBUFS;
+        hdr = (struct sadb_msg *) skb_put(skb_out, sizeof(struct sadb_msg));
+        hdr->sadb_msg_seq = c->seq;
+        hdr->sadb_msg_pid = c->pid;
+        hdr->sadb_msg_version = PF_KEY_V2;
+        hdr->sadb_msg_errno = (uint8_t) 0;
+        hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+        pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL);
+        return 0;
 
-        xfrm_policy_flush();
+}
 
-        hdr_out = (struct sadb_msg *) skb_put(skb_out, sizeof(struct sadb_msg));
-        pfkey_hdr_dup(hdr_out, hdr);
-        hdr_out->sadb_msg_errno = (uint8_t) 0;
-        hdr_out->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
-        pfkey_broadcast(skb_out, GFP_KERNEL, BROADCAST_ALL, NULL);
+static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
+{
+        struct km_event c;
+
+        xfrm_policy_flush();
+        c.event = XFRM_MSG_FLUSHPOLICY;
+        c.pid = hdr->sadb_msg_pid;
+        c.seq = hdr->sadb_msg_seq;
+        km_policy_notify(NULL, 0, &c);
 
         return 0;
 }
@@ -2317,11 +2439,23 @@ static void dump_esp_combs(struct sk_buff *skb, struct xfrm_tmpl *t)
         }
 }
 
-static int pfkey_send_notify(struct xfrm_state *x, int hard)
+static int key_notify_policy_expire(struct xfrm_policy *xp, struct km_event *c)
+{
+        return 0;
+}
+
+static int key_notify_sa_expire(struct xfrm_state *x, struct km_event *c)
 {
         struct sk_buff *out_skb;
         struct sadb_msg *out_hdr;
-        int hsc = (hard ? 2 : 1);
+        int hard;
+        int hsc;
+
+        hard = c->data.hard;
+        if (hard)
+                hsc = 2;
+        else
+                hsc = 1;
 
         out_skb = pfkey_xfrm_state2msg(x, 0, hsc);
         if (IS_ERR(out_skb))
@@ -2340,6 +2474,44 @@ static int pfkey_send_notify(struct xfrm_state *x, int hard)
         return 0;
 }
 
+static int pfkey_send_notify(struct xfrm_state *x, struct km_event *c)
+{
+        switch (c->event) {
+        case XFRM_MSG_EXPIRE:
+                return key_notify_sa_expire(x, c);
+        case XFRM_MSG_DELSA:
+        case XFRM_MSG_NEWSA:
+        case XFRM_MSG_UPDSA:
+                return key_notify_sa(x, c);
+        case XFRM_MSG_FLUSHSA:
+                return key_notify_sa_flush(c);
+        default:
+                printk("pfkey: Unknown SA event %d\n", c->event);
+                break;
+        }
+
+        return 0;
+}
+
+static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
+{
+        switch (c->event) {
+        case XFRM_MSG_POLEXPIRE:
+                return key_notify_policy_expire(xp, c);
+        case XFRM_MSG_DELPOLICY:
+        case XFRM_MSG_NEWPOLICY:
+        case XFRM_MSG_UPDPOLICY:
+                return key_notify_policy(xp, dir, c);
+        case XFRM_MSG_FLUSHPOLICY:
+                return key_notify_policy_flush(c);
+        default:
+                printk("pfkey: Unknown policy event %d\n", c->event);
+                break;
+        }
+
+        return 0;
+}
+
 static u32 get_acqseq(void)
 {
         u32 res;
@@ -2856,6 +3028,7 @@ static struct xfrm_mgr pfkeyv2_mgr =
         .acquire        = pfkey_send_acquire,
         .compile_policy = pfkey_compile_policy,
         .new_mapping    = pfkey_send_new_mapping,
+        .notify_policy  = pfkey_send_policy_notify,
 };
 
 static void __exit ipsec_pfkey_exit(void)
diff --git a/net/lapb/Kconfig b/net/lapb/Kconfig
new file mode 100644
index 000000000000..f0b5efb31a00
--- /dev/null
+++ b/net/lapb/Kconfig
@@ -0,0 +1,22 @@
+#
+# LAPB Data Link Drive
+#
+
+config LAPB
+        tristate "LAPB Data Link Driver (EXPERIMENTAL)"
+        depends on EXPERIMENTAL
+        ---help---
+          Link Access Procedure, Balanced (LAPB) is the data link layer (i.e.
+          the lower) part of the X.25 protocol. It offers a reliable
+          connection service to exchange data frames with one other host, and
+          it is used to transport higher level protocols (mostly X.25 Packet
+          Layer, the higher part of X.25, but others are possible as well).
+          Usually, LAPB is used with specialized X.21 network cards, but Linux
+          currently supports LAPB only over Ethernet connections. If you want
+          to use LAPB connections over Ethernet, say Y here and to "LAPB over
+          Ethernet driver" below. Read
+          <file:Documentation/networking/lapb-module.txt> for technical
+          details.
+
+          To compile this driver as a module, choose M here: the
+          module will be called lapb.  If unsure, say N.
diff --git a/net/llc/llc_c_ev.c b/net/llc/llc_c_ev.c
index cd130c3b72bc..d5bdb53a348f 100644
--- a/net/llc/llc_c_ev.c
+++ b/net/llc/llc_c_ev.c
@@ -84,7 +84,7 @@ static u16 llc_util_nr_inside_tx_window(struct sock *sk, u8 nr)
         if (llc->dev->flags & IFF_LOOPBACK)
                 goto out;
         rc = 1;
-        if (!skb_queue_len(&llc->pdu_unack_q))
+        if (skb_queue_empty(&llc->pdu_unack_q))
                 goto out;
         skb = skb_peek(&llc->pdu_unack_q);
         pdu = llc_pdu_sn_hdr(skb);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index e41ce458c2a9..ff774a06c89d 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -315,8 +315,8 @@ err:
 static void netlink_remove(struct sock *sk)
 {
         netlink_table_grab();
-        nl_table[sk->sk_protocol].hash.entries--;
-        sk_del_node_init(sk);
+        if (sk_del_node_init(sk))
+                nl_table[sk->sk_protocol].hash.entries--;
         if (nlk_sk(sk)->groups)
                 __sk_del_bind_node(sk);
         netlink_table_ungrab();
@@ -429,7 +429,12 @@ retry:
         err = netlink_insert(sk, pid);
         if (err == -EADDRINUSE)
                 goto retry;
-        return 0;
+
+        /* If 2 threads race to autobind, that is fine.  */
+        if (err == -EBUSY)
+                err = 0;
+
+        return err;
 }
 
 static inline int netlink_capable(struct socket *sock, unsigned int flag) 
@@ -643,7 +648,8 @@ void netlink_detachskb(struct sock *sk, struct sk_buff *skb)
         sock_put(sk);
 }
 
-static inline struct sk_buff *netlink_trim(struct sk_buff *skb, int allocation)
+static inline struct sk_buff *netlink_trim(struct sk_buff *skb,
+                                           unsigned int __nocast allocation)
 {
         int delta;
 
@@ -712,7 +718,7 @@ struct netlink_broadcast_data {
         int failure;
         int congested;
         int delivered;
-        int allocation;
+        unsigned int allocation;
         struct sk_buff *skb, *skb2;
 };
 
@@ -853,7 +859,7 @@ static inline void netlink_rcv_wake(struct sock *sk)
 {
         struct netlink_sock *nlk = nlk_sk(sk);
 
-        if (!skb_queue_len(&sk->sk_receive_queue))
+        if (skb_queue_empty(&sk->sk_receive_queue))
                 clear_bit(0, &nlk->state);
         if (!test_bit(0, &nlk->state))
                 wake_up_interruptible(&nlk->wait);
@@ -1095,8 +1101,7 @@ static int netlink_dump(struct sock *sk)
                 return 0;
         }
 
-        nlh = __nlmsg_put(skb, NETLINK_CB(cb->skb).pid, cb->nlh->nlmsg_seq, NLMSG_DONE, sizeof(int));
-        nlh->nlmsg_flags |= NLM_F_MULTI;
+        nlh = NLMSG_NEW_ANSWER(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI);
         memcpy(NLMSG_DATA(nlh), &len, sizeof(len));
         skb_queue_tail(&sk->sk_receive_queue, skb);
         sk->sk_data_ready(sk, skb->len);
@@ -1107,6 +1112,9 @@ static int netlink_dump(struct sock *sk)
 
         netlink_destroy_callback(cb);
         return 0;
+
+nlmsg_failure:
+        return -ENOBUFS;
 }
 
 int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
@@ -1178,7 +1186,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
         }
 
         rep = __nlmsg_put(skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq,
-                          NLMSG_ERROR, sizeof(struct nlmsgerr));
+                          NLMSG_ERROR, sizeof(struct nlmsgerr), 0);
         errmsg = NLMSG_DATA(rep);
         errmsg->error = err;
         memcpy(&errmsg->msg, nlh, err ? nlh->nlmsg_len : sizeof(struct nlmsghdr));
diff --git a/net/packet/Kconfig b/net/packet/Kconfig
new file mode 100644
index 000000000000..34ff93ff894d
--- /dev/null
+++ b/net/packet/Kconfig
@@ -0,0 +1,26 @@
+#
+# Packet configuration
+#
+
+config PACKET
+        tristate "Packet socket"
+        ---help---
+          The Packet protocol is used by applications which communicate
+          directly with network devices without an intermediate network
+          protocol implemented in the kernel, e.g. tcpdump.  If you want them
+          to work, choose Y.
+
+          To compile this driver as a module, choose M here: the module will
+          be called af_packet.
+
+          If unsure, say Y.
+
+config PACKET_MMAP
+        bool "Packet socket: mmapped IO"
+        depends on PACKET
+        help
+          If you say Y here, the Packet protocol driver will use an IO
+          mechanism that results in faster communication.
+
+          If unsure, say N.
+
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 0269616e75a1..c9d5980aa4de 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -274,6 +274,9 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct
         dst_release(skb->dst);
         skb->dst = NULL;
 
+        /* drop conntrack reference */
+        nf_reset(skb);
+
         spkt = (struct sockaddr_pkt*)skb->cb;
 
         skb_push(skb, skb->data-skb->mac.raw);
@@ -517,6 +520,9 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,  struct packe
         dst_release(skb->dst);
         skb->dst = NULL;
 
+        /* drop conntrack reference */
+        nf_reset(skb);
+
         spin_lock(&sk->sk_receive_queue.lock);
         po->stats.tp_packets++;
         __skb_queue_tail(&sk->sk_receive_queue, skb);
diff --git a/net/rxrpc/krxiod.c b/net/rxrpc/krxiod.c
index 2b537f425a17..dada34a77b21 100644
--- a/net/rxrpc/krxiod.c
+++ b/net/rxrpc/krxiod.c
@@ -138,7 +138,7 @@ static int rxrpc_krxiod(void *arg)
 
                 _debug("### End Work");
 
-                try_to_freeze(PF_FREEZE);
+                try_to_freeze();
 
                 /* discard pending signals */
                 rxrpc_discard_my_signals();
diff --git a/net/rxrpc/krxsecd.c b/net/rxrpc/krxsecd.c
index 6020c89d9228..1aadd026d354 100644
--- a/net/rxrpc/krxsecd.c
+++ b/net/rxrpc/krxsecd.c
@@ -107,7 +107,7 @@ static int rxrpc_krxsecd(void *arg)
 
                 _debug("### End Inbound Calls");
 
-                try_to_freeze(PF_FREEZE);
+                try_to_freeze();
 
                 /* discard pending signals */
                 rxrpc_discard_my_signals();
diff --git a/net/rxrpc/krxtimod.c b/net/rxrpc/krxtimod.c
index 249c2b0290bb..3ac81cdd1211 100644
--- a/net/rxrpc/krxtimod.c
+++ b/net/rxrpc/krxtimod.c
@@ -90,7 +90,7 @@ static int krxtimod(void *arg)
                         complete_and_exit(&krxtimod_dead, 0);
                 }
 
-                try_to_freeze(PF_FREEZE);
+                try_to_freeze();
 
                 /* discard pending signals */
                 rxrpc_discard_my_signals();
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index b0941186f867..59d3e71f8b85 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -1,6 +1,43 @@
 #
 # Traffic control configuration.
 # 
+
+menuconfig NET_SCHED
+        bool "QoS and/or fair queueing"
+        ---help---
+          When the kernel has several packets to send out over a network
+          device, it has to decide which ones to send first, which ones to
+          delay, and which ones to drop. This is the job of the packet
+          scheduler, and several different algorithms for how to do this
+          "fairly" have been proposed.
+
+          If you say N here, you will get the standard packet scheduler, which
+          is a FIFO (first come, first served). If you say Y here, you will be
+          able to choose from among several alternative algorithms which can
+          then be attached to different network devices. This is useful for
+          example if some of your network devices are real time devices that
+          need a certain minimum data flow rate, or if you need to limit the
+          maximum data flow rate for traffic which matches specified criteria.
+          This code is considered to be experimental.
+
+          To administer these schedulers, you'll need the user-level utilities
+          from the package iproute2+tc at <ftp://ftp.tux.org/pub/net/ip-routing/>.
+          That package also contains some documentation; for more, check out
+          <http://snafu.freedom.org/linux2.2/iproute-notes.html>.
+
+          This Quality of Service (QoS) support will enable you to use
+          Differentiated Services (diffserv) and Resource Reservation Protocol
+          (RSVP) on your Linux router if you also say Y to "QoS support",
+          "Packet classifier API" and to some classifiers below. Documentation
+          and software is at <http://diffserv.sourceforge.net/>.
+
+          If you say Y here and to "/proc file system" below, you will be able
+          to read status information about packet schedulers from the file
+          /proc/net/psched.
+
+          The available schedulers are listed in the following questions; you
+          can say Y to as many as you like. If unsure, say N now.
+
 choice
         prompt "Packet scheduler clock source"
         depends on NET_SCHED
@@ -405,7 +442,7 @@ config NET_EMATCH_STACK
         ---help---
           Size of the local stack variable used while evaluating the tree of
           ematches. Limits the depth of the tree, i.e. the number of
-          encapsulated precedences. Every level requires 4 bytes of addtional
+          encapsulated precedences. Every level requires 4 bytes of additional
           stack space.
 
 config NET_EMATCH_CMP
@@ -449,6 +486,19 @@ config NET_EMATCH_META
           To compile this code as a module, choose M here: the
           module will be called em_meta.
 
+config NET_EMATCH_TEXT
+        tristate "Textsearch"
+        depends on NET_EMATCH
+        select TEXTSEARCH
+        select TEXTSEARCH_KMP
+        select TEXTSEARCH_FSM
+        ---help---
+          Say Y here if you want to be ablt to classify packets based on
+          textsearch comparisons.
+
+          To compile this code as a module, choose M here: the
+          module will be called em_text.
+
 config NET_CLS_ACT
         bool "Packet ACTION"
         depends on EXPERIMENTAL && NET_CLS && NET_QOS
diff --git a/net/sched/Makefile b/net/sched/Makefile
index eb3fe583eba8..e48d0d456b3e 100644
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -4,7 +4,7 @@
 
 obj-y   := sch_generic.o
 
-obj-$(CONFIG_NET_SCHED)         += sch_api.o sch_fifo.o
+obj-$(CONFIG_NET_SCHED)         += sch_api.o sch_fifo.o sch_blackhole.o
 obj-$(CONFIG_NET_CLS)           += cls_api.o
 obj-$(CONFIG_NET_CLS_ACT)       += act_api.o
 obj-$(CONFIG_NET_ACT_POLICE)    += police.o
@@ -40,3 +40,4 @@ obj-$(CONFIG_NET_EMATCH_CMP)	+= em_cmp.o
 obj-$(CONFIG_NET_EMATCH_NBYTE)  += em_nbyte.o
 obj-$(CONFIG_NET_EMATCH_U32)    += em_u32.o
 obj-$(CONFIG_NET_EMATCH_META)   += em_meta.o
+obj-$(CONFIG_NET_EMATCH_TEXT)   += em_text.o
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index cafcb084098d..249c61936ea0 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -428,17 +428,19 @@ errout:
 
 static int
 tca_get_fill(struct sk_buff *skb, struct tc_action *a, u32 pid, u32 seq,
-             unsigned flags, int event, int bind, int ref)
+             u16 flags, int event, int bind, int ref)
 {
         struct tcamsg *t;
         struct nlmsghdr *nlh;
         unsigned char *b = skb->tail;
         struct rtattr *x;
 
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*t));
-        nlh->nlmsg_flags = flags;
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*t), flags);
+
         t = NLMSG_DATA(nlh);
         t->tca_family = AF_UNSPEC;
+        t->tca__pad1 = 0;
+        t->tca__pad2 = 0;
         
         x = (struct rtattr*) skb->tail;
         RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
@@ -580,6 +582,8 @@ static int tca_action_flush(struct rtattr *rta, struct nlmsghdr *n, u32 pid)
         nlh = NLMSG_PUT(skb, pid, n->nlmsg_seq, RTM_DELACTION, sizeof(*t));
         t = NLMSG_DATA(nlh);
         t->tca_family = AF_UNSPEC;
+        t->tca__pad1 = 0;
+        t->tca__pad2 = 0;
 
         x = (struct rtattr *) skb->tail;
         RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
@@ -669,7 +673,7 @@ err:
 }
 
 static int tcf_add_notify(struct tc_action *a, u32 pid, u32 seq, int event,
-                          unsigned flags)
+                          u16 flags)
 {
         struct tcamsg *t;
         struct nlmsghdr *nlh;
@@ -684,11 +688,12 @@ static int tcf_add_notify(struct tc_action *a, u32 pid, u32 seq, int event,
 
         b = (unsigned char *)skb->tail;
 
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*t));
-        nlh->nlmsg_flags = flags;
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*t), flags);
         t = NLMSG_DATA(nlh);
         t->tca_family = AF_UNSPEC;
-        
+        t->tca__pad1 = 0;
+        t->tca__pad2 = 0;
+
         x = (struct rtattr*) skb->tail;
         RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
 
@@ -843,6 +848,8 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
                         cb->nlh->nlmsg_type, sizeof(*t));
         t = NLMSG_DATA(nlh);
         t->tca_family = AF_UNSPEC;
+        t->tca__pad1 = 0;
+        t->tca__pad2 = 0;
 
         x = (struct rtattr *) skb->tail;
         RTA_PUT(skb, TCA_ACT_TAB, 0, NULL);
@@ -881,7 +888,7 @@ static int __init tc_action_init(void)
                 link_p[RTM_GETACTION-RTM_BASE].dumpit = tc_dump_action;
         }
 
-        printk("TC classifier action (bugs to netdev@oss.sgi.com cc "
+        printk("TC classifier action (bugs to netdev@vger.kernel.org cc "
                "hadi@cyberus.ca)\n");
         return 0;
 }
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 56e66c3fe0fa..3b5714ef4d1a 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -322,16 +322,17 @@ errout:
 
 static int
 tcf_fill_node(struct sk_buff *skb, struct tcf_proto *tp, unsigned long fh,
-              u32 pid, u32 seq, unsigned flags, int event)
+              u32 pid, u32 seq, u16 flags, int event)
 {
         struct tcmsg *tcm;
         struct nlmsghdr  *nlh;
         unsigned char    *b = skb->tail;
 
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*tcm));
-        nlh->nlmsg_flags = flags;
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags);
         tcm = NLMSG_DATA(nlh);
         tcm->tcm_family = AF_UNSPEC;
+        tcm->tcm__pad1 = 0;
+        tcm->tcm__pad1 = 0;
         tcm->tcm_ifindex = tp->q->dev->ifindex;
         tcm->tcm_parent = tp->classid;
         tcm->tcm_info = TC_H_MAKE(tp->prio, tp->protocol);
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index 0d2d4415f334..dfb300bb6baa 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -261,6 +261,9 @@ static int basic_dump(struct tcf_proto *tp, unsigned long fh,
         rta = (struct rtattr *) b;
         RTA_PUT(skb, TCA_OPTIONS, 0, NULL);
 
+        if (f->res.classid)
+                RTA_PUT(skb, TCA_BASIC_CLASSID, sizeof(u32), &f->res.classid);
+
         if (tcf_exts_dump(skb, &f->exts, &basic_ext_map) < 0 ||
             tcf_em_tree_dump(skb, &f->ematches, TCA_BASIC_EMATCHES) < 0)
                 goto rtattr_failure;
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index 232fb9196810..006168d69376 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -618,6 +618,7 @@ static int rsvp_dump(struct tcf_proto *tp, unsigned long fh,
         pinfo.protocol = s->protocol;
         pinfo.tunnelid = s->tunnelid;
         pinfo.tunnelhdr = f->tunnelhdr;
+        pinfo.pad = 0;
         RTA_PUT(skb, TCA_RSVP_PINFO, sizeof(pinfo), &pinfo);
         if (f->res.classid)
                 RTA_PUT(skb, TCA_RSVP_CLASSID, 4, &f->res.classid);
diff --git a/net/sched/em_meta.c b/net/sched/em_meta.c
index f1eeaf65cee5..00eae5f9a01a 100644
--- a/net/sched/em_meta.c
+++ b/net/sched/em_meta.c
@@ -27,17 +27,17 @@
  *               lvalue                                   rvalue
  *            +-----------+                           +-----------+
  *            | type: INT |                           | type: INT |
- *       def  | id: INDEV |                           | id: VALUE |
+ *       def  | id: DEV   |                           | id: VALUE |
  *            | data:     |                           | data: 3   |
  *            +-----------+                           +-----------+
  *                  |                                       |
- *                  ---> meta_ops[INT][INDEV](...)          |
- *                            |                            |
+ *                  ---> meta_ops[INT][DEV](...)            |
+ *                            |                             |
  *                  -----------                             |
  *                  V                                       V
  *            +-----------+                           +-----------+
  *            | type: INT |                           | type: INT |
- *       obj  | id: INDEV |                           | id: VALUE |
+ *       obj  | id: DEV |                             | id: VALUE |
  *            | data: 2   |<--data got filled out     | data: 3   |
  *            +-----------+                           +-----------+
  *                  |                                         |
@@ -70,6 +70,7 @@
 #include <net/dst.h>
 #include <net/route.h>
 #include <net/pkt_cls.h>
+#include <net/sock.h>
 
 struct meta_obj
 {
@@ -169,26 +170,6 @@ META_COLLECTOR(var_dev)
         *err = var_dev(skb->dev, dst);
 }
 
-META_COLLECTOR(int_indev)
-{
-        *err = int_dev(skb->input_dev, dst);
-}
-
-META_COLLECTOR(var_indev)
-{
-        *err = var_dev(skb->input_dev, dst);
-}
-
-META_COLLECTOR(int_realdev)
-{
-        *err = int_dev(skb->real_dev, dst);
-}
-
-META_COLLECTOR(var_realdev)
-{
-        *err = var_dev(skb->real_dev, dst);
-}
-
 /**************************************************************************
  * skb attributes
  **************************************************************************/
@@ -204,11 +185,6 @@ META_COLLECTOR(int_protocol)
         dst->value = skb->protocol;
 }
 
-META_COLLECTOR(int_security)
-{
-        dst->value = skb->security;
-}
-
 META_COLLECTOR(int_pkttype)
 {
         dst->value = skb->pkt_type;
@@ -233,12 +209,14 @@ META_COLLECTOR(int_maclen)
  * Netfilter
  **************************************************************************/
 
-#ifdef CONFIG_NETFILTER
 META_COLLECTOR(int_nfmark)
 {
+#ifdef CONFIG_NETFILTER
         dst->value = skb->nfmark;
-}
+#else
+        dst->value = 0;
 #endif
+}
 
 /**************************************************************************
  * Traffic Control
@@ -249,31 +227,21 @@ META_COLLECTOR(int_tcindex)
         dst->value = skb->tc_index;
 }
 
-#ifdef CONFIG_NET_CLS_ACT
-META_COLLECTOR(int_tcverd)
-{
-        dst->value = skb->tc_verd;
-}
-
-META_COLLECTOR(int_tcclassid)
-{
-        dst->value = skb->tc_classid;
-}
-#endif
-
 /**************************************************************************
  * Routing
  **************************************************************************/
 
-#ifdef CONFIG_NET_CLS_ROUTE
 META_COLLECTOR(int_rtclassid)
 {
         if (unlikely(skb->dst == NULL))
                 *err = -1;
         else
+#ifdef CONFIG_NET_CLS_ROUTE
                 dst->value = skb->dst->tclassid;
-}
+#else
+                dst->value = 0;
 #endif
+}
 
 META_COLLECTOR(int_rtiif)
 {
@@ -284,6 +252,214 @@ META_COLLECTOR(int_rtiif)
 }
 
 /**************************************************************************
+ * Socket Attributes
+ **************************************************************************/
+
+#define SKIP_NONLOCAL(skb)                      \
+        if (unlikely(skb->sk == NULL)) {        \
+                *err = -1;                      \
+                return;                         \
+        }
+
+META_COLLECTOR(int_sk_family)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_family;
+}
+
+META_COLLECTOR(int_sk_state)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_state;
+}
+
+META_COLLECTOR(int_sk_reuse)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_reuse;
+}
+
+META_COLLECTOR(int_sk_bound_if)
+{
+        SKIP_NONLOCAL(skb);
+        /* No error if bound_dev_if is 0, legal userspace check */
+        dst->value = skb->sk->sk_bound_dev_if;
+}
+
+META_COLLECTOR(var_sk_bound_if)
+{
+        SKIP_NONLOCAL(skb);
+
+         if (skb->sk->sk_bound_dev_if == 0) {
+                dst->value = (unsigned long) "any";
+                dst->len = 3;
+         } else  {
+                struct net_device *dev;
+                
+                dev = dev_get_by_index(skb->sk->sk_bound_dev_if);
+                *err = var_dev(dev, dst);
+                if (dev)
+                        dev_put(dev);
+         }
+}
+
+META_COLLECTOR(int_sk_refcnt)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = atomic_read(&skb->sk->sk_refcnt);
+}
+
+META_COLLECTOR(int_sk_rcvbuf)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_rcvbuf;
+}
+
+META_COLLECTOR(int_sk_shutdown)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_shutdown;
+}
+
+META_COLLECTOR(int_sk_proto)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_protocol;
+}
+
+META_COLLECTOR(int_sk_type)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_type;
+}
+
+META_COLLECTOR(int_sk_rmem_alloc)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = atomic_read(&skb->sk->sk_rmem_alloc);
+}
+
+META_COLLECTOR(int_sk_wmem_alloc)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = atomic_read(&skb->sk->sk_wmem_alloc);
+}
+
+META_COLLECTOR(int_sk_omem_alloc)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = atomic_read(&skb->sk->sk_omem_alloc);
+}
+
+META_COLLECTOR(int_sk_rcv_qlen)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_receive_queue.qlen;
+}
+
+META_COLLECTOR(int_sk_snd_qlen)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_write_queue.qlen;
+}
+
+META_COLLECTOR(int_sk_wmem_queued)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_wmem_queued;
+}
+
+META_COLLECTOR(int_sk_fwd_alloc)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_forward_alloc;
+}
+
+META_COLLECTOR(int_sk_sndbuf)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_sndbuf;
+}
+
+META_COLLECTOR(int_sk_alloc)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_allocation;
+}
+
+META_COLLECTOR(int_sk_route_caps)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_route_caps;
+}
+
+META_COLLECTOR(int_sk_hashent)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_hashent;
+}
+
+META_COLLECTOR(int_sk_lingertime)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_lingertime / HZ;
+}
+
+META_COLLECTOR(int_sk_err_qlen)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_error_queue.qlen;
+}
+
+META_COLLECTOR(int_sk_ack_bl)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_ack_backlog;
+}
+
+META_COLLECTOR(int_sk_max_ack_bl)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_max_ack_backlog;
+}
+
+META_COLLECTOR(int_sk_prio)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_priority;
+}
+
+META_COLLECTOR(int_sk_rcvlowat)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_rcvlowat;
+}
+
+META_COLLECTOR(int_sk_rcvtimeo)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_rcvtimeo / HZ;
+}
+
+META_COLLECTOR(int_sk_sndtimeo)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_sndtimeo / HZ;
+}
+
+META_COLLECTOR(int_sk_sendmsg_off)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_sndmsg_off;
+}
+
+META_COLLECTOR(int_sk_write_pend)
+{
+        SKIP_NONLOCAL(skb);
+        dst->value = skb->sk->sk_write_pending;
+}
+
+/**************************************************************************
  * Meta value collectors assignment table
  **************************************************************************/
 
@@ -293,41 +469,62 @@ struct meta_ops
                                struct meta_value *, struct meta_obj *, int *);
 };
 
+#define META_ID(name) TCF_META_ID_##name
+#define META_FUNC(name) { .get = meta_##name }
+
 /* Meta value operations table listing all meta value collectors and
  * assigns them to a type and meta id. */
 static struct meta_ops __meta_ops[TCF_META_TYPE_MAX+1][TCF_META_ID_MAX+1] = {
         [TCF_META_TYPE_VAR] = {
-                [TCF_META_ID_DEV]       = { .get = meta_var_dev },
-                [TCF_META_ID_INDEV]     = { .get = meta_var_indev },
-                [TCF_META_ID_REALDEV]   = { .get = meta_var_realdev }
+                [META_ID(DEV)]                  = META_FUNC(var_dev),
+                [META_ID(SK_BOUND_IF)]          = META_FUNC(var_sk_bound_if),
         },
         [TCF_META_TYPE_INT] = {
-                [TCF_META_ID_RANDOM]    = { .get = meta_int_random },
-                [TCF_META_ID_LOADAVG_0] = { .get = meta_int_loadavg_0 },
-                [TCF_META_ID_LOADAVG_1] = { .get = meta_int_loadavg_1 },
-                [TCF_META_ID_LOADAVG_2] = { .get = meta_int_loadavg_2 },
-                [TCF_META_ID_DEV]       = { .get = meta_int_dev },
-                [TCF_META_ID_INDEV]     = { .get = meta_int_indev },
-                [TCF_META_ID_REALDEV]   = { .get = meta_int_realdev },
-                [TCF_META_ID_PRIORITY]  = { .get = meta_int_priority },
-                [TCF_META_ID_PROTOCOL]  = { .get = meta_int_protocol },
-                [TCF_META_ID_SECURITY]  = { .get = meta_int_security },
-                [TCF_META_ID_PKTTYPE]   = { .get = meta_int_pkttype },
-                [TCF_META_ID_PKTLEN]    = { .get = meta_int_pktlen },
-                [TCF_META_ID_DATALEN]   = { .get = meta_int_datalen },
-                [TCF_META_ID_MACLEN]    = { .get = meta_int_maclen },
-#ifdef CONFIG_NETFILTER
-                [TCF_META_ID_NFMARK]    = { .get = meta_int_nfmark },
-#endif
-                [TCF_META_ID_TCINDEX]   = { .get = meta_int_tcindex },
-#ifdef CONFIG_NET_CLS_ACT
-                [TCF_META_ID_TCVERDICT] = { .get = meta_int_tcverd },
-                [TCF_META_ID_TCCLASSID] = { .get = meta_int_tcclassid },
-#endif
-#ifdef CONFIG_NET_CLS_ROUTE
-                [TCF_META_ID_RTCLASSID] = { .get = meta_int_rtclassid },
-#endif
-                [TCF_META_ID_RTIIF]     = { .get = meta_int_rtiif }
+                [META_ID(RANDOM)]               = META_FUNC(int_random),
+                [META_ID(LOADAVG_0)]            = META_FUNC(int_loadavg_0),
+                [META_ID(LOADAVG_1)]            = META_FUNC(int_loadavg_1),
+                [META_ID(LOADAVG_2)]            = META_FUNC(int_loadavg_2),
+                [META_ID(DEV)]                  = META_FUNC(int_dev),
+                [META_ID(PRIORITY)]             = META_FUNC(int_priority),
+                [META_ID(PROTOCOL)]             = META_FUNC(int_protocol),
+                [META_ID(PKTTYPE)]              = META_FUNC(int_pkttype),
+                [META_ID(PKTLEN)]               = META_FUNC(int_pktlen),
+                [META_ID(DATALEN)]              = META_FUNC(int_datalen),
+                [META_ID(MACLEN)]               = META_FUNC(int_maclen),
+                [META_ID(NFMARK)]               = META_FUNC(int_nfmark),
+                [META_ID(TCINDEX)]              = META_FUNC(int_tcindex),
+                [META_ID(RTCLASSID)]            = META_FUNC(int_rtclassid),
+                [META_ID(RTIIF)]                = META_FUNC(int_rtiif),
+                [META_ID(SK_FAMILY)]            = META_FUNC(int_sk_family),
+                [META_ID(SK_STATE)]             = META_FUNC(int_sk_state),
+                [META_ID(SK_REUSE)]             = META_FUNC(int_sk_reuse),
+                [META_ID(SK_BOUND_IF)]          = META_FUNC(int_sk_bound_if),
+                [META_ID(SK_REFCNT)]            = META_FUNC(int_sk_refcnt),
+                [META_ID(SK_RCVBUF)]            = META_FUNC(int_sk_rcvbuf),
+                [META_ID(SK_SNDBUF)]            = META_FUNC(int_sk_sndbuf),
+                [META_ID(SK_SHUTDOWN)]          = META_FUNC(int_sk_shutdown),
+                [META_ID(SK_PROTO)]             = META_FUNC(int_sk_proto),
+                [META_ID(SK_TYPE)]              = META_FUNC(int_sk_type),
+                [META_ID(SK_RMEM_ALLOC)]        = META_FUNC(int_sk_rmem_alloc),
+                [META_ID(SK_WMEM_ALLOC)]        = META_FUNC(int_sk_wmem_alloc),
+                [META_ID(SK_OMEM_ALLOC)]        = META_FUNC(int_sk_omem_alloc),
+                [META_ID(SK_WMEM_QUEUED)]       = META_FUNC(int_sk_wmem_queued),
+                [META_ID(SK_RCV_QLEN)]          = META_FUNC(int_sk_rcv_qlen),
+                [META_ID(SK_SND_QLEN)]          = META_FUNC(int_sk_snd_qlen),
+                [META_ID(SK_ERR_QLEN)]          = META_FUNC(int_sk_err_qlen),
+                [META_ID(SK_FORWARD_ALLOCS)]    = META_FUNC(int_sk_fwd_alloc),
+                [META_ID(SK_ALLOCS)]            = META_FUNC(int_sk_alloc),
+                [META_ID(SK_ROUTE_CAPS)]        = META_FUNC(int_sk_route_caps),
+                [META_ID(SK_HASHENT)]           = META_FUNC(int_sk_hashent),
+                [META_ID(SK_LINGERTIME)]        = META_FUNC(int_sk_lingertime),
+                [META_ID(SK_ACK_BACKLOG)]       = META_FUNC(int_sk_ack_bl),
+                [META_ID(SK_MAX_ACK_BACKLOG)]   = META_FUNC(int_sk_max_ack_bl),
+                [META_ID(SK_PRIO)]              = META_FUNC(int_sk_prio),
+                [META_ID(SK_RCVLOWAT)]          = META_FUNC(int_sk_rcvlowat),
+                [META_ID(SK_RCVTIMEO)]          = META_FUNC(int_sk_rcvtimeo),
+                [META_ID(SK_SNDTIMEO)]          = META_FUNC(int_sk_sndtimeo),
+                [META_ID(SK_SENDMSG_OFF)]       = META_FUNC(int_sk_sendmsg_off),
+                [META_ID(SK_WRITE_PENDING)]     = META_FUNC(int_sk_write_pend),
         }
 };
 
@@ -396,9 +593,9 @@ static int meta_int_compare(struct meta_obj *a, struct meta_obj *b)
         /* Let gcc optimize it, the unlikely is not really based on
          * some numbers but jump free code for mismatches seems
          * more logical. */
-        if (unlikely(a == b))
+        if (unlikely(a->value == b->value))
                 return 0;
-        else if (a < b)
+        else if (a->value < b->value)
                 return -1;
         else
                 return 1;
diff --git a/net/sched/em_text.c b/net/sched/em_text.c
new file mode 100644
index 000000000000..77beabc91fa3
--- /dev/null
+++ b/net/sched/em_text.c
@@ -0,0 +1,154 @@
+/*
+ * net/sched/em_text.c  Textsearch ematch
+ *
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              as published by the Free Software Foundation; either version
+ *              2 of the License, or (at your option) any later version.
+ *
+ * Authors:     Thomas Graf <tgraf@suug.ch>
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/string.h>
+#include <linux/skbuff.h>
+#include <linux/textsearch.h>
+#include <linux/tc_ematch/tc_em_text.h>
+#include <net/pkt_cls.h>
+
+struct text_match
+{
+        u16                     from_offset;
+        u16                     to_offset;
+        u8                      from_layer;
+        u8                      to_layer;
+        struct ts_config        *config;
+};
+
+#define EM_TEXT_PRIV(m) ((struct text_match *) (m)->data)
+
+static int em_text_match(struct sk_buff *skb, struct tcf_ematch *m,
+                         struct tcf_pkt_info *info)
+{
+        struct text_match *tm = EM_TEXT_PRIV(m);
+        int from, to;
+        struct ts_state state;
+
+        from = tcf_get_base_ptr(skb, tm->from_layer) - skb->data;
+        from += tm->from_offset;
+
+        to = tcf_get_base_ptr(skb, tm->to_layer) - skb->data;
+        to += tm->to_offset;
+
+        return skb_find_text(skb, from, to, tm->config, &state) != UINT_MAX;
+}
+
+static int em_text_change(struct tcf_proto *tp, void *data, int len,
+                          struct tcf_ematch *m)
+{
+        struct text_match *tm;
+        struct tcf_em_text *conf = data;
+        struct ts_config *ts_conf;
+        int flags = 0;
+
+        if (len < sizeof(*conf) || len < (sizeof(*conf) + conf->pattern_len))
+                return -EINVAL;
+
+        if (conf->from_layer > conf->to_layer)
+                return -EINVAL;
+
+        if (conf->from_layer == conf->to_layer &&
+            conf->from_offset > conf->to_offset)
+                return -EINVAL;
+
+retry:
+        ts_conf = textsearch_prepare(conf->algo, (u8 *) conf + sizeof(*conf),
+                                     conf->pattern_len, GFP_KERNEL, flags);
+
+        if (flags & TS_AUTOLOAD)
+                rtnl_lock();
+
+        if (IS_ERR(ts_conf)) {
+                if (PTR_ERR(ts_conf) == -ENOENT && !(flags & TS_AUTOLOAD)) {
+                        rtnl_unlock();
+                        flags |= TS_AUTOLOAD;
+                        goto retry;
+                } else
+                        return PTR_ERR(ts_conf);
+        } else if (flags & TS_AUTOLOAD) {
+                textsearch_destroy(ts_conf);
+                return -EAGAIN;
+        }
+
+        tm = kmalloc(sizeof(*tm), GFP_KERNEL);
+        if (tm == NULL) {
+                textsearch_destroy(ts_conf);
+                return -ENOBUFS;
+        }
+
+        tm->from_offset = conf->from_offset;
+        tm->to_offset   = conf->to_offset;
+        tm->from_layer  = conf->from_layer;
+        tm->to_layer    = conf->to_layer;
+        tm->config      = ts_conf;
+
+        m->datalen = sizeof(*tm);
+        m->data = (unsigned long) tm;
+
+        return 0;
+}
+
+static void em_text_destroy(struct tcf_proto *tp, struct tcf_ematch *m)
+{
+        textsearch_destroy(EM_TEXT_PRIV(m)->config);
+}
+
+static int em_text_dump(struct sk_buff *skb, struct tcf_ematch *m)
+{
+        struct text_match *tm = EM_TEXT_PRIV(m);
+        struct tcf_em_text conf;
+
+        strncpy(conf.algo, tm->config->ops->name, sizeof(conf.algo) - 1);
+        conf.from_offset = tm->from_offset;
+        conf.to_offset = tm->to_offset;
+        conf.from_layer = tm->from_layer;
+        conf.to_layer = tm->to_layer;
+        conf.pattern_len = textsearch_get_pattern_len(tm->config);
+        conf.pad = 0;
+
+        RTA_PUT_NOHDR(skb, sizeof(conf), &conf);
+        RTA_APPEND(skb, conf.pattern_len, textsearch_get_pattern(tm->config));
+        return 0;
+
+rtattr_failure:
+        return -1;
+}               
+
+static struct tcf_ematch_ops em_text_ops = {
+        .kind     = TCF_EM_TEXT,
+        .change   = em_text_change,
+        .match    = em_text_match,
+        .destroy  = em_text_destroy,
+        .dump     = em_text_dump,
+        .owner    = THIS_MODULE,
+        .link     = LIST_HEAD_INIT(em_text_ops.link)
+};
+
+static int __init init_em_text(void)
+{
+        return tcf_em_register(&em_text_ops);
+}
+
+static void __exit exit_em_text(void) 
+{
+        tcf_em_unregister(&em_text_ops);
+}
+
+MODULE_LICENSE("GPL");
+
+module_init(init_em_text);
+module_exit(exit_em_text);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 07977f8f2679..b9a069af4a02 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -399,10 +399,8 @@ qdisc_create(struct net_device *dev, u32 handle, struct rtattr **tca, int *errp)
 {
         int err;
         struct rtattr *kind = tca[TCA_KIND-1];
-        void *p = NULL;
         struct Qdisc *sch;
         struct Qdisc_ops *ops;
-        int size;
 
         ops = qdisc_lookup_ops(kind);
 #ifdef CONFIG_KMOD
@@ -437,64 +435,55 @@ qdisc_create(struct net_device *dev, u32 handle, struct rtattr **tca, int *errp)
         if (ops == NULL)
                 goto err_out;
 
-        /* ensure that the Qdisc and the private data are 32-byte aligned */
-        size = ((sizeof(*sch) + QDISC_ALIGN_CONST) & ~QDISC_ALIGN_CONST);
-        size += ops->priv_size + QDISC_ALIGN_CONST;
-
-        p = kmalloc(size, GFP_KERNEL);
-        err = -ENOBUFS;
-        if (!p)
+        sch = qdisc_alloc(dev, ops);
+        if (IS_ERR(sch)) {
+                err = PTR_ERR(sch);
                 goto err_out2;
-        memset(p, 0, size);
-        sch = (struct Qdisc *)(((unsigned long)p + QDISC_ALIGN_CONST)
-                               & ~QDISC_ALIGN_CONST);
-        sch->padded = (char *)sch - (char *)p;
-
-        INIT_LIST_HEAD(&sch->list);
-        skb_queue_head_init(&sch->q);
+        }
 
-        if (handle == TC_H_INGRESS)
+        if (handle == TC_H_INGRESS) {
                 sch->flags |= TCQ_F_INGRESS;
-
-        sch->ops = ops;
-        sch->enqueue = ops->enqueue;
-        sch->dequeue = ops->dequeue;
-        sch->dev = dev;
-        dev_hold(dev);
-        atomic_set(&sch->refcnt, 1);
-        sch->stats_lock = &dev->queue_lock;
-        if (handle == 0) {
+                handle = TC_H_MAKE(TC_H_INGRESS, 0);
+        } else if (handle == 0) {
                 handle = qdisc_alloc_handle(dev);
                 err = -ENOMEM;
                 if (handle == 0)
                         goto err_out3;
         }
 
-        if (handle == TC_H_INGRESS)
-                sch->handle =TC_H_MAKE(TC_H_INGRESS, 0);
-        else
-                sch->handle = handle;
+        sch->handle = handle;
 
         if (!ops->init || (err = ops->init(sch, tca[TCA_OPTIONS-1])) == 0) {
+#ifdef CONFIG_NET_ESTIMATOR
+                if (tca[TCA_RATE-1]) {
+                        err = gen_new_estimator(&sch->bstats, &sch->rate_est,
+                                                sch->stats_lock,
+                                                tca[TCA_RATE-1]);
+                        if (err) {
+                                /*
+                                 * Any broken qdiscs that would require
+                                 * a ops->reset() here? The qdisc was never
+                                 * in action so it shouldn't be necessary.
+                                 */
+                                if (ops->destroy)
+                                        ops->destroy(sch);
+                                goto err_out3;
+                        }
+                }
+#endif
                 qdisc_lock_tree(dev);
                 list_add_tail(&sch->list, &dev->qdisc_list);
                 qdisc_unlock_tree(dev);
 
-#ifdef CONFIG_NET_ESTIMATOR
-                if (tca[TCA_RATE-1])
-                        gen_new_estimator(&sch->bstats, &sch->rate_est,
-                                sch->stats_lock, tca[TCA_RATE-1]);
-#endif
                 return sch;
         }
 err_out3:
         dev_put(dev);
+        kfree((char *) sch - sch->padded);
 err_out2:
         module_put(ops->owner);
 err_out:
         *errp = err;
-        if (p)
-                kfree(p);
         return NULL;
 }
 
@@ -760,17 +749,18 @@ graft:
 }
 
 static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
-                         u32 pid, u32 seq, unsigned flags, int event)
+                         u32 pid, u32 seq, u16 flags, int event)
 {
         struct tcmsg *tcm;
         struct nlmsghdr  *nlh;
         unsigned char    *b = skb->tail;
         struct gnet_dump d;
 
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*tcm));
-        nlh->nlmsg_flags = flags;
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags);
         tcm = NLMSG_DATA(nlh);
         tcm->tcm_family = AF_UNSPEC;
+        tcm->tcm__pad1 = 0;
+        tcm->tcm__pad2 = 0;
         tcm->tcm_ifindex = q->dev->ifindex;
         tcm->tcm_parent = clid;
         tcm->tcm_handle = q->handle;
@@ -997,7 +987,7 @@ out:
 
 static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
                           unsigned long cl,
-                          u32 pid, u32 seq, unsigned flags, int event)
+                          u32 pid, u32 seq, u16 flags, int event)
 {
         struct tcmsg *tcm;
         struct nlmsghdr  *nlh;
@@ -1005,8 +995,7 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
         struct gnet_dump d;
         struct Qdisc_class_ops *cl_ops = q->ops->cl_ops;
 
-        nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*tcm));
-        nlh->nlmsg_flags = flags;
+        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags);
         tcm = NLMSG_DATA(nlh);
         tcm->tcm_family = AF_UNSPEC;
         tcm->tcm_ifindex = q->dev->ifindex;
diff --git a/net/sched/sch_blackhole.c b/net/sched/sch_blackhole.c
new file mode 100644
index 000000000000..81f0b8346d17
--- /dev/null
+++ b/net/sched/sch_blackhole.c
@@ -0,0 +1,54 @@
+/*
+ * net/sched/sch_blackhole.c    Black hole queue
+ *
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              as published by the Free Software Foundation; either version
+ *              2 of the License, or (at your option) any later version.
+ *
+ * Authors:     Thomas Graf <tgraf@suug.ch>
+ *
+ * Note: Quantum tunneling is not supported.
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <net/pkt_sched.h>
+
+static int blackhole_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+{
+        qdisc_drop(skb, sch);
+        return NET_XMIT_SUCCESS;
+}
+
+static struct sk_buff *blackhole_dequeue(struct Qdisc *sch)
+{
+        return NULL;
+}
+
+static struct Qdisc_ops blackhole_qdisc_ops = {
+        .id             = "blackhole",
+        .priv_size      = 0,
+        .enqueue        = blackhole_enqueue,
+        .dequeue        = blackhole_dequeue,
+        .owner          = THIS_MODULE,
+};
+
+static int __init blackhole_module_init(void)
+{
+        return register_qdisc(&blackhole_qdisc_ops);
+}
+
+static void __exit blackhole_module_exit(void)
+{
+        unregister_qdisc(&blackhole_qdisc_ops);
+}
+
+module_init(blackhole_module_init)
+module_exit(blackhole_module_exit)
+
+MODULE_LICENSE("GPL");
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index d43e3b8cbf6a..09453f997d8c 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1528,6 +1528,7 @@ static __inline__ int cbq_dump_ovl(struct sk_buff *skb, struct cbq_class *cl)
 
         opt.strategy = cl->ovl_strategy;
         opt.priority2 = cl->priority2+1;
+        opt.pad = 0;
         opt.penalty = (cl->penalty*1000)/HZ;
         RTA_PUT(skb, TCA_CBQ_OVL_STRATEGY, sizeof(opt), &opt);
         return skb->len;
@@ -1563,6 +1564,8 @@ static __inline__ int cbq_dump_police(struct sk_buff *skb, struct cbq_class *cl)
 
         if (cl->police) {
                 opt.police = cl->police;
+                opt.__res1 = 0;
+                opt.__res2 = 0;
                 RTA_PUT(skb, TCA_CBQ_POLICE, sizeof(opt), &opt);
         }
         return skb->len;
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index d8bd2a569c7c..13e0e7b3856b 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -31,7 +31,7 @@
 #endif
 
 
-#define PRIV(sch) qdisc_priv(sch)
+#define PRIV(sch) ((struct dsmark_qdisc_data *) qdisc_priv(sch))
 
 
 /*
@@ -55,24 +55,38 @@
 struct dsmark_qdisc_data {
         struct Qdisc            *q;
         struct tcf_proto        *filter_list;
-        __u8                    *mask;  /* "owns" the array */
-        __u8                    *value;
-        __u16                   indices;
-        __u32                   default_index;  /* index range is 0...0xffff */
+        u8                      *mask;  /* "owns" the array */
+        u8                      *value;
+        u16                     indices;
+        u32                     default_index;  /* index range is 0...0xffff */
         int                     set_tc_index;
 };
 
+static inline int dsmark_valid_indices(u16 indices)
+{
+        while (indices != 1) {
+                if (indices & 1)
+                        return 0;
+                indices >>= 1;
+        }
+ 
+        return 1;
+}
 
-/* ------------------------- Class/flow operations ------------------------- */
+static inline int dsmark_valid_index(struct dsmark_qdisc_data *p, u16 index)
+{
+        return (index <= p->indices && index > 0);
+}
 
+/* ------------------------- Class/flow operations ------------------------- */
 
-static int dsmark_graft(struct Qdisc *sch,unsigned long arg,
-    struct Qdisc *new,struct Qdisc **old)
+static int dsmark_graft(struct Qdisc *sch, unsigned long arg,
+                        struct Qdisc *new, struct Qdisc **old)
 {
         struct dsmark_qdisc_data *p = PRIV(sch);
 
-        DPRINTK("dsmark_graft(sch %p,[qdisc %p],new %p,old %p)\n",sch,p,new,
-            old);
+        DPRINTK("dsmark_graft(sch %p,[qdisc %p],new %p,old %p)\n",
+                sch, p, new, old);
 
         if (new == NULL) {
                 new = qdisc_create_dflt(sch->dev, &pfifo_qdisc_ops);
@@ -81,91 +95,95 @@ static int dsmark_graft(struct Qdisc *sch,unsigned long arg,
         }
 
         sch_tree_lock(sch);
-        *old = xchg(&p->q,new);
-        if (*old)
-                qdisc_reset(*old);
+        *old = xchg(&p->q, new);
+        qdisc_reset(*old);
         sch->q.qlen = 0;
-        sch_tree_unlock(sch); /* @@@ move up ? */
+        sch_tree_unlock(sch);
+
         return 0;
 }
 
-
 static struct Qdisc *dsmark_leaf(struct Qdisc *sch, unsigned long arg)
 {
-        struct dsmark_qdisc_data *p = PRIV(sch);
-
-        return p->q;
+        return PRIV(sch)->q;
 }
 
-
-static unsigned long dsmark_get(struct Qdisc *sch,u32 classid)
+static unsigned long dsmark_get(struct Qdisc *sch, u32 classid)
 {
-        struct dsmark_qdisc_data *p __attribute__((unused)) = PRIV(sch);
+        DPRINTK("dsmark_get(sch %p,[qdisc %p],classid %x)\n",
+                sch, PRIV(sch), classid);
 
-        DPRINTK("dsmark_get(sch %p,[qdisc %p],classid %x)\n",sch,p,classid);
-        return TC_H_MIN(classid)+1;
+        return TC_H_MIN(classid) + 1;
 }
 
-
 static unsigned long dsmark_bind_filter(struct Qdisc *sch,
-    unsigned long parent, u32 classid)
+                                        unsigned long parent, u32 classid)
 {
-        return dsmark_get(sch,classid);
+        return dsmark_get(sch, classid);
 }
 
-
 static void dsmark_put(struct Qdisc *sch, unsigned long cl)
 {
 }
 
-
 static int dsmark_change(struct Qdisc *sch, u32 classid, u32 parent,
-    struct rtattr **tca, unsigned long *arg)
+                         struct rtattr **tca, unsigned long *arg)
 {
         struct dsmark_qdisc_data *p = PRIV(sch);
         struct rtattr *opt = tca[TCA_OPTIONS-1];
         struct rtattr *tb[TCA_DSMARK_MAX];
+        int err = -EINVAL;
+        u8 mask = 0;
 
         DPRINTK("dsmark_change(sch %p,[qdisc %p],classid %x,parent %x),"
-            "arg 0x%lx\n",sch,p,classid,parent,*arg);
-        if (*arg > p->indices)
-                return -ENOENT;
-        if (!opt || rtattr_parse_nested(tb, TCA_DSMARK_MAX, opt))
-                return -EINVAL;
-        if (tb[TCA_DSMARK_MASK-1]) {
-                if (!RTA_PAYLOAD(tb[TCA_DSMARK_MASK-1]))
-                        return -EINVAL;
-                p->mask[*arg-1] = *(__u8 *) RTA_DATA(tb[TCA_DSMARK_MASK-1]);
-        }
-        if (tb[TCA_DSMARK_VALUE-1]) {
-                if (!RTA_PAYLOAD(tb[TCA_DSMARK_VALUE-1]))
-                        return -EINVAL;
-                p->value[*arg-1] = *(__u8 *) RTA_DATA(tb[TCA_DSMARK_VALUE-1]);
+                "arg 0x%lx\n", sch, p, classid, parent, *arg);
+
+        if (!dsmark_valid_index(p, *arg)) {
+                err = -ENOENT;
+                goto rtattr_failure;
         }
-        return 0;
-}
 
+        if (!opt || rtattr_parse_nested(tb, TCA_DSMARK_MAX, opt))
+                goto rtattr_failure;
+
+        if (tb[TCA_DSMARK_MASK-1])
+                mask = RTA_GET_U8(tb[TCA_DSMARK_MASK-1]);
+
+        if (tb[TCA_DSMARK_VALUE-1])
+                p->value[*arg-1] = RTA_GET_U8(tb[TCA_DSMARK_VALUE-1]);
+                
+        if (tb[TCA_DSMARK_MASK-1])
+                p->mask[*arg-1] = mask;
+
+        err = 0;
 
-static int dsmark_delete(struct Qdisc *sch,unsigned long arg)
+rtattr_failure:
+        return err;
+}
+
+static int dsmark_delete(struct Qdisc *sch, unsigned long arg)
 {
         struct dsmark_qdisc_data *p = PRIV(sch);
 
-        if (!arg || arg > p->indices)
+        if (!dsmark_valid_index(p, arg))
                 return -EINVAL;
+        
         p->mask[arg-1] = 0xff;
         p->value[arg-1] = 0;
+
         return 0;
 }
 
-
 static void dsmark_walk(struct Qdisc *sch,struct qdisc_walker *walker)
 {
         struct dsmark_qdisc_data *p = PRIV(sch);
         int i;
 
-        DPRINTK("dsmark_walk(sch %p,[qdisc %p],walker %p)\n",sch,p,walker);
+        DPRINTK("dsmark_walk(sch %p,[qdisc %p],walker %p)\n", sch, p, walker);
+
         if (walker->stop)
                 return;
+
         for (i = 0; i < p->indices; i++) {
                 if (p->mask[i] == 0xff && !p->value[i])
                         goto ignore;
@@ -180,26 +198,20 @@ ignore:
         }
 }
 
-
 static struct tcf_proto **dsmark_find_tcf(struct Qdisc *sch,unsigned long cl)
 {
-        struct dsmark_qdisc_data *p = PRIV(sch);
-
-        return &p->filter_list;
+        return &PRIV(sch)->filter_list;
 }
 
-
 /* --------------------------- Qdisc operations ---------------------------- */
 
-
 static int dsmark_enqueue(struct sk_buff *skb,struct Qdisc *sch)
 {
         struct dsmark_qdisc_data *p = PRIV(sch);
-        struct tcf_result res;
-        int result;
-        int ret = NET_XMIT_POLICED;
+        int err;
+
+        D2PRINTK("dsmark_enqueue(skb %p,sch %p,[qdisc %p])\n", skb, sch, p);
 
-        D2PRINTK("dsmark_enqueue(skb %p,sch %p,[qdisc %p])\n",skb,sch,p);
         if (p->set_tc_index) {
                 /* FIXME: Safe with non-linear skbs? --RR */
                 switch (skb->protocol) {
@@ -216,17 +228,21 @@ static int dsmark_enqueue(struct sk_buff *skb,struct Qdisc *sch)
                                 break;
                 };
         }
-        result = TC_POLICE_OK; /* be nice to gcc */
-        if (TC_H_MAJ(skb->priority) == sch->handle) {
+
+        if (TC_H_MAJ(skb->priority) == sch->handle)
                 skb->tc_index = TC_H_MIN(skb->priority);
-        } else {
-                result = tc_classify(skb,p->filter_list,&res);
-                D2PRINTK("result %d class 0x%04x\n",result,res.classid);
+        else {
+                struct tcf_result res;
+                int result = tc_classify(skb, p->filter_list, &res);
+
+                D2PRINTK("result %d class 0x%04x\n", result, res.classid);
+
                 switch (result) {
 #ifdef CONFIG_NET_CLS_POLICE
                         case TC_POLICE_SHOT:
                                 kfree_skb(skb);
-                                break;
+                                sch->qstats.drops++;
+                                return NET_XMIT_POLICED;
 #if 0
                         case TC_POLICE_RECLASSIFY:
                                 /* FIXME: what to do here ??? */
@@ -243,43 +259,45 @@ static int dsmark_enqueue(struct sk_buff *skb,struct Qdisc *sch)
                                 break;
                 };
         }
-        if (
-#ifdef CONFIG_NET_CLS_POLICE
-            result == TC_POLICE_SHOT ||
-#endif
 
-            ((ret = p->q->enqueue(skb,p->q)) != 0)) {
+        err = p->q->enqueue(skb,p->q);
+        if (err != NET_XMIT_SUCCESS) {
                 sch->qstats.drops++;
-                return ret;
+                return err;
         }
+
         sch->bstats.bytes += skb->len;
         sch->bstats.packets++;
         sch->q.qlen++;
-        return ret;
-}
 
+        return NET_XMIT_SUCCESS;
+}
 
 static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
 {
         struct dsmark_qdisc_data *p = PRIV(sch);
         struct sk_buff *skb;
-        int index;
+        u32 index;
+
+        D2PRINTK("dsmark_dequeue(sch %p,[qdisc %p])\n", sch, p);
 
-        D2PRINTK("dsmark_dequeue(sch %p,[qdisc %p])\n",sch,p);
         skb = p->q->ops->dequeue(p->q);
-        if (!skb)
+        if (skb == NULL)
                 return NULL;
+
         sch->q.qlen--;
-        index = skb->tc_index & (p->indices-1);
-        D2PRINTK("index %d->%d\n",skb->tc_index,index);
+
+        index = skb->tc_index & (p->indices - 1);
+        D2PRINTK("index %d->%d\n", skb->tc_index, index);
+
         switch (skb->protocol) {
                 case __constant_htons(ETH_P_IP):
-                        ipv4_change_dsfield(skb->nh.iph,
-                            p->mask[index],p->value[index]);
+                        ipv4_change_dsfield(skb->nh.iph, p->mask[index],
+                                            p->value[index]);
                         break;
                 case __constant_htons(ETH_P_IPV6):
-                        ipv6_change_dsfield(skb->nh.ipv6h,
-                            p->mask[index],p->value[index]);
+                        ipv6_change_dsfield(skb->nh.ipv6h, p->mask[index],
+                                            p->value[index]);
                         break;
                 default:
                         /*
@@ -293,152 +311,162 @@ static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
                                        htons(skb->protocol));
                         break;
         };
+
         return skb;
 }
 
-
 static int dsmark_requeue(struct sk_buff *skb,struct Qdisc *sch)
 {
-        int ret;
         struct dsmark_qdisc_data *p = PRIV(sch);
+        int err;
 
-        D2PRINTK("dsmark_requeue(skb %p,sch %p,[qdisc %p])\n",skb,sch,p);
-        if ((ret = p->q->ops->requeue(skb, p->q)) == 0) {
-                sch->q.qlen++;
-                sch->qstats.requeues++;
-                return 0;
+        D2PRINTK("dsmark_requeue(skb %p,sch %p,[qdisc %p])\n", skb, sch, p);
+
+        err = p->q->ops->requeue(skb, p->q);
+        if (err != NET_XMIT_SUCCESS) {
+                sch->qstats.drops++;
+                return err;
         }
-        sch->qstats.drops++;
-        return ret;
-}
 
+        sch->q.qlen++;
+        sch->qstats.requeues++;
+
+        return NET_XMIT_SUCCESS;
+}
 
 static unsigned int dsmark_drop(struct Qdisc *sch)
 {
         struct dsmark_qdisc_data *p = PRIV(sch);
         unsigned int len;
         
-        DPRINTK("dsmark_reset(sch %p,[qdisc %p])\n",sch,p);
-        if (!p->q->ops->drop)
-                return 0;
-        if (!(len = p->q->ops->drop(p->q)))
+        DPRINTK("dsmark_reset(sch %p,[qdisc %p])\n", sch, p);
+
+        if (p->q->ops->drop == NULL)
                 return 0;
-        sch->q.qlen--;
+
+        len = p->q->ops->drop(p->q);
+        if (len)
+                sch->q.qlen--;
+
         return len;
 }
 
-
-static int dsmark_init(struct Qdisc *sch,struct rtattr *opt)
+static int dsmark_init(struct Qdisc *sch, struct rtattr *opt)
 {
         struct dsmark_qdisc_data *p = PRIV(sch);
         struct rtattr *tb[TCA_DSMARK_MAX];
-        __u16 tmp;
-
-        DPRINTK("dsmark_init(sch %p,[qdisc %p],opt %p)\n",sch,p,opt);
-        if (!opt ||
-            rtattr_parse(tb,TCA_DSMARK_MAX,RTA_DATA(opt),RTA_PAYLOAD(opt)) < 0 ||
-            !tb[TCA_DSMARK_INDICES-1] ||
-            RTA_PAYLOAD(tb[TCA_DSMARK_INDICES-1]) < sizeof(__u16))
-                return -EINVAL;
-        p->indices = *(__u16 *) RTA_DATA(tb[TCA_DSMARK_INDICES-1]);
-        if (!p->indices)
-                return -EINVAL;
-        for (tmp = p->indices; tmp != 1; tmp >>= 1) {
-                if (tmp & 1)
-                        return -EINVAL;
-        }
-        p->default_index = NO_DEFAULT_INDEX;
-        if (tb[TCA_DSMARK_DEFAULT_INDEX-1]) {
-                if (RTA_PAYLOAD(tb[TCA_DSMARK_DEFAULT_INDEX-1]) < sizeof(__u16))
-                        return -EINVAL;
-                p->default_index =
-                    *(__u16 *) RTA_DATA(tb[TCA_DSMARK_DEFAULT_INDEX-1]);
+        int err = -EINVAL;
+        u32 default_index = NO_DEFAULT_INDEX;
+        u16 indices;
+        u8 *mask;
+
+        DPRINTK("dsmark_init(sch %p,[qdisc %p],opt %p)\n", sch, p, opt);
+
+        if (!opt || rtattr_parse_nested(tb, TCA_DSMARK_MAX, opt) < 0)
+                goto errout;
+
+        indices = RTA_GET_U16(tb[TCA_DSMARK_INDICES-1]);
+        if (!indices || !dsmark_valid_indices(indices))
+                goto errout;
+
+        if (tb[TCA_DSMARK_DEFAULT_INDEX-1])
+                default_index = RTA_GET_U16(tb[TCA_DSMARK_DEFAULT_INDEX-1]);
+
+        mask = kmalloc(indices * 2, GFP_KERNEL);
+        if (mask == NULL) {
+                err = -ENOMEM;
+                goto errout;
         }
-        p->set_tc_index = !!tb[TCA_DSMARK_SET_TC_INDEX-1];
-        p->mask = kmalloc(p->indices*2,GFP_KERNEL);
-        if (!p->mask)
-                return -ENOMEM;
-        p->value = p->mask+p->indices;
-        memset(p->mask,0xff,p->indices);
-        memset(p->value,0,p->indices);
-        if (!(p->q = qdisc_create_dflt(sch->dev, &pfifo_qdisc_ops)))
+
+        p->mask = mask;
+        memset(p->mask, 0xff, indices);
+
+        p->value = p->mask + indices;
+        memset(p->value, 0, indices);
+
+        p->indices = indices;
+        p->default_index = default_index;
+        p->set_tc_index = RTA_GET_FLAG(tb[TCA_DSMARK_SET_TC_INDEX-1]);
+
+        p->q = qdisc_create_dflt(sch->dev, &pfifo_qdisc_ops);
+        if (p->q == NULL)
                 p->q = &noop_qdisc;
-        DPRINTK("dsmark_init: qdisc %p\n",&p->q);
-        return 0;
-}
 
+        DPRINTK("dsmark_init: qdisc %p\n", p->q);
+
+        err = 0;
+errout:
+rtattr_failure:
+        return err;
+}
 
 static void dsmark_reset(struct Qdisc *sch)
 {
         struct dsmark_qdisc_data *p = PRIV(sch);
 
-        DPRINTK("dsmark_reset(sch %p,[qdisc %p])\n",sch,p);
+        DPRINTK("dsmark_reset(sch %p,[qdisc %p])\n", sch, p);
         qdisc_reset(p->q);
         sch->q.qlen = 0;
 }
 
-
 static void dsmark_destroy(struct Qdisc *sch)
 {
         struct dsmark_qdisc_data *p = PRIV(sch);
         struct tcf_proto *tp;
 
-        DPRINTK("dsmark_destroy(sch %p,[qdisc %p])\n",sch,p);
+        DPRINTK("dsmark_destroy(sch %p,[qdisc %p])\n", sch, p);
+
         while (p->filter_list) {
                 tp = p->filter_list;
                 p->filter_list = tp->next;
                 tcf_destroy(tp);
         }
+
         qdisc_destroy(p->q);
         kfree(p->mask);
 }
 
-
 static int dsmark_dump_class(struct Qdisc *sch, unsigned long cl,
-    struct sk_buff *skb, struct tcmsg *tcm)
+                             struct sk_buff *skb, struct tcmsg *tcm)
 {
         struct dsmark_qdisc_data *p = PRIV(sch);
-        unsigned char *b = skb->tail;
-        struct rtattr *rta;
+        struct rtattr *opts = NULL;
+
+        DPRINTK("dsmark_dump_class(sch %p,[qdisc %p],class %ld\n", sch, p, cl);
 
-        DPRINTK("dsmark_dump_class(sch %p,[qdisc %p],class %ld\n",sch,p,cl);
-        if (!cl || cl > p->indices)
+        if (!dsmark_valid_index(p, cl))
                 return -EINVAL;
-        tcm->tcm_handle = TC_H_MAKE(TC_H_MAJ(sch->handle),cl-1);
-        rta = (struct rtattr *) b;
-        RTA_PUT(skb,TCA_OPTIONS,0,NULL);
-        RTA_PUT(skb,TCA_DSMARK_MASK,1,&p->mask[cl-1]);
-        RTA_PUT(skb,TCA_DSMARK_VALUE,1,&p->value[cl-1]);
-        rta->rta_len = skb->tail-b;
-        return skb->len;
+
+        tcm->tcm_handle = TC_H_MAKE(TC_H_MAJ(sch->handle), cl-1);
+
+        opts = RTA_NEST(skb, TCA_OPTIONS);
+        RTA_PUT_U8(skb,TCA_DSMARK_MASK, p->mask[cl-1]);
+        RTA_PUT_U8(skb,TCA_DSMARK_VALUE, p->value[cl-1]);
+
+        return RTA_NEST_END(skb, opts);
 
 rtattr_failure:
-        skb_trim(skb,b-skb->data);
-        return -1;
+        return RTA_NEST_CANCEL(skb, opts);
 }
 
 static int dsmark_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct dsmark_qdisc_data *p = PRIV(sch);
-        unsigned char *b = skb->tail;
-        struct rtattr *rta;
+        struct rtattr *opts = NULL;
 
-        rta = (struct rtattr *) b;
-        RTA_PUT(skb,TCA_OPTIONS,0,NULL);
-        RTA_PUT(skb,TCA_DSMARK_INDICES,sizeof(__u16),&p->indices);
-        if (p->default_index != NO_DEFAULT_INDEX) {
-                __u16 tmp = p->default_index;
+        opts = RTA_NEST(skb, TCA_OPTIONS);
+        RTA_PUT_U16(skb, TCA_DSMARK_INDICES, p->indices);
+
+        if (p->default_index != NO_DEFAULT_INDEX)
+                RTA_PUT_U16(skb, TCA_DSMARK_DEFAULT_INDEX, p->default_index);
 
-                RTA_PUT(skb,TCA_DSMARK_DEFAULT_INDEX, sizeof(__u16), &tmp);
-        }
         if (p->set_tc_index)
-                RTA_PUT(skb, TCA_DSMARK_SET_TC_INDEX, 0, NULL);
-        rta->rta_len = skb->tail-b;
-        return skb->len;
+                RTA_PUT_FLAG(skb, TCA_DSMARK_SET_TC_INDEX);
+
+        return RTA_NEST_END(skb, opts);
 
 rtattr_failure:
-        skb_trim(skb,b-skb->data);
-        return -1;
+        return RTA_NEST_CANCEL(skb, opts);
 }
 
 static struct Qdisc_class_ops dsmark_class_ops = {
@@ -476,10 +504,13 @@ static int __init dsmark_module_init(void)
 {
         return register_qdisc(&dsmark_qdisc_ops);
 }
+
 static void __exit dsmark_module_exit(void) 
 {
         unregister_qdisc(&dsmark_qdisc_ops);
 }
+
 module_init(dsmark_module_init)
 module_exit(dsmark_module_exit)
+
 MODULE_LICENSE("GPL");
diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
index 4888305c96da..033083bf0e74 100644
--- a/net/sched/sch_fifo.c
+++ b/net/sched/sch_fifo.c
@@ -11,131 +11,38 @@
 
 #include <linux/config.h>
 #include <linux/module.h>
-#include <asm/uaccess.h>
-#include <asm/system.h>
-#include <linux/bitops.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
-#include <linux/string.h>
-#include <linux/mm.h>
-#include <linux/socket.h>
-#include <linux/sockios.h>
-#include <linux/in.h>
 #include <linux/errno.h>
-#include <linux/interrupt.h>
-#include <linux/if_ether.h>
-#include <linux/inet.h>
 #include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <linux/notifier.h>
-#include <net/ip.h>
-#include <net/route.h>
 #include <linux/skbuff.h>
-#include <net/sock.h>
 #include <net/pkt_sched.h>
 
 /* 1 band FIFO pseudo-"scheduler" */
 
 struct fifo_sched_data
 {
-        unsigned limit;
+        u32 limit;
 };
 
-static int
-bfifo_enqueue(struct sk_buff *skb, struct Qdisc* sch)
+static int bfifo_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 {
         struct fifo_sched_data *q = qdisc_priv(sch);
 
-        if (sch->qstats.backlog + skb->len <= q->limit) {
-                __skb_queue_tail(&sch->q, skb);
-                sch->qstats.backlog += skb->len;
-                sch->bstats.bytes += skb->len;
-                sch->bstats.packets++;
-                return 0;
-        }
-        sch->qstats.drops++;
-#ifdef CONFIG_NET_CLS_POLICE
-        if (sch->reshape_fail==NULL || sch->reshape_fail(skb, sch))
-#endif
-                kfree_skb(skb);
-        return NET_XMIT_DROP;
-}
-
-static int
-bfifo_requeue(struct sk_buff *skb, struct Qdisc* sch)
-{
-        __skb_queue_head(&sch->q, skb);
-        sch->qstats.backlog += skb->len;
-        sch->qstats.requeues++;
-        return 0;
-}
-
-static struct sk_buff *
-bfifo_dequeue(struct Qdisc* sch)
-{
-        struct sk_buff *skb;
+        if (likely(sch->qstats.backlog + skb->len <= q->limit))
+                return qdisc_enqueue_tail(skb, sch);
 
-        skb = __skb_dequeue(&sch->q);
-        if (skb)
-                sch->qstats.backlog -= skb->len;
-        return skb;
+        return qdisc_reshape_fail(skb, sch);
 }
 
-static unsigned int 
-fifo_drop(struct Qdisc* sch)
-{
-        struct sk_buff *skb;
-
-        skb = __skb_dequeue_tail(&sch->q);
-        if (skb) {
-                unsigned int len = skb->len;
-                sch->qstats.backlog -= len;
-                kfree_skb(skb);
-                return len;
-        }
-        return 0;
-}
-
-static void
-fifo_reset(struct Qdisc* sch)
-{
-        skb_queue_purge(&sch->q);
-        sch->qstats.backlog = 0;
-}
-
-static int
-pfifo_enqueue(struct sk_buff *skb, struct Qdisc* sch)
+static int pfifo_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 {
         struct fifo_sched_data *q = qdisc_priv(sch);
 
-        if (sch->q.qlen < q->limit) {
-                __skb_queue_tail(&sch->q, skb);
-                sch->bstats.bytes += skb->len;
-                sch->bstats.packets++;
-                return 0;
-        }
-        sch->qstats.drops++;
-#ifdef CONFIG_NET_CLS_POLICE
-        if (sch->reshape_fail==NULL || sch->reshape_fail(skb, sch))
-#endif
-                kfree_skb(skb);
-        return NET_XMIT_DROP;
-}
-
-static int
-pfifo_requeue(struct sk_buff *skb, struct Qdisc* sch)
-{
-        __skb_queue_head(&sch->q, skb);
-        sch->qstats.requeues++;
-        return 0;
-}
-
+        if (likely(skb_queue_len(&sch->q) < q->limit))
+                return qdisc_enqueue_tail(skb, sch);
 
-static struct sk_buff *
-pfifo_dequeue(struct Qdisc* sch)
-{
-        return __skb_dequeue(&sch->q);
+        return qdisc_reshape_fail(skb, sch);
 }
 
 static int fifo_init(struct Qdisc *sch, struct rtattr *opt)
@@ -143,66 +50,59 @@ static int fifo_init(struct Qdisc *sch, struct rtattr *opt)
         struct fifo_sched_data *q = qdisc_priv(sch);
 
         if (opt == NULL) {
-                unsigned int limit = sch->dev->tx_queue_len ? : 1;
+                u32 limit = sch->dev->tx_queue_len ? : 1;
 
                 if (sch->ops == &bfifo_qdisc_ops)
-                        q->limit = limit*sch->dev->mtu;
-                else    
-                        q->limit = limit;
+                        limit *= sch->dev->mtu;
+
+                q->limit = limit;
         } else {
                 struct tc_fifo_qopt *ctl = RTA_DATA(opt);
-                if (opt->rta_len < RTA_LENGTH(sizeof(*ctl)))
+
+                if (RTA_PAYLOAD(opt) < sizeof(*ctl))
                         return -EINVAL;
+
                 q->limit = ctl->limit;
         }
+
         return 0;
 }
 
 static int fifo_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct fifo_sched_data *q = qdisc_priv(sch);
-        unsigned char    *b = skb->tail;
-        struct tc_fifo_qopt opt;
+        struct tc_fifo_qopt opt = { .limit = q->limit };
 
-        opt.limit = q->limit;
         RTA_PUT(skb, TCA_OPTIONS, sizeof(opt), &opt);
-
         return skb->len;
 
 rtattr_failure:
-        skb_trim(skb, b - skb->data);
         return -1;
 }
 
 struct Qdisc_ops pfifo_qdisc_ops = {
-        .next           =       NULL,
-        .cl_ops         =       NULL,
         .id             =       "pfifo",
         .priv_size      =       sizeof(struct fifo_sched_data),
         .enqueue        =       pfifo_enqueue,
-        .dequeue        =       pfifo_dequeue,
-        .requeue        =       pfifo_requeue,
-        .drop           =       fifo_drop,
+        .dequeue        =       qdisc_dequeue_head,
+        .requeue        =       qdisc_requeue,
+        .drop           =       qdisc_queue_drop,
         .init           =       fifo_init,
-        .reset          =       fifo_reset,
-        .destroy        =       NULL,
+        .reset          =       qdisc_reset_queue,
         .change         =       fifo_init,
         .dump           =       fifo_dump,
         .owner          =       THIS_MODULE,
 };
 
 struct Qdisc_ops bfifo_qdisc_ops = {
-        .next           =       NULL,
-        .cl_ops         =       NULL,
         .id             =       "bfifo",
         .priv_size      =       sizeof(struct fifo_sched_data),
         .enqueue        =       bfifo_enqueue,
-        .dequeue        =       bfifo_dequeue,
-        .requeue        =       bfifo_requeue,
-        .drop           =       fifo_drop,
+        .dequeue        =       qdisc_dequeue_head,
+        .requeue        =       qdisc_requeue,
+        .drop           =       qdisc_queue_drop,
         .init           =       fifo_init,
-        .reset          =       fifo_reset,
-        .destroy        =       NULL,
+        .reset          =       qdisc_reset_queue,
         .change         =       fifo_init,
         .dump           =       fifo_dump,
         .owner          =       THIS_MODULE,
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 87e48a4e1051..8edefd5d095d 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -243,31 +243,27 @@ static void dev_watchdog_down(struct net_device *dev)
    cheaper.
  */
 
-static int
-noop_enqueue(struct sk_buff *skb, struct Qdisc * qdisc)
+static int noop_enqueue(struct sk_buff *skb, struct Qdisc * qdisc)
 {
         kfree_skb(skb);
         return NET_XMIT_CN;
 }
 
-static struct sk_buff *
-noop_dequeue(struct Qdisc * qdisc)
+static struct sk_buff *noop_dequeue(struct Qdisc * qdisc)
 {
         return NULL;
 }
 
-static int
-noop_requeue(struct sk_buff *skb, struct Qdisc* qdisc)
+static int noop_requeue(struct sk_buff *skb, struct Qdisc* qdisc)
 {
         if (net_ratelimit())
-                printk(KERN_DEBUG "%s deferred output. It is buggy.\n", skb->dev->name);
+                printk(KERN_DEBUG "%s deferred output. It is buggy.\n",
+                       skb->dev->name);
         kfree_skb(skb);
         return NET_XMIT_CN;
 }
 
 struct Qdisc_ops noop_qdisc_ops = {
-        .next           =       NULL,
-        .cl_ops         =       NULL,
         .id             =       "noop",
         .priv_size      =       0,
         .enqueue        =       noop_enqueue,
@@ -285,8 +281,6 @@ struct Qdisc noop_qdisc = {
 };
 
 static struct Qdisc_ops noqueue_qdisc_ops = {
-        .next           =       NULL,
-        .cl_ops         =       NULL,
         .id             =       "noqueue",
         .priv_size      =       0,
         .enqueue        =       noop_enqueue,
@@ -311,97 +305,86 @@ static const u8 prio2band[TC_PRIO_MAX+1] =
    generic prio+fifo combination.
  */
 
-static int
-pfifo_fast_enqueue(struct sk_buff *skb, struct Qdisc* qdisc)
+#define PFIFO_FAST_BANDS 3
+
+static inline struct sk_buff_head *prio2list(struct sk_buff *skb,
+                                             struct Qdisc *qdisc)
 {
         struct sk_buff_head *list = qdisc_priv(qdisc);
+        return list + prio2band[skb->priority & TC_PRIO_MAX];
+}
 
-        list += prio2band[skb->priority&TC_PRIO_MAX];
+static int pfifo_fast_enqueue(struct sk_buff *skb, struct Qdisc* qdisc)
+{
+        struct sk_buff_head *list = prio2list(skb, qdisc);
 
-        if (list->qlen < qdisc->dev->tx_queue_len) {
-                __skb_queue_tail(list, skb);
+        if (skb_queue_len(list) < qdisc->dev->tx_queue_len) {
                 qdisc->q.qlen++;
-                qdisc->bstats.bytes += skb->len;
-                qdisc->bstats.packets++;
-                return 0;
+                return __qdisc_enqueue_tail(skb, qdisc, list);
         }
-        qdisc->qstats.drops++;
-        kfree_skb(skb);
-        return NET_XMIT_DROP;
+
+        return qdisc_drop(skb, qdisc);
 }
 
-static struct sk_buff *
-pfifo_fast_dequeue(struct Qdisc* qdisc)
+static struct sk_buff *pfifo_fast_dequeue(struct Qdisc* qdisc)
 {
         int prio;
         struct sk_buff_head *list = qdisc_priv(qdisc);
-        struct sk_buff *skb;
 
-        for (prio = 0; prio < 3; prio++, list++) {
-                skb = __skb_dequeue(list);
-                if (skb) {
+        for (prio = 0; prio < PFIFO_FAST_BANDS; prio++) {
+                if (!skb_queue_empty(list + prio)) {
                         qdisc->q.qlen--;
-                        return skb;
+                        return __qdisc_dequeue_head(qdisc, list + prio);
                 }
         }
+
         return NULL;
 }
 
-static int
-pfifo_fast_requeue(struct sk_buff *skb, struct Qdisc* qdisc)
+static int pfifo_fast_requeue(struct sk_buff *skb, struct Qdisc* qdisc)
 {
-        struct sk_buff_head *list = qdisc_priv(qdisc);
-
-        list += prio2band[skb->priority&TC_PRIO_MAX];
-
-        __skb_queue_head(list, skb);
         qdisc->q.qlen++;
-        qdisc->qstats.requeues++;
-        return 0;
+        return __qdisc_requeue(skb, qdisc, prio2list(skb, qdisc));
 }
 
-static void
-pfifo_fast_reset(struct Qdisc* qdisc)
+static void pfifo_fast_reset(struct Qdisc* qdisc)
 {
         int prio;
         struct sk_buff_head *list = qdisc_priv(qdisc);
 
-        for (prio=0; prio < 3; prio++)
-                skb_queue_purge(list+prio);
+        for (prio = 0; prio < PFIFO_FAST_BANDS; prio++)
+                __qdisc_reset_queue(qdisc, list + prio);
+
+        qdisc->qstats.backlog = 0;
         qdisc->q.qlen = 0;
 }
 
 static int pfifo_fast_dump(struct Qdisc *qdisc, struct sk_buff *skb)
 {
-        unsigned char    *b = skb->tail;
-        struct tc_prio_qopt opt;
+        struct tc_prio_qopt opt = { .bands = PFIFO_FAST_BANDS };
 
-        opt.bands = 3; 
         memcpy(&opt.priomap, prio2band, TC_PRIO_MAX+1);
         RTA_PUT(skb, TCA_OPTIONS, sizeof(opt), &opt);
         return skb->len;
 
 rtattr_failure:
-        skb_trim(skb, b - skb->data);
         return -1;
 }
 
 static int pfifo_fast_init(struct Qdisc *qdisc, struct rtattr *opt)
 {
-        int i;
+        int prio;
         struct sk_buff_head *list = qdisc_priv(qdisc);
 
-        for (i=0; i<3; i++)
-                skb_queue_head_init(list+i);
+        for (prio = 0; prio < PFIFO_FAST_BANDS; prio++)
+                skb_queue_head_init(list + prio);
 
         return 0;
 }
 
 static struct Qdisc_ops pfifo_fast_ops = {
-        .next           =       NULL,
-        .cl_ops         =       NULL,
         .id             =       "pfifo_fast",
-        .priv_size      =       3 * sizeof(struct sk_buff_head),
+        .priv_size      =       PFIFO_FAST_BANDS * sizeof(struct sk_buff_head),
         .enqueue        =       pfifo_fast_enqueue,
         .dequeue        =       pfifo_fast_dequeue,
         .requeue        =       pfifo_fast_requeue,
@@ -411,24 +394,23 @@ static struct Qdisc_ops pfifo_fast_ops = {
         .owner          =       THIS_MODULE,
 };
 
-struct Qdisc * qdisc_create_dflt(struct net_device *dev, struct Qdisc_ops *ops)
+struct Qdisc *qdisc_alloc(struct net_device *dev, struct Qdisc_ops *ops)
 {
         void *p;
         struct Qdisc *sch;
-        int size;
+        unsigned int size;
+        int err = -ENOBUFS;
 
         /* ensure that the Qdisc and the private data are 32-byte aligned */
-        size = ((sizeof(*sch) + QDISC_ALIGN_CONST) & ~QDISC_ALIGN_CONST);
-        size += ops->priv_size + QDISC_ALIGN_CONST;
+        size = QDISC_ALIGN(sizeof(*sch));
+        size += ops->priv_size + (QDISC_ALIGNTO - 1);
 
         p = kmalloc(size, GFP_KERNEL);
         if (!p)
-                return NULL;
+                goto errout;
         memset(p, 0, size);
-
-        sch = (struct Qdisc *)(((unsigned long)p + QDISC_ALIGN_CONST) 
-                               & ~QDISC_ALIGN_CONST);
-        sch->padded = (char *)sch - (char *)p;
+        sch = (struct Qdisc *) QDISC_ALIGN((unsigned long) p);
+        sch->padded = (char *) sch - (char *) p;
 
         INIT_LIST_HEAD(&sch->list);
         skb_queue_head_init(&sch->q);
@@ -439,11 +421,24 @@ struct Qdisc * qdisc_create_dflt(struct net_device *dev, struct Qdisc_ops *ops)
         dev_hold(dev);
         sch->stats_lock = &dev->queue_lock;
         atomic_set(&sch->refcnt, 1);
+
+        return sch;
+errout:
+        return ERR_PTR(-err);
+}
+
+struct Qdisc * qdisc_create_dflt(struct net_device *dev, struct Qdisc_ops *ops)
+{
+        struct Qdisc *sch;
+        
+        sch = qdisc_alloc(dev, ops);
+        if (IS_ERR(sch))
+                goto errout;
+
         if (!ops->init || ops->init(sch, NULL) == 0)
                 return sch;
 
-        dev_put(dev);
-        kfree(p);
+errout:
         return NULL;
 }
 
@@ -607,6 +602,7 @@ EXPORT_SYMBOL(__netdev_watchdog_up);
 EXPORT_SYMBOL(noop_qdisc);
 EXPORT_SYMBOL(noop_qdisc_ops);
 EXPORT_SYMBOL(qdisc_create_dflt);
+EXPORT_SYMBOL(qdisc_alloc);
 EXPORT_SYMBOL(qdisc_destroy);
 EXPORT_SYMBOL(qdisc_reset);
 EXPORT_SYMBOL(qdisc_restart);
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 664d0e47374f..7845d045eec4 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -385,7 +385,7 @@ static int red_change(struct Qdisc *sch, struct rtattr *opt)
         memcpy(q->Stab, RTA_DATA(tb[TCA_RED_STAB-1]), 256);
 
         q->qcount = -1;
-        if (skb_queue_len(&sch->q) == 0)
+        if (skb_queue_empty(&sch->q))
                 PSCHED_SET_PASTPERFECT(q->qidlestart);
         sch_tree_unlock(sch);
         return 0;
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 663843d97a92..5b24ae0650d3 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -71,7 +71,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
                                           const struct sctp_endpoint *ep,
                                           const struct sock *sk,
                                           sctp_scope_t scope,
-                                          int gfp)
+                                          unsigned int __nocast gfp)
 {
         struct sctp_sock *sp;
         int i;
@@ -191,10 +191,6 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         asoc->last_cwr_tsn = asoc->ctsn_ack_point;
         asoc->unack_data = 0;
 
-        SCTP_DEBUG_PRINTK("myctsnap for %s INIT as 0x%x.\n",
-                          asoc->ep->debug_name,
-                          asoc->ctsn_ack_point);
-
         /* ADDIP Section 4.1 Asconf Chunk Procedures
          *
          * When an endpoint has an ASCONF signaled change to be sent to the
@@ -207,10 +203,11 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
          */
         asoc->addip_serial = asoc->c.initial_tsn;
 
-        skb_queue_head_init(&asoc->addip_chunks);
+        INIT_LIST_HEAD(&asoc->addip_chunk_list);
 
         /* Make an empty list of remote transport addresses.  */
         INIT_LIST_HEAD(&asoc->peer.transport_addr_list);
+        asoc->peer.transport_count = 0;
 
         /* RFC 2960 5.1 Normal Establishment of an Association
          *
@@ -275,7 +272,8 @@ fail_init:
 /* Allocate and initialize a new association */
 struct sctp_association *sctp_association_new(const struct sctp_endpoint *ep,
                                          const struct sock *sk,
-                                         sctp_scope_t scope, int gfp)
+                                         sctp_scope_t scope,
+                                         unsigned int __nocast gfp)
 {
         struct sctp_association *asoc;
 
@@ -288,6 +286,7 @@ struct sctp_association *sctp_association_new(const struct sctp_endpoint *ep,
 
         asoc->base.malloced = 1;
         SCTP_DBG_OBJCNT_INC(assoc);
+        SCTP_DEBUG_PRINTK("Created asoc %p\n", asoc);
 
         return asoc;
 
@@ -356,6 +355,8 @@ void sctp_association_free(struct sctp_association *asoc)
                 sctp_transport_free(transport);
         }
 
+        asoc->peer.transport_count = 0;
+
         /* Free any cached ASCONF_ACK chunk. */
         if (asoc->addip_last_asconf_ack)
                 sctp_chunk_free(asoc->addip_last_asconf_ack);
@@ -400,7 +401,7 @@ void sctp_assoc_set_primary(struct sctp_association *asoc,
         /* If the primary path is changing, assume that the
          * user wants to use this new path.
          */
-        if (transport->active)
+        if (transport->state != SCTP_INACTIVE)
                 asoc->peer.active_path = transport;
 
         /*
@@ -428,10 +429,58 @@ void sctp_assoc_set_primary(struct sctp_association *asoc,
         transport->cacc.next_tsn_at_change = asoc->next_tsn;
 }
 
+/* Remove a transport from an association.  */
+void sctp_assoc_rm_peer(struct sctp_association *asoc,
+                        struct sctp_transport *peer)
+{
+        struct list_head        *pos;
+        struct sctp_transport   *transport;
+
+        SCTP_DEBUG_PRINTK_IPADDR("sctp_assoc_rm_peer:association %p addr: ",
+                                 " port: %d\n",
+                                 asoc,
+                                 (&peer->ipaddr),
+                                 peer->ipaddr.v4.sin_port);
+
+        /* If we are to remove the current retran_path, update it
+         * to the next peer before removing this peer from the list.
+         */
+        if (asoc->peer.retran_path == peer)
+                sctp_assoc_update_retran_path(asoc);
+
+        /* Remove this peer from the list. */
+        list_del(&peer->transports);
+
+        /* Get the first transport of asoc. */
+        pos = asoc->peer.transport_addr_list.next;
+        transport = list_entry(pos, struct sctp_transport, transports);
+
+        /* Update any entries that match the peer to be deleted. */
+        if (asoc->peer.primary_path == peer)
+                sctp_assoc_set_primary(asoc, transport);
+        if (asoc->peer.active_path == peer)
+                asoc->peer.active_path = transport;
+        if (asoc->peer.last_data_from == peer)
+                asoc->peer.last_data_from = transport;
+
+        /* If we remove the transport an INIT was last sent to, set it to
+         * NULL. Combined with the update of the retran path above, this
+         * will cause the next INIT to be sent to the next available
+         * transport, maintaining the cycle.
+         */
+        if (asoc->init_last_sent_to == peer)
+                asoc->init_last_sent_to = NULL;
+
+        asoc->peer.transport_count--;
+
+        sctp_transport_free(peer);
+}
+
 /* Add a transport address to an association.  */
 struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
                                            const union sctp_addr *addr,
-                                           int gfp)
+                                           const unsigned int __nocast gfp,
+                                           const int peer_state)
 {
         struct sctp_transport *peer;
         struct sctp_sock *sp;
@@ -442,14 +491,25 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
         /* AF_INET and AF_INET6 share common port field. */
         port = addr->v4.sin_port;
 
+        SCTP_DEBUG_PRINTK_IPADDR("sctp_assoc_add_peer:association %p addr: ",
+                                 " port: %d state:%s\n",
+                                 asoc,
+                                 addr,
+                                 addr->v4.sin_port,
+                                 peer_state == SCTP_UNKNOWN?"UNKNOWN":"ACTIVE");
+
         /* Set the port if it has not been set yet.  */
         if (0 == asoc->peer.port)
                 asoc->peer.port = port;
 
         /* Check to see if this is a duplicate. */
         peer = sctp_assoc_lookup_paddr(asoc, addr);
-        if (peer)
+        if (peer) {
+                if (peer_state == SCTP_ACTIVE &&
+                    peer->state == SCTP_UNKNOWN)
+                     peer->state = SCTP_ACTIVE;
                 return peer;
+        }
 
         peer = sctp_transport_new(addr, gfp);
         if (!peer)
@@ -516,8 +576,12 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
         /* Set the transport's RTO.initial value */
         peer->rto = asoc->rto_initial;
 
+        /* Set the peer's active state. */
+        peer->state = peer_state;
+
         /* Attach the remote transport to our asoc.  */
         list_add_tail(&peer->transports, &asoc->peer.transport_addr_list);
+        asoc->peer.transport_count++;
 
         /* If we do not yet have a primary path, set one.  */
         if (!asoc->peer.primary_path) {
@@ -525,8 +589,9 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
                 asoc->peer.retran_path = peer;
         }
 
-        if (asoc->peer.active_path == asoc->peer.retran_path)
+        if (asoc->peer.active_path == asoc->peer.retran_path) {
                 asoc->peer.retran_path = peer;
+        }
 
         return peer;
 }
@@ -537,37 +602,16 @@ void sctp_assoc_del_peer(struct sctp_association *asoc,
 {
         struct list_head        *pos;
         struct list_head        *temp;
-        struct sctp_transport   *peer = NULL;
         struct sctp_transport   *transport;
 
         list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
                 transport = list_entry(pos, struct sctp_transport, transports);
                 if (sctp_cmp_addr_exact(addr, &transport->ipaddr)) {
-                        peer = transport;
-                        list_del(pos);
+                        /* Do book keeping for removing the peer and free it. */
+                        sctp_assoc_rm_peer(asoc, transport);
                         break;
                 }
         }
-
-        /* The address we want delete is not in the association. */
-        if (!peer)
-                return;
-
-        /* Get the first transport of asoc. */ 
-        pos = asoc->peer.transport_addr_list.next;
-        transport = list_entry(pos, struct sctp_transport, transports);
-
-        /* Update any entries that match the peer to be deleted. */  
-        if (asoc->peer.primary_path == peer)
-                sctp_assoc_set_primary(asoc, transport);
-        if (asoc->peer.active_path == peer)
-                asoc->peer.active_path = transport;
-        if (asoc->peer.retran_path == peer)
-                asoc->peer.retran_path = transport;
-        if (asoc->peer.last_data_from == peer)
-                asoc->peer.last_data_from = transport;
-
-        sctp_transport_free(peer);
 }
 
 /* Lookup a transport by address. */
@@ -608,12 +652,12 @@ void sctp_assoc_control_transport(struct sctp_association *asoc,
         /* Record the transition on the transport.  */
         switch (command) {
         case SCTP_TRANSPORT_UP:
-                transport->active = SCTP_ACTIVE;
+                transport->state = SCTP_ACTIVE;
                 spc_state = SCTP_ADDR_AVAILABLE;
                 break;
 
         case SCTP_TRANSPORT_DOWN:
-                transport->active = SCTP_INACTIVE;
+                transport->state = SCTP_INACTIVE;
                 spc_state = SCTP_ADDR_UNREACHABLE;
                 break;
 
@@ -643,7 +687,7 @@ void sctp_assoc_control_transport(struct sctp_association *asoc,
         list_for_each(pos, &asoc->peer.transport_addr_list) {
                 t = list_entry(pos, struct sctp_transport, transports);
 
-                if (!t->active)
+                if (t->state == SCTP_INACTIVE)
                         continue;
                 if (!first || t->last_time_heard > first->last_time_heard) {
                         second = first;
@@ -663,7 +707,7 @@ void sctp_assoc_control_transport(struct sctp_association *asoc,
          * [If the primary is active but not most recent, bump the most
          * recently used transport.]
          */
-        if (asoc->peer.primary_path->active &&
+        if (asoc->peer.primary_path->state != SCTP_INACTIVE &&
             first != asoc->peer.primary_path) {
                 second = first;
                 first = asoc->peer.primary_path;
@@ -958,7 +1002,7 @@ void sctp_assoc_update(struct sctp_association *asoc,
                                            transports);
                         if (!sctp_assoc_lookup_paddr(asoc, &trans->ipaddr))
                                 sctp_assoc_add_peer(asoc, &trans->ipaddr,
-                                                    GFP_ATOMIC);
+                                                    GFP_ATOMIC, SCTP_ACTIVE);
                 }
 
                 asoc->ctsn_ack_point = asoc->next_tsn - 1;
@@ -998,7 +1042,7 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc)
 
                 /* Try to find an active transport. */
 
-                if (t->active) {
+                if (t->state != SCTP_INACTIVE) {
                         break;
                 } else {
                         /* Keep track of the next transport in case
@@ -1019,6 +1063,40 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc)
         }
 
         asoc->peer.retran_path = t;
+
+        SCTP_DEBUG_PRINTK_IPADDR("sctp_assoc_update_retran_path:association"
+                                 " %p addr: ",
+                                 " port: %d\n",
+                                 asoc,
+                                 (&t->ipaddr),
+                                 t->ipaddr.v4.sin_port);
+}
+
+/* Choose the transport for sending a INIT packet.  */
+struct sctp_transport *sctp_assoc_choose_init_transport(
+        struct sctp_association *asoc)
+{
+        struct sctp_transport *t;
+
+        /* Use the retran path. If the last INIT was sent over the
+         * retran path, update the retran path and use it.
+         */
+        if (!asoc->init_last_sent_to) {
+                t = asoc->peer.active_path;
+        } else {
+                if (asoc->init_last_sent_to == asoc->peer.retran_path)
+                        sctp_assoc_update_retran_path(asoc);
+                t = asoc->peer.retran_path;
+        }
+
+        SCTP_DEBUG_PRINTK_IPADDR("sctp_assoc_update_retran_path:association"
+                                 " %p addr: ",
+                                 " port: %d\n",
+                                 asoc,
+                                 (&t->ipaddr),
+                                 t->ipaddr.v4.sin_port);
+
+        return t;
 }
 
 /* Choose the transport for sending a SHUTDOWN packet.  */
@@ -1152,7 +1230,8 @@ void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned len)
 /* Build the bind address list for the association based on info from the
  * local endpoint and the remote peer.
  */
-int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc, int gfp)
+int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc,
+                                     unsigned int __nocast gfp)
 {
         sctp_scope_t scope;
         int flags;
@@ -1174,7 +1253,8 @@ int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc, int gfp)
 
 /* Build the association's bind address list from the cookie.  */
 int sctp_assoc_set_bind_addr_from_cookie(struct sctp_association *asoc,
-                                         struct sctp_cookie *cookie, int gfp)
+                                         struct sctp_cookie *cookie,
+                                         unsigned int __nocast gfp)
 {
         int var_size2 = ntohs(cookie->peer_init->chunk_hdr.length);
         int var_size3 = cookie->raw_addr_list_len;
diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
index f90eadfb60a2..f71549710f2e 100644
--- a/net/sctp/bind_addr.c
+++ b/net/sctp/bind_addr.c
@@ -53,7 +53,8 @@
 
 /* Forward declarations for internal helpers. */
 static int sctp_copy_one_addr(struct sctp_bind_addr *, union sctp_addr *,
-                              sctp_scope_t scope, int gfp, int flags);
+                              sctp_scope_t scope, unsigned int __nocast gfp,
+                              int flags);
 static void sctp_bind_addr_clean(struct sctp_bind_addr *);
 
 /* First Level Abstractions. */
@@ -63,7 +64,8 @@ static void sctp_bind_addr_clean(struct sctp_bind_addr *);
  */
 int sctp_bind_addr_copy(struct sctp_bind_addr *dest, 
                         const struct sctp_bind_addr *src,
-                        sctp_scope_t scope, int gfp, int flags)
+                        sctp_scope_t scope, unsigned int __nocast gfp,
+                        int flags)
 {
         struct sctp_sockaddr_entry *addr;
         struct list_head *pos;
@@ -144,7 +146,7 @@ void sctp_bind_addr_free(struct sctp_bind_addr *bp)
 
 /* Add an address to the bind address list in the SCTP_bind_addr structure. */
 int sctp_add_bind_addr(struct sctp_bind_addr *bp, union sctp_addr *new,
-                       int gfp)
+                       unsigned int __nocast gfp)
 {
         struct sctp_sockaddr_entry *addr;
 
@@ -197,7 +199,8 @@ int sctp_del_bind_addr(struct sctp_bind_addr *bp, union sctp_addr *del_addr)
  * The second argument is the return value for the length.
  */
 union sctp_params sctp_bind_addrs_to_raw(const struct sctp_bind_addr *bp,
-                                         int *addrs_len, int gfp)
+                                         int *addrs_len,
+                                         unsigned int __nocast gfp)
 {
         union sctp_params addrparms;
         union sctp_params retval;
@@ -249,7 +252,7 @@ end_raw:
  * address parameters).
  */
 int sctp_raw_to_bind_addrs(struct sctp_bind_addr *bp, __u8 *raw_addr_list,
-                           int addrs_len, __u16 port, int gfp)
+                           int addrs_len, __u16 port, unsigned int __nocast gfp)
 {
         union sctp_addr_param *rawaddr;
         struct sctp_paramhdr *param;
@@ -347,7 +350,8 @@ union sctp_addr *sctp_find_unmatch_addr(struct sctp_bind_addr	*bp,
 /* Copy out addresses from the global local address list. */
 static int sctp_copy_one_addr(struct sctp_bind_addr *dest, 
                               union sctp_addr *addr,
-                              sctp_scope_t scope, int gfp, int flags)
+                              sctp_scope_t scope, unsigned int __nocast gfp,
+                              int flags)
 {
         int error = 0;
 
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 0c2ab7885058..61da2937e641 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -62,7 +62,7 @@ static void sctp_datamsg_init(struct sctp_datamsg *msg)
 }
 
 /* Allocate and initialize datamsg. */
-SCTP_STATIC struct sctp_datamsg *sctp_datamsg_new(int gfp)
+SCTP_STATIC struct sctp_datamsg *sctp_datamsg_new(unsigned int __nocast gfp)
 {
         struct sctp_datamsg *msg;
         msg = kmalloc(sizeof(struct sctp_datamsg), gfp);
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 334f61773e6d..e47ac0d1a6d6 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -67,7 +67,8 @@ static void sctp_endpoint_bh_rcv(struct sctp_endpoint *ep);
  * Initialize the base fields of the endpoint structure.
  */
 static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
-                                                struct sock *sk, int gfp)
+                                                struct sock *sk,
+                                                unsigned int __nocast gfp)
 {
         struct sctp_sock *sp = sctp_sk(sk);
         memset(ep, 0, sizeof(struct sctp_endpoint));
@@ -102,9 +103,9 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         /* Set up the base timeout information.  */
         ep->timeouts[SCTP_EVENT_TIMEOUT_NONE] = 0;
         ep->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] =
-                SCTP_DEFAULT_TIMEOUT_T1_COOKIE;
+                msecs_to_jiffies(sp->rtoinfo.srto_initial);
         ep->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT] =
-                SCTP_DEFAULT_TIMEOUT_T1_INIT;
+                msecs_to_jiffies(sp->rtoinfo.srto_initial);
         ep->timeouts[SCTP_EVENT_TIMEOUT_T2_SHUTDOWN] =
                 msecs_to_jiffies(sp->rtoinfo.srto_initial);
         ep->timeouts[SCTP_EVENT_TIMEOUT_T3_RTX] = 0;
@@ -117,12 +118,9 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         ep->timeouts[SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD]
                 = 5 * msecs_to_jiffies(sp->rtoinfo.srto_max);
 
-        ep->timeouts[SCTP_EVENT_TIMEOUT_HEARTBEAT] =
-                SCTP_DEFAULT_TIMEOUT_HEARTBEAT;
-        ep->timeouts[SCTP_EVENT_TIMEOUT_SACK] =
-                SCTP_DEFAULT_TIMEOUT_SACK;
-        ep->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] =
-                sp->autoclose * HZ;
+        ep->timeouts[SCTP_EVENT_TIMEOUT_HEARTBEAT] = 0;
+        ep->timeouts[SCTP_EVENT_TIMEOUT_SACK] = sctp_sack_timeout;
+        ep->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] = sp->autoclose * HZ;
 
         /* Use SCTP specific send buffer space queues.  */
         ep->sndbuf_policy = sctp_sndbuf_policy;
@@ -134,14 +132,14 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         ep->last_key = ep->current_key = 0;
         ep->key_changed_at = jiffies;
 
-        ep->debug_name = "unnamedEndpoint";
         return ep;
 }
 
 /* Create a sctp_endpoint with all that boring stuff initialized.
  * Returns NULL if there isn't enough memory.
  */
-struct sctp_endpoint *sctp_endpoint_new(struct sock *sk, int gfp)
+struct sctp_endpoint *sctp_endpoint_new(struct sock *sk,
+                                        unsigned int __nocast gfp)
 {
         struct sctp_endpoint *ep;
 
diff --git a/net/sctp/input.c b/net/sctp/input.c
index b719a77d66b4..742be9171b7d 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -115,6 +115,17 @@ static void sctp_rcv_set_owner_r(struct sk_buff *skb, struct sock *sk)
         atomic_add(sizeof(struct sctp_chunk),&sk->sk_rmem_alloc);
 }
 
+struct sctp_input_cb {
+        union {
+                struct inet_skb_parm    h4;
+#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
+                struct inet6_skb_parm   h6;
+#endif
+        } header;
+        struct sctp_chunk *chunk;
+};
+#define SCTP_INPUT_CB(__skb)    ((struct sctp_input_cb *)&((__skb)->cb[0]))
+
 /*
  * This is the routine which IP calls when receiving an SCTP packet.
  */
@@ -178,6 +189,37 @@ int sctp_rcv(struct sk_buff *skb)
 
         asoc = __sctp_rcv_lookup(skb, &src, &dest, &transport);
 
+        if (!asoc)
+                ep = __sctp_rcv_lookup_endpoint(&dest);
+
+        /* Retrieve the common input handling substructure. */
+        rcvr = asoc ? &asoc->base : &ep->base;
+        sk = rcvr->sk;
+
+        /*
+         * If a frame arrives on an interface and the receiving socket is
+         * bound to another interface, via SO_BINDTODEVICE, treat it as OOTB
+         */
+        if (sk->sk_bound_dev_if && (sk->sk_bound_dev_if != af->skb_iif(skb)))
+        {
+                sock_put(sk);
+                if (asoc) {
+                        sctp_association_put(asoc);
+                        asoc = NULL;
+                } else {
+                        sctp_endpoint_put(ep);
+                        ep = NULL;
+                }
+                sk = sctp_get_ctl_sock();
+                ep = sctp_sk(sk)->ep;
+                sctp_endpoint_hold(ep);
+                sock_hold(sk);
+                rcvr = &ep->base;
+        }
+
+        if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
+                goto discard_release;
+
         /*
          * RFC 2960, 8.4 - Handle "Out of the blue" Packets.
          * An SCTP packet is called an "out of the blue" (OOTB)
@@ -187,22 +229,12 @@ int sctp_rcv(struct sk_buff *skb)
          * packet belongs.
          */
         if (!asoc) {
-                ep = __sctp_rcv_lookup_endpoint(&dest);
                 if (sctp_rcv_ootb(skb)) {
                         SCTP_INC_STATS_BH(SCTP_MIB_OUTOFBLUES);
                         goto discard_release;
                 }
         }
 
-        /* Retrieve the common input handling substructure. */
-        rcvr = asoc ? &asoc->base : &ep->base;
-        sk = rcvr->sk;
-
-        if ((sk) && (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)) {
-                goto discard_release;
-        }
-
-
         /* SCTP seems to always need a timestamp right now (FIXME) */
         if (skb->stamp.tv_sec == 0) {
                 do_gettimeofday(&skb->stamp);
@@ -222,6 +254,7 @@ int sctp_rcv(struct sk_buff *skb)
                 ret = -ENOMEM;
                 goto discard_release;
         }
+        SCTP_INPUT_CB(skb)->chunk = chunk;
 
         sctp_rcv_set_owner_r(skb,sk);
 
@@ -244,9 +277,9 @@ int sctp_rcv(struct sk_buff *skb)
         sctp_bh_lock_sock(sk);
 
         if (sock_owned_by_user(sk))
-                sk_add_backlog(sk, (struct sk_buff *) chunk);
+                sk_add_backlog(sk, skb);
         else
-                sctp_backlog_rcv(sk, (struct sk_buff *) chunk);
+                sctp_backlog_rcv(sk, skb);
 
         /* Release the sock and any reference counts we took in the
          * lookup calls.
@@ -265,13 +298,11 @@ discard_it:
 
 discard_release:
         /* Release any structures we may be holding. */
-        if (asoc) {
-                sock_put(asoc->base.sk);
+        sock_put(sk);
+        if (asoc)
                 sctp_association_put(asoc);
-        } else {
-                sock_put(ep->base.sk);
+        else
                 sctp_endpoint_put(ep);
-        }
 
         goto discard_it;
 }
@@ -283,14 +314,8 @@ discard_release:
  */
 int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 {
-        struct sctp_chunk *chunk;
-        struct sctp_inq *inqueue;
-
-        /* One day chunk will live inside the skb, but for
-         * now this works.
-         */
-        chunk = (struct sctp_chunk *) skb;
-        inqueue = &chunk->rcvr->inqueue;
+        struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
+        struct sctp_inq *inqueue = &chunk->rcvr->inqueue;
 
         sctp_inq_push(inqueue, chunk);
         return 0;
@@ -326,7 +351,6 @@ void sctp_icmp_frag_needed(struct sock *sk, struct sctp_association *asoc,
  *
  */
 void sctp_icmp_proto_unreachable(struct sock *sk,
-                           struct sctp_endpoint *ep,
                            struct sctp_association *asoc,
                            struct sctp_transport *t)
 {
@@ -334,7 +358,7 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
 
         sctp_do_sm(SCTP_EVENT_T_OTHER,
                    SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
-                   asoc->state, asoc->ep, asoc, NULL,
+                   asoc->state, asoc->ep, asoc, t,
                    GFP_ATOMIC);
 
 }
@@ -342,7 +366,6 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
 /* Common lookup code for icmp/icmpv6 error handler. */
 struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
                              struct sctphdr *sctphdr,
-                             struct sctp_endpoint **epp,
                              struct sctp_association **app,
                              struct sctp_transport **tpp)
 {
@@ -350,11 +373,10 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
         union sctp_addr daddr;
         struct sctp_af *af;
         struct sock *sk = NULL;
-        struct sctp_endpoint *ep = NULL;
         struct sctp_association *asoc = NULL;
         struct sctp_transport *transport = NULL;
 
-        *app = NULL; *epp = NULL; *tpp = NULL;
+        *app = NULL; *tpp = NULL;
 
         af = sctp_get_af_specific(family);
         if (unlikely(!af)) {
@@ -369,26 +391,15 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
          * packet.
          */
         asoc = __sctp_lookup_association(&saddr, &daddr, &transport);
-        if (!asoc) {
-                /* If there is no matching association, see if it matches any
-                 * endpoint. This may happen for an ICMP error generated in
-                 * response to an INIT_ACK.
-                 */
-                ep = __sctp_rcv_lookup_endpoint(&daddr);
-                if (!ep) {
-                        return NULL;
-                }
-        }
+        if (!asoc)
+                return NULL;
 
-        if (asoc) {
-                sk = asoc->base.sk;
+        sk = asoc->base.sk;
 
-                if (ntohl(sctphdr->vtag) != asoc->c.peer_vtag) {
-                        ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
-                        goto out;
-                }
-        } else
-                sk = ep->base.sk;
+        if (ntohl(sctphdr->vtag) != asoc->c.peer_vtag) {
+                ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
+                goto out;
+        }
 
         sctp_bh_lock_sock(sk);
 
@@ -398,7 +409,6 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
         if (sock_owned_by_user(sk))
                 NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
 
-        *epp = ep;
         *app = asoc;
         *tpp = transport;
         return sk;
@@ -407,21 +417,16 @@ out:
         sock_put(sk);
         if (asoc)
                 sctp_association_put(asoc);
-        if (ep)
-                sctp_endpoint_put(ep);
         return NULL;
 }
 
 /* Common cleanup code for icmp/icmpv6 error handler. */
-void sctp_err_finish(struct sock *sk, struct sctp_endpoint *ep,
-                     struct sctp_association *asoc)
+void sctp_err_finish(struct sock *sk, struct sctp_association *asoc)
 {
         sctp_bh_unlock_sock(sk);
         sock_put(sk);
         if (asoc)
                 sctp_association_put(asoc);
-        if (ep)
-                sctp_endpoint_put(ep);
 }
 
 /*
@@ -446,7 +451,6 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
         int type = skb->h.icmph->type;
         int code = skb->h.icmph->code;
         struct sock *sk;
-        struct sctp_endpoint *ep;
         struct sctp_association *asoc;
         struct sctp_transport *transport;
         struct inet_sock *inet;
@@ -463,7 +467,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
         savesctp  = skb->h.raw;
         skb->nh.iph = iph;
         skb->h.raw = (char *)sh;
-        sk = sctp_err_lookup(AF_INET, skb, sh, &ep, &asoc, &transport);
+        sk = sctp_err_lookup(AF_INET, skb, sh, &asoc, &transport);
         /* Put back, the original pointers. */
         skb->nh.raw = saveip;
         skb->h.raw = savesctp;
@@ -490,7 +494,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
                 }
                 else {
                         if (ICMP_PROT_UNREACH == code) {
-                                sctp_icmp_proto_unreachable(sk, ep, asoc,
+                                sctp_icmp_proto_unreachable(sk, asoc,
                                                             transport);
                                 goto out_unlock;
                         }
@@ -519,7 +523,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
         }
 
 out_unlock:
-        sctp_err_finish(sk, ep, asoc);
+        sctp_err_finish(sk, asoc);
 }
 
 /*
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index cedf4351556c..2d33922c044b 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -50,7 +50,7 @@
 /* Initialize an SCTP inqueue.  */
 void sctp_inq_init(struct sctp_inq *queue)
 {
-        skb_queue_head_init(&queue->in);
+        INIT_LIST_HEAD(&queue->in_chunk_list);
         queue->in_progress = NULL;
 
         /* Create a task for delivering data.  */
@@ -62,11 +62,13 @@ void sctp_inq_init(struct sctp_inq *queue)
 /* Release the memory associated with an SCTP inqueue.  */
 void sctp_inq_free(struct sctp_inq *queue)
 {
-        struct sctp_chunk *chunk;
+        struct sctp_chunk *chunk, *tmp;
 
         /* Empty the queue.  */
-        while ((chunk = (struct sctp_chunk *) skb_dequeue(&queue->in)) != NULL)
+        list_for_each_entry_safe(chunk, tmp, &queue->in_chunk_list, list) {
+                list_del_init(&chunk->list);
                 sctp_chunk_free(chunk);
+        }
 
         /* If there is a packet which is currently being worked on,
          * free it as well.
@@ -92,7 +94,7 @@ void sctp_inq_push(struct sctp_inq *q, struct sctp_chunk *packet)
          * Eventually, we should clean up inqueue to not rely
          * on the BH related data structures.
          */
-        skb_queue_tail(&(q->in), (struct sk_buff *) packet);
+        list_add_tail(&packet->list, &q->in_chunk_list);
         q->immediate.func(q->immediate.data);
 }
 
@@ -131,12 +133,16 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
 
         /* Do we need to take the next packet out of the queue to process? */
         if (!chunk) {
+                struct list_head *entry;
+
                 /* Is the queue empty?  */
-                if (skb_queue_empty(&queue->in))
+                if (list_empty(&queue->in_chunk_list))
                         return NULL;
 
+                entry = queue->in_chunk_list.next;
                 chunk = queue->in_progress =
-                        (struct sctp_chunk *) skb_dequeue(&queue->in);
+                        list_entry(entry, struct sctp_chunk, list);
+                list_del_init(entry);
 
                 /* This is the first chunk in the packet.  */
                 chunk->singleton = 1;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index c9d9ea064734..e9b2fd480d61 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -91,7 +91,6 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         struct ipv6hdr *iph = (struct ipv6hdr *)skb->data;
         struct sctphdr *sh = (struct sctphdr *)(skb->data + offset);
         struct sock *sk;
-        struct sctp_endpoint *ep;
         struct sctp_association *asoc;
         struct sctp_transport *transport;
         struct ipv6_pinfo *np;
@@ -105,7 +104,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         savesctp  = skb->h.raw;
         skb->nh.ipv6h = iph;
         skb->h.raw = (char *)sh;
-        sk = sctp_err_lookup(AF_INET6, skb, sh, &ep, &asoc, &transport);
+        sk = sctp_err_lookup(AF_INET6, skb, sh, &asoc, &transport);
         /* Put back, the original pointers. */
         skb->nh.raw = saveip;
         skb->h.raw = savesctp;
@@ -124,7 +123,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 goto out_unlock;
         case ICMPV6_PARAMPROB:
                 if (ICMPV6_UNK_NEXTHDR == code) {
-                        sctp_icmp_proto_unreachable(sk, ep, asoc, transport);
+                        sctp_icmp_proto_unreachable(sk, asoc, transport);
                         goto out_unlock;
                 }
                 break;
@@ -142,7 +141,7 @@ SCTP_STATIC void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         }
 
 out_unlock:
-        sctp_err_finish(sk, ep, asoc);
+        sctp_err_finish(sk, asoc);
 out:
         if (likely(idev != NULL))
                 in6_dev_put(idev);
@@ -812,26 +811,23 @@ static int sctp_inet6_bind_verify(struct sctp_sock *opt, union sctp_addr *addr)
         if (addr->sa.sa_family != AF_INET6)
                 af = sctp_get_af_specific(addr->sa.sa_family);
         else {
-                struct sock *sk;
                 int type = ipv6_addr_type(&addr->v6.sin6_addr);
-                sk = sctp_opt2sk(opt);
+                struct net_device *dev;
+
                 if (type & IPV6_ADDR_LINKLOCAL) {
-                        /* Note: Behavior similar to af_inet6.c:
-                         *  1) Overrides previous bound_dev_if
-                         *  2) Destructive even if bind isn't successful.
-                         */
-
-                        if (addr->v6.sin6_scope_id)
-                                sk->sk_bound_dev_if = addr->v6.sin6_scope_id;
-                        if (!sk->sk_bound_dev_if)
+                        if (!addr->v6.sin6_scope_id)
+                                return 0;
+                        dev = dev_get_by_index(addr->v6.sin6_scope_id);
+                        if (!dev)
                                 return 0;
+                        dev_put(dev);
                 }
                 af = opt->pf->af;
         }
         return af->available(addr, opt);
 }
 
-/* Verify that the provided sockaddr looks bindable.   Common verification,
+/* Verify that the provided sockaddr looks sendable.   Common verification,
  * has already been taken care of.
  */
 static int sctp_inet6_send_verify(struct sctp_sock *opt, union sctp_addr *addr)
@@ -842,19 +838,16 @@ static int sctp_inet6_send_verify(struct sctp_sock *opt, union sctp_addr *addr)
         if (addr->sa.sa_family != AF_INET6)
                 af = sctp_get_af_specific(addr->sa.sa_family);
         else {
-                struct sock *sk;
                 int type = ipv6_addr_type(&addr->v6.sin6_addr);
-                sk = sctp_opt2sk(opt);
+                struct net_device *dev;
+
                 if (type & IPV6_ADDR_LINKLOCAL) {
-                        /* Note: Behavior similar to af_inet6.c:
-                         *  1) Overrides previous bound_dev_if
-                         *  2) Destructive even if bind isn't successful.
-                         */
-
-                        if (addr->v6.sin6_scope_id)
-                                sk->sk_bound_dev_if = addr->v6.sin6_scope_id;
-                        if (!sk->sk_bound_dev_if)
+                        if (!addr->v6.sin6_scope_id)
+                                return 0;
+                        dev = dev_get_by_index(addr->v6.sin6_scope_id);
+                        if (!dev)
                                 return 0;
+                        dev_put(dev);
                 }
                 af = opt->pf->af;
         }
diff --git a/net/sctp/objcnt.c b/net/sctp/objcnt.c
index 0781e5d509fd..8ff588f0d76a 100644
--- a/net/sctp/objcnt.c
+++ b/net/sctp/objcnt.c
@@ -127,8 +127,12 @@ done:
 /* Initialize the objcount in the proc filesystem.  */
 void sctp_dbg_objcnt_init(void)
 {
-        create_proc_read_entry("sctp_dbg_objcnt", 0, proc_net_sctp,
+        struct proc_dir_entry *ent;
+        ent = create_proc_read_entry("sctp_dbg_objcnt", 0, proc_net_sctp,
                                sctp_dbg_objcnt_read, NULL);
+        if (!ent)
+                printk(KERN_WARNING 
+                        "sctp_dbg_objcnt: Unable to create /proc entry.\n");
 }
 
 /* Cleanup the objcount entry in the proc filesystem.  */
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 84b5b370b09d..931371633464 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -108,7 +108,7 @@ struct sctp_packet *sctp_packet_init(struct sctp_packet *packet,
         packet->transport = transport;
         packet->source_port = sport;
         packet->destination_port = dport;
-        skb_queue_head_init(&packet->chunks);
+        INIT_LIST_HEAD(&packet->chunk_list);
         if (asoc) {
                 struct sctp_sock *sp = sctp_sk(asoc->base.sk);  
                 overhead = sp->pf->af->net_header_len; 
@@ -129,12 +129,14 @@ struct sctp_packet *sctp_packet_init(struct sctp_packet *packet,
 /* Free a packet.  */
 void sctp_packet_free(struct sctp_packet *packet)
 {
-        struct sctp_chunk *chunk;
+        struct sctp_chunk *chunk, *tmp;
 
         SCTP_DEBUG_PRINTK("%s: packet:%p\n", __FUNCTION__, packet);
 
-        while ((chunk = (struct sctp_chunk *)__skb_dequeue(&packet->chunks)) != NULL)
+        list_for_each_entry_safe(chunk, tmp, &packet->chunk_list, list) {
+                list_del_init(&chunk->list);
                 sctp_chunk_free(chunk);
+        }
 
         if (packet->malloced)
                 kfree(packet);
@@ -276,7 +278,7 @@ append:
                 packet->has_sack = 1;
 
         /* It is OK to send this chunk.  */
-        __skb_queue_tail(&packet->chunks, (struct sk_buff *)chunk);
+        list_add_tail(&chunk->list, &packet->chunk_list);
         packet->size += chunk_len;
         chunk->transport = packet->transport;
 finish:
@@ -295,7 +297,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         struct sctphdr *sh;
         __u32 crc32;
         struct sk_buff *nskb;
-        struct sctp_chunk *chunk;
+        struct sctp_chunk *chunk, *tmp;
         struct sock *sk;
         int err = 0;
         int padding;            /* How much padding do we need?  */
@@ -305,11 +307,11 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         SCTP_DEBUG_PRINTK("%s: packet:%p\n", __FUNCTION__, packet);
 
         /* Do NOT generate a chunkless packet. */
-        chunk = (struct sctp_chunk *)skb_peek(&packet->chunks);
-        if (unlikely(!chunk))
+        if (list_empty(&packet->chunk_list))
                 return err;
 
         /* Set up convenience variables... */
+        chunk = list_entry(packet->chunk_list.next, struct sctp_chunk, list);
         sk = chunk->skb->sk;
 
         /* Allocate the new skb.  */
@@ -370,7 +372,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
          * [This whole comment explains WORD_ROUND() below.]
          */
         SCTP_DEBUG_PRINTK("***sctp_transmit_packet***\n");
-        while ((chunk = (struct sctp_chunk *)__skb_dequeue(&packet->chunks)) != NULL) {
+        list_for_each_entry_safe(chunk, tmp, &packet->chunk_list, list) {
+                list_del_init(&chunk->list);
                 if (sctp_chunk_is_data(chunk)) {
 
                         if (!chunk->has_tsn) {
@@ -511,7 +514,8 @@ err:
          * will get resent or dropped later.
          */
 
-        while ((chunk = (struct sctp_chunk *)__skb_dequeue(&packet->chunks)) != NULL) {
+        list_for_each_entry_safe(chunk, tmp, &packet->chunk_list, list) {
+                list_del_init(&chunk->list);
                 if (!sctp_chunk_is_data(chunk))
                         sctp_chunk_free(chunk);
         }
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 1b2d4adc4ddb..efb72faba20c 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -75,7 +75,7 @@ static void sctp_generate_fwdtsn(struct sctp_outq *q, __u32 sack_ctsn);
 static inline void sctp_outq_head_data(struct sctp_outq *q,
                                         struct sctp_chunk *ch)
 {
-        __skb_queue_head(&q->out, (struct sk_buff *)ch);
+        list_add(&ch->list, &q->out_chunk_list);
         q->out_qlen += ch->skb->len;
         return;
 }
@@ -83,17 +83,22 @@ static inline void sctp_outq_head_data(struct sctp_outq *q,
 /* Take data from the front of the queue. */
 static inline struct sctp_chunk *sctp_outq_dequeue_data(struct sctp_outq *q)
 {
-        struct sctp_chunk *ch;
-        ch = (struct sctp_chunk *)__skb_dequeue(&q->out);
-        if (ch)
+        struct sctp_chunk *ch = NULL;
+
+        if (!list_empty(&q->out_chunk_list)) {
+                struct list_head *entry = q->out_chunk_list.next;
+
+                ch = list_entry(entry, struct sctp_chunk, list);
+                list_del_init(entry);
                 q->out_qlen -= ch->skb->len;
+        }
         return ch;
 }
 /* Add data chunk to the end of the queue. */
 static inline void sctp_outq_tail_data(struct sctp_outq *q,
                                        struct sctp_chunk *ch)
 {
-        __skb_queue_tail(&q->out, (struct sk_buff *)ch);
+        list_add_tail(&ch->list, &q->out_chunk_list);
         q->out_qlen += ch->skb->len;
         return;
 }
@@ -197,8 +202,8 @@ static inline int sctp_cacc_skip(struct sctp_transport *primary,
 void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
 {
         q->asoc = asoc;
-        skb_queue_head_init(&q->out);
-        skb_queue_head_init(&q->control);
+        INIT_LIST_HEAD(&q->out_chunk_list);
+        INIT_LIST_HEAD(&q->control_chunk_list);
         INIT_LIST_HEAD(&q->retransmit);
         INIT_LIST_HEAD(&q->sacked);
         INIT_LIST_HEAD(&q->abandoned);
@@ -217,7 +222,7 @@ void sctp_outq_teardown(struct sctp_outq *q)
 {
         struct sctp_transport *transport;
         struct list_head *lchunk, *pos, *temp;
-        struct sctp_chunk *chunk;
+        struct sctp_chunk *chunk, *tmp;
 
         /* Throw away unacknowledged chunks. */
         list_for_each(pos, &q->asoc->peer.transport_addr_list) {
@@ -269,8 +274,10 @@ void sctp_outq_teardown(struct sctp_outq *q)
         q->error = 0;
 
         /* Throw away any leftover control chunks. */
-        while ((chunk = (struct sctp_chunk *) skb_dequeue(&q->control)) != NULL)
+        list_for_each_entry_safe(chunk, tmp, &q->control_chunk_list, list) {
+                list_del_init(&chunk->list);
                 sctp_chunk_free(chunk);
+        }
 }
 
 /* Free the outqueue structure and any related pending chunks.  */
@@ -333,7 +340,7 @@ int sctp_outq_tail(struct sctp_outq *q, struct sctp_chunk *chunk)
                         break;
                 };
         } else {
-                __skb_queue_tail(&q->control, (struct sk_buff *) chunk);
+                list_add_tail(&chunk->list, &q->control_chunk_list);
                 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
         }
 
@@ -650,10 +657,9 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
         __u16 sport = asoc->base.bind_addr.port;
         __u16 dport = asoc->peer.port;
         __u32 vtag = asoc->peer.i.init_tag;
-        struct sk_buff_head *queue;
         struct sctp_transport *transport = NULL;
         struct sctp_transport *new_transport;
-        struct sctp_chunk *chunk;
+        struct sctp_chunk *chunk, *tmp;
         sctp_xmit_t status;
         int error = 0;
         int start_timer = 0;
@@ -675,16 +681,17 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
          *   ...
          */
 
-        queue = &q->control;
-        while ((chunk = (struct sctp_chunk *)skb_dequeue(queue)) != NULL) {
+        list_for_each_entry_safe(chunk, tmp, &q->control_chunk_list, list) {
+                list_del_init(&chunk->list);
+
                 /* Pick the right transport to use. */
                 new_transport = chunk->transport;
 
                 if (!new_transport) {
                         new_transport = asoc->peer.active_path;
-                } else if (!new_transport->active) {
-                        /* If the chunk is Heartbeat or Heartbeat Ack, 
-                         * send it to chunk->transport, even if it's 
+                } else if (new_transport->state == SCTP_INACTIVE) {
+                        /* If the chunk is Heartbeat or Heartbeat Ack,
+                         * send it to chunk->transport, even if it's
                          * inactive.
                          *
                          * 3.3.6 Heartbeat Acknowledgement:
@@ -814,8 +821,6 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
 
                 /* Finally, transmit new packets.  */
                 start_timer = 0;
-                queue = &q->out;
-
                 while ((chunk = sctp_outq_dequeue_data(q)) != NULL) {
                         /* RFC 2960 6.5 Every DATA chunk MUST carry a valid
                          * stream identifier.
@@ -840,7 +845,8 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                          * Otherwise, we want to use the active path.
                          */
                         new_transport = chunk->transport;
-                        if (!new_transport || !new_transport->active)
+                        if (!new_transport ||
+                            new_transport->state == SCTP_INACTIVE)
                                 new_transport = asoc->peer.active_path;
 
                         /* Change packets if necessary.  */
@@ -1148,8 +1154,9 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_sackhdr *sack)
         /* See if all chunks are acked.
          * Make sure the empty queue handler will get run later.
          */
-        q->empty = skb_queue_empty(&q->out) && skb_queue_empty(&q->control) &&
-                        list_empty(&q->retransmit);
+        q->empty = (list_empty(&q->out_chunk_list) &&
+                    list_empty(&q->control_chunk_list) &&
+                    list_empty(&q->retransmit));
         if (!q->empty)
                 goto finish;
 
@@ -1454,7 +1461,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                         /* Mark the destination transport address as
                          * active if it is not so marked.
                          */
-                        if (!transport->active) {
+                        if (transport->state == SCTP_INACTIVE) {
                                 sctp_assoc_control_transport(
                                         transport->asoc,
                                         transport,
@@ -1678,9 +1685,9 @@ static void sctp_generate_fwdtsn(struct sctp_outq *q, __u32 ctsn)
                 if (TSN_lte(tsn, ctsn)) {
                         list_del_init(lchunk);
                         if (!chunk->tsn_gap_acked) {
-                        chunk->transport->flight_size -=
-                                                 sctp_data_size(chunk);
-                        q->outstanding_bytes -= sctp_data_size(chunk);
+                                chunk->transport->flight_size -=
+                                        sctp_data_size(chunk);
+                                q->outstanding_bytes -= sctp_data_size(chunk);
                         }
                         sctp_chunk_free(chunk);
                 } else {
@@ -1728,7 +1735,7 @@ static void sctp_generate_fwdtsn(struct sctp_outq *q, __u32 ctsn)
                                               nskips, &ftsn_skip_arr[0]); 
 
         if (ftsn_chunk) {
-                __skb_queue_tail(&q->control, (struct sk_buff *)ftsn_chunk);
+                list_add_tail(&ftsn_chunk->list, &q->control_chunk_list);
                 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
         }
 }
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index e42fd8c2916b..98d49ec9b74b 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -132,14 +132,25 @@ void sctp_snmp_proc_exit(void)
 static void sctp_seq_dump_local_addrs(struct seq_file *seq, struct sctp_ep_common *epb)
 {
         struct list_head *pos;
+        struct sctp_association *asoc;
         struct sctp_sockaddr_entry *laddr;
-        union sctp_addr *addr;
+        struct sctp_transport *peer;
+        union sctp_addr *addr, *primary = NULL;
         struct sctp_af *af;
 
+        if (epb->type == SCTP_EP_TYPE_ASSOCIATION) {
+            asoc = sctp_assoc(epb);
+            peer = asoc->peer.primary_path;
+            primary = &peer->saddr;
+        }
+
         list_for_each(pos, &epb->bind_addr.address_list) {
                 laddr = list_entry(pos, struct sctp_sockaddr_entry, list);
                 addr = (union sctp_addr *)&laddr->a;
                 af = sctp_get_af_specific(addr->sa.sa_family);
+                if (primary && af->cmp_addr(addr, primary)) {
+                        seq_printf(seq, "*");
+                }
                 af->seq_dump_addr(seq, addr);
         }
 }
@@ -149,17 +160,54 @@ static void sctp_seq_dump_remote_addrs(struct seq_file *seq, struct sctp_associa
 {
         struct list_head *pos;
         struct sctp_transport *transport;
-        union sctp_addr *addr;
+        union sctp_addr *addr, *primary;
         struct sctp_af *af;
 
+        primary = &(assoc->peer.primary_addr);
         list_for_each(pos, &assoc->peer.transport_addr_list) {
                 transport = list_entry(pos, struct sctp_transport, transports);
                 addr = (union sctp_addr *)&transport->ipaddr;
                 af = sctp_get_af_specific(addr->sa.sa_family);
+                if (af->cmp_addr(addr, primary)) {
+                        seq_printf(seq, "*");
+                }
                 af->seq_dump_addr(seq, addr);
         }
 }
 
+static void * sctp_eps_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        if (*pos > sctp_ep_hashsize)
+                return NULL;
+
+        if (*pos < 0)
+                *pos = 0;
+
+        if (*pos == 0)
+                seq_printf(seq, " ENDPT     SOCK   STY SST HBKT LPORT   UID INODE LADDRS\n");
+
+        ++*pos;
+
+        return (void *)pos;
+}
+
+static void sctp_eps_seq_stop(struct seq_file *seq, void *v)
+{
+        return;
+}
+
+
+static void * sctp_eps_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        if (*pos > sctp_ep_hashsize)
+                return NULL;
+
+        ++*pos;
+
+        return pos;
+}
+
+
 /* Display sctp endpoints (/proc/net/sctp/eps). */
 static int sctp_eps_seq_show(struct seq_file *seq, void *v)
 {
@@ -167,38 +215,50 @@ static int sctp_eps_seq_show(struct seq_file *seq, void *v)
         struct sctp_ep_common *epb;
         struct sctp_endpoint *ep;
         struct sock *sk;
-        int hash;
-
-        seq_printf(seq, " ENDPT     SOCK   STY SST HBKT LPORT LADDRS\n");
-        for (hash = 0; hash < sctp_ep_hashsize; hash++) {
-                head = &sctp_ep_hashtable[hash];
-                read_lock(&head->lock);
-                for (epb = head->chain; epb; epb = epb->next) {
-                        ep = sctp_ep(epb);
-                        sk = epb->sk;
-                        seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d ", ep, sk,
-                                   sctp_sk(sk)->type, sk->sk_state, hash,
-                                   epb->bind_addr.port);
-                        sctp_seq_dump_local_addrs(seq, epb);
-                        seq_printf(seq, "\n");
-                }
-                read_unlock(&head->lock);
+        int    hash = *(int *)v;
+
+        if (hash > sctp_ep_hashsize)
+                return -ENOMEM;
+
+        head = &sctp_ep_hashtable[hash-1];
+        sctp_local_bh_disable();
+        read_lock(&head->lock);
+        for (epb = head->chain; epb; epb = epb->next) {
+                ep = sctp_ep(epb);
+                sk = epb->sk;
+                seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ", ep, sk,
+                           sctp_sk(sk)->type, sk->sk_state, hash-1,
+                           epb->bind_addr.port,
+                           sock_i_uid(sk), sock_i_ino(sk));
+
+                sctp_seq_dump_local_addrs(seq, epb);
+                seq_printf(seq, "\n");
         }
+        read_unlock(&head->lock);
+        sctp_local_bh_enable();
 
         return 0;
 }
 
+static struct seq_operations sctp_eps_ops = {
+        .start = sctp_eps_seq_start,
+        .next  = sctp_eps_seq_next,
+        .stop  = sctp_eps_seq_stop,
+        .show  = sctp_eps_seq_show,
+};
+
+
 /* Initialize the seq file operations for 'eps' object. */
 static int sctp_eps_seq_open(struct inode *inode, struct file *file)
 {
-        return single_open(file, sctp_eps_seq_show, NULL);
+        return seq_open(file, &sctp_eps_ops);
 }
 
 static struct file_operations sctp_eps_seq_fops = {
         .open    = sctp_eps_seq_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = single_release,
+        .release = seq_release,
 };
 
 /* Set up the proc fs entry for 'eps' object. */
@@ -221,6 +281,40 @@ void sctp_eps_proc_exit(void)
         remove_proc_entry("eps", proc_net_sctp);
 }
 
+
+static void * sctp_assocs_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        if (*pos > sctp_assoc_hashsize)
+                return NULL;
+
+        if (*pos < 0)
+                *pos = 0;
+
+        if (*pos == 0)
+                seq_printf(seq, " ASSOC     SOCK   STY SST ST HBKT ASSOC-ID TX_QUEUE RX_QUEUE UID INODE LPORT "
+                                "RPORT LADDRS <-> RADDRS\n");
+
+        ++*pos;
+
+        return (void *)pos;
+}
+
+static void sctp_assocs_seq_stop(struct seq_file *seq, void *v)
+{
+        return;
+}
+
+
+static void * sctp_assocs_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        if (*pos > sctp_assoc_hashsize)
+                return NULL;
+
+        ++*pos;
+
+        return pos;
+}
+
 /* Display sctp associations (/proc/net/sctp/assocs). */
 static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
 {
@@ -228,43 +322,57 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
         struct sctp_ep_common *epb;
         struct sctp_association *assoc;
         struct sock *sk;
-        int hash;
-
-        seq_printf(seq, " ASSOC     SOCK   STY SST ST HBKT LPORT RPORT "
-                        "LADDRS <-> RADDRS\n");
-        for (hash = 0; hash < sctp_assoc_hashsize; hash++) {
-                head = &sctp_assoc_hashtable[hash];
-                read_lock(&head->lock);
-                for (epb = head->chain; epb; epb = epb->next) {
-                        assoc = sctp_assoc(epb);
-                        sk = epb->sk;
-                        seq_printf(seq,
-                                   "%8p %8p %-3d %-3d %-2d %-4d %-5d %-5d ",
-                                   assoc, sk, sctp_sk(sk)->type, sk->sk_state,
-                                   assoc->state, hash, epb->bind_addr.port,
-                                   assoc->peer.port);
-                        sctp_seq_dump_local_addrs(seq, epb);
-                        seq_printf(seq, "<-> ");
-                        sctp_seq_dump_remote_addrs(seq, assoc);
-                        seq_printf(seq, "\n");
-                }
-                read_unlock(&head->lock);
+        int    hash = *(int *)v;
+
+        if (hash > sctp_assoc_hashsize)
+                return -ENOMEM;
+
+        head = &sctp_assoc_hashtable[hash-1];
+        sctp_local_bh_disable();
+        read_lock(&head->lock);
+        for (epb = head->chain; epb; epb = epb->next) {
+                assoc = sctp_assoc(epb);
+                sk = epb->sk;
+                seq_printf(seq,
+                           "%8p %8p %-3d %-3d %-2d %-4d %4d %8d %8d %7d %5lu %-5d %5d ",
+                           assoc, sk, sctp_sk(sk)->type, sk->sk_state,
+                           assoc->state, hash-1, assoc->assoc_id,
+                           (sk->sk_rcvbuf - assoc->rwnd),
+                           assoc->sndbuf_used,
+                           sock_i_uid(sk), sock_i_ino(sk),
+                           epb->bind_addr.port,
+                           assoc->peer.port);
+
+                seq_printf(seq, " ");
+                sctp_seq_dump_local_addrs(seq, epb);
+                seq_printf(seq, "<-> ");
+                sctp_seq_dump_remote_addrs(seq, assoc);
+                seq_printf(seq, "\n");
         }
+        read_unlock(&head->lock);
+        sctp_local_bh_enable();
 
         return 0;
 }
 
+static struct seq_operations sctp_assoc_ops = {
+        .start = sctp_assocs_seq_start,
+        .next  = sctp_assocs_seq_next,
+        .stop  = sctp_assocs_seq_stop,
+        .show  = sctp_assocs_seq_show,
+};
+
 /* Initialize the seq file operations for 'assocs' object. */
 static int sctp_assocs_seq_open(struct inode *inode, struct file *file)
 {
-        return single_open(file, sctp_assocs_seq_show, NULL);
+        return seq_open(file, &sctp_assoc_ops);
 }
 
 static struct file_operations sctp_assocs_seq_fops = {
         .open    = sctp_assocs_seq_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = single_release,
+        .release = seq_release,
 };
 
 /* Set up the proc fs entry for 'assocs' object. */
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 2e1f9c3556f5..ce9245e71fca 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -219,7 +219,7 @@ static void sctp_free_local_addr_list(void)
 
 /* Copy the local addresses which are valid for 'scope' into 'bp'.  */
 int sctp_copy_local_addr_list(struct sctp_bind_addr *bp, sctp_scope_t scope,
-                              int gfp, int copy_flags)
+                              unsigned int __nocast gfp, int copy_flags)
 {
         struct sctp_sockaddr_entry *addr;
         int error = 0;
@@ -378,10 +378,13 @@ static int sctp_v4_available(union sctp_addr *addr, struct sctp_sock *sp)
 {
         int ret = inet_addr_type(addr->v4.sin_addr.s_addr);
 
-        /* FIXME: ip_nonlocal_bind sysctl support. */
 
-        if (addr->v4.sin_addr.s_addr != INADDR_ANY && ret != RTN_LOCAL)
+        if (addr->v4.sin_addr.s_addr != INADDR_ANY &&
+           ret != RTN_LOCAL &&
+           !sp->inet.freebind &&
+           !sysctl_ip_nonlocal_bind)
                 return 0;
+
         return 1;
 }
 
@@ -1047,7 +1050,10 @@ SCTP_STATIC __init int sctp_init(void)
         sctp_sndbuf_policy              = 0;
 
         /* HB.interval              - 30 seconds */
-        sctp_hb_interval                = 30 * HZ;
+        sctp_hb_interval                = SCTP_DEFAULT_TIMEOUT_HEARTBEAT;
+
+        /* delayed SACK timeout */
+        sctp_sack_timeout               = SCTP_DEFAULT_TIMEOUT_SACK;
 
         /* Implementation specific variables. */
 
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 33ac8bf47b0e..00d32b7c8266 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -78,7 +78,7 @@ static sctp_cookie_param_t *sctp_pack_cookie(const struct sctp_endpoint *ep,
 static int sctp_process_param(struct sctp_association *asoc,
                               union sctp_params param,
                               const union sctp_addr *peer_addr,
-                              int gfp);
+                              unsigned int __nocast gfp);
 
 /* What was the inbound interface for this chunk? */
 int sctp_chunk_iif(const struct sctp_chunk *chunk)
@@ -174,7 +174,7 @@ void  sctp_init_cause(struct sctp_chunk *chunk, __u16 cause_code,
  */
 struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
                              const struct sctp_bind_addr *bp,
-                             int gfp, int vparam_len)
+                             unsigned int __nocast gfp, int vparam_len)
 {
         sctp_inithdr_t init;
         union sctp_params addrs;
@@ -261,7 +261,7 @@ nodata:
 
 struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
                                  const struct sctp_chunk *chunk,
-                                 int gfp, int unkparam_len)
+                                 unsigned int __nocast gfp, int unkparam_len)
 {
         sctp_inithdr_t initack;
         struct sctp_chunk *retval;
@@ -1003,6 +1003,7 @@ struct sctp_chunk *sctp_chunkify(struct sk_buff *skb,
                 SCTP_DEBUG_PRINTK("chunkifying skb %p w/o an sk\n", skb);
         }
 
+        INIT_LIST_HEAD(&retval->list);
         retval->skb             = skb;
         retval->asoc            = (struct sctp_association *)asoc;
         retval->resent          = 0;
@@ -1116,8 +1117,7 @@ static void sctp_chunk_destroy(struct sctp_chunk *chunk)
 /* Possibly, free the chunk.  */
 void sctp_chunk_free(struct sctp_chunk *chunk)
 {
-        /* Make sure that we are not on any list.  */
-        skb_unlink((struct sk_buff *) chunk);
+        BUG_ON(!list_empty(&chunk->list));
         list_del_init(&chunk->transmitted_list);
 
         /* Release our reference on the message tracker. */
@@ -1233,7 +1233,8 @@ void sctp_chunk_assign_tsn(struct sctp_chunk *chunk)
 
 /* Create a CLOSED association to use with an incoming packet.  */
 struct sctp_association *sctp_make_temp_asoc(const struct sctp_endpoint *ep,
-                                        struct sctp_chunk *chunk, int gfp)
+                                        struct sctp_chunk *chunk,
+                                        unsigned int __nocast gfp)
 {
         struct sctp_association *asoc;
         struct sk_buff *skb;
@@ -1348,7 +1349,7 @@ nodata:
 struct sctp_association *sctp_unpack_cookie(
         const struct sctp_endpoint *ep,
         const struct sctp_association *asoc,
-        struct sctp_chunk *chunk, int gfp,
+        struct sctp_chunk *chunk, unsigned int __nocast gfp,
         int *error, struct sctp_chunk **errp)
 {
         struct sctp_association *retval = NULL;
@@ -1812,7 +1813,7 @@ int sctp_verify_init(const struct sctp_association *asoc,
  */
 int sctp_process_init(struct sctp_association *asoc, sctp_cid_t cid,
                       const union sctp_addr *peer_addr,
-                      sctp_init_chunk_t *peer_init, int gfp)
+                      sctp_init_chunk_t *peer_init, unsigned int __nocast gfp)
 {
         union sctp_params param;
         struct sctp_transport *transport;
@@ -1830,7 +1831,7 @@ int sctp_process_init(struct sctp_association *asoc, sctp_cid_t cid,
          * be a a better choice than any of the embedded addresses.
          */
         if (peer_addr)
-                if(!sctp_assoc_add_peer(asoc, peer_addr, gfp))
+                if(!sctp_assoc_add_peer(asoc, peer_addr, gfp, SCTP_ACTIVE))
                         goto nomem;
 
         /* Process the initialization parameters.  */
@@ -1841,6 +1842,14 @@ int sctp_process_init(struct sctp_association *asoc, sctp_cid_t cid,
                         goto clean_up;
         }
 
+        /* Walk list of transports, removing transports in the UNKNOWN state. */
+        list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
+                transport = list_entry(pos, struct sctp_transport, transports);
+                if (transport->state == SCTP_UNKNOWN) {
+                        sctp_assoc_rm_peer(asoc, transport);
+                }
+        }
+
         /* The fixed INIT headers are always in network byte
          * order.
          */
@@ -1906,7 +1915,8 @@ int sctp_process_init(struct sctp_association *asoc, sctp_cid_t cid,
          * stream sequence number shall be set to 0.
          */
 
-        /* Allocate storage for the negotiated streams if it is not a temporary          * association.
+        /* Allocate storage for the negotiated streams if it is not a temporary
+         * association.
          */
         if (!asoc->temp) {
                 int assoc_id;
@@ -1952,6 +1962,9 @@ clean_up:
                 list_del_init(pos);
                 sctp_transport_free(transport);
         }
+
+        asoc->peer.transport_count = 0;
+
 nomem:
         return 0;
 }
@@ -1971,7 +1984,7 @@ nomem:
 static int sctp_process_param(struct sctp_association *asoc,
                               union sctp_params param,
                               const union sctp_addr *peer_addr,
-                              int gfp)
+                              unsigned int __nocast gfp)
 {
         union sctp_addr addr;
         int i;
@@ -1995,7 +2008,7 @@ static int sctp_process_param(struct sctp_association *asoc,
                 af->from_addr_param(&addr, param.addr, asoc->peer.port, 0);
                 scope = sctp_scope(peer_addr);
                 if (sctp_in_scope(&addr, scope))
-                        if (!sctp_assoc_add_peer(asoc, &addr, gfp))
+                        if (!sctp_assoc_add_peer(asoc, &addr, gfp, SCTP_ACTIVE))
                                 return 0;
                 break;
 
@@ -2396,7 +2409,7 @@ static __u16 sctp_process_asconf_param(struct sctp_association *asoc,
                  * Due to Resource Shortage'.
                  */
 
-                peer = sctp_assoc_add_peer(asoc, &addr, GFP_ATOMIC);
+                peer = sctp_assoc_add_peer(asoc, &addr, GFP_ATOMIC, SCTP_ACTIVE);
                 if (!peer)
                         return SCTP_ERROR_RSRC_LOW;
 
@@ -2727,8 +2740,12 @@ int sctp_process_asconf_ack(struct sctp_association *asoc,
         asoc->addip_last_asconf = NULL;
 
         /* Send the next asconf chunk from the addip chunk queue. */
-        asconf = (struct sctp_chunk *)__skb_dequeue(&asoc->addip_chunks);
-        if (asconf) {
+        if (!list_empty(&asoc->addip_chunk_list)) {
+                struct list_head *entry = asoc->addip_chunk_list.next;
+                asconf = list_entry(entry, struct sctp_chunk, list);
+
+                list_del_init(entry);
+
                 /* Hold the chunk until an ASCONF_ACK is received. */
                 sctp_chunk_hold(asconf);
                 if (sctp_primitive_ASCONF(asoc, asconf))
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index f65fa441952f..39c970b5b198 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -63,7 +63,7 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                                 void *event_arg,
                                 sctp_disposition_t status,
                                 sctp_cmd_seq_t *commands,
-                                int gfp);
+                                unsigned int __nocast gfp);
 static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
                              sctp_state_t state,
                              struct sctp_endpoint *ep,
@@ -71,7 +71,7 @@ static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
                              void *event_arg,
                              sctp_disposition_t status,
                              sctp_cmd_seq_t *commands,
-                             int gfp);
+                             unsigned int __nocast gfp);
 
 /********************************************************************
  * Helper functions
@@ -414,11 +414,13 @@ static void sctp_do_8_2_transport_strike(struct sctp_association *asoc,
          */
         asoc->overall_error_count++;
 
-        if (transport->active &&
+        if (transport->state != SCTP_INACTIVE &&
             (transport->error_count++ >= transport->max_retrans)) {
-                SCTP_DEBUG_PRINTK("transport_strike: transport "
-                                  "IP:%d.%d.%d.%d failed.\n",
-                                  NIPQUAD(transport->ipaddr.v4.sin_addr));
+                SCTP_DEBUG_PRINTK_IPADDR("transport_strike:association %p",
+                                         " transport IP: port:%d failed.\n",
+                                         asoc,
+                                         (&transport->ipaddr),
+                                         transport->ipaddr.v4.sin_port);
                 sctp_assoc_control_transport(asoc, transport,
                                              SCTP_TRANSPORT_DOWN,
                                              SCTP_FAILED_THRESHOLD);
@@ -495,7 +497,8 @@ static void sctp_cmd_assoc_failed(sctp_cmd_seq_t *commands,
 static int sctp_cmd_process_init(sctp_cmd_seq_t *commands,
                                  struct sctp_association *asoc,
                                  struct sctp_chunk *chunk,
-                                 sctp_init_chunk_t *peer_init, int gfp)
+                                 sctp_init_chunk_t *peer_init,
+                                 unsigned int __nocast gfp)
 {
         int error;
 
@@ -593,7 +596,7 @@ static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds,
         /* Mark the destination transport address as active if it is not so
          * marked.
          */
-        if (!t->active)
+        if (t->state == SCTP_INACTIVE)
                 sctp_assoc_control_transport(asoc, t, SCTP_TRANSPORT_UP,
                                              SCTP_HEARTBEAT_SUCCESS);
 
@@ -665,8 +668,11 @@ static void sctp_cmd_new_state(sctp_cmd_seq_t *cmds,
 
         asoc->state = state;
 
+        SCTP_DEBUG_PRINTK("sctp_cmd_new_state: asoc %p[%s]\n",
+                          asoc, sctp_state_tbl[state]);
+
         if (sctp_style(sk, TCP)) {
-                /* Change the sk->sk_state of a TCP-style socket that has 
+                /* Change the sk->sk_state of a TCP-style socket that has
                  * sucessfully completed a connect() call.
                  */
                 if (sctp_state(asoc, ESTABLISHED) && sctp_sstate(sk, CLOSED))
@@ -678,6 +684,16 @@ static void sctp_cmd_new_state(sctp_cmd_seq_t *cmds,
                         sk->sk_shutdown |= RCV_SHUTDOWN;
         }
 
+        if (sctp_state(asoc, COOKIE_WAIT)) {
+                /* Reset init timeouts since they may have been
+                 * increased due to timer expirations.
+                 */
+                asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT] =
+                        asoc->ep->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT];
+                asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] =
+                        asoc->ep->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE];
+        }
+
         if (sctp_state(asoc, ESTABLISHED) ||
             sctp_state(asoc, CLOSED) ||
             sctp_state(asoc, SHUTDOWN_RECEIVED)) {
@@ -837,7 +853,7 @@ int sctp_do_sm(sctp_event_t event_type, sctp_subtype_t subtype,
                struct sctp_endpoint *ep,
                struct sctp_association *asoc,
                void *event_arg,
-               int gfp)
+               unsigned int __nocast gfp)
 {
         sctp_cmd_seq_t commands;
         const sctp_sm_table_entry_t *state_fn;
@@ -882,7 +898,7 @@ static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
                              void *event_arg,
                              sctp_disposition_t status,
                              sctp_cmd_seq_t *commands,
-                             int gfp)
+                             unsigned int __nocast gfp)
 {
         int error;
 
@@ -970,7 +986,7 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                                 void *event_arg,
                                 sctp_disposition_t status,
                                 sctp_cmd_seq_t *commands,
-                                int gfp)
+                                unsigned int __nocast gfp)
 {
         int error = 0;
         int force;
@@ -1120,10 +1136,10 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                          * to be executed only during failed attempts of
                          * association establishment.
                          */
-                        if ((asoc->peer.retran_path != 
-                             asoc->peer.primary_path) && 
-                            (asoc->counters[SCTP_COUNTER_INIT_ERROR] > 0)) {
-                                sctp_add_cmd_sf(commands, 
+                        if ((asoc->peer.retran_path !=
+                             asoc->peer.primary_path) &&
+                            (asoc->init_err_counter > 0)) {
+                                sctp_add_cmd_sf(commands,
                                                 SCTP_CMD_FORCE_PRIM_RETRAN,
                                                 SCTP_NULL());
                         }
@@ -1237,18 +1253,67 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                                 sctp_association_put(asoc);
                         break;
 
+                case SCTP_CMD_INIT_CHOOSE_TRANSPORT:
+                        chunk = cmd->obj.ptr;
+                        t = sctp_assoc_choose_init_transport(asoc);
+                        asoc->init_last_sent_to = t;
+                        chunk->transport = t;
+                        t->init_sent_count++;
+                        break;
+
                 case SCTP_CMD_INIT_RESTART:
                         /* Do the needed accounting and updates
                          * associated with restarting an initialization
-                         * timer.
+                         * timer. Only multiply the timeout by two if
+                         * all transports have been tried at the current
+                         * timeout.
+                         */
+                        t = asoc->init_last_sent_to;
+                        asoc->init_err_counter++;
+
+                        if (t->init_sent_count > (asoc->init_cycle + 1)) {
+                                asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT] *= 2;
+                                if (asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT] >
+                                    asoc->max_init_timeo) {
+                                        asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT] =
+                                                asoc->max_init_timeo;
+                                }
+                                asoc->init_cycle++;
+                                SCTP_DEBUG_PRINTK(
+                                        "T1 INIT Timeout adjustment"
+                                        " init_err_counter: %d"
+                                        " cycle: %d"
+                                        " timeout: %d\n",
+                                        asoc->init_err_counter,
+                                        asoc->init_cycle,
+                                        asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT]);
+                        }
+
+                        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
+                                        SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
+                        break;
+
+                case SCTP_CMD_COOKIEECHO_RESTART:
+                        /* Do the needed accounting and updates
+                         * associated with restarting an initialization
+                         * timer. Only multiply the timeout by two if
+                         * all transports have been tried at the current
+                         * timeout.
                          */
-                        asoc->counters[SCTP_COUNTER_INIT_ERROR]++;
-                        asoc->timeouts[cmd->obj.to] *= 2;
-                        if (asoc->timeouts[cmd->obj.to] >
+                        asoc->init_err_counter++;
+
+                        asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] *= 2;
+                        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] >
                             asoc->max_init_timeo) {
-                                asoc->timeouts[cmd->obj.to] =
+                                asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] =
                                         asoc->max_init_timeo;
                         }
+                        SCTP_DEBUG_PRINTK(
+                                "T1 COOKIE Timeout adjustment"
+                                " init_err_counter: %d"
+                                " timeout: %d\n",
+                                asoc->init_err_counter,
+                                asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE]);
 
                         /* If we've sent any data bundled with
                          * COOKIE-ECHO we need to resend.
@@ -1261,7 +1326,7 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
 
                         sctp_add_cmd_sf(commands,
                                         SCTP_CMD_TIMER_RESTART,
-                                        SCTP_TO(cmd->obj.to));
+                                        SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
                         break;
 
                 case SCTP_CMD_INIT_FAILED:
@@ -1273,12 +1338,13 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                                               subtype, chunk, cmd->obj.u32);
                         break;
 
-                case SCTP_CMD_COUNTER_INC:
-                        asoc->counters[cmd->obj.counter]++;
+                case SCTP_CMD_INIT_COUNTER_INC:
+                        asoc->init_err_counter++;
                         break;
 
-                case SCTP_CMD_COUNTER_RESET:
-                        asoc->counters[cmd->obj.counter] = 0;
+                case SCTP_CMD_INIT_COUNTER_RESET:
+                        asoc->init_err_counter = 0;
+                        asoc->init_cycle = 0;
                         break;
 
                 case SCTP_CMD_REPORT_DUP:
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 8e01b8f09ac2..86073df418f5 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -92,6 +92,17 @@ static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
                                              sctp_cmd_seq_t *commands);
 static struct sctp_sackhdr *sctp_sm_pull_sack(struct sctp_chunk *chunk);
 
+static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
+                                           __u16 error,
+                                           const struct sctp_association *asoc,
+                                           struct sctp_transport *transport);
+
+static sctp_disposition_t sctp_sf_violation_chunklen(
+                                     const struct sctp_endpoint *ep,
+                                     const struct sctp_association *asoc,
+                                     const sctp_subtype_t type,
+                                     void *arg,
+                                     sctp_cmd_seq_t *commands);
 
 /* Small helper function that checks if the chunk length
  * is of the appropriate length.  The 'required_length' argument
@@ -533,6 +544,9 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
         sctp_add_cmd_sf(commands, SCTP_CMD_PEER_INIT,
                         SCTP_PEER_INIT(initchunk));
 
+        /* Reset init error count upon receipt of INIT-ACK.  */
+        sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
+
         /* 5.1 C) "A" shall stop the T1-init timer and leave
          * COOKIE-WAIT state.  "A" shall then ... start the T1-cookie
          * timer, and enter the COOKIE-ECHOED state.
@@ -775,8 +789,7 @@ sctp_disposition_t sctp_sf_do_5_1E_ca(const struct sctp_endpoint *ep,
          * from the COOKIE-ECHOED state to the COOKIE-WAIT
          * state is performed.
          */
-        sctp_add_cmd_sf(commands, SCTP_CMD_COUNTER_RESET,
-                        SCTP_COUNTER(SCTP_COUNTER_INIT_ERROR));
+        sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
 
         /* RFC 2960 5.1 Normal Establishment of an Association
          *
@@ -1019,10 +1032,22 @@ sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep,
         link = sctp_assoc_lookup_paddr(asoc, &from_addr);
 
         /* This should never happen, but lets log it if so.  */
-        if (!link) {
-                printk(KERN_WARNING
-                       "%s: Could not find address %d.%d.%d.%d\n",
-                       __FUNCTION__, NIPQUAD(from_addr.v4.sin_addr));
+        if (unlikely(!link)) {
+                if (from_addr.sa.sa_family == AF_INET6) {
+                        printk(KERN_WARNING
+                               "%s association %p could not find address "
+                               "%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x\n",
+                               __FUNCTION__,
+                               asoc,
+                               NIP6(from_addr.v6.sin6_addr));
+                } else {
+                        printk(KERN_WARNING
+                               "%s association %p could not find address "
+                               "%u.%u.%u.%u\n",
+                               __FUNCTION__,
+                               asoc,
+                               NIPQUAD(from_addr.v4.sin_addr.s_addr));
+                }
                 return SCTP_DISPOSITION_DISCARD;
         }
 
@@ -2095,9 +2120,7 @@ static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
         sctp_errhdr_t *err;
         struct sctp_chunk *reply;
         struct sctp_bind_addr *bp;
-        int attempts;
-
-        attempts = asoc->counters[SCTP_COUNTER_INIT_ERROR] + 1;
+        int attempts = asoc->init_err_counter + 1;
 
         if (attempts >= asoc->max_init_attempts) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
@@ -2157,8 +2180,7 @@ static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
         /* Cast away the const modifier, as we want to just
          * rerun it through as a sideffect.
          */
-        sctp_add_cmd_sf(commands, SCTP_CMD_COUNTER_INC,
-                        SCTP_COUNTER(SCTP_COUNTER_INIT_ERROR));
+        sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_INC, SCTP_NULL());
 
         sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                         SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
@@ -2281,8 +2303,7 @@ sctp_disposition_t sctp_sf_cookie_wait_abort(const struct sctp_endpoint *ep,
         if (len >= sizeof(struct sctp_chunkhdr) + sizeof(struct sctp_errhdr))
                 error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
 
-        sctp_stop_t1_and_abort(commands, error);
-        return SCTP_DISPOSITION_ABORT;
+        return sctp_stop_t1_and_abort(commands, error, asoc, chunk->transport);
 }
 
 /*
@@ -2294,8 +2315,8 @@ sctp_disposition_t sctp_sf_cookie_wait_icmp_abort(const struct sctp_endpoint *ep
                                         void *arg,
                                         sctp_cmd_seq_t *commands)
 {
-        sctp_stop_t1_and_abort(commands, SCTP_ERROR_NO_ERROR);
-        return SCTP_DISPOSITION_ABORT;
+        return sctp_stop_t1_and_abort(commands, SCTP_ERROR_NO_ERROR, asoc,
+                                      (struct sctp_transport *)arg);
 }
 
 /*
@@ -2318,8 +2339,12 @@ sctp_disposition_t sctp_sf_cookie_echoed_abort(const struct sctp_endpoint *ep,
  *
  * This is common code called by several sctp_sf_*_abort() functions above.
  */
-void sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands, __u16 error)
+static sctp_disposition_t sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands,
+                                           __u16 error,
+                                           const struct sctp_association *asoc,
+                                           struct sctp_transport *transport)
 {
+        SCTP_DEBUG_PRINTK("ABORT received (INIT).\n");
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
                         SCTP_STATE(SCTP_STATE_CLOSED));
         SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
@@ -2328,6 +2353,7 @@ void sctp_stop_t1_and_abort(sctp_cmd_seq_t *commands, __u16 error)
         /* CMD_INIT_FAILED will DELETE_TCB. */
         sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                         SCTP_U32(error));
+        return SCTP_DISPOSITION_ABORT;
 }
 
 /*
@@ -3672,7 +3698,8 @@ sctp_disposition_t sctp_sf_violation(const struct sctp_endpoint *ep,
  *
  * Generate an  ABORT chunk and terminate the association.
  */
-sctp_disposition_t sctp_sf_violation_chunklen(const struct sctp_endpoint *ep,
+static sctp_disposition_t sctp_sf_violation_chunklen(
+                                     const struct sctp_endpoint *ep,
                                      const struct sctp_association *asoc,
                                      const sctp_subtype_t type,
                                      void *arg,
@@ -3805,6 +3832,10 @@ sctp_disposition_t sctp_sf_do_prm_asoc(const struct sctp_endpoint *ep,
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC,
                         SCTP_ASOC((struct sctp_association *) asoc));
 
+        /* Choose transport for INIT. */
+        sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
+                        SCTP_CHUNK(repl));
+
         /* After sending the INIT, "A" starts the T1-init timer and
          * enters the COOKIE-WAIT state.
          */
@@ -4589,7 +4620,7 @@ sctp_disposition_t sctp_sf_do_6_2_sack(const struct sctp_endpoint *ep,
 }
 
 /*
- * sctp_sf_t1_timer_expire
+ * sctp_sf_t1_init_timer_expire
  *
  * Section: 4 Note: 2
  * Verification Tag:
@@ -4603,7 +4634,59 @@ sctp_disposition_t sctp_sf_do_6_2_sack(const struct sctp_endpoint *ep,
  *     endpoint MUST abort the initialization process and report the
  *     error to SCTP user.
  *
- *   3) If the T1-cookie timer expires, the endpoint MUST retransmit
+ * Outputs
+ * (timers, events)
+ *
+ */
+sctp_disposition_t sctp_sf_t1_init_timer_expire(const struct sctp_endpoint *ep,
+                                           const struct sctp_association *asoc,
+                                           const sctp_subtype_t type,
+                                           void *arg,
+                                           sctp_cmd_seq_t *commands)
+{
+        struct sctp_chunk *repl = NULL;
+        struct sctp_bind_addr *bp;
+        int attempts = asoc->init_err_counter + 1;
+
+        SCTP_DEBUG_PRINTK("Timer T1 expired (INIT).\n");
+
+        if (attempts < asoc->max_init_attempts) {
+                bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
+                repl = sctp_make_init(asoc, bp, GFP_ATOMIC, 0);
+                if (!repl)
+                        return SCTP_DISPOSITION_NOMEM;
+
+                /* Choose transport for INIT. */
+                sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
+                                SCTP_CHUNK(repl));
+
+                /* Issue a sideeffect to do the needed accounting. */
+                sctp_add_cmd_sf(commands, SCTP_CMD_INIT_RESTART,
+                                SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
+
+                sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
+        } else {
+                SCTP_DEBUG_PRINTK("Giving up on INIT, attempts: %d"
+                                  " max_init_attempts: %d\n",
+                                  attempts, asoc->max_init_attempts);
+                sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
+                                SCTP_U32(SCTP_ERROR_NO_ERROR));
+                return SCTP_DISPOSITION_DELETE_TCB;
+        }
+
+        return SCTP_DISPOSITION_CONSUME;
+}
+
+/*
+ * sctp_sf_t1_cookie_timer_expire
+ *
+ * Section: 4 Note: 2
+ * Verification Tag:
+ * Inputs
+ * (endpoint, asoc)
+ *
+ *  RFC 2960 Section 4 Notes
+ *  3) If the T1-cookie timer expires, the endpoint MUST retransmit
  *     COOKIE ECHO and re-start the T1-cookie timer without changing
  *     state.  This MUST be repeated up to 'Max.Init.Retransmits' times.
  *     After that, the endpoint MUST abort the initialization process and
@@ -4613,46 +4696,26 @@ sctp_disposition_t sctp_sf_do_6_2_sack(const struct sctp_endpoint *ep,
  * (timers, events)
  *
  */
-sctp_disposition_t sctp_sf_t1_timer_expire(const struct sctp_endpoint *ep,
+sctp_disposition_t sctp_sf_t1_cookie_timer_expire(const struct sctp_endpoint *ep,
                                            const struct sctp_association *asoc,
                                            const sctp_subtype_t type,
                                            void *arg,
                                            sctp_cmd_seq_t *commands)
 {
-        struct sctp_chunk *repl;
-        struct sctp_bind_addr *bp;
-        sctp_event_timeout_t timer = (sctp_event_timeout_t) arg;
-        int timeout;
-        int attempts;
+        struct sctp_chunk *repl = NULL;
+        int attempts = asoc->init_err_counter + 1;
 
-        timeout = asoc->timeouts[timer];
-        attempts = asoc->counters[SCTP_COUNTER_INIT_ERROR] + 1;
-        repl = NULL;
-
-        SCTP_DEBUG_PRINTK("Timer T1 expired.\n");
+        SCTP_DEBUG_PRINTK("Timer T1 expired (COOKIE-ECHO).\n");
 
         if (attempts < asoc->max_init_attempts) {
-                switch (timer) {
-                case SCTP_EVENT_TIMEOUT_T1_INIT:
-                        bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
-                        repl = sctp_make_init(asoc, bp, GFP_ATOMIC, 0);
-                        break;
-
-                case SCTP_EVENT_TIMEOUT_T1_COOKIE:
-                        repl = sctp_make_cookie_echo(asoc, NULL);
-                        break;
-
-                default:
-                        BUG();
-                        break;
-                };
-
+                repl = sctp_make_cookie_echo(asoc, NULL);
                 if (!repl)
-                        goto nomem;
+                        return SCTP_DISPOSITION_NOMEM;
 
                 /* Issue a sideeffect to do the needed accounting. */
-                sctp_add_cmd_sf(commands, SCTP_CMD_INIT_RESTART,
-                                SCTP_TO(timer));
+                sctp_add_cmd_sf(commands, SCTP_CMD_COOKIEECHO_RESTART,
+                                SCTP_TO(SCTP_EVENT_TIMEOUT_T1_COOKIE));
+
                 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
         } else {
                 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
@@ -4661,9 +4724,6 @@ sctp_disposition_t sctp_sf_t1_timer_expire(const struct sctp_endpoint *ep,
         }
 
         return SCTP_DISPOSITION_CONSUME;
-
-nomem:
-        return SCTP_DISPOSITION_NOMEM;
 }
 
 /* RFC2960 9.2 If the timer expires, the endpoint must re-send the SHUTDOWN
diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c
index 8967846f69e8..75ef10408764 100644
--- a/net/sctp/sm_statetable.c
+++ b/net/sctp/sm_statetable.c
@@ -783,7 +783,8 @@ static const sctp_sm_table_entry_t other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_
         /* SCTP_STATE_COOKIE_WAIT */ \
         {.fn = sctp_sf_bug, .name = "sctp_sf_bug"}, \
         /* SCTP_STATE_COOKIE_ECHOED */ \
-        {.fn = sctp_sf_t1_timer_expire, .name = "sctp_sf_t1_timer_expire"}, \
+        {.fn = sctp_sf_t1_cookie_timer_expire, \
+         .name = "sctp_sf_t1_cookie_timer_expire"}, \
         /* SCTP_STATE_ESTABLISHED */ \
         {.fn = sctp_sf_timer_ignore, .name = "sctp_sf_timer_ignore"}, \
         /* SCTP_STATE_SHUTDOWN_PENDING */ \
@@ -802,7 +803,8 @@ static const sctp_sm_table_entry_t other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_
         /* SCTP_STATE_CLOSED */ \
         {.fn = sctp_sf_timer_ignore, .name = "sctp_sf_timer_ignore"}, \
         /* SCTP_STATE_COOKIE_WAIT */ \
-        {.fn = sctp_sf_t1_timer_expire, .name = "sctp_sf_t1_timer_expire"}, \
+        {.fn = sctp_sf_t1_init_timer_expire, \
+         .name = "sctp_sf_t1_init_timer_expire"}, \
         /* SCTP_STATE_COOKIE_ECHOED */ \
         {.fn = sctp_sf_timer_ignore, .name = "sctp_sf_timer_ignore"}, \
         /* SCTP_STATE_ESTABLISHED */ \
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 0b338eca6dc0..091a66f06a35 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -262,18 +262,18 @@ static struct sctp_transport *sctp_addr_id2transport(struct sock *sk,
  *             sockaddr_in6 [RFC 2553]),
  *   addr_len - the size of the address structure.
  */
-SCTP_STATIC int sctp_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+SCTP_STATIC int sctp_bind(struct sock *sk, struct sockaddr *addr, int addr_len)
 {
         int retval = 0;
 
         sctp_lock_sock(sk);
 
-        SCTP_DEBUG_PRINTK("sctp_bind(sk: %p, uaddr: %p, addr_len: %d)\n",
-                          sk, uaddr, addr_len);
+        SCTP_DEBUG_PRINTK("sctp_bind(sk: %p, addr: %p, addr_len: %d)\n",
+                          sk, addr, addr_len);
 
         /* Disallow binding twice. */
         if (!sctp_sk(sk)->ep->base.bind_addr.port)
-                retval = sctp_do_bind(sk, (union sctp_addr *)uaddr,
+                retval = sctp_do_bind(sk, (union sctp_addr *)addr,
                                       addr_len);
         else
                 retval = -EINVAL;
@@ -318,23 +318,27 @@ SCTP_STATIC int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
         unsigned short snum;
         int ret = 0;
 
-        SCTP_DEBUG_PRINTK("sctp_do_bind(sk: %p, newaddr: %p, len: %d)\n",
-                          sk, addr, len);
-
         /* Common sockaddr verification. */
         af = sctp_sockaddr_af(sp, addr, len);
-        if (!af)
+        if (!af) {
+                SCTP_DEBUG_PRINTK("sctp_do_bind(sk: %p, newaddr: %p, len: %d) EINVAL\n",
+                                  sk, addr, len);
                 return -EINVAL;
+        }
+
+        snum = ntohs(addr->v4.sin_port);
+
+        SCTP_DEBUG_PRINTK_IPADDR("sctp_do_bind(sk: %p, new addr: ",
+                                 ", port: %d, new port: %d, len: %d)\n",
+                                 sk,
+                                 addr,
+                                 bp->port, snum,
+                                 len);
 
         /* PF specific bind() address verification. */
         if (!sp->pf->bind_verify(sp, addr))
                 return -EADDRNOTAVAIL;
 
-        snum= ntohs(addr->v4.sin_port);
-
-        SCTP_DEBUG_PRINTK("sctp_do_bind: port: %d, new port: %d\n",
-                          bp->port, snum);
-
         /* We must either be unbound, or bind to the same port.  */
         if (bp->port && (snum != bp->port)) {
                 SCTP_DEBUG_PRINTK("sctp_do_bind:"
@@ -402,7 +406,7 @@ static int sctp_send_asconf(struct sctp_association *asoc,
          * transmission.
          */     
         if (asoc->addip_last_asconf) {
-                __skb_queue_tail(&asoc->addip_chunks, (struct sk_buff *)chunk);
+                list_add_tail(&chunk->list, &asoc->addip_chunk_list);
                 goto out;       
         }
 
@@ -816,7 +820,8 @@ out:
  *
  * Basically do nothing but copying the addresses from user to kernel
  * land and invoking either sctp_bindx_add() or sctp_bindx_rem() on the sk.
- * This is used for tunneling the sctp_bindx() request through sctp_setsockopt() * from userspace.
+ * This is used for tunneling the sctp_bindx() request through sctp_setsockopt()
+ * from userspace.
  *
  * We don't use copy_from_user() for optimization: we first do the
  * sanity checks (buffer size -fast- and access check-healthy
@@ -913,6 +918,243 @@ out:
         return err;
 }
 
+/* __sctp_connect(struct sock* sk, struct sockaddr *kaddrs, int addrs_size)
+ *
+ * Common routine for handling connect() and sctp_connectx().
+ * Connect will come in with just a single address.
+ */
+static int __sctp_connect(struct sock* sk,
+                          struct sockaddr *kaddrs,
+                          int addrs_size)
+{
+        struct sctp_sock *sp;
+        struct sctp_endpoint *ep;
+        struct sctp_association *asoc = NULL;
+        struct sctp_association *asoc2;
+        struct sctp_transport *transport;
+        union sctp_addr to;
+        struct sctp_af *af;
+        sctp_scope_t scope;
+        long timeo;
+        int err = 0;
+        int addrcnt = 0;
+        int walk_size = 0;
+        struct sockaddr *sa_addr;
+        void *addr_buf;
+
+        sp = sctp_sk(sk);
+        ep = sp->ep;
+
+        /* connect() cannot be done on a socket that is already in ESTABLISHED
+         * state - UDP-style peeled off socket or a TCP-style socket that
+         * is already connected.
+         * It cannot be done even on a TCP-style listening socket.
+         */
+        if (sctp_sstate(sk, ESTABLISHED) ||
+            (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))) {
+                err = -EISCONN;
+                goto out_free;
+        }
+
+        /* Walk through the addrs buffer and count the number of addresses. */
+        addr_buf = kaddrs;
+        while (walk_size < addrs_size) {
+                sa_addr = (struct sockaddr *)addr_buf;
+                af = sctp_get_af_specific(sa_addr->sa_family);
+
+                /* If the address family is not supported or if this address
+                 * causes the address buffer to overflow return EINVAL.
+                 */
+                if (!af || (walk_size + af->sockaddr_len) > addrs_size) {
+                        err = -EINVAL;
+                        goto out_free;
+                }
+
+                err = sctp_verify_addr(sk, (union sctp_addr *)sa_addr,
+                                       af->sockaddr_len);
+                if (err)
+                        goto out_free;
+
+                memcpy(&to, sa_addr, af->sockaddr_len);
+                to.v4.sin_port = ntohs(to.v4.sin_port);
+
+                /* Check if there already is a matching association on the
+                 * endpoint (other than the one created here).
+                 */
+                asoc2 = sctp_endpoint_lookup_assoc(ep, &to, &transport);
+                if (asoc2 && asoc2 != asoc) {
+                        if (asoc2->state >= SCTP_STATE_ESTABLISHED)
+                                err = -EISCONN;
+                        else
+                                err = -EALREADY;
+                        goto out_free;
+                }
+
+                /* If we could not find a matching association on the endpoint,
+                 * make sure that there is no peeled-off association matching
+                 * the peer address even on another socket.
+                 */
+                if (sctp_endpoint_is_peeled_off(ep, &to)) {
+                        err = -EADDRNOTAVAIL;
+                        goto out_free;
+                }
+
+                if (!asoc) {
+                        /* If a bind() or sctp_bindx() is not called prior to
+                         * an sctp_connectx() call, the system picks an
+                         * ephemeral port and will choose an address set
+                         * equivalent to binding with a wildcard address.
+                         */
+                        if (!ep->base.bind_addr.port) {
+                                if (sctp_autobind(sk)) {
+                                        err = -EAGAIN;
+                                        goto out_free;
+                                }
+                        }
+
+                        scope = sctp_scope(&to);
+                        asoc = sctp_association_new(ep, sk, scope, GFP_KERNEL);
+                        if (!asoc) {
+                                err = -ENOMEM;
+                                goto out_free;
+                        }
+                }
+
+                /* Prime the peer's transport structures.  */
+                transport = sctp_assoc_add_peer(asoc, &to, GFP_KERNEL,
+                                                SCTP_UNKNOWN);
+                if (!transport) {
+                        err = -ENOMEM;
+                        goto out_free;
+                }
+
+                addrcnt++;
+                addr_buf += af->sockaddr_len;
+                walk_size += af->sockaddr_len;
+        }
+
+        err = sctp_assoc_set_bind_addr_from_ep(asoc, GFP_KERNEL);
+        if (err < 0) {
+                goto out_free;
+        }
+
+        err = sctp_primitive_ASSOCIATE(asoc, NULL);
+        if (err < 0) {
+                goto out_free;
+        }
+
+        /* Initialize sk's dport and daddr for getpeername() */
+        inet_sk(sk)->dport = htons(asoc->peer.port);
+        af = sctp_get_af_specific(to.sa.sa_family);
+        af->to_sk_daddr(&to, sk);
+
+        timeo = sock_sndtimeo(sk, sk->sk_socket->file->f_flags & O_NONBLOCK);
+        err = sctp_wait_for_connect(asoc, &timeo);
+
+        /* Don't free association on exit. */
+        asoc = NULL;
+
+out_free:
+
+        SCTP_DEBUG_PRINTK("About to exit __sctp_connect() free asoc: %p"
+                          " kaddrs: %p err: %d\n",
+                          asoc, kaddrs, err);
+        if (asoc)
+                sctp_association_free(asoc);
+        return err;
+}
+
+/* Helper for tunneling sctp_connectx() requests through sctp_setsockopt()
+ *
+ * API 8.9
+ * int sctp_connectx(int sd, struct sockaddr *addrs, int addrcnt);
+ *
+ * If sd is an IPv4 socket, the addresses passed must be IPv4 addresses.
+ * If the sd is an IPv6 socket, the addresses passed can either be IPv4
+ * or IPv6 addresses.
+ *
+ * A single address may be specified as INADDR_ANY or IN6ADDR_ANY, see
+ * Section 3.1.2 for this usage.
+ *
+ * addrs is a pointer to an array of one or more socket addresses. Each
+ * address is contained in its appropriate structure (i.e. struct
+ * sockaddr_in or struct sockaddr_in6) the family of the address type
+ * must be used to distengish the address length (note that this
+ * representation is termed a "packed array" of addresses). The caller
+ * specifies the number of addresses in the array with addrcnt.
+ *
+ * On success, sctp_connectx() returns 0. On failure, sctp_connectx() returns
+ * -1, and sets errno to the appropriate error code.
+ *
+ * For SCTP, the port given in each socket address must be the same, or
+ * sctp_connectx() will fail, setting errno to EINVAL.
+ *
+ * An application can use sctp_connectx to initiate an association with
+ * an endpoint that is multi-homed.  Much like sctp_bindx() this call
+ * allows a caller to specify multiple addresses at which a peer can be
+ * reached.  The way the SCTP stack uses the list of addresses to set up
+ * the association is implementation dependant.  This function only
+ * specifies that the stack will try to make use of all the addresses in
+ * the list when needed.
+ *
+ * Note that the list of addresses passed in is only used for setting up
+ * the association.  It does not necessarily equal the set of addresses
+ * the peer uses for the resulting association.  If the caller wants to
+ * find out the set of peer addresses, it must use sctp_getpaddrs() to
+ * retrieve them after the association has been set up.
+ *
+ * Basically do nothing but copying the addresses from user to kernel
+ * land and invoking either sctp_connectx(). This is used for tunneling
+ * the sctp_connectx() request through sctp_setsockopt() from userspace.
+ *
+ * We don't use copy_from_user() for optimization: we first do the
+ * sanity checks (buffer size -fast- and access check-healthy
+ * pointer); if all of those succeed, then we can alloc the memory
+ * (expensive operation) needed to copy the data to kernel. Then we do
+ * the copying without checking the user space area
+ * (__copy_from_user()).
+ *
+ * On exit there is no need to do sockfd_put(), sys_setsockopt() does
+ * it.
+ *
+ * sk        The sk of the socket
+ * addrs     The pointer to the addresses in user land
+ * addrssize Size of the addrs buffer
+ *
+ * Returns 0 if ok, <0 errno code on error.
+ */
+SCTP_STATIC int sctp_setsockopt_connectx(struct sock* sk,
+                                      struct sockaddr __user *addrs,
+                                      int addrs_size)
+{
+        int err = 0;
+        struct sockaddr *kaddrs;
+
+        SCTP_DEBUG_PRINTK("%s - sk %p addrs %p addrs_size %d\n",
+                          __FUNCTION__, sk, addrs, addrs_size);
+
+        if (unlikely(addrs_size <= 0))
+                return -EINVAL;
+
+        /* Check the user passed a healthy pointer.  */
+        if (unlikely(!access_ok(VERIFY_READ, addrs, addrs_size)))
+                return -EFAULT;
+
+        /* Alloc space for the address array in kernel memory.  */
+        kaddrs = (struct sockaddr *)kmalloc(addrs_size, GFP_KERNEL);
+        if (unlikely(!kaddrs))
+                return -ENOMEM;
+
+        if (__copy_from_user(kaddrs, addrs, addrs_size)) {
+                err = -EFAULT;
+        } else {
+                err = __sctp_connect(sk, kaddrs, addrs_size);
+        }
+
+        kfree(kaddrs);
+        return err;
+}
+
 /* API 3.1.4 close() - UDP Style Syntax
  * Applications use close() to perform graceful shutdown (as described in
  * Section 10.1 of [SCTP]) on ALL the associations currently represented
@@ -1095,7 +1337,7 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
         sp = sctp_sk(sk);
         ep = sp->ep;
 
-        SCTP_DEBUG_PRINTK("Using endpoint: %s.\n", ep->debug_name);
+        SCTP_DEBUG_PRINTK("Using endpoint: %p.\n", ep);
 
         /* We cannot send a message over a TCP-style listening socket. */
         if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING)) {
@@ -1306,7 +1548,7 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                 }
 
                 /* Prime the peer's transport structures.  */
-                transport = sctp_assoc_add_peer(asoc, &to, GFP_KERNEL);
+                transport = sctp_assoc_add_peer(asoc, &to, GFP_KERNEL, SCTP_UNKNOWN);
                 if (!transport) {
                         err = -ENOMEM;
                         goto out_free;
@@ -2208,6 +2450,12 @@ SCTP_STATIC int sctp_setsockopt(struct sock *sk, int level, int optname,
                                                optlen, SCTP_BINDX_REM_ADDR);
                 break;
 
+        case SCTP_SOCKOPT_CONNECTX:
+                /* 'optlen' is the size of the addresses buffer. */
+                retval = sctp_setsockopt_connectx(sk, (struct sockaddr __user *)optval,
+                                               optlen);
+                break;
+
         case SCTP_DISABLE_FRAGMENTS:
                 retval = sctp_setsockopt_disable_fragments(sk, optval, optlen);
                 break;
@@ -2283,112 +2531,29 @@ out_nounlock:
  *
  * len: the size of the address.
  */
-SCTP_STATIC int sctp_connect(struct sock *sk, struct sockaddr *uaddr,
+SCTP_STATIC int sctp_connect(struct sock *sk, struct sockaddr *addr,
                              int addr_len)
 {
-        struct sctp_sock *sp;
-        struct sctp_endpoint *ep;
-        struct sctp_association *asoc;
-        struct sctp_transport *transport;
-        union sctp_addr to;
-        struct sctp_af *af;
-        sctp_scope_t scope;
-        long timeo;
         int err = 0;
+        struct sctp_af *af;
 
         sctp_lock_sock(sk);
 
-        SCTP_DEBUG_PRINTK("%s - sk: %p, sockaddr: %p, addr_len: %d)\n",
-                          __FUNCTION__, sk, uaddr, addr_len);
-
-        sp = sctp_sk(sk);
-        ep = sp->ep;
-
-        /* connect() cannot be done on a socket that is already in ESTABLISHED
-         * state - UDP-style peeled off socket or a TCP-style socket that
-         * is already connected.
-         * It cannot be done even on a TCP-style listening socket.
-         */
-        if (sctp_sstate(sk, ESTABLISHED) ||
-            (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))) {
-                err = -EISCONN;
-                goto out_unlock;
-        }
-
-        err = sctp_verify_addr(sk, (union sctp_addr *)uaddr, addr_len);
-        if (err)
-                goto out_unlock;
+        SCTP_DEBUG_PRINTK("%s - sk: %p, sockaddr: %p, addr_len: %d\n",
+                          __FUNCTION__, sk, addr, addr_len);
 
-        if (addr_len > sizeof(to))
-                addr_len = sizeof(to);
-        memcpy(&to, uaddr, addr_len);
-        to.v4.sin_port = ntohs(to.v4.sin_port);
-
-        asoc = sctp_endpoint_lookup_assoc(ep, &to, &transport);
-        if (asoc) {
-                if (asoc->state >= SCTP_STATE_ESTABLISHED)
-                        err = -EISCONN;
-                else
-                        err = -EALREADY;
-                goto out_unlock;
-        }
-
-        /* If we could not find a matching association on the endpoint,
-         * make sure that there is no peeled-off association matching the
-         * peer address even on another socket.
-         */
-        if (sctp_endpoint_is_peeled_off(ep, &to)) {
-                err = -EADDRNOTAVAIL;
-                goto out_unlock;
-        }
-
-        /* If a bind() or sctp_bindx() is not called prior to a connect()
-         * call, the system picks an ephemeral port and will choose an address
-         * set equivalent to binding with a wildcard address.
-         */
-        if (!ep->base.bind_addr.port) {
-                if (sctp_autobind(sk)) {
-                        err = -EAGAIN;
-                        goto out_unlock;
-                }
-        }
-
-        scope = sctp_scope(&to);
-        asoc = sctp_association_new(ep, sk, scope, GFP_KERNEL);
-        if (!asoc) {
-                err = -ENOMEM;
-                goto out_unlock;
-        }
-
-        /* Prime the peer's transport structures.  */
-        transport = sctp_assoc_add_peer(asoc, &to, GFP_KERNEL);
-        if (!transport) {
-                sctp_association_free(asoc);
-                goto out_unlock;
-        }
-        err = sctp_assoc_set_bind_addr_from_ep(asoc, GFP_KERNEL);
-        if (err < 0) {
-                sctp_association_free(asoc);
-                goto out_unlock;
-        }
-
-        err = sctp_primitive_ASSOCIATE(asoc, NULL);
-        if (err < 0) {
-                sctp_association_free(asoc);
-                goto out_unlock;
+        /* Validate addr_len before calling common connect/connectx routine. */
+        af = sctp_get_af_specific(addr->sa_family);
+        if (!af || addr_len < af->sockaddr_len) {
+                err = -EINVAL;
+        } else {
+                /* Pass correct addr len to common routine (so it knows there
+                 * is only one address being passed.
+                 */
+                err = __sctp_connect(sk, addr, af->sockaddr_len);
         }
 
-        /* Initialize sk's dport and daddr for getpeername() */
-        inet_sk(sk)->dport = htons(asoc->peer.port);
-        af = sctp_get_af_specific(to.sa.sa_family);
-        af->to_sk_daddr(&to, sk);
-
-        timeo = sock_sndtimeo(sk, sk->sk_socket->file->f_flags & O_NONBLOCK);
-        err = sctp_wait_for_connect(asoc, &timeo);
-
-out_unlock:
         sctp_release_sock(sk);
-
         return err;
 }
 
@@ -2677,12 +2842,15 @@ static int sctp_getsockopt_sctp_status(struct sock *sk, int len,
         /* Map ipv4 address into v4-mapped-on-v6 address.  */
         sctp_get_pf_specific(sk->sk_family)->addr_v4map(sctp_sk(sk),
                 (union sctp_addr *)&status.sstat_primary.spinfo_address);
-        status.sstat_primary.spinfo_state = transport->active;
+        status.sstat_primary.spinfo_state = transport->state;
         status.sstat_primary.spinfo_cwnd = transport->cwnd;
         status.sstat_primary.spinfo_srtt = transport->srtt;
         status.sstat_primary.spinfo_rto = jiffies_to_msecs(transport->rto);
         status.sstat_primary.spinfo_mtu = transport->pmtu;
 
+        if (status.sstat_primary.spinfo_state == SCTP_UNKNOWN)
+                status.sstat_primary.spinfo_state = SCTP_ACTIVE;
+
         if (put_user(len, optlen)) {
                 retval = -EFAULT;
                 goto out;
@@ -2733,12 +2901,15 @@ static int sctp_getsockopt_peer_addr_info(struct sock *sk, int len,
                 return -EINVAL;
 
         pinfo.spinfo_assoc_id = sctp_assoc2id(transport->asoc);
-        pinfo.spinfo_state = transport->active;
+        pinfo.spinfo_state = transport->state;
         pinfo.spinfo_cwnd = transport->cwnd;
         pinfo.spinfo_srtt = transport->srtt;
         pinfo.spinfo_rto = jiffies_to_msecs(transport->rto);
         pinfo.spinfo_mtu = transport->pmtu;
 
+        if (pinfo.spinfo_state == SCTP_UNKNOWN)
+                pinfo.spinfo_state = SCTP_ACTIVE;
+
         if (put_user(len, optlen)) {
                 retval = -EFAULT;
                 goto out;
@@ -3591,7 +3762,8 @@ SCTP_STATIC int sctp_getsockopt(struct sock *sk, int level, int optname,
         int retval = 0;
         int len;
 
-        SCTP_DEBUG_PRINTK("sctp_getsockopt(sk: %p, ...)\n", sk);
+        SCTP_DEBUG_PRINTK("sctp_getsockopt(sk: %p... optname: %d)\n",
+                          sk, optname);
 
         /* I can hardly begin to describe how wrong this is.  This is
          * so broken as to be worse than useless.  The API draft
@@ -4368,15 +4540,11 @@ static struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags,
                  *  However, this function was corrent in any case. 8)
                  */
                 if (flags & MSG_PEEK) {
-                        unsigned long cpu_flags;
-
-                        sctp_spin_lock_irqsave(&sk->sk_receive_queue.lock,
-                                               cpu_flags);
+                        spin_lock_bh(&sk->sk_receive_queue.lock);
                         skb = skb_peek(&sk->sk_receive_queue);
                         if (skb)
                                 atomic_inc(&skb->users);
-                        sctp_spin_unlock_irqrestore(&sk->sk_receive_queue.lock,
-                                                    cpu_flags);
+                        spin_unlock_bh(&sk->sk_receive_queue.lock);
                 } else {
                         skb = skb_dequeue(&sk->sk_receive_queue);
                 }
@@ -4600,8 +4768,7 @@ out:
         return err;
 
 do_error:
-        if (asoc->counters[SCTP_COUNTER_INIT_ERROR] + 1 >=
-                                                asoc->max_init_attempts)
+        if (asoc->init_err_counter + 1 >= asoc->max_init_attempts)
                 err = -ETIMEDOUT;
         else
                 err = -ECONNREFUSED;
@@ -4686,6 +4853,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         struct sctp_endpoint *newep = newsp->ep;
         struct sk_buff *skb, *tmp;
         struct sctp_ulpevent *event;
+        int flags = 0;
 
         /* Migrate socket buffer sizes and all the socket level options to the
          * new socket.
@@ -4707,6 +4875,17 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         sctp_sk(newsk)->bind_hash = pp;
         inet_sk(newsk)->num = inet_sk(oldsk)->num;
 
+        /* Copy the bind_addr list from the original endpoint to the new
+         * endpoint so that we can handle restarts properly
+         */
+        if (assoc->peer.ipv4_address)
+                flags |= SCTP_ADDR4_PEERSUPP;
+        if (assoc->peer.ipv6_address)
+                flags |= SCTP_ADDR6_PEERSUPP;
+        sctp_bind_addr_copy(&newsp->ep->base.bind_addr,
+                             &oldsp->ep->base.bind_addr,
+                             SCTP_SCOPE_GLOBAL, GFP_KERNEL, flags);
+
         /* Move any messages in the old socket's receive queue that are for the
          * peeled off association to the new socket's receive queue.
          */
diff --git a/net/sctp/ssnmap.c b/net/sctp/ssnmap.c
index e627d2b451b6..25037daf3fa0 100644
--- a/net/sctp/ssnmap.c
+++ b/net/sctp/ssnmap.c
@@ -57,7 +57,8 @@ static inline size_t sctp_ssnmap_size(__u16 in, __u16 out)
 /* Create a new sctp_ssnmap.
  * Allocate room to store at least 'len' contiguous TSNs.
  */
-struct sctp_ssnmap *sctp_ssnmap_new(__u16 in, __u16 out, int gfp)
+struct sctp_ssnmap *sctp_ssnmap_new(__u16 in, __u16 out,
+                                    unsigned int __nocast gfp)
 {
         struct sctp_ssnmap *retval;
         int size;
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 7fc31849312b..dc4893474f18 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -47,6 +47,8 @@
 static ctl_handler sctp_sysctl_jiffies_ms;
 static long rto_timer_min = 1;
 static long rto_timer_max = 86400000; /* One day */
+static long sack_timer_min = 1;
+static long sack_timer_max = 500;
 
 static ctl_table sctp_table[] = {
         {
@@ -187,6 +189,17 @@ static ctl_table sctp_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec
         },
+        {
+                .ctl_name       = NET_SCTP_SACK_TIMEOUT,
+                .procname       = "sack_timeout",
+                .data           = &sctp_sack_timeout,
+                .maxlen         = sizeof(long),
+                .mode           = 0644,
+                .proc_handler   = &proc_doulongvec_ms_jiffies_minmax,
+                .strategy       = &sctp_sysctl_jiffies_ms,
+                .extra1         = &sack_timer_min,
+                .extra2         = &sack_timer_max,
+        },
         { .ctl_name = 0 }
 };
 
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index f30882e1e96a..d2f04ebe5081 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -57,7 +57,7 @@
 /* Initialize a new transport from provided memory.  */
 static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
                                                   const union sctp_addr *addr,
-                                                  int gfp)
+                                                  unsigned int __nocast gfp)
 {
         /* Copy in the address.  */
         peer->ipaddr = *addr;
@@ -83,7 +83,9 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
         peer->last_time_used = jiffies;
         peer->last_time_ecne_reduced = jiffies;
 
-        peer->active = SCTP_ACTIVE;
+        peer->init_sent_count = 0;
+
+        peer->state = SCTP_ACTIVE;
         peer->hb_allowed = 0;
 
         /* Initialize the default path max_retrans.  */
@@ -101,7 +103,6 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
 
         /* Set up the heartbeat timer. */
         init_timer(&peer->hb_timer);
-        peer->hb_interval = SCTP_DEFAULT_TIMEOUT_HEARTBEAT;
         peer->hb_timer.function = sctp_generate_heartbeat_event;
         peer->hb_timer.data = (unsigned long)peer;
 
@@ -120,7 +121,8 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
 }
 
 /* Allocate and initialize a new transport.  */
-struct sctp_transport *sctp_transport_new(const union sctp_addr *addr, int gfp)
+struct sctp_transport *sctp_transport_new(const union sctp_addr *addr,
+                                          unsigned int __nocast gfp)
 {
         struct sctp_transport *transport;
 
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 17d0ff534735..0abd5101107c 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -74,7 +74,7 @@ SCTP_STATIC void sctp_ulpevent_init(struct sctp_ulpevent *event, int msg_flags)
 
 /* Create a new sctp_ulpevent.  */
 SCTP_STATIC struct sctp_ulpevent *sctp_ulpevent_new(int size, int msg_flags,
-                                                    int gfp)
+                                                    unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sk_buff *skb;
@@ -136,7 +136,7 @@ static inline void sctp_ulpevent_release_owner(struct sctp_ulpevent *event)
 struct sctp_ulpevent  *sctp_ulpevent_make_assoc_change(
         const struct sctp_association *asoc,
         __u16 flags, __u16 state, __u16 error, __u16 outbound,
-        __u16 inbound, int gfp)
+        __u16 inbound, unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_assoc_change *sac;
@@ -237,7 +237,7 @@ fail:
 struct sctp_ulpevent *sctp_ulpevent_make_peer_addr_change(
         const struct sctp_association *asoc,
         const struct sockaddr_storage *aaddr,
-        int flags, int state, int error, int gfp)
+        int flags, int state, int error, unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_paddr_change  *spc;
@@ -350,7 +350,7 @@ fail:
  */
 struct sctp_ulpevent *sctp_ulpevent_make_remote_error(
         const struct sctp_association *asoc, struct sctp_chunk *chunk,
-        __u16 flags, int gfp)
+        __u16 flags, unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_remote_error *sre;
@@ -448,7 +448,7 @@ fail:
  */
 struct sctp_ulpevent *sctp_ulpevent_make_send_failed(
         const struct sctp_association *asoc, struct sctp_chunk *chunk,
-        __u16 flags, __u32 error, int gfp)
+        __u16 flags, __u32 error, unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_send_failed *ssf;
@@ -557,7 +557,7 @@ fail:
  */
 struct sctp_ulpevent *sctp_ulpevent_make_shutdown_event(
         const struct sctp_association *asoc,
-        __u16 flags, int gfp)
+        __u16 flags, unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_shutdown_event *sse;
@@ -620,7 +620,7 @@ fail:
  * 5.3.1.6 SCTP_ADAPTION_INDICATION
  */
 struct sctp_ulpevent *sctp_ulpevent_make_adaption_indication(
-        const struct sctp_association *asoc, int gfp)
+        const struct sctp_association *asoc, unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_adaption_event *sai;
@@ -657,7 +657,7 @@ fail:
  */
 struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
                                                 struct sctp_chunk *chunk,
-                                                int gfp)
+                                                unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event = NULL;
         struct sk_buff *skb;
@@ -718,7 +718,8 @@ fail:
  *   various events.
  */
 struct sctp_ulpevent *sctp_ulpevent_make_pdapi(
-        const struct sctp_association *asoc, __u32 indication, int gfp)
+        const struct sctp_association *asoc, __u32 indication,
+        unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_pdapi_event *pd;
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index d5dd2cf7ac4a..8bbc279d6c99 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -100,7 +100,7 @@ void sctp_ulpq_free(struct sctp_ulpq *ulpq)
 
 /* Process an incoming DATA chunk.  */
 int sctp_ulpq_tail_data(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
-                        int gfp)
+                        unsigned int __nocast gfp)
 {
         struct sk_buff_head temp;
         sctp_data_chunk_t *hdr;
@@ -778,7 +778,8 @@ static __u16 sctp_ulpq_renege_frags(struct sctp_ulpq *ulpq, __u16 needed)
 
 /* Partial deliver the first message as there is pressure on rwnd. */
 void sctp_ulpq_partial_delivery(struct sctp_ulpq *ulpq,
-                                struct sctp_chunk *chunk, int gfp)
+                                struct sctp_chunk *chunk,
+                                unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *event;
         struct sctp_association *asoc;
@@ -802,7 +803,7 @@ void sctp_ulpq_partial_delivery(struct sctp_ulpq *ulpq,
 
 /* Renege some packets to make room for an incoming chunk.  */
 void sctp_ulpq_renege(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
-                      int gfp)
+                      unsigned int __nocast gfp)
 {
         struct sctp_association *asoc;
         __u16 needed, freed;
@@ -841,7 +842,7 @@ void sctp_ulpq_renege(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
 /* Notify the application if an association is aborted and in
  * partial delivery mode.  Send up any pending received messages.
  */
-void sctp_ulpq_abort_pd(struct sctp_ulpq *ulpq, int gfp)
+void sctp_ulpq_abort_pd(struct sctp_ulpq *ulpq, unsigned int __nocast gfp)
 {
         struct sctp_ulpevent *ev = NULL;
         struct sock *sk;
diff --git a/net/socket.c b/net/socket.c
index cec0cb38b9ce..6f2a17881972 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -81,6 +81,7 @@
 #include <linux/syscalls.h>
 #include <linux/compat.h>
 #include <linux/kmod.h>
+#include <linux/audit.h>
 
 #ifdef CONFIG_NET_RADIO
 #include <linux/wireless.h>             /* Note : will define WIRELESS_EXT */
@@ -226,7 +227,7 @@ int move_addr_to_kernel(void __user *uaddr, int ulen, void *kaddr)
                 return 0;
         if(copy_from_user(kaddr,uaddr,ulen))
                 return -EFAULT;
-        return 0;
+        return audit_sockaddr(ulen, kaddr);
 }
 
 /**
@@ -382,9 +383,8 @@ int sock_map_fd(struct socket *sock)
                         goto out;
                 }
 
-                sprintf(name, "[%lu]", SOCK_INODE(sock)->i_ino);
+                this.len = sprintf(name, "[%lu]", SOCK_INODE(sock)->i_ino);
                 this.name = name;
-                this.len = strlen(name);
                 this.hash = SOCK_INODE(sock)->i_ino;
 
                 file->f_dentry = d_alloc(sock_mnt->mnt_sb->s_root, &this);
@@ -1906,7 +1906,11 @@ asmlinkage long sys_socketcall(int call, unsigned long __user *args)
         /* copy_from_user should be SMP safe. */
         if (copy_from_user(a, args, nargs[call]))
                 return -EFAULT;
-                
+
+        err = audit_socketcall(nargs[call]/sizeof(unsigned long), a);
+        if (err)
+                return err;
+
         a0=a[0];
         a1=a[1];
         
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 9bcec9b927b9..505e2d4b3d62 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -66,10 +66,10 @@ rpcauth_create(rpc_authflavor_t pseudoflavor, struct rpc_clnt *clnt)
         u32                     flavor = pseudoflavor_to_flavor(pseudoflavor);
 
         if (flavor >= RPC_AUTH_MAXFLAVOR || !(ops = auth_flavors[flavor]))
-                return NULL;
+                return ERR_PTR(-EINVAL);
         auth = ops->create(clnt, pseudoflavor);
-        if (!auth)
-                return NULL;
+        if (IS_ERR(auth))
+                return auth;
         if (clnt->cl_auth)
                 rpcauth_destroy(clnt->cl_auth);
         clnt->cl_auth = auth;
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index a33b627cbef4..2f7b867161d2 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -660,14 +660,16 @@ gss_create(struct rpc_clnt *clnt, rpc_authflavor_t flavor)
 {
         struct gss_auth *gss_auth;
         struct rpc_auth * auth;
+        int err = -ENOMEM; /* XXX? */
 
         dprintk("RPC:      creating GSS authenticator for client %p\n",clnt);
 
         if (!try_module_get(THIS_MODULE))
-                return NULL;
+                return ERR_PTR(err);
         if (!(gss_auth = kmalloc(sizeof(*gss_auth), GFP_KERNEL)))
                 goto out_dec;
         gss_auth->client = clnt;
+        err = -EINVAL;
         gss_auth->mech = gss_mech_get_by_pseudoflavor(flavor);
         if (!gss_auth->mech) {
                 printk(KERN_WARNING "%s: Pseudoflavor %d not found!",
@@ -675,9 +677,8 @@ gss_create(struct rpc_clnt *clnt, rpc_authflavor_t flavor)
                 goto err_free;
         }
         gss_auth->service = gss_pseudoflavor_to_service(gss_auth->mech, flavor);
-        /* FIXME: Will go away once privacy support is merged in */
-        if (gss_auth->service == RPC_GSS_SVC_PRIVACY)
-                gss_auth->service = RPC_GSS_SVC_INTEGRITY;
+        if (gss_auth->service == 0)
+                goto err_put_mech;
         INIT_LIST_HEAD(&gss_auth->upcalls);
         spin_lock_init(&gss_auth->lock);
         auth = &gss_auth->rpc_auth;
@@ -687,15 +688,18 @@ gss_create(struct rpc_clnt *clnt, rpc_authflavor_t flavor)
         auth->au_flavor = flavor;
         atomic_set(&auth->au_count, 1);
 
-        if (rpcauth_init_credcache(auth, GSS_CRED_EXPIRE) < 0)
+        err = rpcauth_init_credcache(auth, GSS_CRED_EXPIRE);
+        if (err)
                 goto err_put_mech;
 
         snprintf(gss_auth->path, sizeof(gss_auth->path), "%s/%s",
                         clnt->cl_pathname,
                         gss_auth->mech->gm_name);
         gss_auth->dentry = rpc_mkpipe(gss_auth->path, clnt, &gss_upcall_ops, RPC_PIPE_WAIT_FOR_OPEN);
-        if (IS_ERR(gss_auth->dentry))
+        if (IS_ERR(gss_auth->dentry)) {
+                err = PTR_ERR(gss_auth->dentry);
                 goto err_put_mech;
+        }
 
         return auth;
 err_put_mech:
@@ -704,7 +708,7 @@ err_free:
         kfree(gss_auth);
 out_dec:
         module_put(THIS_MODULE);
-        return NULL;
+        return ERR_PTR(err);
 }
 
 static void
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 02bc029d46fe..f17e6153b688 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -97,12 +97,13 @@ rpc_setup_pipedir(struct rpc_clnt *clnt, char *dir_name)
  * made to sleep too long.
  */
 struct rpc_clnt *
-rpc_create_client(struct rpc_xprt *xprt, char *servname,
+rpc_new_client(struct rpc_xprt *xprt, char *servname,
                   struct rpc_program *program, u32 vers,
                   rpc_authflavor_t flavor)
 {
         struct rpc_version      *version;
         struct rpc_clnt         *clnt = NULL;
+        struct rpc_auth         *auth;
         int err;
         int len;
 
@@ -157,10 +158,11 @@ rpc_create_client(struct rpc_xprt *xprt, char *servname,
         if (err < 0)
                 goto out_no_path;
 
-        err = -ENOMEM;
-        if (!rpcauth_create(flavor, clnt)) {
+        auth = rpcauth_create(flavor, clnt);
+        if (IS_ERR(auth)) {
                 printk(KERN_INFO "RPC: Couldn't create auth handle (flavor %u)\n",
                                 flavor);
+                err = PTR_ERR(auth);
                 goto out_no_auth;
         }
 
@@ -178,6 +180,37 @@ out_no_path:
                 kfree(clnt->cl_server);
         kfree(clnt);
 out_err:
+        xprt_destroy(xprt);
+        return ERR_PTR(err);
+}
+
+/**
+ * Create an RPC client
+ * @xprt - pointer to xprt struct
+ * @servname - name of server
+ * @info - rpc_program
+ * @version - rpc_program version
+ * @authflavor - rpc_auth flavour to use
+ *
+ * Creates an RPC client structure, then pings the server in order to
+ * determine if it is up, and if it supports this program and version.
+ *
+ * This function should never be called by asynchronous tasks such as
+ * the portmapper.
+ */
+struct rpc_clnt *rpc_create_client(struct rpc_xprt *xprt, char *servname,
+                struct rpc_program *info, u32 version, rpc_authflavor_t authflavor)
+{
+        struct rpc_clnt *clnt;
+        int err;
+        
+        clnt = rpc_new_client(xprt, servname, info, version, authflavor);
+        if (IS_ERR(clnt))
+                return clnt;
+        err = rpc_ping(clnt, RPC_TASK_SOFT|RPC_TASK_NOINTR);
+        if (err == 0)
+                return clnt;
+        rpc_shutdown_client(clnt);
         return ERR_PTR(err);
 }
 
@@ -208,6 +241,8 @@ rpc_clone_client(struct rpc_clnt *clnt)
         rpc_init_rtt(&new->cl_rtt_default, clnt->cl_xprt->timeout.to_initval);
         if (new->cl_auth)
                 atomic_inc(&new->cl_auth->au_count);
+        new->cl_pmap            = &new->cl_pmap_default;
+        rpc_init_wait_queue(&new->cl_pmap_default.pm_bindwait, "bindwait");
         return new;
 out_no_clnt:
         printk(KERN_INFO "RPC: out of memory in %s\n", __FUNCTION__);
@@ -296,6 +331,44 @@ rpc_release_client(struct rpc_clnt *clnt)
                 rpc_destroy_client(clnt);
 }
 
+/**
+ * rpc_bind_new_program - bind a new RPC program to an existing client
+ * @old - old rpc_client
+ * @program - rpc program to set
+ * @vers - rpc program version
+ *
+ * Clones the rpc client and sets up a new RPC program. This is mainly
+ * of use for enabling different RPC programs to share the same transport.
+ * The Sun NFSv2/v3 ACL protocol can do this.
+ */
+struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *old,
+                                      struct rpc_program *program,
+                                      int vers)
+{
+        struct rpc_clnt *clnt;
+        struct rpc_version *version;
+        int err;
+
+        BUG_ON(vers >= program->nrvers || !program->version[vers]);
+        version = program->version[vers];
+        clnt = rpc_clone_client(old);
+        if (IS_ERR(clnt))
+                goto out;
+        clnt->cl_procinfo = version->procs;
+        clnt->cl_maxproc  = version->nrprocs;
+        clnt->cl_protname = program->name;
+        clnt->cl_prog     = program->number;
+        clnt->cl_vers     = version->number;
+        clnt->cl_stats    = program->stats;
+        err = rpc_ping(clnt, RPC_TASK_SOFT|RPC_TASK_NOINTR);
+        if (err != 0) {
+                rpc_shutdown_client(clnt);
+                clnt = ERR_PTR(err);
+        }
+out:    
+        return clnt;
+}
+
 /*
  * Default callback for async RPC calls
  */
@@ -305,38 +378,41 @@ rpc_default_callback(struct rpc_task *task)
 }
 
 /*
- *      Export the signal mask handling for aysnchronous code that
+ *      Export the signal mask handling for synchronous code that
  *      sleeps on RPC calls
  */
+#define RPC_INTR_SIGNALS (sigmask(SIGINT) | sigmask(SIGQUIT) | sigmask(SIGKILL))
  
+static void rpc_save_sigmask(sigset_t *oldset, int intr)
+{
+        unsigned long   sigallow = 0;
+        sigset_t sigmask;
+
+        /* Block all signals except those listed in sigallow */
+        if (intr)
+                sigallow |= RPC_INTR_SIGNALS;
+        siginitsetinv(&sigmask, sigallow);
+        sigprocmask(SIG_BLOCK, &sigmask, oldset);
+}
+
+static inline void rpc_task_sigmask(struct rpc_task *task, sigset_t *oldset)
+{
+        rpc_save_sigmask(oldset, !RPC_TASK_UNINTERRUPTIBLE(task));
+}
+
+static inline void rpc_restore_sigmask(sigset_t *oldset)
+{
+        sigprocmask(SIG_SETMASK, oldset, NULL);
+}
+
 void rpc_clnt_sigmask(struct rpc_clnt *clnt, sigset_t *oldset)
 {
-        unsigned long   sigallow = sigmask(SIGKILL);
-        unsigned long   irqflags;
-        
-        /* Turn off various signals */
-        if (clnt->cl_intr) {
-                struct k_sigaction *action = current->sighand->action;
-                if (action[SIGINT-1].sa.sa_handler == SIG_DFL)
-                        sigallow |= sigmask(SIGINT);
-                if (action[SIGQUIT-1].sa.sa_handler == SIG_DFL)
-                        sigallow |= sigmask(SIGQUIT);
-        }
-        spin_lock_irqsave(&current->sighand->siglock, irqflags);
-        *oldset = current->blocked;
-        siginitsetinv(&current->blocked, sigallow & ~oldset->sig[0]);
-        recalc_sigpending();
-        spin_unlock_irqrestore(&current->sighand->siglock, irqflags);
+        rpc_save_sigmask(oldset, clnt->cl_intr);
 }
 
 void rpc_clnt_sigunmask(struct rpc_clnt *clnt, sigset_t *oldset)
 {
-        unsigned long   irqflags;
-        
-        spin_lock_irqsave(&current->sighand->siglock, irqflags);
-        current->blocked = *oldset;
-        recalc_sigpending();
-        spin_unlock_irqrestore(&current->sighand->siglock, irqflags);
+        rpc_restore_sigmask(oldset);
 }
 
 /*
@@ -354,26 +430,26 @@ int rpc_call_sync(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
 
         BUG_ON(flags & RPC_TASK_ASYNC);
 
-        rpc_clnt_sigmask(clnt, &oldset);                
-
         status = -ENOMEM;
         task = rpc_new_task(clnt, NULL, flags);
         if (task == NULL)
                 goto out;
 
+        /* Mask signals on RPC calls _and_ GSS_AUTH upcalls */
+        rpc_task_sigmask(task, &oldset);
+
         rpc_call_setup(task, msg, 0);
 
         /* Set up the call info struct and execute the task */
-        if (task->tk_status == 0)
+        if (task->tk_status == 0) {
                 status = rpc_execute(task);
-        else {
+        } else {
                 status = task->tk_status;
                 rpc_release_task(task);
         }
 
+        rpc_restore_sigmask(&oldset);
 out:
-        rpc_clnt_sigunmask(clnt, &oldset);              
-
         return status;
 }
 
@@ -394,8 +470,6 @@ rpc_call_async(struct rpc_clnt *clnt, struct rpc_message *msg, int flags,
 
         flags |= RPC_TASK_ASYNC;
 
-        rpc_clnt_sigmask(clnt, &oldset);                
-
         /* Create/initialize a new RPC task */
         if (!callback)
                 callback = rpc_default_callback;
@@ -404,6 +478,9 @@ rpc_call_async(struct rpc_clnt *clnt, struct rpc_message *msg, int flags,
                 goto out;
         task->tk_calldata = data;
 
+        /* Mask signals on GSS_AUTH upcalls */
+        rpc_task_sigmask(task, &oldset);                
+
         rpc_call_setup(task, msg, 0);
 
         /* Set up the call info struct and execute the task */
@@ -413,9 +490,8 @@ rpc_call_async(struct rpc_clnt *clnt, struct rpc_message *msg, int flags,
         else
                 rpc_release_task(task);
 
+        rpc_restore_sigmask(&oldset);           
 out:
-        rpc_clnt_sigunmask(clnt, &oldset);              
-
         return status;
 }
 
@@ -593,7 +669,7 @@ call_allocate(struct rpc_task *task)
                 return;
         printk(KERN_INFO "RPC: buffer allocation failed for task %p\n", task); 
 
-        if (RPC_IS_ASYNC(task) || !(task->tk_client->cl_intr && signalled())) {
+        if (RPC_IS_ASYNC(task) || !signalled()) {
                 xprt_release(task);
                 task->tk_action = call_reserve;
                 rpc_delay(task, HZ>>4);
@@ -957,7 +1033,9 @@ call_header(struct rpc_task *task)
         *p++ = htonl(clnt->cl_prog);    /* program number */
         *p++ = htonl(clnt->cl_vers);    /* program version */
         *p++ = htonl(task->tk_msg.rpc_proc->p_proc);    /* procedure */
-        return rpcauth_marshcred(task, p);
+        p = rpcauth_marshcred(task, p);
+        req->rq_slen = xdr_adjust_iovec(&req->rq_svec[0], p);
+        return p;
 }
 
 /*
@@ -986,10 +1064,11 @@ call_verify(struct rpc_task *task)
                         case RPC_AUTH_ERROR:
                                 break;
                         case RPC_MISMATCH:
-                                printk(KERN_WARNING "%s: RPC call version mismatch!\n", __FUNCTION__);
-                                goto out_eio;
+                                dprintk("%s: RPC call version mismatch!\n", __FUNCTION__);
+                                error = -EPROTONOSUPPORT;
+                                goto out_err;
                         default:
-                                printk(KERN_WARNING "%s: RPC call rejected, unknown error: %x\n", __FUNCTION__, n);
+                                dprintk("%s: RPC call rejected, unknown error: %x\n", __FUNCTION__, n);
                                 goto out_eio;
                 }
                 if (--len < 0)
@@ -1040,23 +1119,26 @@ call_verify(struct rpc_task *task)
         case RPC_SUCCESS:
                 return p;
         case RPC_PROG_UNAVAIL:
-                printk(KERN_WARNING "RPC: call_verify: program %u is unsupported by server %s\n",
+                dprintk("RPC: call_verify: program %u is unsupported by server %s\n",
                                 (unsigned int)task->tk_client->cl_prog,
                                 task->tk_client->cl_server);
-                goto out_eio;
+                error = -EPFNOSUPPORT;
+                goto out_err;
         case RPC_PROG_MISMATCH:
-                printk(KERN_WARNING "RPC: call_verify: program %u, version %u unsupported by server %s\n",
+                dprintk("RPC: call_verify: program %u, version %u unsupported by server %s\n",
                                 (unsigned int)task->tk_client->cl_prog,
                                 (unsigned int)task->tk_client->cl_vers,
                                 task->tk_client->cl_server);
-                goto out_eio;
+                error = -EPROTONOSUPPORT;
+                goto out_err;
         case RPC_PROC_UNAVAIL:
-                printk(KERN_WARNING "RPC: call_verify: proc %p unsupported by program %u, version %u on server %s\n",
+                dprintk("RPC: call_verify: proc %p unsupported by program %u, version %u on server %s\n",
                                 task->tk_msg.rpc_proc,
                                 task->tk_client->cl_prog,
                                 task->tk_client->cl_vers,
                                 task->tk_client->cl_server);
-                goto out_eio;
+                error = -EOPNOTSUPP;
+                goto out_err;
         case RPC_GARBAGE_ARGS:
                 dprintk("RPC: %4d %s: server saw garbage\n", task->tk_pid, __FUNCTION__);
                 break;                  /* retry */
@@ -1069,7 +1151,7 @@ out_retry:
         task->tk_client->cl_stats->rpcgarbage++;
         if (task->tk_garb_retry) {
                 task->tk_garb_retry--;
-                dprintk(KERN_WARNING "RPC %s: retrying %4d\n", __FUNCTION__, task->tk_pid);
+                dprintk("RPC %s: retrying %4d\n", __FUNCTION__, task->tk_pid);
                 task->tk_action = call_bind;
                 return NULL;
         }
@@ -1083,3 +1165,30 @@ out_overflow:
         printk(KERN_WARNING "RPC %s: server reply was truncated.\n", __FUNCTION__);
         goto out_retry;
 }
+
+static int rpcproc_encode_null(void *rqstp, u32 *data, void *obj)
+{
+        return 0;
+}
+
+static int rpcproc_decode_null(void *rqstp, u32 *data, void *obj)
+{
+        return 0;
+}
+
+static struct rpc_procinfo rpcproc_null = {
+        .p_encode = rpcproc_encode_null,
+        .p_decode = rpcproc_decode_null,
+};
+
+int rpc_ping(struct rpc_clnt *clnt, int flags)
+{
+        struct rpc_message msg = {
+                .rpc_proc = &rpcproc_null,
+        };
+        int err;
+        msg.rpc_cred = authnull_ops.lookup_cred(NULL, NULL, 0);
+        err = rpc_call_sync(clnt, &msg, flags);
+        put_rpccred(msg.rpc_cred);
+        return err;
+}
diff --git a/net/sunrpc/pmap_clnt.c b/net/sunrpc/pmap_clnt.c
index d0b1d2c34a4d..4e81f2766923 100644
--- a/net/sunrpc/pmap_clnt.c
+++ b/net/sunrpc/pmap_clnt.c
@@ -53,6 +53,9 @@ rpc_getport(struct rpc_task *task, struct rpc_clnt *clnt)
                         task->tk_pid, clnt->cl_server,
                         map->pm_prog, map->pm_vers, map->pm_prot);
 
+        /* Autobind on cloned rpc clients is discouraged */
+        BUG_ON(clnt->cl_parent != clnt);
+
         spin_lock(&pmap_lock);
         if (map->pm_binding) {
                 rpc_sleep_on(&map->pm_bindwait, task, NULL, NULL);
@@ -207,12 +210,10 @@ pmap_create(char *hostname, struct sockaddr_in *srvaddr, int proto)
         xprt->addr.sin_port = htons(RPC_PMAP_PORT);
 
         /* printk("pmap: create clnt\n"); */
-        clnt = rpc_create_client(xprt, hostname,
+        clnt = rpc_new_client(xprt, hostname,
                                 &pmap_program, RPC_PMAP_VERSION,
                                 RPC_AUTH_UNIX);
-        if (IS_ERR(clnt)) {
-                xprt_destroy(xprt);
-        } else {
+        if (!IS_ERR(clnt)) {
                 clnt->cl_softrtry = 1;
                 clnt->cl_chatty   = 1;
                 clnt->cl_oneshot  = 1;
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index c06614d0e31d..2d9eb7fbd521 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -290,7 +290,7 @@ static void rpc_make_runnable(struct rpc_task *task)
                         return;
                 }
         } else
-                wake_up(&task->u.tk_wait.waitq);
+                wake_up_bit(&task->tk_runstate, RPC_TASK_QUEUED);
 }
 
 /*
@@ -555,6 +555,38 @@ __rpc_atrun(struct rpc_task *task)
 }
 
 /*
+ * Helper that calls task->tk_exit if it exists and then returns
+ * true if we should exit __rpc_execute.
+ */
+static inline int __rpc_do_exit(struct rpc_task *task)
+{
+        if (task->tk_exit != NULL) {
+                lock_kernel();
+                task->tk_exit(task);
+                unlock_kernel();
+                /* If tk_action is non-null, we should restart the call */
+                if (task->tk_action != NULL) {
+                        if (!RPC_ASSASSINATED(task)) {
+                                /* Release RPC slot and buffer memory */
+                                xprt_release(task);
+                                rpc_free(task);
+                                return 0;
+                        }
+                        printk(KERN_ERR "RPC: dead task tried to walk away.\n");
+                }
+        }
+        return 1;
+}
+
+static int rpc_wait_bit_interruptible(void *word)
+{
+        if (signal_pending(current))
+                return -ERESTARTSYS;
+        schedule();
+        return 0;
+}
+
+/*
  * This is the RPC `scheduler' (or rather, the finite state machine).
  */
 static int __rpc_execute(struct rpc_task *task)
@@ -566,8 +598,7 @@ static int __rpc_execute(struct rpc_task *task)
 
         BUG_ON(RPC_IS_QUEUED(task));
 
- restarted:
-        while (1) {
+        for (;;) {
                 /*
                  * Garbage collection of pending timers...
                  */
@@ -600,11 +631,12 @@ static int __rpc_execute(struct rpc_task *task)
                  * by someone else.
                  */
                 if (!RPC_IS_QUEUED(task)) {
-                        if (!task->tk_action)
+                        if (task->tk_action != NULL) {
+                                lock_kernel();
+                                task->tk_action(task);
+                                unlock_kernel();
+                        } else if (__rpc_do_exit(task))
                                 break;
-                        lock_kernel();
-                        task->tk_action(task);
-                        unlock_kernel();
                 }
 
                 /*
@@ -624,44 +656,26 @@ static int __rpc_execute(struct rpc_task *task)
 
                 /* sync task: sleep here */
                 dprintk("RPC: %4d sync task going to sleep\n", task->tk_pid);
-                if (RPC_TASK_UNINTERRUPTIBLE(task)) {
-                        __wait_event(task->u.tk_wait.waitq, !RPC_IS_QUEUED(task));
-                } else {
-                        __wait_event_interruptible(task->u.tk_wait.waitq, !RPC_IS_QUEUED(task), status);
+                /* Note: Caller should be using rpc_clnt_sigmask() */
+                status = out_of_line_wait_on_bit(&task->tk_runstate,
+                                RPC_TASK_QUEUED, rpc_wait_bit_interruptible,
+                                TASK_INTERRUPTIBLE);
+                if (status == -ERESTARTSYS) {
                         /*
                          * When a sync task receives a signal, it exits with
                          * -ERESTARTSYS. In order to catch any callbacks that
                          * clean up after sleeping on some queue, we don't
                          * break the loop here, but go around once more.
                          */
-                        if (status == -ERESTARTSYS) {
-                                dprintk("RPC: %4d got signal\n", task->tk_pid);
-                                task->tk_flags |= RPC_TASK_KILLED;
-                                rpc_exit(task, -ERESTARTSYS);
-                                rpc_wake_up_task(task);
-                        }
+                        dprintk("RPC: %4d got signal\n", task->tk_pid);
+                        task->tk_flags |= RPC_TASK_KILLED;
+                        rpc_exit(task, -ERESTARTSYS);
+                        rpc_wake_up_task(task);
                 }
                 rpc_set_running(task);
                 dprintk("RPC: %4d sync task resuming\n", task->tk_pid);
         }
 
-        if (task->tk_exit) {
-                lock_kernel();
-                task->tk_exit(task);
-                unlock_kernel();
-                /* If tk_action is non-null, the user wants us to restart */
-                if (task->tk_action) {
-                        if (!RPC_ASSASSINATED(task)) {
-                                /* Release RPC slot and buffer memory */
-                                if (task->tk_rqstp)
-                                        xprt_release(task);
-                                rpc_free(task);
-                                goto restarted;
-                        }
-                        printk(KERN_ERR "RPC: dead task tries to walk away.\n");
-                }
-        }
-
         dprintk("RPC: %4d exit() = %d\n", task->tk_pid, task->tk_status);
         status = task->tk_status;
 
@@ -759,8 +773,6 @@ void rpc_init_task(struct rpc_task *task, struct rpc_clnt *clnt, rpc_action call
 
         /* Initialize workqueue for async tasks */
         task->tk_workqueue = rpciod_workqueue;
-        if (!RPC_IS_ASYNC(task))
-                init_waitqueue_head(&task->u.tk_wait.waitq);
 
         if (clnt) {
                 atomic_inc(&clnt->cl_users);
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index d4f26bf9e732..62a073495276 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -41,7 +41,9 @@ EXPORT_SYMBOL(rpc_release_task);
 
 /* RPC client functions */
 EXPORT_SYMBOL(rpc_create_client);
+EXPORT_SYMBOL(rpc_new_client);
 EXPORT_SYMBOL(rpc_clone_client);
+EXPORT_SYMBOL(rpc_bind_new_program);
 EXPORT_SYMBOL(rpc_destroy_client);
 EXPORT_SYMBOL(rpc_shutdown_client);
 EXPORT_SYMBOL(rpc_release_client);
@@ -61,7 +63,6 @@ EXPORT_SYMBOL(rpc_mkpipe);
 
 /* Client transport */
 EXPORT_SYMBOL(xprt_create_proto);
-EXPORT_SYMBOL(xprt_destroy);
 EXPORT_SYMBOL(xprt_set_timeout);
 EXPORT_SYMBOL(xprt_udp_slot_table_entries);
 EXPORT_SYMBOL(xprt_tcp_slot_table_entries);
@@ -129,6 +130,10 @@ EXPORT_SYMBOL(xdr_encode_netobj);
 EXPORT_SYMBOL(xdr_encode_pages);
 EXPORT_SYMBOL(xdr_inline_pages);
 EXPORT_SYMBOL(xdr_shift_buf);
+EXPORT_SYMBOL(xdr_encode_word);
+EXPORT_SYMBOL(xdr_decode_word);
+EXPORT_SYMBOL(xdr_encode_array2);
+EXPORT_SYMBOL(xdr_decode_array2);
 EXPORT_SYMBOL(xdr_buf_from_iov);
 EXPORT_SYMBOL(xdr_buf_subsegment);
 EXPORT_SYMBOL(xdr_buf_read_netobj);
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index bb2d99f33315..e9bd91265f70 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -35,20 +35,24 @@ svc_create(struct svc_program *prog, unsigned int bufsize)
         if (!(serv = (struct svc_serv *) kmalloc(sizeof(*serv), GFP_KERNEL)))
                 return NULL;
         memset(serv, 0, sizeof(*serv));
+        serv->sv_name      = prog->pg_name;
         serv->sv_program   = prog;
         serv->sv_nrthreads = 1;
         serv->sv_stats     = prog->pg_stats;
         serv->sv_bufsz     = bufsize? bufsize : 4096;
-        prog->pg_lovers = prog->pg_nvers-1;
         xdrsize = 0;
-        for (vers=0; vers<prog->pg_nvers ; vers++)
-                if (prog->pg_vers[vers]) {
-                        prog->pg_hivers = vers;
-                        if (prog->pg_lovers > vers)
-                                prog->pg_lovers = vers;
-                        if (prog->pg_vers[vers]->vs_xdrsize > xdrsize)
-                                xdrsize = prog->pg_vers[vers]->vs_xdrsize;
-                }
+        while (prog) {
+                prog->pg_lovers = prog->pg_nvers-1;
+                for (vers=0; vers<prog->pg_nvers ; vers++)
+                        if (prog->pg_vers[vers]) {
+                                prog->pg_hivers = vers;
+                                if (prog->pg_lovers > vers)
+                                        prog->pg_lovers = vers;
+                                if (prog->pg_vers[vers]->vs_xdrsize > xdrsize)
+                                        xdrsize = prog->pg_vers[vers]->vs_xdrsize;
+                        }
+                prog = prog->pg_next;
+        }
         serv->sv_xdrsize   = xdrsize;
         INIT_LIST_HEAD(&serv->sv_threads);
         INIT_LIST_HEAD(&serv->sv_sockets);
@@ -56,8 +60,6 @@ svc_create(struct svc_program *prog, unsigned int bufsize)
         INIT_LIST_HEAD(&serv->sv_permsocks);
         spin_lock_init(&serv->sv_lock);
 
-        serv->sv_name      = prog->pg_name;
-
         /* Remove any stale portmap registrations */
         svc_register(serv, 0, 0);
 
@@ -281,6 +283,7 @@ svc_process(struct svc_serv *serv, struct svc_rqst *rqstp)
         rqstp->rq_res.len = 0;
         rqstp->rq_res.page_base = 0;
         rqstp->rq_res.page_len = 0;
+        rqstp->rq_res.buflen = PAGE_SIZE;
         rqstp->rq_res.tail[0].iov_len = 0;
         /* tcp needs a space for the record length... */
         if (rqstp->rq_prot == IPPROTO_TCP)
@@ -338,7 +341,10 @@ svc_process(struct svc_serv *serv, struct svc_rqst *rqstp)
                 goto sendit;
         }
                 
-        if (prog != progp->pg_prog)
+        for (progp = serv->sv_program; progp; progp = progp->pg_next)
+                if (prog == progp->pg_prog)
+                        break;
+        if (progp == NULL)
                 goto err_bad_prog;
 
         if (vers >= progp->pg_nvers ||
@@ -451,11 +457,7 @@ err_bad_auth:
         goto sendit;
 
 err_bad_prog:
-#ifdef RPC_PARANOIA
-        if (prog != 100227 || progp->pg_prog != 100003)
-                printk("svc: unknown program %d (me %d)\n", prog, progp->pg_prog);
-        /* else it is just a Solaris client seeing if ACLs are supported */
-#endif
+        dprintk("svc: unknown program %d\n", prog);
         serv->sv_stats->rpcbadfmt++;
         svc_putu32(resv, rpc_prog_unavail);
         goto sendit;
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 2b99b4028d31..d6baf6fdf8a9 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -8,6 +8,7 @@
 #include <linux/err.h>
 #include <linux/seq_file.h>
 #include <linux/hash.h>
+#include <linux/string.h>
 
 #define RPCDBG_FACILITY RPCDBG_AUTH
 
@@ -20,14 +21,6 @@
  */
 
 
-static char *strdup(char *s)
-{
-        char *rv = kmalloc(strlen(s)+1, GFP_KERNEL);
-        if (rv)
-                strcpy(rv, s);
-        return rv;
-}
-
 struct unix_domain {
         struct auth_domain      h;
         int     addr_changes;
@@ -55,7 +48,7 @@ struct auth_domain *unix_domain_find(char *name)
         if (new == NULL)
                 return NULL;
         cache_init(&new->h.h);
-        new->h.name = strdup(name);
+        new->h.name = kstrdup(name, GFP_KERNEL);
         new->h.flavour = RPC_AUTH_UNIX;
         new->addr_changes = 0;
         new->h.h.expiry_time = NEVER;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 05907035bc96..d0c3120d0233 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -586,7 +586,7 @@ svc_udp_recvfrom(struct svc_rqst *rqstp)
         }
         if (skb->stamp.tv_sec == 0) {
                 skb->stamp.tv_sec = xtime.tv_sec; 
-                skb->stamp.tv_usec = xtime.tv_nsec * 1000; 
+                skb->stamp.tv_usec = xtime.tv_nsec / NSEC_PER_USEC; 
                 /* Don't enable netstamp, sunrpc doesn't 
                    need that much accuracy */
         }
@@ -1185,8 +1185,8 @@ svc_recv(struct svc_serv *serv, struct svc_rqst *rqstp, long timeout)
         arg->page_len = (pages-2)*PAGE_SIZE;
         arg->len = (pages-1)*PAGE_SIZE;
         arg->tail[0].iov_len = 0;
-        
-        try_to_freeze(PF_FREEZE);
+
+        try_to_freeze();
         if (signalled())
                 return -EINTR;
 
@@ -1227,7 +1227,7 @@ svc_recv(struct svc_serv *serv, struct svc_rqst *rqstp, long timeout)
 
                 schedule_timeout(timeout);
 
-                try_to_freeze(PF_FREEZE);
+                try_to_freeze();
 
                 spin_lock_bh(&serv->sv_lock);
                 remove_wait_queue(&rqstp->rq_wait, &wait);
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 67b9f035ba86..fde16f40a581 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -176,21 +176,23 @@ xdr_inline_pages(struct xdr_buf *xdr, unsigned int offset,
         xdr->buflen += len;
 }
 
-void
+ssize_t
 xdr_partial_copy_from_skb(struct xdr_buf *xdr, unsigned int base,
                           skb_reader_t *desc,
                           skb_read_actor_t copy_actor)
 {
         struct page     **ppage = xdr->pages;
         unsigned int    len, pglen = xdr->page_len;
+        ssize_t         copied = 0;
         int             ret;
 
         len = xdr->head[0].iov_len;
         if (base < len) {
                 len -= base;
                 ret = copy_actor(desc, (char *)xdr->head[0].iov_base + base, len);
+                copied += ret;
                 if (ret != len || !desc->count)
-                        return;
+                        goto out;
                 base = 0;
         } else
                 base -= len;
@@ -210,6 +212,17 @@ xdr_partial_copy_from_skb(struct xdr_buf *xdr, unsigned int base,
         do {
                 char *kaddr;
 
+                /* ACL likes to be lazy in allocating pages - ACLs
+                 * are small by default but can get huge. */
+                if (unlikely(*ppage == NULL)) {
+                        *ppage = alloc_page(GFP_ATOMIC);
+                        if (unlikely(*ppage == NULL)) {
+                                if (copied == 0)
+                                        copied = -ENOMEM;
+                                goto out;
+                        }
+                }
+
                 len = PAGE_CACHE_SIZE;
                 kaddr = kmap_atomic(*ppage, KM_SKB_SUNRPC_DATA);
                 if (base) {
@@ -225,14 +238,17 @@ xdr_partial_copy_from_skb(struct xdr_buf *xdr, unsigned int base,
                 }
                 flush_dcache_page(*ppage);
                 kunmap_atomic(kaddr, KM_SKB_SUNRPC_DATA);
+                copied += ret;
                 if (ret != len || !desc->count)
-                        return;
+                        goto out;
                 ppage++;
         } while ((pglen -= len) != 0);
 copy_tail:
         len = xdr->tail[0].iov_len;
         if (base < len)
-                copy_actor(desc, (char *)xdr->tail[0].iov_base + base, len - base);
+                copied += copy_actor(desc, (char *)xdr->tail[0].iov_base + base, len - base);
+out:
+        return copied;
 }
 
 
@@ -616,12 +632,24 @@ xdr_shift_buf(struct xdr_buf *buf, size_t len)
 void xdr_init_encode(struct xdr_stream *xdr, struct xdr_buf *buf, uint32_t *p)
 {
         struct kvec *iov = buf->head;
+        int scratch_len = buf->buflen - buf->page_len - buf->tail[0].iov_len;
 
+        BUG_ON(scratch_len < 0);
         xdr->buf = buf;
         xdr->iov = iov;
-        xdr->end = (uint32_t *)((char *)iov->iov_base + iov->iov_len);
-        buf->len = iov->iov_len = (char *)p - (char *)iov->iov_base;
-        xdr->p = p;
+        xdr->p = (uint32_t *)((char *)iov->iov_base + iov->iov_len);
+        xdr->end = (uint32_t *)((char *)iov->iov_base + scratch_len);
+        BUG_ON(iov->iov_len > scratch_len);
+
+        if (p != xdr->p && p != NULL) {
+                size_t len;
+
+                BUG_ON(p < xdr->p || p > xdr->end);
+                len = (char *)p - (char *)xdr->p;
+                xdr->p = p;
+                buf->len += len;
+                iov->iov_len += len;
+        }
 }
 EXPORT_SYMBOL(xdr_init_encode);
 
@@ -859,8 +887,34 @@ out:
         return status;
 }
 
-static int
-read_u32_from_xdr_buf(struct xdr_buf *buf, int base, u32 *obj)
+/* obj is assumed to point to allocated memory of size at least len: */
+int
+write_bytes_to_xdr_buf(struct xdr_buf *buf, int base, void *obj, int len)
+{
+        struct xdr_buf subbuf;
+        int this_len;
+        int status;
+
+        status = xdr_buf_subsegment(buf, &subbuf, base, len);
+        if (status)
+                goto out;
+        this_len = min(len, (int)subbuf.head[0].iov_len);
+        memcpy(subbuf.head[0].iov_base, obj, this_len);
+        len -= this_len;
+        obj += this_len;
+        this_len = min(len, (int)subbuf.page_len);
+        if (this_len)
+                _copy_to_pages(subbuf.pages, subbuf.page_base, obj, this_len);
+        len -= this_len;
+        obj += this_len;
+        this_len = min(len, (int)subbuf.tail[0].iov_len);
+        memcpy(subbuf.tail[0].iov_base, obj, this_len);
+out:
+        return status;
+}
+
+int
+xdr_decode_word(struct xdr_buf *buf, int base, u32 *obj)
 {
         u32     raw;
         int     status;
@@ -872,6 +926,14 @@ read_u32_from_xdr_buf(struct xdr_buf *buf, int base, u32 *obj)
         return 0;
 }
 
+int
+xdr_encode_word(struct xdr_buf *buf, int base, u32 obj)
+{
+        u32     raw = htonl(obj);
+
+        return write_bytes_to_xdr_buf(buf, base, &raw, sizeof(obj));
+}
+
 /* If the netobj starting offset bytes from the start of xdr_buf is contained
  * entirely in the head or the tail, set object to point to it; otherwise
  * try to find space for it at the end of the tail, copy it there, and
@@ -882,7 +944,7 @@ xdr_buf_read_netobj(struct xdr_buf *buf, struct xdr_netobj *obj, int offset)
         u32     tail_offset = buf->head[0].iov_len + buf->page_len;
         u32     obj_end_offset;
 
-        if (read_u32_from_xdr_buf(buf, offset, &obj->len))
+        if (xdr_decode_word(buf, offset, &obj->len))
                 goto out;
         obj_end_offset = offset + 4 + obj->len;
 
@@ -915,3 +977,220 @@ xdr_buf_read_netobj(struct xdr_buf *buf, struct xdr_netobj *obj, int offset)
 out:
         return -1;
 }
+
+/* Returns 0 on success, or else a negative error code. */
+static int
+xdr_xcode_array2(struct xdr_buf *buf, unsigned int base,
+                 struct xdr_array2_desc *desc, int encode)
+{
+        char *elem = NULL, *c;
+        unsigned int copied = 0, todo, avail_here;
+        struct page **ppages = NULL;
+        int err;
+
+        if (encode) {
+                if (xdr_encode_word(buf, base, desc->array_len) != 0)
+                        return -EINVAL;
+        } else {
+                if (xdr_decode_word(buf, base, &desc->array_len) != 0 ||
+                    desc->array_len > desc->array_maxlen ||
+                    (unsigned long) base + 4 + desc->array_len *
+                                    desc->elem_size > buf->len)
+                        return -EINVAL;
+        }
+        base += 4;
+
+        if (!desc->xcode)
+                return 0;
+
+        todo = desc->array_len * desc->elem_size;
+
+        /* process head */
+        if (todo && base < buf->head->iov_len) {
+                c = buf->head->iov_base + base;
+                avail_here = min_t(unsigned int, todo,
+                                   buf->head->iov_len - base);
+                todo -= avail_here;
+
+                while (avail_here >= desc->elem_size) {
+                        err = desc->xcode(desc, c);
+                        if (err)
+                                goto out;
+                        c += desc->elem_size;
+                        avail_here -= desc->elem_size;
+                }
+                if (avail_here) {
+                        if (!elem) {
+                                elem = kmalloc(desc->elem_size, GFP_KERNEL);
+                                err = -ENOMEM;
+                                if (!elem)
+                                        goto out;
+                        }
+                        if (encode) {
+                                err = desc->xcode(desc, elem);
+                                if (err)
+                                        goto out;
+                                memcpy(c, elem, avail_here);
+                        } else
+                                memcpy(elem, c, avail_here);
+                        copied = avail_here;
+                }
+                base = buf->head->iov_len;  /* align to start of pages */
+        }
+
+        /* process pages array */
+        base -= buf->head->iov_len;
+        if (todo && base < buf->page_len) {
+                unsigned int avail_page;
+
+                avail_here = min(todo, buf->page_len - base);
+                todo -= avail_here;
+
+                base += buf->page_base;
+                ppages = buf->pages + (base >> PAGE_CACHE_SHIFT);
+                base &= ~PAGE_CACHE_MASK;
+                avail_page = min_t(unsigned int, PAGE_CACHE_SIZE - base,
+                                        avail_here);
+                c = kmap(*ppages) + base;
+
+                while (avail_here) {
+                        avail_here -= avail_page;
+                        if (copied || avail_page < desc->elem_size) {
+                                unsigned int l = min(avail_page,
+                                        desc->elem_size - copied);
+                                if (!elem) {
+                                        elem = kmalloc(desc->elem_size,
+                                                       GFP_KERNEL);
+                                        err = -ENOMEM;
+                                        if (!elem)
+                                                goto out;
+                                }
+                                if (encode) {
+                                        if (!copied) {
+                                                err = desc->xcode(desc, elem);
+                                                if (err)
+                                                        goto out;
+                                        }
+                                        memcpy(c, elem + copied, l);
+                                        copied += l;
+                                        if (copied == desc->elem_size)
+                                                copied = 0;
+                                } else {
+                                        memcpy(elem + copied, c, l);
+                                        copied += l;
+                                        if (copied == desc->elem_size) {
+                                                err = desc->xcode(desc, elem);
+                                                if (err)
+                                                        goto out;
+                                                copied = 0;
+                                        }
+                                }
+                                avail_page -= l;
+                                c += l;
+                        }
+                        while (avail_page >= desc->elem_size) {
+                                err = desc->xcode(desc, c);
+                                if (err)
+                                        goto out;
+                                c += desc->elem_size;
+                                avail_page -= desc->elem_size;
+                        }
+                        if (avail_page) {
+                                unsigned int l = min(avail_page,
+                                            desc->elem_size - copied);
+                                if (!elem) {
+                                        elem = kmalloc(desc->elem_size,
+                                                       GFP_KERNEL);
+                                        err = -ENOMEM;
+                                        if (!elem)
+                                                goto out;
+                                }
+                                if (encode) {
+                                        if (!copied) {
+                                                err = desc->xcode(desc, elem);
+                                                if (err)
+                                                        goto out;
+                                        }
+                                        memcpy(c, elem + copied, l);
+                                        copied += l;
+                                        if (copied == desc->elem_size)
+                                                copied = 0;
+                                } else {
+                                        memcpy(elem + copied, c, l);
+                                        copied += l;
+                                        if (copied == desc->elem_size) {
+                                                err = desc->xcode(desc, elem);
+                                                if (err)
+                                                        goto out;
+                                                copied = 0;
+                                        }
+                                }
+                        }
+                        if (avail_here) {
+                                kunmap(*ppages);
+                                ppages++;
+                                c = kmap(*ppages);
+                        }
+
+                        avail_page = min(avail_here,
+                                 (unsigned int) PAGE_CACHE_SIZE);
+                }
+                base = buf->page_len;  /* align to start of tail */
+        }
+
+        /* process tail */
+        base -= buf->page_len;
+        if (todo) {
+                c = buf->tail->iov_base + base;
+                if (copied) {
+                        unsigned int l = desc->elem_size - copied;
+
+                        if (encode)
+                                memcpy(c, elem + copied, l);
+                        else {
+                                memcpy(elem + copied, c, l);
+                                err = desc->xcode(desc, elem);
+                                if (err)
+                                        goto out;
+                        }
+                        todo -= l;
+                        c += l;
+                }
+                while (todo) {
+                        err = desc->xcode(desc, c);
+                        if (err)
+                                goto out;
+                        c += desc->elem_size;
+                        todo -= desc->elem_size;
+                }
+        }
+        err = 0;
+
+out:
+        if (elem)
+                kfree(elem);
+        if (ppages)
+                kunmap(*ppages);
+        return err;
+}
+
+int
+xdr_decode_array2(struct xdr_buf *buf, unsigned int base,
+                  struct xdr_array2_desc *desc)
+{
+        if (base >= buf->len)
+                return -EINVAL;
+
+        return xdr_xcode_array2(buf, base, desc, 0);
+}
+
+int
+xdr_encode_array2(struct xdr_buf *buf, unsigned int base,
+                  struct xdr_array2_desc *desc)
+{
+        if ((unsigned long) base + 4 + desc->array_len * desc->elem_size >
+            buf->head->iov_len + buf->page_len + buf->tail->iov_len)
+                return -EINVAL;
+
+        return xdr_xcode_array2(buf, base, desc, 1);
+}
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index c74a6bb94074..3c654e06b084 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -145,8 +145,6 @@ __xprt_lock_write(struct rpc_xprt *xprt, struct rpc_task *task)
         if (test_and_set_bit(XPRT_LOCKED, &xprt->sockstate)) {
                 if (task == xprt->snd_task)
                         return 1;
-                if (task == NULL)
-                        return 0;
                 goto out_sleep;
         }
         if (xprt->nocong || __xprt_get_cong(xprt, task)) {
@@ -569,8 +567,11 @@ void xprt_connect(struct rpc_task *task)
                 if (xprt->sock != NULL)
                         schedule_delayed_work(&xprt->sock_connect,
                                         RPC_REESTABLISH_TIMEOUT);
-                else
+                else {
                         schedule_work(&xprt->sock_connect);
+                        if (!RPC_IS_ASYNC(task))
+                                flush_scheduled_work();
+                }
         }
         return;
  out_write:
@@ -725,7 +726,8 @@ csum_partial_copy_to_xdr(struct xdr_buf *xdr, struct sk_buff *skb)
                 goto no_checksum;
 
         desc.csum = csum_partial(skb->data, desc.offset, skb->csum);
-        xdr_partial_copy_from_skb(xdr, 0, &desc, skb_read_and_csum_bits);
+        if (xdr_partial_copy_from_skb(xdr, 0, &desc, skb_read_and_csum_bits) < 0)
+                return -1;
         if (desc.offset != skb->len) {
                 unsigned int csum2;
                 csum2 = skb_checksum(skb, desc.offset, skb->len - desc.offset, 0);
@@ -737,7 +739,8 @@ csum_partial_copy_to_xdr(struct xdr_buf *xdr, struct sk_buff *skb)
                 return -1;
         return 0;
 no_checksum:
-        xdr_partial_copy_from_skb(xdr, 0, &desc, skb_read_bits);
+        if (xdr_partial_copy_from_skb(xdr, 0, &desc, skb_read_bits) < 0)
+                return -1;
         if (desc.count)
                 return -1;
         return 0;
@@ -821,10 +824,15 @@ tcp_copy_data(skb_reader_t *desc, void *p, size_t len)
 {
         if (len > desc->count)
                 len = desc->count;
-        if (skb_copy_bits(desc->skb, desc->offset, p, len))
+        if (skb_copy_bits(desc->skb, desc->offset, p, len)) {
+                dprintk("RPC:      failed to copy %zu bytes from skb. %zu bytes remain\n",
+                                len, desc->count);
                 return 0;
+        }
         desc->offset += len;
         desc->count -= len;
+        dprintk("RPC:      copied %zu bytes from skb. %zu bytes remain\n",
+                        len, desc->count);
         return len;
 }
 
@@ -863,6 +871,8 @@ tcp_read_fraghdr(struct rpc_xprt *xprt, skb_reader_t *desc)
 static void
 tcp_check_recm(struct rpc_xprt *xprt)
 {
+        dprintk("RPC:      xprt = %p, tcp_copied = %lu, tcp_offset = %u, tcp_reclen = %u, tcp_flags = %lx\n",
+                        xprt, xprt->tcp_copied, xprt->tcp_offset, xprt->tcp_reclen, xprt->tcp_flags);
         if (xprt->tcp_offset == xprt->tcp_reclen) {
                 xprt->tcp_flags |= XPRT_COPY_RECM;
                 xprt->tcp_offset = 0;
@@ -907,6 +917,7 @@ tcp_read_request(struct rpc_xprt *xprt, skb_reader_t *desc)
         struct rpc_rqst *req;
         struct xdr_buf *rcvbuf;
         size_t len;
+        ssize_t r;
 
         /* Find and lock the request corresponding to this xid */
         spin_lock(&xprt->sock_lock);
@@ -927,15 +938,40 @@ tcp_read_request(struct rpc_xprt *xprt, skb_reader_t *desc)
                 len = xprt->tcp_reclen - xprt->tcp_offset;
                 memcpy(&my_desc, desc, sizeof(my_desc));
                 my_desc.count = len;
-                xdr_partial_copy_from_skb(rcvbuf, xprt->tcp_copied,
+                r = xdr_partial_copy_from_skb(rcvbuf, xprt->tcp_copied,
                                           &my_desc, tcp_copy_data);
-                desc->count -= len;
-                desc->offset += len;
+                desc->count -= r;
+                desc->offset += r;
         } else
-                xdr_partial_copy_from_skb(rcvbuf, xprt->tcp_copied,
+                r = xdr_partial_copy_from_skb(rcvbuf, xprt->tcp_copied,
                                           desc, tcp_copy_data);
-        xprt->tcp_copied += len;
-        xprt->tcp_offset += len;
+
+        if (r > 0) {
+                xprt->tcp_copied += r;
+                xprt->tcp_offset += r;
+        }
+        if (r != len) {
+                /* Error when copying to the receive buffer,
+                 * usually because we weren't able to allocate
+                 * additional buffer pages. All we can do now
+                 * is turn off XPRT_COPY_DATA, so the request
+                 * will not receive any additional updates,
+                 * and time out.
+                 * Any remaining data from this record will
+                 * be discarded.
+                 */
+                xprt->tcp_flags &= ~XPRT_COPY_DATA;
+                dprintk("RPC:      XID %08x truncated request\n",
+                                ntohl(xprt->tcp_xid));
+                dprintk("RPC:      xprt = %p, tcp_copied = %lu, tcp_offset = %u, tcp_reclen = %u\n",
+                                xprt, xprt->tcp_copied, xprt->tcp_offset, xprt->tcp_reclen);
+                goto out;
+        }
+
+        dprintk("RPC:      XID %08x read %Zd bytes\n",
+                        ntohl(xprt->tcp_xid), r);
+        dprintk("RPC:      xprt = %p, tcp_copied = %lu, tcp_offset = %u, tcp_reclen = %u\n",
+                        xprt, xprt->tcp_copied, xprt->tcp_offset, xprt->tcp_reclen);
 
         if (xprt->tcp_copied == req->rq_private_buf.buflen)
                 xprt->tcp_flags &= ~XPRT_COPY_DATA;
@@ -944,6 +980,7 @@ tcp_read_request(struct rpc_xprt *xprt, skb_reader_t *desc)
                         xprt->tcp_flags &= ~XPRT_COPY_DATA;
         }
 
+out:
         if (!(xprt->tcp_flags & XPRT_COPY_DATA)) {
                 dprintk("RPC: %4d received reply complete\n",
                                 req->rq_task->tk_pid);
@@ -967,6 +1004,7 @@ tcp_read_discard(struct rpc_xprt *xprt, skb_reader_t *desc)
         desc->count -= len;
         desc->offset += len;
         xprt->tcp_offset += len;
+        dprintk("RPC:      discarded %Zu bytes\n", len);
         tcp_check_recm(xprt);
 }
 
@@ -1064,8 +1102,7 @@ tcp_state_change(struct sock *sk)
         case TCP_SYN_RECV:
                 break;
         default:
-                if (xprt_test_and_clear_connected(xprt))
-                        rpc_wake_up_status(&xprt->pending, -ENOTCONN);
+                xprt_disconnect(xprt);
                 break;
         }
  out:
@@ -1203,6 +1240,8 @@ xprt_transmit(struct rpc_task *task)
                         list_add_tail(&req->rq_list, &xprt->recv);
                         spin_unlock_bh(&xprt->sock_lock);
                         xprt_reset_majortimeo(req);
+                        /* Turn off autodisconnect */
+                        del_singleshot_timer_sync(&xprt->timer);
                 }
         } else if (!req->rq_bytes_sent)
                 return;
@@ -1333,8 +1372,6 @@ xprt_reserve(struct rpc_task *task)
                 spin_lock(&xprt->xprt_lock);
                 do_xprt_reserve(task);
                 spin_unlock(&xprt->xprt_lock);
-                if (task->tk_rqstp)
-                        del_timer_sync(&xprt->timer);
         }
 }
 
@@ -1649,6 +1686,10 @@ xprt_shutdown(struct rpc_xprt *xprt)
         rpc_wake_up(&xprt->backlog);
         wake_up(&xprt->cong_wait);
         del_timer_sync(&xprt->timer);
+
+        /* synchronously wait for connect worker to finish */
+        cancel_delayed_work(&xprt->sock_connect);
+        flush_scheduled_work();
 }
 
 /*
diff --git a/net/unix/Kconfig b/net/unix/Kconfig
new file mode 100644
index 000000000000..5a69733bcdad
--- /dev/null
+++ b/net/unix/Kconfig
@@ -0,0 +1,21 @@
+#
+# Unix Domain Sockets
+#
+
+config UNIX
+        tristate "Unix domain sockets"
+        ---help---
+          If you say Y here, you will include support for Unix domain sockets;
+          sockets are the standard Unix mechanism for establishing and
+          accessing network connections.  Many commonly used programs such as
+          the X Window system and syslog use these sockets even if your
+          machine is not connected to any network.  Unless you are working on
+          an embedded system or something similar, you therefore definitely
+          want to say Y here.
+
+          To compile this driver as a module, choose M here: the module will be
+          called unix.  Note that several important services won't work
+          correctly if you say M here and then neglect to load the module.
+
+          Say Y unless you know what you are doing.
+
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index c420eba4876b..d403e34088ad 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -302,7 +302,7 @@ static void unix_write_space(struct sock *sk)
  * may receive messages only from that peer. */
 static void unix_dgram_disconnected(struct sock *sk, struct sock *other)
 {
-        if (skb_queue_len(&sk->sk_receive_queue)) {
+        if (!skb_queue_empty(&sk->sk_receive_queue)) {
                 skb_queue_purge(&sk->sk_receive_queue);
                 wake_up_interruptible_all(&unix_sk(sk)->peer_wait);
 
@@ -1619,7 +1619,7 @@ static long unix_stream_data_wait(struct sock * sk, long timeo)
         for (;;) {
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
 
-                if (skb_queue_len(&sk->sk_receive_queue) ||
+                if (!skb_queue_empty(&sk->sk_receive_queue) ||
                     sk->sk_err ||
                     (sk->sk_shutdown & RCV_SHUTDOWN) ||
                     signal_pending(current) ||
diff --git a/net/wanrouter/Kconfig b/net/wanrouter/Kconfig
new file mode 100644
index 000000000000..1debe1cb054e
--- /dev/null
+++ b/net/wanrouter/Kconfig
@@ -0,0 +1,29 @@
+#
+# Configuration for WAN router
+#
+
+config WAN_ROUTER
+        tristate "WAN router"
+        depends on EXPERIMENTAL
+        ---help---
+          Wide Area Networks (WANs), such as X.25, frame relay and leased
+          lines, are used to interconnect Local Area Networks (LANs) over vast
+          distances with data transfer rates significantly higher than those
+          achievable with commonly used asynchronous modem connections.
+          Usually, a quite expensive external device called a `WAN router' is
+          needed to connect to a WAN.
+
+          As an alternative, WAN routing can be built into the Linux kernel.
+          With relatively inexpensive WAN interface cards available on the
+          market, a perfectly usable router can be built for less than half
+          the price of an external router.  If you have one of those cards and
+          wish to use your Linux box as a WAN router, say Y here and also to
+          the WAN driver for your card, below.  You will then need the
+          wan-tools package which is available from <ftp://ftp.sangoma.com/>.
+          Read <file:Documentation/networking/wan-router.txt> for more
+          information.
+
+          To compile WAN routing support as a module, choose M here: the
+          module will be called wanrouter.
+
+          If unsure, say N.
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index d6844ac226f5..13b650ad22e2 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -358,10 +358,10 @@ int wanrouter_encapsulate(struct sk_buff *skb, struct net_device *dev,
  */
 
 
-unsigned short wanrouter_type_trans(struct sk_buff *skb, struct net_device *dev)
+__be16 wanrouter_type_trans(struct sk_buff *skb, struct net_device *dev)
 {
         int cnt = skb->data[0] ? 0 : 1; /* there may be a pad present */
-        unsigned short ethertype;
+        __be16 ethertype;
 
         switch (skb->data[cnt]) {
         case NLPID_IP:          /* IP datagramm */
@@ -379,7 +379,7 @@ unsigned short wanrouter_type_trans(struct sk_buff *skb, struct net_device *dev)
                                 skb->data[cnt+3], dev->name);
                         return 0;
                 }
-                ethertype = *((unsigned short*)&skb->data[cnt+4]);
+                ethertype = *((__be16*)&skb->data[cnt+4]);
                 cnt += 6;
                 break;
 
diff --git a/net/x25/Kconfig b/net/x25/Kconfig
new file mode 100644
index 000000000000..e6759c9660bb
--- /dev/null
+++ b/net/x25/Kconfig
@@ -0,0 +1,36 @@
+#
+# CCITT X.25 Packet Layer
+#
+
+config X25
+        tristate "CCITT X.25 Packet Layer (EXPERIMENTAL)"
+        depends on EXPERIMENTAL
+        ---help---
+          X.25 is a set of standardized network protocols, similar in scope to
+          frame relay; the one physical line from your box to the X.25 network
+          entry point can carry several logical point-to-point connections
+          (called "virtual circuits") to other computers connected to the X.25
+          network. Governments, banks, and other organizations tend to use it
+          to connect to each other or to form Wide Area Networks (WANs). Many
+          countries have public X.25 networks. X.25 consists of two
+          protocols: the higher level Packet Layer Protocol (PLP) (say Y here
+          if you want that) and the lower level data link layer protocol LAPB
+          (say Y to "LAPB Data Link Driver" below if you want that).
+
+          You can read more about X.25 at <http://www.sangoma.com/x25.htm> and
+          <http://www.cisco.com/univercd/cc/td/doc/product/software/ios11/cbook/cx25.htm>.
+          Information about X.25 for Linux is contained in the files
+          <file:Documentation/networking/x25.txt> and
+          <file:Documentation/networking/x25-iface.txt>.
+
+          One connects to an X.25 network either with a dedicated network card
+          using the X.21 protocol (not yet supported by Linux) or one can do
+          X.25 over a standard telephone line using an ordinary modem (say Y
+          to "X.25 async driver" below) or over Ethernet using an ordinary
+          Ethernet card and the LAPB over Ethernet (say Y to "LAPB Data Link
+          Driver" and "LAPB over Ethernet driver" below).
+
+          To compile this driver as a module, choose M here: the module
+          will be called x25. If unsure, say N.
+
+
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 2a24b243b841..04bec047fa9a 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -29,6 +29,10 @@
  *      2000-11-14      Henner Eisen    Closing datalink from NETDEV_GOING_DOWN
  *      2002-10-06      Arnaldo C. Melo Get rid of cli/sti, move proc stuff to
  *                                      x25_proc.c, using seq_file
+ *      2005-04-02      Shaun Pereira   Selective sub address matching
+ *                                      with call user data
+ *      2005-04-15      Shaun Pereira   Fast select with no restriction on
+ *                                      response
  */
 
 #include <linux/config.h>
@@ -219,7 +223,8 @@ static void x25_insert_socket(struct sock *sk)
  *      Note: if a listening socket has cud set it must only get calls
  *      with matching cud.
  */
-static struct sock *x25_find_listener(struct x25_address *addr, struct x25_calluserdata *calluserdata)
+static struct sock *x25_find_listener(struct x25_address *addr,
+                                        struct sk_buff *skb)
 {
         struct sock *s;
         struct sock *next_best;
@@ -230,22 +235,23 @@ static struct sock *x25_find_listener(struct x25_address *addr, struct x25_callu
 
         sk_for_each(s, node, &x25_list)
                 if ((!strcmp(addr->x25_addr,
-                             x25_sk(s)->source_addr.x25_addr) ||
-                     !strcmp(addr->x25_addr,
-                             null_x25_address.x25_addr)) &&
-                     s->sk_state == TCP_LISTEN) {
-
+                        x25_sk(s)->source_addr.x25_addr) ||
+                                !strcmp(addr->x25_addr,
+                                        null_x25_address.x25_addr)) &&
+                                        s->sk_state == TCP_LISTEN) {
                         /*
                          * Found a listening socket, now check the incoming
                          * call user data vs this sockets call user data
                          */
-                        if (x25_check_calluserdata(&x25_sk(s)->calluserdata, calluserdata)) {
-                                sock_hold(s);
-                                goto found;
-                        }
-                        if (x25_sk(s)->calluserdata.cudlength == 0) {
+                        if(skb->len > 0 && x25_sk(s)->cudmatchlength > 0) {
+                                if((memcmp(x25_sk(s)->calluserdata.cuddata,
+                                        skb->data,
+                                        x25_sk(s)->cudmatchlength)) == 0) {
+                                        sock_hold(s);
+                                        goto found;
+                                 }
+                        } else
                                 next_best = s;
-                        }
                 }
         if (next_best) {
                 s = next_best;
@@ -497,6 +503,9 @@ static int x25_create(struct socket *sock, int protocol)
         x25->t23   = sysctl_x25_clear_request_timeout;
         x25->t2    = sysctl_x25_ack_holdback_timeout;
         x25->state = X25_STATE_0;
+        x25->cudmatchlength = 0;
+        x25->accptapprv = X25_DENY_ACCPT_APPRV;         /* normally no cud  */
+                                                        /* on call accept   */
 
         x25->facilities.winsize_in  = X25_DEFAULT_WINDOW_SIZE;
         x25->facilities.winsize_out = X25_DEFAULT_WINDOW_SIZE;
@@ -545,6 +554,8 @@ static struct sock *x25_make_new(struct sock *osk)
         x25->t2         = ox25->t2;
         x25->facilities = ox25->facilities;
         x25->qbitincl   = ox25->qbitincl;
+        x25->cudmatchlength = ox25->cudmatchlength;
+        x25->accptapprv = ox25->accptapprv;
 
         x25_init_timers(sk);
 out:
@@ -822,7 +833,6 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
         struct x25_sock *makex25;
         struct x25_address source_addr, dest_addr;
         struct x25_facilities facilities;
-        struct x25_calluserdata calluserdata;
         int len, rc;
 
         /*
@@ -845,19 +855,10 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
         skb_pull(skb,len);
 
         /*
-         *      Incoming Call User Data.
-         */
-        if (skb->len >= 0) {
-                memcpy(calluserdata.cuddata, skb->data, skb->len);
-                calluserdata.cudlength = skb->len;
-        }
-
-        skb_push(skb,len);
-
-        /*
          *      Find a listener for the particular address/cud pair.
          */
-        sk = x25_find_listener(&source_addr,&calluserdata);
+        sk = x25_find_listener(&source_addr,skb);
+        skb_push(skb,len);
 
         /*
          *      We can't accept the Call Request.
@@ -900,11 +901,23 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
         makex25->neighbour     = nb;
         makex25->facilities    = facilities;
         makex25->vc_facil_mask = x25_sk(sk)->vc_facil_mask;
-        makex25->calluserdata  = calluserdata;
-
-        x25_write_internal(make, X25_CALL_ACCEPTED);
+        /* ensure no reverse facil on accept */
+        makex25->vc_facil_mask &= ~X25_MASK_REVERSE;
+        makex25->cudmatchlength = x25_sk(sk)->cudmatchlength;
+
+        /* Normally all calls are accepted immediatly */
+        if(makex25->accptapprv & X25_DENY_ACCPT_APPRV) {
+                x25_write_internal(make, X25_CALL_ACCEPTED);
+                makex25->state = X25_STATE_3;
+        }
 
-        makex25->state = X25_STATE_3;
+        /*
+         *      Incoming Call User Data.
+         */
+        if (skb->len >= 0) {
+                memcpy(makex25->calluserdata.cuddata, skb->data, skb->len);
+                makex25->calluserdata.cudlength = skb->len;
+        }
 
         sk->sk_ack_backlog++;
 
@@ -1288,7 +1301,8 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         if (facilities.throughput < 0x03 ||
                             facilities.throughput > 0xDD)
                                 break;
-                        if (facilities.reverse && facilities.reverse != 1)
+                        if (facilities.reverse &&
+                                (facilities.reverse | 0x81)!= 0x81)
                                 break;
                         x25->facilities = facilities;
                         rc = 0;
@@ -1325,6 +1339,44 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         break;
                 }
 
+                case SIOCX25SCUDMATCHLEN: {
+                        struct x25_subaddr sub_addr;
+                        rc = -EINVAL;
+                        if(sk->sk_state != TCP_CLOSE)
+                                break;
+                        rc = -EFAULT;
+                        if (copy_from_user(&sub_addr, argp,
+                                        sizeof(sub_addr)))
+                                break;
+                        rc = -EINVAL;
+                        if(sub_addr.cudmatchlength > X25_MAX_CUD_LEN)
+                                break;
+                        x25->cudmatchlength = sub_addr.cudmatchlength;
+                        rc = 0;
+                        break;
+                }
+
+                case SIOCX25CALLACCPTAPPRV: {
+                        rc = -EINVAL;
+                        if (sk->sk_state != TCP_CLOSE)
+                                break;
+                        x25->accptapprv = X25_ALLOW_ACCPT_APPRV;
+                        rc = 0;
+                        break;
+                }
+
+                case SIOCX25SENDCALLACCPT:  {
+                        rc = -EINVAL;
+                        if (sk->sk_state != TCP_ESTABLISHED)
+                                break;
+                        if (x25->accptapprv)    /* must call accptapprv above */
+                                break;
+                        x25_write_internal(sk, X25_CALL_ACCEPTED);
+                        x25->state = X25_STATE_3;
+                        rc = 0;
+                        break;
+                }
+
                 default:
                         rc = dev_ioctl(cmd, argp);
                         break;
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index a21bdb95f9a8..54278b962f4c 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -17,6 +17,8 @@
  *      X.25 001        Split from x25_subr.c
  *      mar/20/00       Daniela Squassoni Disabling/enabling of facilities 
  *                                        negotiation.
+ *      apr/14/05       Shaun Pereira - Allow fast select with no restriction
+ *                                      on response.
  */
 
 #include <linux/kernel.h>
@@ -43,9 +45,31 @@ int x25_parse_facilities(struct sk_buff *skb,
                 case X25_FAC_CLASS_A:
                         switch (*p) {
                         case X25_FAC_REVERSE:
-                                facilities->reverse = p[1] & 0x01;
-                                *vc_fac_mask |= X25_MASK_REVERSE;
-                                break;
+                                if((p[1] & 0x81) == 0x81) {
+                                        facilities->reverse = p[1] & 0x81;
+                                        *vc_fac_mask |= X25_MASK_REVERSE;
+                                        break;
+                                }
+
+                                if((p[1] & 0x01) == 0x01) {
+                                        facilities->reverse = p[1] & 0x01;
+                                        *vc_fac_mask |= X25_MASK_REVERSE;
+                                        break;
+                                }
+
+                                if((p[1] & 0x80) == 0x80) {
+                                        facilities->reverse = p[1] & 0x80;
+                                        *vc_fac_mask |= X25_MASK_REVERSE;
+                                        break;
+                                }
+
+                                if(p[1] == 0x00) {
+                                        facilities->reverse
+                                                = X25_DEFAULT_REVERSE;
+                                        *vc_fac_mask |= X25_MASK_REVERSE;
+                                        break;
+                                }
+
                         case X25_FAC_THROUGHPUT:
                                 facilities->throughput = p[1];
                                 *vc_fac_mask |= X25_MASK_THROUGHPUT;
@@ -122,7 +146,7 @@ int x25_create_facilities(unsigned char *buffer,
 
         if (facilities->reverse && (facil_mask & X25_MASK_REVERSE)) {
                 *p++ = X25_FAC_REVERSE;
-                *p++ = !!facilities->reverse;
+                *p++ = facilities->reverse;
         }
 
         if (facilities->throughput && (facil_mask & X25_MASK_THROUGHPUT)) {
@@ -171,7 +195,7 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
         /*
          *      They want reverse charging, we won't accept it.
          */
-        if (theirs.reverse && ours->reverse) {
+        if ((theirs.reverse & 0x01 ) && (ours->reverse & 0x01)) {
                 SOCK_DEBUG(sk, "X.25: rejecting reverse charging request");
                 return -1;
         }
diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c
index 183fea3bba67..7fd872ad0c20 100644
--- a/net/x25/x25_subr.c
+++ b/net/x25/x25_subr.c
@@ -19,6 +19,8 @@
  *      mar/20/00       Daniela Squassoni Disabling/enabling of facilities
  *                                        negotiation.
  *      jun/24/01       Arnaldo C. Melo   use skb_queue_purge, cleanups
+ *      apr/04/15       Shaun Pereira           Fast select with no
+ *                                              restriction on response.
  */
 
 #include <linux/kernel.h>
@@ -127,8 +129,12 @@ void x25_write_internal(struct sock *sk, int frametype)
                         len += 1 + X25_ADDR_LEN + X25_MAX_FAC_LEN +
                                X25_MAX_CUD_LEN;
                         break;
-                case X25_CALL_ACCEPTED:
-                        len += 1 + X25_MAX_FAC_LEN + X25_MAX_CUD_LEN;
+                case X25_CALL_ACCEPTED: /* fast sel with no restr on resp */
+                        if(x25->facilities.reverse & 0x80) {
+                                len += 1 + X25_MAX_FAC_LEN + X25_MAX_CUD_LEN;
+                        } else {
+                                len += 1 + X25_MAX_FAC_LEN;
+                        }
                         break;
                 case X25_CLEAR_REQUEST:
                 case X25_RESET_REQUEST:
@@ -203,9 +209,16 @@ void x25_write_internal(struct sock *sk, int frametype)
                                                         x25->vc_facil_mask);
                         dptr    = skb_put(skb, len);
                         memcpy(dptr, facilities, len);
-                        dptr = skb_put(skb, x25->calluserdata.cudlength);
-                        memcpy(dptr, x25->calluserdata.cuddata,
-                               x25->calluserdata.cudlength);
+
+                        /* fast select with no restriction on response
+                                allows call user data. Userland must
+                                ensure it is ours and not theirs */
+                        if(x25->facilities.reverse & 0x80) {
+                                dptr = skb_put(skb,
+                                        x25->calluserdata.cudlength);
+                                memcpy(dptr, x25->calluserdata.cuddata,
+                                       x25->calluserdata.cudlength);
+                        }
                         x25->calluserdata.cudlength = 0;
                         break;
 
@@ -354,21 +367,3 @@ void x25_check_rbuf(struct sock *sk)
         }
 }
 
-/*
- * Compare 2 calluserdata structures, used to find correct listening sockets
- * when call user data is used.
- */
-int x25_check_calluserdata(struct x25_calluserdata *ours, struct x25_calluserdata *theirs)
-{
-        int i;
-        if (ours->cudlength != theirs->cudlength)
-                return 0;
-
-        for (i=0;i<ours->cudlength;i++) {
-                if (ours->cuddata[i] != theirs->cuddata[i]) {
-                        return 0;
-                }
-        }
-        return 1;
-}
-
diff --git a/net/xfrm/Kconfig b/net/xfrm/Kconfig
index 58ca6a972c48..0c1c04322baf 100644
--- a/net/xfrm/Kconfig
+++ b/net/xfrm/Kconfig
@@ -1,6 +1,10 @@
 #
 # XFRM configuration
 #
+config XFRM
+       bool
+       depends on NET
+
 config XFRM_USER
         tristate "IPsec user configuration interface"
         depends on INET && XFRM
@@ -10,3 +14,14 @@ config XFRM_USER
 
           If unsure, say Y.
 
+config NET_KEY
+        tristate "PF_KEY sockets"
+        select XFRM
+        ---help---
+          PF_KEYv2 socket family, compatible to KAME ones.
+          They are required if you are going to use IPsec tools ported
+          from KAME.
+
+          Say Y unless you know what you are doing.
+
+
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index d07f5ce31824..d65ed8684fc1 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -118,7 +118,6 @@ retry:
         xfrm_policy_put_afinfo(afinfo);
         return type;
 }
-EXPORT_SYMBOL(xfrm_get_type);
 
 int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, 
                     unsigned short family)
@@ -216,8 +215,8 @@ out:
 
 expired:
         read_unlock(&xp->lock);
-        km_policy_expired(xp, dir, 1);
-        xfrm_policy_delete(xp, dir);
+        if (!xfrm_policy_delete(xp, dir))
+                km_policy_expired(xp, dir, 1);
         xfrm_pol_put(xp);
 }
 
@@ -555,7 +554,7 @@ static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
         return NULL;
 }
 
-void xfrm_policy_delete(struct xfrm_policy *pol, int dir)
+int xfrm_policy_delete(struct xfrm_policy *pol, int dir)
 {
         write_lock_bh(&xfrm_policy_lock);
         pol = __xfrm_policy_unlink(pol, dir);
@@ -564,7 +563,9 @@ void xfrm_policy_delete(struct xfrm_policy *pol, int dir)
                 if (dir < XFRM_POLICY_MAX)
                         atomic_inc(&flow_cache_genid);
                 xfrm_policy_kill(pol);
+                return 0;
         }
+        return -ENOENT;
 }
 
 int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index d11747c2a763..9d206c282cf1 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -50,7 +50,7 @@ static DEFINE_SPINLOCK(xfrm_state_gc_lock);
 
 static int xfrm_state_gc_flush_bundles;
 
-static void __xfrm_state_delete(struct xfrm_state *x);
+static int __xfrm_state_delete(struct xfrm_state *x);
 
 static struct xfrm_state_afinfo *xfrm_state_get_afinfo(unsigned short family);
 static void xfrm_state_put_afinfo(struct xfrm_state_afinfo *afinfo);
@@ -154,6 +154,7 @@ static void xfrm_timer_handler(unsigned long data)
                         next = tmo;
         }
 
+        x->km.dying = warn;
         if (warn)
                 km_state_expired(x, 0);
 resched:
@@ -169,9 +170,8 @@ expired:
                 next = 2;
                 goto resched;
         }
-        if (x->id.spi != 0)
+        if (!__xfrm_state_delete(x) && x->id.spi)
                 km_state_expired(x, 1);
-        __xfrm_state_delete(x);
 
 out:
         spin_unlock(&x->lock);
@@ -215,8 +215,10 @@ void __xfrm_state_destroy(struct xfrm_state *x)
 }
 EXPORT_SYMBOL(__xfrm_state_destroy);
 
-static void __xfrm_state_delete(struct xfrm_state *x)
+static int __xfrm_state_delete(struct xfrm_state *x)
 {
+        int err = -ESRCH;
+
         if (x->km.state != XFRM_STATE_DEAD) {
                 x->km.state = XFRM_STATE_DEAD;
                 spin_lock(&xfrm_state_lock);
@@ -245,14 +247,21 @@ static void __xfrm_state_delete(struct xfrm_state *x)
                  * is what we are dropping here.
                  */
                 atomic_dec(&x->refcnt);
+                err = 0;
         }
+
+        return err;
 }
 
-void xfrm_state_delete(struct xfrm_state *x)
+int xfrm_state_delete(struct xfrm_state *x)
 {
+        int err;
+
         spin_lock_bh(&x->lock);
-        __xfrm_state_delete(x);
+        err = __xfrm_state_delete(x);
         spin_unlock_bh(&x->lock);
+
+        return err;
 }
 EXPORT_SYMBOL(xfrm_state_delete);
 
@@ -557,16 +566,18 @@ int xfrm_state_check_expire(struct xfrm_state *x)
 
         if (x->curlft.bytes >= x->lft.hard_byte_limit ||
             x->curlft.packets >= x->lft.hard_packet_limit) {
-                km_state_expired(x, 1);
-                if (!mod_timer(&x->timer, jiffies + XFRM_ACQ_EXPIRES*HZ))
+                x->km.state = XFRM_STATE_EXPIRED;
+                if (!mod_timer(&x->timer, jiffies))
                         xfrm_state_hold(x);
                 return -EINVAL;
         }
 
         if (!x->km.dying &&
             (x->curlft.bytes >= x->lft.soft_byte_limit ||
-             x->curlft.packets >= x->lft.soft_packet_limit))
+             x->curlft.packets >= x->lft.soft_packet_limit)) {
+                x->km.dying = 1;
                 km_state_expired(x, 0);
+        }
         return 0;
 }
 EXPORT_SYMBOL(xfrm_state_check_expire);
@@ -796,34 +807,56 @@ EXPORT_SYMBOL(xfrm_replay_advance);
 static struct list_head xfrm_km_list = LIST_HEAD_INIT(xfrm_km_list);
 static DEFINE_RWLOCK(xfrm_km_lock);
 
-static void km_state_expired(struct xfrm_state *x, int hard)
+void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
 {
         struct xfrm_mgr *km;
 
-        if (hard)
-                x->km.state = XFRM_STATE_EXPIRED;
-        else
-                x->km.dying = 1;
+        read_lock(&xfrm_km_lock);
+        list_for_each_entry(km, &xfrm_km_list, list)
+                if (km->notify_policy)
+                        km->notify_policy(xp, dir, c);
+        read_unlock(&xfrm_km_lock);
+}
 
+void km_state_notify(struct xfrm_state *x, struct km_event *c)
+{
+        struct xfrm_mgr *km;
         read_lock(&xfrm_km_lock);
         list_for_each_entry(km, &xfrm_km_list, list)
-                km->notify(x, hard);
+                if (km->notify)
+                        km->notify(x, c);
         read_unlock(&xfrm_km_lock);
+}
+
+EXPORT_SYMBOL(km_policy_notify);
+EXPORT_SYMBOL(km_state_notify);
+
+static void km_state_expired(struct xfrm_state *x, int hard)
+{
+        struct km_event c;
+
+        c.data.hard = hard;
+        c.event = XFRM_MSG_EXPIRE;
+        km_state_notify(x, &c);
 
         if (hard)
                 wake_up(&km_waitq);
 }
 
+/*
+ * We send to all registered managers regardless of failure
+ * We are happy with one success
+*/
 static int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol)
 {
-        int err = -EINVAL;
+        int err = -EINVAL, acqret;
         struct xfrm_mgr *km;
 
         read_lock(&xfrm_km_lock);
         list_for_each_entry(km, &xfrm_km_list, list) {
-                err = km->acquire(x, t, pol, XFRM_POLICY_OUT);
-                if (!err)
-                        break;
+                acqret = km->acquire(x, t, pol, XFRM_POLICY_OUT);
+                if (!acqret)
+                        err = acqret;
         }
         read_unlock(&xfrm_km_lock);
         return err;
@@ -848,13 +881,11 @@ EXPORT_SYMBOL(km_new_mapping);
 
 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard)
 {
-        struct xfrm_mgr *km;
+        struct km_event c;
 
-        read_lock(&xfrm_km_lock);
-        list_for_each_entry(km, &xfrm_km_list, list)
-                if (km->notify_policy)
-                        km->notify_policy(pol, dir, hard);
-        read_unlock(&xfrm_km_lock);
+        c.data.hard = hard;
+        c.event = XFRM_MSG_POLEXPIRE;
+        km_policy_notify(pol, dir, &c);
 
         if (hard)
                 wake_up(&km_waitq);
@@ -1024,6 +1055,43 @@ int xfrm_state_mtu(struct xfrm_state *x, int mtu)
 }
 
 EXPORT_SYMBOL(xfrm_state_mtu);
+
+int xfrm_init_state(struct xfrm_state *x)
+{
+        struct xfrm_state_afinfo *afinfo;
+        int family = x->props.family;
+        int err;
+
+        err = -EAFNOSUPPORT;
+        afinfo = xfrm_state_get_afinfo(family);
+        if (!afinfo)
+                goto error;
+
+        err = 0;
+        if (afinfo->init_flags)
+                err = afinfo->init_flags(x);
+
+        xfrm_state_put_afinfo(afinfo);
+
+        if (err)
+                goto error;
+
+        err = -EPROTONOSUPPORT;
+        x->type = xfrm_get_type(x->id.proto, family);
+        if (x->type == NULL)
+                goto error;
+
+        err = x->type->init_state(x);
+        if (err)
+                goto error;
+
+        x->km.state = XFRM_STATE_VALID;
+
+error:
+        return err;
+}
+
+EXPORT_SYMBOL(xfrm_init_state);
  
 void __init xfrm_state_init(void)
 {
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 97509011c274..8da3e25b2c4c 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -249,17 +249,10 @@ static struct xfrm_state *xfrm_state_construct(struct xfrm_usersa_info *p,
         if ((err = attach_encap_tmpl(&x->encap, xfrma[XFRMA_ENCAP-1])))
                 goto error;
 
-        err = -ENOENT;
-        x->type = xfrm_get_type(x->id.proto, x->props.family);
-        if (x->type == NULL)
-                goto error;
-
-        err = x->type->init_state(x, NULL);
+        err = xfrm_init_state(x);
         if (err)
                 goto error;
 
-        x->curlft.add_time = (unsigned long) xtime.tv_sec;
-        x->km.state = XFRM_STATE_VALID;
         x->km.seq = p->seq;
 
         return x;
@@ -277,6 +270,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
         struct xfrm_usersa_info *p = NLMSG_DATA(nlh);
         struct xfrm_state *x;
         int err;
+        struct km_event c;
 
         err = verify_newsa_info(p, (struct rtattr **) xfrma);
         if (err)
@@ -286,6 +280,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
         if (!x)
                 return err;
 
+        xfrm_state_hold(x);
         if (nlh->nlmsg_type == XFRM_MSG_NEWSA)
                 err = xfrm_state_add(x);
         else
@@ -294,14 +289,24 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
         if (err < 0) {
                 x->km.state = XFRM_STATE_DEAD;
                 xfrm_state_put(x);
+                goto out;
         }
 
+        c.seq = nlh->nlmsg_seq;
+        c.pid = nlh->nlmsg_pid;
+        c.event = nlh->nlmsg_type;
+
+        km_state_notify(x, &c);
+out:
+        xfrm_state_put(x);
         return err;
 }
 
 static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
 {
         struct xfrm_state *x;
+        int err;
+        struct km_event c;
         struct xfrm_usersa_id *p = NLMSG_DATA(nlh);
 
         x = xfrm_state_lookup(&p->daddr, p->spi, p->proto, p->family);
@@ -313,10 +318,19 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
                 return -EPERM;
         }
 
-        xfrm_state_delete(x);
+        err = xfrm_state_delete(x);
+        if (err < 0) {
+                xfrm_state_put(x);
+                return err;
+        }
+
+        c.seq = nlh->nlmsg_seq;
+        c.pid = nlh->nlmsg_pid;
+        c.event = nlh->nlmsg_type;
+        km_state_notify(x, &c);
         xfrm_state_put(x);
 
-        return 0;
+        return err;
 }
 
 static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
@@ -681,6 +695,7 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
 {
         struct xfrm_userpolicy_info *p = NLMSG_DATA(nlh);
         struct xfrm_policy *xp;
+        struct km_event c;
         int err;
         int excl;
 
@@ -692,6 +707,10 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
         if (!xp)
                 return err;
 
+        /* shouldnt excl be based on nlh flags??
+         * Aha! this is anti-netlink really i.e  more pfkey derived
+         * in netlink excl is a flag and you wouldnt need
+         * a type XFRM_MSG_UPDPOLICY - JHS */
         excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
         err = xfrm_policy_insert(p->dir, xp, excl);
         if (err) {
@@ -699,6 +718,11 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
                 return err;
         }
 
+        c.event = nlh->nlmsg_type;
+        c.seq = nlh->nlmsg_seq;
+        c.pid = nlh->nlmsg_pid;
+        km_policy_notify(xp, p->dir, &c);
+
         xfrm_pol_put(xp);
 
         return 0;
@@ -816,6 +840,7 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
         struct xfrm_policy *xp;
         struct xfrm_userpolicy_id *p;
         int err;
+        struct km_event c;
         int delete;
 
         p = NLMSG_DATA(nlh);
@@ -843,6 +868,12 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
                                               NETLINK_CB(skb).pid,
                                               MSG_DONTWAIT);
                 }
+        } else {
+                c.data.byid = p->index;
+                c.event = nlh->nlmsg_type;
+                c.seq = nlh->nlmsg_seq;
+                c.pid = nlh->nlmsg_pid;
+                km_policy_notify(xp, p->dir, &c);
         }
 
         xfrm_pol_put(xp);
@@ -852,15 +883,28 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
 
 static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
 {
+        struct km_event c;
         struct xfrm_usersa_flush *p = NLMSG_DATA(nlh);
 
         xfrm_state_flush(p->proto);
+        c.data.proto = p->proto;
+        c.event = nlh->nlmsg_type;
+        c.seq = nlh->nlmsg_seq;
+        c.pid = nlh->nlmsg_pid;
+        km_state_notify(NULL, &c);
+
         return 0;
 }
 
 static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
 {
+        struct km_event c;
+
         xfrm_policy_flush();
+        c.event = nlh->nlmsg_type;
+        c.seq = nlh->nlmsg_seq;
+        c.pid = nlh->nlmsg_pid;
+        km_policy_notify(NULL, 0, &c);
         return 0;
 }
 
@@ -1069,15 +1113,16 @@ nlmsg_failure:
         return -1;
 }
 
-static int xfrm_send_state_notify(struct xfrm_state *x, int hard)
+static int xfrm_exp_state_notify(struct xfrm_state *x, struct km_event *c)
 {
         struct sk_buff *skb;
+        int len = NLMSG_LENGTH(sizeof(struct xfrm_user_expire));
 
-        skb = alloc_skb(sizeof(struct xfrm_user_expire) + 16, GFP_ATOMIC);
+        skb = alloc_skb(len, GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;
 
-        if (build_expire(skb, x, hard) < 0)
+        if (build_expire(skb, x, c->data.hard) < 0)
                 BUG();
 
         NETLINK_CB(skb).dst_groups = XFRMGRP_EXPIRE;
@@ -1085,6 +1130,131 @@ static int xfrm_send_state_notify(struct xfrm_state *x, int hard)
         return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_EXPIRE, GFP_ATOMIC);
 }
 
+static int xfrm_notify_sa_flush(struct km_event *c)
+{
+        struct xfrm_usersa_flush *p;
+        struct nlmsghdr *nlh;
+        struct sk_buff *skb;
+        unsigned char *b;
+        int len = NLMSG_LENGTH(sizeof(struct xfrm_usersa_flush));
+
+        skb = alloc_skb(len, GFP_ATOMIC);
+        if (skb == NULL)
+                return -ENOMEM;
+        b = skb->tail;
+
+        nlh = NLMSG_PUT(skb, c->pid, c->seq,
+                        XFRM_MSG_FLUSHSA, sizeof(*p));
+        nlh->nlmsg_flags = 0;
+
+        p = NLMSG_DATA(nlh);
+        p->proto = c->data.proto;
+
+        nlh->nlmsg_len = skb->tail - b;
+
+        return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_SA, GFP_ATOMIC);
+
+nlmsg_failure:
+        kfree_skb(skb);
+        return -1;
+}
+
+static int inline xfrm_sa_len(struct xfrm_state *x)
+{
+        int l = 0;
+        if (x->aalg)
+                l += RTA_SPACE(sizeof(*x->aalg) + (x->aalg->alg_key_len+7)/8);
+        if (x->ealg)
+                l += RTA_SPACE(sizeof(*x->ealg) + (x->ealg->alg_key_len+7)/8);
+        if (x->calg)
+                l += RTA_SPACE(sizeof(*x->calg));
+        if (x->encap)
+                l += RTA_SPACE(sizeof(*x->encap));
+
+        return l;
+}
+
+static int xfrm_notify_sa(struct xfrm_state *x, struct km_event *c)
+{
+        struct xfrm_usersa_info *p;
+        struct xfrm_usersa_id *id;
+        struct nlmsghdr *nlh;
+        struct sk_buff *skb;
+        unsigned char *b;
+        int len = xfrm_sa_len(x);
+        int headlen;
+
+        headlen = sizeof(*p);
+        if (c->event == XFRM_MSG_DELSA) {
+                len += RTA_SPACE(headlen);
+                headlen = sizeof(*id);
+        }
+        len += NLMSG_SPACE(headlen);
+
+        skb = alloc_skb(len, GFP_ATOMIC);
+        if (skb == NULL)
+                return -ENOMEM;
+        b = skb->tail;
+
+        nlh = NLMSG_PUT(skb, c->pid, c->seq, c->event, headlen);
+        nlh->nlmsg_flags = 0;
+
+        p = NLMSG_DATA(nlh);
+        if (c->event == XFRM_MSG_DELSA) {
+                id = NLMSG_DATA(nlh);
+                memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
+                id->spi = x->id.spi;
+                id->family = x->props.family;
+                id->proto = x->id.proto;
+
+                p = RTA_DATA(__RTA_PUT(skb, XFRMA_SA, sizeof(*p)));
+        }
+
+        copy_to_user_state(x, p);
+
+        if (x->aalg)
+                RTA_PUT(skb, XFRMA_ALG_AUTH,
+                        sizeof(*(x->aalg))+(x->aalg->alg_key_len+7)/8, x->aalg);
+        if (x->ealg)
+                RTA_PUT(skb, XFRMA_ALG_CRYPT,
+                        sizeof(*(x->ealg))+(x->ealg->alg_key_len+7)/8, x->ealg);
+        if (x->calg)
+                RTA_PUT(skb, XFRMA_ALG_COMP, sizeof(*(x->calg)), x->calg);
+
+        if (x->encap)
+                RTA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
+
+        nlh->nlmsg_len = skb->tail - b;
+
+        return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_SA, GFP_ATOMIC);
+
+nlmsg_failure:
+rtattr_failure:
+        kfree_skb(skb);
+        return -1;
+}
+
+static int xfrm_send_state_notify(struct xfrm_state *x, struct km_event *c)
+{
+
+        switch (c->event) {
+        case XFRM_MSG_EXPIRE:
+                return xfrm_exp_state_notify(x, c);
+        case XFRM_MSG_DELSA:
+        case XFRM_MSG_UPDSA:
+        case XFRM_MSG_NEWSA:
+                return xfrm_notify_sa(x, c);
+        case XFRM_MSG_FLUSHSA:
+                return xfrm_notify_sa_flush(c);
+        default:
+                 printk("xfrm_user: Unknown SA event %d\n", c->event);
+                 break;
+        }
+
+        return 0;
+
+}
+
 static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
                          struct xfrm_tmpl *xt, struct xfrm_policy *xp,
                          int dir)
@@ -1180,6 +1350,9 @@ static struct xfrm_policy *xfrm_compile_policy(u16 family, int opt,
         if (nr > XFRM_MAX_DEPTH)
                 return NULL;
 
+        if (p->dir > XFRM_POLICY_OUT)
+                return NULL;
+
         xp = xfrm_policy_alloc(GFP_KERNEL);
         if (xp == NULL) {
                 *dir = -ENOBUFS;
@@ -1218,7 +1391,7 @@ nlmsg_failure:
         return -1;
 }
 
-static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, int hard)
+static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
 {
         struct sk_buff *skb;
         size_t len;
@@ -1229,7 +1402,7 @@ static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, int hard)
         if (skb == NULL)
                 return -ENOMEM;
 
-        if (build_polexpire(skb, xp, dir, hard) < 0)
+        if (build_polexpire(skb, xp, dir, c->data.hard) < 0)
                 BUG();
 
         NETLINK_CB(skb).dst_groups = XFRMGRP_EXPIRE;
@@ -1237,6 +1410,103 @@ static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, int hard)
         return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_EXPIRE, GFP_ATOMIC);
 }
 
+static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c)
+{
+        struct xfrm_userpolicy_info *p;
+        struct xfrm_userpolicy_id *id;
+        struct nlmsghdr *nlh;
+        struct sk_buff *skb;
+        unsigned char *b;
+        int len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
+        int headlen;
+
+        headlen = sizeof(*p);
+        if (c->event == XFRM_MSG_DELPOLICY) {
+                len += RTA_SPACE(headlen);
+                headlen = sizeof(*id);
+        }
+        len += NLMSG_SPACE(headlen);
+
+        skb = alloc_skb(len, GFP_ATOMIC);
+        if (skb == NULL)
+                return -ENOMEM;
+        b = skb->tail;
+
+        nlh = NLMSG_PUT(skb, c->pid, c->seq, c->event, headlen);
+
+        p = NLMSG_DATA(nlh);
+        if (c->event == XFRM_MSG_DELPOLICY) {
+                id = NLMSG_DATA(nlh);
+                memset(id, 0, sizeof(*id));
+                id->dir = dir;
+                if (c->data.byid)
+                        id->index = xp->index;
+                else
+                        memcpy(&id->sel, &xp->selector, sizeof(id->sel));
+
+                p = RTA_DATA(__RTA_PUT(skb, XFRMA_POLICY, sizeof(*p)));
+        }
+
+        nlh->nlmsg_flags = 0;
+
+        copy_to_user_policy(xp, p, dir);
+        if (copy_to_user_tmpl(xp, skb) < 0)
+                goto nlmsg_failure;
+
+        nlh->nlmsg_len = skb->tail - b;
+
+        return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_POLICY, GFP_ATOMIC);
+
+nlmsg_failure:
+rtattr_failure:
+        kfree_skb(skb);
+        return -1;
+}
+
+static int xfrm_notify_policy_flush(struct km_event *c)
+{
+        struct nlmsghdr *nlh;
+        struct sk_buff *skb;
+        unsigned char *b;
+        int len = NLMSG_LENGTH(0);
+
+        skb = alloc_skb(len, GFP_ATOMIC);
+        if (skb == NULL)
+                return -ENOMEM;
+        b = skb->tail;
+
+
+        nlh = NLMSG_PUT(skb, c->pid, c->seq, XFRM_MSG_FLUSHPOLICY, 0);
+
+        nlh->nlmsg_len = skb->tail - b;
+
+        return netlink_broadcast(xfrm_nl, skb, 0, XFRMGRP_POLICY, GFP_ATOMIC);
+
+nlmsg_failure:
+        kfree_skb(skb);
+        return -1;
+}
+
+static int xfrm_send_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c)
+{
+
+        switch (c->event) {
+        case XFRM_MSG_NEWPOLICY:
+        case XFRM_MSG_UPDPOLICY:
+        case XFRM_MSG_DELPOLICY:
+                return xfrm_notify_policy(xp, dir, c);
+        case XFRM_MSG_FLUSHPOLICY:
+                return xfrm_notify_policy_flush(c);
+        case XFRM_MSG_POLEXPIRE:
+                return xfrm_exp_policy_notify(xp, dir, c);
+        default:
+                printk("xfrm_user: Unknown Policy event %d\n", c->event);
+        }
+
+        return 0;
+
+}
+
 static struct xfrm_mgr netlink_mgr = {
         .id             = "netlink",
         .notify         = xfrm_send_state_notify,