11 files changed, 107 insertions, 86 deletions

diff --git a/net/core/datagram.c b/net/core/datagram.c
index d1bfd279cc1a..fcee054b6f75 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -115,10 +115,10 @@ out_noerr:
 
 /**
  *      skb_recv_datagram - Receive a datagram skbuff
- *      @sk - socket
- *      @flags - MSG_ flags
- *      @noblock - blocking operation?
- *      @err - error code returned
+ *      @sk: socket
+ *      @flags: MSG_ flags
+ *      @noblock: blocking operation?
+ *      @err: error code returned
  *
  *      Get a datagram skbuff, understands the peeking, nonblocking wakeups
  *      and possible races. This replaces identical code in packet, raw and
@@ -201,10 +201,10 @@ void skb_free_datagram(struct sock *sk, struct sk_buff *skb)
 
 /**
  *      skb_copy_datagram_iovec - Copy a datagram to an iovec.
- *      @skb - buffer to copy
- *      @offset - offset in the buffer to start copying from
- *      @iovec - io vector to copy to
- *      @len - amount of data to copy from buffer to iovec
+ *      @skb: buffer to copy
+ *      @offset: offset in the buffer to start copying from
+ *      @to: io vector to copy to
+ *      @len: amount of data to copy from buffer to iovec
  *
  *      Note: the iovec is modified during the copy.
  */
@@ -377,9 +377,9 @@ fault:
 
 /**
  *      skb_copy_and_csum_datagram_iovec - Copy and checkum skb to user iovec.
- *      @skb - skbuff
- *      @hlen - hardware length
- *      @iovec - io vector
+ *      @skb: skbuff
+ *      @hlen: hardware length
+ *      @iov: io vector
  * 
  *      Caller _must_ check that skb will fit to this iovec.
  *
@@ -425,9 +425,9 @@ fault:
 
 /**
  *      datagram_poll - generic datagram poll
- *      @file - file struct
- *      @sock - socket
- *      @wait - poll table
+ *      @file: file struct
+ *      @sock: socket
+ *      @wait: poll table
  *
  *      Datagram poll: Again totally generic. This also handles
  *      sequenced packet sockets providing the socket receive queue
diff --git a/net/core/dev.c b/net/core/dev.c
index 42344d903692..d4d9e2680adb 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -7,7 +7,7 @@
  *              2 of the License, or (at your option) any later version.
  *
  *      Derived from the non IP parts of dev.c 1.0.19
- *              Authors:        Ross Biro, <bir7@leland.Stanford.Edu>
+ *              Authors:        Ross Biro
  *                              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *                              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *
@@ -1214,6 +1214,19 @@ int __skb_linearize(struct sk_buff *skb, int gfp_mask)
  *      A negative errno code is returned on a failure. A success does not
  *      guarantee the frame will be transmitted as it may be dropped due
  *      to congestion or traffic shaping.
+ *
+ * -----------------------------------------------------------------------------------
+ *      I notice this method can also return errors from the queue disciplines,
+ *      including NET_XMIT_DROP, which is a positive value.  So, errors can also
+ *      be positive.
+ *
+ *      Regardless of the return value, the skb is consumed, so it is currently
+ *      difficult to retry a send to this method.  (You can bump the ref count
+ *      before sending to hold a reference for retry if you are careful.)
+ *
+ *      When calling this method, interrupts MUST be enabled.  This is because
+ *      the BH enable code must have IRQs enabled so that it will not deadlock.
+ *          --BLG
  */
 
 int dev_queue_xmit(struct sk_buff *skb)
@@ -3078,7 +3091,7 @@ void free_netdev(struct net_device *dev)
 void synchronize_net(void) 
 {
         might_sleep();
-        synchronize_kernel();
+        synchronize_rcu();
 }
 
 /**
diff --git a/net/core/iovec.c b/net/core/iovec.c
index d57ace949ab8..65e4b56fbc77 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -33,7 +33,7 @@
  *      Verify iovec. The caller must ensure that the iovec is big enough
  *      to hold the message iovec.
  *
- *      Save time not doing verify_area. copy_*_user will make this work
+ *      Save time not doing access_ok. copy_*_user will make this work
  *      in any case.
  */
 
diff --git a/net/core/link_watch.c b/net/core/link_watch.c
index 4859b7446c6f..d43d1201275c 100644
--- a/net/core/link_watch.c
+++ b/net/core/link_watch.c
@@ -16,6 +16,7 @@
 #include <linux/netdevice.h>
 #include <linux/if.h>
 #include <net/sock.h>
+#include <net/pkt_sched.h>
 #include <linux/rtnetlink.h>
 #include <linux/jiffies.h>
 #include <linux/spinlock.h>
@@ -74,6 +75,12 @@ void linkwatch_run_queue(void)
                 clear_bit(__LINK_STATE_LINKWATCH_PENDING, &dev->state);
 
                 if (dev->flags & IFF_UP) {
+                        if (netif_carrier_ok(dev)) {
+                                WARN_ON(dev->qdisc_sleeping == &noop_qdisc);
+                                dev_activate(dev);
+                        } else
+                                dev_deactivate(dev);
+
                         netdev_state_change(dev);
                 }
 
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 0a2f67bbef2e..43bdc521e20d 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1953,7 +1953,7 @@ static int neigh_stat_seq_show(struct seq_file *seq, void *v)
         struct neigh_statistics *st = v;
 
         if (v == SEQ_START_TOKEN) {
-                seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs forced_gc_goal_miss\n");
+                seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs\n");
                 return 0;
         }
 
diff --git a/net/core/netfilter.c b/net/core/netfilter.c
index e51cfa46950c..22a8f127c4aa 100644
--- a/net/core/netfilter.c
+++ b/net/core/netfilter.c
@@ -217,21 +217,10 @@ void nf_debug_ip_local_deliver(struct sk_buff *skb)
          * NF_IP_RAW_INPUT and NF_IP_PRE_ROUTING.  */
         if (!skb->dev) {
                 printk("ip_local_deliver: skb->dev is NULL.\n");
-        }
-        else if (strcmp(skb->dev->name, "lo") == 0) {
-                if (skb->nf_debug != ((1 << NF_IP_LOCAL_OUT)
-                                      | (1 << NF_IP_POST_ROUTING)
-                                      | (1 << NF_IP_PRE_ROUTING)
-                                      | (1 << NF_IP_LOCAL_IN))) {
-                        printk("ip_local_deliver: bad loopback skb: ");
-                        debug_print_hooks_ip(skb->nf_debug);
-                        nf_dump_skb(PF_INET, skb);
-                }
-        }
-        else {
+        } else {
                 if (skb->nf_debug != ((1<<NF_IP_PRE_ROUTING)
                                       | (1<<NF_IP_LOCAL_IN))) {
-                        printk("ip_local_deliver: bad non-lo skb: ");
+                        printk("ip_local_deliver: bad skb: ");
                         debug_print_hooks_ip(skb->nf_debug);
                         nf_dump_skb(PF_INET, skb);
                 }
@@ -247,8 +236,6 @@ void nf_debug_ip_loopback_xmit(struct sk_buff *newskb)
                 debug_print_hooks_ip(newskb->nf_debug);
                 nf_dump_skb(PF_INET, newskb);
         }
-        /* Clear to avoid confusing input check */
-        newskb->nf_debug = 0;
 }
 
 void nf_debug_ip_finish_output2(struct sk_buff *skb)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 44dfaf8f04af..00caf4b318b2 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -22,7 +22,6 @@
 #include <linux/types.h>
 #include <linux/socket.h>
 #include <linux/kernel.h>
-#include <linux/major.h>
 #include <linux/sched.h>
 #include <linux/timer.h>
 #include <linux/string.h>
@@ -87,30 +86,33 @@ struct sock *rtnl;
 
 struct rtnetlink_link * rtnetlink_links[NPROTO];
 
-static const int rtm_min[(RTM_MAX+1-RTM_BASE)/4] =
+static const int rtm_min[RTM_NR_FAMILIES] =
 {
-        NLMSG_LENGTH(sizeof(struct ifinfomsg)),
-        NLMSG_LENGTH(sizeof(struct ifaddrmsg)),
-        NLMSG_LENGTH(sizeof(struct rtmsg)),
-        NLMSG_LENGTH(sizeof(struct ndmsg)),
-        NLMSG_LENGTH(sizeof(struct rtmsg)),
-        NLMSG_LENGTH(sizeof(struct tcmsg)),
-        NLMSG_LENGTH(sizeof(struct tcmsg)),
-        NLMSG_LENGTH(sizeof(struct tcmsg)),
-        NLMSG_LENGTH(sizeof(struct tcamsg))
+        [RTM_FAM(RTM_NEWLINK)]      = NLMSG_LENGTH(sizeof(struct ifinfomsg)),
+        [RTM_FAM(RTM_NEWADDR)]      = NLMSG_LENGTH(sizeof(struct ifaddrmsg)),
+        [RTM_FAM(RTM_NEWROUTE)]     = NLMSG_LENGTH(sizeof(struct rtmsg)),
+        [RTM_FAM(RTM_NEWNEIGH)]     = NLMSG_LENGTH(sizeof(struct ndmsg)),
+        [RTM_FAM(RTM_NEWRULE)]      = NLMSG_LENGTH(sizeof(struct rtmsg)),
+        [RTM_FAM(RTM_NEWQDISC)]     = NLMSG_LENGTH(sizeof(struct tcmsg)),
+        [RTM_FAM(RTM_NEWTCLASS)]    = NLMSG_LENGTH(sizeof(struct tcmsg)),
+        [RTM_FAM(RTM_NEWTFILTER)]   = NLMSG_LENGTH(sizeof(struct tcmsg)),
+        [RTM_FAM(RTM_NEWACTION)]    = NLMSG_LENGTH(sizeof(struct tcamsg)),
+        [RTM_FAM(RTM_NEWPREFIX)]    = NLMSG_LENGTH(sizeof(struct rtgenmsg)),
+        [RTM_FAM(RTM_GETMULTICAST)] = NLMSG_LENGTH(sizeof(struct rtgenmsg)),
+        [RTM_FAM(RTM_GETANYCAST)]   = NLMSG_LENGTH(sizeof(struct rtgenmsg)),
 };
 
-static const int rta_max[(RTM_MAX+1-RTM_BASE)/4] =
+static const int rta_max[RTM_NR_FAMILIES] =
 {
-        IFLA_MAX,
-        IFA_MAX,
-        RTA_MAX,
-        NDA_MAX,
-        RTA_MAX,
-        TCA_MAX,
-        TCA_MAX,
-        TCA_MAX,
-        TCAA_MAX
+        [RTM_FAM(RTM_NEWLINK)]      = IFLA_MAX,
+        [RTM_FAM(RTM_NEWADDR)]      = IFA_MAX,
+        [RTM_FAM(RTM_NEWROUTE)]     = RTA_MAX,
+        [RTM_FAM(RTM_NEWNEIGH)]     = NDA_MAX,
+        [RTM_FAM(RTM_NEWRULE)]      = RTA_MAX,
+        [RTM_FAM(RTM_NEWQDISC)]     = TCA_MAX,
+        [RTM_FAM(RTM_NEWTCLASS)]    = TCA_MAX,
+        [RTM_FAM(RTM_NEWTFILTER)]   = TCA_MAX,
+        [RTM_FAM(RTM_NEWACTION)]    = TCAA_MAX,
 };
 
 void __rta_fill(struct sk_buff *skb, int attrtype, int attrlen, const void *data)
@@ -607,27 +609,33 @@ static inline int rtnetlink_rcv_skb(struct sk_buff *skb)
 
 /*
  *  rtnetlink input queue processing routine:
- *      - try to acquire shared lock. If it is failed, defer processing.
+ *      - process as much as there was in the queue upon entry.
  *      - feed skbs to rtnetlink_rcv_skb, until it refuse a message,
- *        that will occur, when a dump started and/or acquisition of
- *        exclusive lock failed.
+ *        that will occur, when a dump started.
  */
 
 static void rtnetlink_rcv(struct sock *sk, int len)
 {
+        unsigned int qlen = skb_queue_len(&sk->sk_receive_queue);
+
         do {
                 struct sk_buff *skb;
 
-                if (rtnl_shlock_nowait())
-                        return;
+                rtnl_lock();
+
+                if (qlen > skb_queue_len(&sk->sk_receive_queue))
+                        qlen = skb_queue_len(&sk->sk_receive_queue);
 
-                while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+                for (; qlen; qlen--) {
+                        skb = skb_dequeue(&sk->sk_receive_queue);
                         if (rtnetlink_rcv_skb(skb)) {
                                 if (skb->len)
                                         skb_queue_head(&sk->sk_receive_queue,
                                                        skb);
-                                else
+                                else {
                                         kfree_skb(skb);
+                                        qlen--;
+                                }
                                 break;
                         }
                         kfree_skb(skb);
@@ -636,10 +644,10 @@ static void rtnetlink_rcv(struct sock *sk, int len)
                 up(&rtnl_sem);
 
                 netdev_run_todo();
-        } while (rtnl && rtnl->sk_receive_queue.qlen);
+        } while (qlen);
 }
 
-static struct rtnetlink_link link_rtnetlink_table[RTM_MAX-RTM_BASE+1] =
+static struct rtnetlink_link link_rtnetlink_table[RTM_NR_MSGTYPES] =
 {
         [RTM_GETLINK  - RTM_BASE] = { .dumpit = rtnetlink_dump_ifinfo },
         [RTM_SETLINK  - RTM_BASE] = { .doit   = do_setlink            },
diff --git a/net/core/scm.c b/net/core/scm.c
index a2ebf30f6aa8..e887d19be506 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -15,7 +15,6 @@
 #include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/kernel.h>
-#include <linux/major.h>
 #include <linux/stat.h>
 #include <linux/socket.h>
 #include <linux/file.h>
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 1b64817d7de6..f65b3de590a9 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -86,8 +86,10 @@ static kmem_cache_t *skbuff_head_cache;
  */
 void skb_over_panic(struct sk_buff *skb, int sz, void *here)
 {
-        printk(KERN_INFO "skput:over: %p:%d put:%d dev:%s",
-                here, skb->len, sz, skb->dev ? skb->dev->name : "<NULL>");
+        printk(KERN_EMERG "skb_over_panic: text:%p len:%d put:%d head:%p "
+                          "data:%p tail:%p end:%p dev:%s\n",
+               here, skb->len, sz, skb->head, skb->data, skb->tail, skb->end,
+               skb->dev ? skb->dev->name : "<NULL>");
         BUG();
 }
 
@@ -102,8 +104,10 @@ void skb_over_panic(struct sk_buff *skb, int sz, void *here)
 
 void skb_under_panic(struct sk_buff *skb, int sz, void *here)
 {
-        printk(KERN_INFO "skput:under: %p:%d put:%d dev:%s",
-               here, skb->len, sz, skb->dev ? skb->dev->name : "<NULL>");
+        printk(KERN_EMERG "skb_under_panic: text:%p len:%d put:%d head:%p "
+                          "data:%p tail:%p end:%p dev:%s\n",
+               here, skb->len, sz, skb->head, skb->data, skb->tail, skb->end,
+               skb->dev ? skb->dev->name : "<NULL>");
         BUG();
 }
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 4df4fa3c5de0..96e00b08698f 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -9,7 +9,7 @@
  *
  * Version:     $Id: sock.c,v 1.117 2002/02/01 22:01:03 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Florian La Roche, <flla@stud.uni-sb.de>
  *              Alan Cox, <A.Cox@swansea.ac.uk>
@@ -97,7 +97,6 @@
 #include <linux/socket.h>
 #include <linux/in.h>
 #include <linux/kernel.h>
-#include <linux/major.h>
 #include <linux/module.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
@@ -617,10 +616,10 @@ lenout:
 
 /**
  *      sk_alloc - All socket objects are allocated here
- *      @family - protocol family
- *      @priority - for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
- *      @prot - struct proto associated with this new sock instance
- *      @zero_it - if we should zero the newly allocated sock
+ *      @family: protocol family
+ *      @priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
+ *      @prot: struct proto associated with this new sock instance
+ *      @zero_it: if we should zero the newly allocated sock
  */
 struct sock *sk_alloc(int family, int priority, struct proto *prot, int zero_it)
 {
@@ -636,7 +635,11 @@ struct sock *sk_alloc(int family, int priority, struct proto *prot, int zero_it)
                 if (zero_it) {
                         memset(sk, 0, prot->obj_size);
                         sk->sk_family = family;
-                        sk->sk_prot = prot;
+                        /*
+                         * See comment in struct sock definition to understand
+                         * why we need sk_prot_creator -acme
+                         */
+                        sk->sk_prot = sk->sk_prot_creator = prot;
                         sock_lock_init(sk);
                 }
                 
@@ -655,7 +658,7 @@ struct sock *sk_alloc(int family, int priority, struct proto *prot, int zero_it)
 void sk_free(struct sock *sk)
 {
         struct sk_filter *filter;
-        struct module *owner = sk->sk_prot->owner;
+        struct module *owner = sk->sk_prot_creator->owner;
 
         if (sk->sk_destruct)
                 sk->sk_destruct(sk);
@@ -673,8 +676,8 @@ void sk_free(struct sock *sk)
                        __FUNCTION__, atomic_read(&sk->sk_omem_alloc));
 
         security_sk_free(sk);
-        if (sk->sk_prot->slab != NULL)
-                kmem_cache_free(sk->sk_prot->slab, sk);
+        if (sk->sk_prot_creator->slab != NULL)
+                kmem_cache_free(sk->sk_prot_creator->slab, sk);
         else
                 kfree(sk);
         module_put(owner);
@@ -971,8 +974,8 @@ static void __release_sock(struct sock *sk)
 
 /**
  * sk_wait_data - wait for data to arrive at sk_receive_queue
- * sk - sock to wait on
- * timeo - for how long
+ * @sk:    sock to wait on
+ * @timeo: for how long
  *
  * Now socket state including sk->sk_err is changed only under lock,
  * hence we may omit checks after joining wait queue.
diff --git a/net/core/stream.c b/net/core/stream.c
index 1e27a57b5a97..ac9edfdf8742 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -21,7 +21,7 @@
 
 /**
  * sk_stream_write_space - stream socket write_space callback.
- * sk - socket
+ * @sk: socket
  *
  * FIXME: write proper description
  */
@@ -43,8 +43,8 @@ EXPORT_SYMBOL(sk_stream_write_space);
 
 /**
  * sk_stream_wait_connect - Wait for a socket to get into the connected state
- * @sk - sock to wait on
- * @timeo_p - for how long to wait
+ * @sk: sock to wait on
+ * @timeo_p: for how long to wait
  *
  * Must be called with the socket locked.
  */
@@ -79,7 +79,7 @@ EXPORT_SYMBOL(sk_stream_wait_connect);
 
 /**
  * sk_stream_closing - Return 1 if we still have things to send in our buffers.
- * @sk - socket to verify
+ * @sk: socket to verify
  */
 static inline int sk_stream_closing(struct sock *sk)
 {
@@ -107,8 +107,8 @@ EXPORT_SYMBOL(sk_stream_wait_close);
 
 /**
  * sk_stream_wait_memory - Wait for more memory for a socket
- * @sk - socket to wait for memory
- * @timeo_p - for how long
+ * @sk: socket to wait for memory
+ * @timeo_p: for how long
  */
 int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
 {