21 files changed, 145 insertions, 259 deletions

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index d9b72fde433c..f564ee99782d 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -21,10 +21,7 @@
 
 static struct net_device_stats *br_dev_get_stats(struct net_device *dev)
 {
-        struct net_bridge *br;
-
-        br = dev->priv;
-
+        struct net_bridge *br = netdev_priv(dev);
         return &br->statistics;
 }
 
@@ -54,9 +51,11 @@ int br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 
 static int br_dev_open(struct net_device *dev)
 {
-        netif_start_queue(dev);
+        struct net_bridge *br = netdev_priv(dev);
 
-        br_stp_enable_bridge(dev->priv);
+        br_features_recompute(br);
+        netif_start_queue(dev);
+        br_stp_enable_bridge(br);
 
         return 0;
 }
@@ -67,7 +66,7 @@ static void br_dev_set_multicast_list(struct net_device *dev)
 
 static int br_dev_stop(struct net_device *dev)
 {
-        br_stp_disable_bridge(dev->priv);
+        br_stp_disable_bridge(netdev_priv(dev));
 
         netif_stop_queue(dev);
 
@@ -76,7 +75,7 @@ static int br_dev_stop(struct net_device *dev)
 
 static int br_change_mtu(struct net_device *dev, int new_mtu)
 {
-        if ((new_mtu < 68) || new_mtu > br_min_mtu(dev->priv))
+        if (new_mtu < 68 || new_mtu > br_min_mtu(netdev_priv(dev)))
                 return -EINVAL;
 
         dev->mtu = new_mtu;
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 69872bf3b87e..91bb895375f4 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -314,6 +314,28 @@ int br_min_mtu(const struct net_bridge *br)
         return mtu;
 }
 
+/*
+ * Recomputes features using slave's features
+ */
+void br_features_recompute(struct net_bridge *br)
+{
+        struct net_bridge_port *p;
+        unsigned long features, checksum;
+
+        features = NETIF_F_SG | NETIF_F_FRAGLIST 
+                | NETIF_F_HIGHDMA | NETIF_F_TSO;
+        checksum = NETIF_F_IP_CSUM;     /* least commmon subset */
+
+        list_for_each_entry(p, &br->port_list, list) {
+                if (!(p->dev->features 
+                      & (NETIF_F_IP_CSUM|NETIF_F_NO_CSUM|NETIF_F_HW_CSUM)))
+                        checksum = 0;
+                features &= p->dev->features;
+        }
+
+        br->dev->features = features | checksum | NETIF_F_LLTX;
+}
+
 /* called with RTNL */
 int br_add_if(struct net_bridge *br, struct net_device *dev)
 {
@@ -368,6 +390,7 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
 
         spin_lock_bh(&br->lock);
         br_stp_recalculate_bridge_id(br);
+        br_features_recompute(br);
         spin_unlock_bh(&br->lock);
 
         return 0;
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 2b1cce46cab4..8f5f2e730992 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -26,7 +26,7 @@ static int br_pass_frame_up_finish(struct sk_buff *skb)
 #ifdef CONFIG_NETFILTER_DEBUG
         skb->nf_debug = 0;
 #endif
-        netif_rx(skb);
+        netif_receive_skb(skb);
 
         return 0;
 }
@@ -54,6 +54,9 @@ int br_handle_frame_finish(struct sk_buff *skb)
         struct net_bridge_fdb_entry *dst;
         int passedup = 0;
 
+        /* insert into forwarding database after filtering to avoid spoofing */
+        br_fdb_update(p->br, p, eth_hdr(skb)->h_source);
+
         if (br->dev->flags & IFF_PROMISC) {
                 struct sk_buff *skb2;
 
@@ -108,8 +111,7 @@ int br_handle_frame(struct net_bridge_port *p, struct sk_buff **pskb)
         if (!is_valid_ether_addr(eth_hdr(skb)->h_source))
                 goto err;
 
-        if (p->state == BR_STATE_LEARNING ||
-            p->state == BR_STATE_FORWARDING)
+        if (p->state == BR_STATE_LEARNING)
                 br_fdb_update(p->br, p, eth_hdr(skb)->h_source);
 
         if (p->br->stp_enabled &&
diff --git a/net/bridge/br_notify.c b/net/bridge/br_notify.c
index f8fb49e34764..917311c6828b 100644
--- a/net/bridge/br_notify.c
+++ b/net/bridge/br_notify.c
@@ -65,6 +65,15 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
                 }
                 break;
 
+        case NETDEV_FEAT_CHANGE:
+                if (br->dev->flags & IFF_UP) 
+                        br_features_recompute(br);
+
+                /* could do recursive feature change notification
+                 * but who would care?? 
+                 */
+                break;
+
         case NETDEV_DOWN:
                 if (br->dev->flags & IFF_UP)
                         br_stp_disable_port(p);
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 54d63f1372a0..bdf95a74d8cd 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -174,6 +174,7 @@ extern int br_add_if(struct net_bridge *br,
 extern int br_del_if(struct net_bridge *br,
               struct net_device *dev);
 extern int br_min_mtu(const struct net_bridge *br);
+extern void br_features_recompute(struct net_bridge *br);
 
 /* br_input.c */
 extern int br_handle_frame_finish(struct sk_buff *skb);
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index b91a875aca01..d071f1c9ad0b 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -140,6 +140,9 @@ int br_stp_handle_bpdu(struct sk_buff *skb)
         struct net_bridge *br = p->br;
         unsigned char *buf;
 
+        /* insert into forwarding database after filtering to avoid spoofing */
+        br_fdb_update(p->br, p, eth_hdr(skb)->h_source);
+
         /* need at least the 802 and STP headers */
         if (!pskb_may_pull(skb, sizeof(header)+1) ||
             memcmp(skb->data, header, sizeof(header)))
diff --git a/net/core/dev.c b/net/core/dev.c
index d4d9e2680adb..f15a3ffff635 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -761,6 +761,18 @@ int dev_change_name(struct net_device *dev, char *newname)
 }
 
 /**
+ *      netdev_features_change - device changes fatures
+ *      @dev: device to cause notification
+ *
+ *      Called to indicate a device has changed features.
+ */
+void netdev_features_change(struct net_device *dev)
+{
+        notifier_call_chain(&netdev_chain, NETDEV_FEAT_CHANGE, dev);
+}
+EXPORT_SYMBOL(netdev_features_change);
+
+/**
  *      netdev_state_change - device changes state
  *      @dev: device to cause notification
  *
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index f05fde97c43d..8ec484894d68 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -29,7 +29,7 @@ u32 ethtool_op_get_link(struct net_device *dev)
 
 u32 ethtool_op_get_tx_csum(struct net_device *dev)
 {
-        return (dev->features & NETIF_F_IP_CSUM) != 0;
+        return (dev->features & (NETIF_F_IP_CSUM | NETIF_F_HW_CSUM)) != 0;
 }
 
 int ethtool_op_set_tx_csum(struct net_device *dev, u32 data)
@@ -42,6 +42,15 @@ int ethtool_op_set_tx_csum(struct net_device *dev, u32 data)
         return 0;
 }
 
+int ethtool_op_set_tx_hw_csum(struct net_device *dev, u32 data)
+{
+        if (data)
+                dev->features |= NETIF_F_HW_CSUM;
+        else
+                dev->features &= ~NETIF_F_HW_CSUM;
+
+        return 0;
+}
 u32 ethtool_op_get_sg(struct net_device *dev)
 {
         return (dev->features & NETIF_F_SG) != 0;
@@ -682,6 +691,7 @@ int dev_ethtool(struct ifreq *ifr)
         void __user *useraddr = ifr->ifr_data;
         u32 ethcmd;
         int rc;
+        unsigned long old_features;
 
         /*
          * XXX: This can be pushed down into the ethtool_* handlers that
@@ -703,6 +713,8 @@ int dev_ethtool(struct ifreq *ifr)
                 if ((rc = dev->ethtool_ops->begin(dev)) < 0)
                         return rc;
 
+        old_features = dev->features;
+
         switch (ethcmd) {
         case ETHTOOL_GSET:
                 rc = ethtool_get_settings(dev, useraddr);
@@ -712,7 +724,6 @@ int dev_ethtool(struct ifreq *ifr)
                 break;
         case ETHTOOL_GDRVINFO:
                 rc = ethtool_get_drvinfo(dev, useraddr);
-
                 break;
         case ETHTOOL_GREGS:
                 rc = ethtool_get_regs(dev, useraddr);
@@ -801,6 +812,10 @@ int dev_ethtool(struct ifreq *ifr)
         
         if(dev->ethtool_ops->complete)
                 dev->ethtool_ops->complete(dev);
+
+        if (old_features != dev->features)
+                netdev_features_change(dev);
+
         return rc;
 
  ioctl:
@@ -817,3 +832,4 @@ EXPORT_SYMBOL(ethtool_op_get_tx_csum);
 EXPORT_SYMBOL(ethtool_op_set_sg);
 EXPORT_SYMBOL(ethtool_op_set_tso);
 EXPORT_SYMBOL(ethtool_op_set_tx_csum);
+EXPORT_SYMBOL(ethtool_op_set_tx_hw_csum);
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 060f703659e8..910eb4c05a47 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -21,6 +21,7 @@
 #define to_net_dev(class) container_of(class, struct net_device, class_dev)
 
 static const char fmt_hex[] = "%#x\n";
+static const char fmt_long_hex[] = "%#lx\n";
 static const char fmt_dec[] = "%d\n";
 static const char fmt_ulong[] = "%lu\n";
 
@@ -91,7 +92,7 @@ static CLASS_DEVICE_ATTR(field, S_IRUGO, show_##field, NULL)		\
 NETDEVICE_ATTR(addr_len, fmt_dec);
 NETDEVICE_ATTR(iflink, fmt_dec);
 NETDEVICE_ATTR(ifindex, fmt_dec);
-NETDEVICE_ATTR(features, fmt_hex);
+NETDEVICE_ATTR(features, fmt_long_hex);
 NETDEVICE_ATTR(type, fmt_dec);
 
 /* use same locking rules as GIFHWADDR ioctl's */
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 3cc96730c4ed..478a30179a52 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -233,11 +233,14 @@ int inet_addr_onlink(struct in_device *in_dev, u32 a, u32 b)
 static void inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
                          int destroy)
 {
+        struct in_ifaddr *promote = NULL;
         struct in_ifaddr *ifa1 = *ifap;
 
         ASSERT_RTNL();
 
-        /* 1. Deleting primary ifaddr forces deletion all secondaries */
+        /* 1. Deleting primary ifaddr forces deletion all secondaries 
+         * unless alias promotion is set
+         **/
 
         if (!(ifa1->ifa_flags & IFA_F_SECONDARY)) {
                 struct in_ifaddr *ifa;
@@ -251,11 +254,16 @@ static void inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
                                 continue;
                         }
 
-                        *ifap1 = ifa->ifa_next;
+                        if (!IN_DEV_PROMOTE_SECONDARIES(in_dev)) {
+                                *ifap1 = ifa->ifa_next;
 
-                        rtmsg_ifa(RTM_DELADDR, ifa);
-                        notifier_call_chain(&inetaddr_chain, NETDEV_DOWN, ifa);
-                        inet_free_ifa(ifa);
+                                rtmsg_ifa(RTM_DELADDR, ifa);
+                                notifier_call_chain(&inetaddr_chain, NETDEV_DOWN, ifa);
+                                inet_free_ifa(ifa);
+                        } else {
+                                promote = ifa;
+                                break;
+                        }
                 }
         }
 
@@ -281,6 +289,13 @@ static void inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
                 if (!in_dev->ifa_list)
                         inetdev_destroy(in_dev);
         }
+
+        if (promote && IN_DEV_PROMOTE_SECONDARIES(in_dev)) {
+                /* not sure if we should send a delete notify first? */
+                promote->ifa_flags &= ~IFA_F_SECONDARY;
+                rtmsg_ifa(RTM_NEWADDR, promote);
+                notifier_call_chain(&inetaddr_chain, NETDEV_UP, promote);
+        }
 }
 
 static int inet_insert_ifa(struct in_ifaddr *ifa)
@@ -1384,6 +1399,15 @@ static struct devinet_sysctl_table {
                         .proc_handler   = &ipv4_doint_and_flush,
                         .strategy       = &ipv4_doint_and_flush_strategy,
                 },
+                {
+                        .ctl_name       = NET_IPV4_CONF_PROMOTE_SECONDARIES,
+                        .procname       = "promote_secondaries",
+                        .data           = &ipv4_devconf.promote_secondaries,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = &ipv4_doint_and_flush,
+                        .strategy       = &ipv4_doint_and_flush_strategy,
+                },
         },
         .devinet_dev = {
                 {
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 053a883247ba..eae84cc39d3f 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -478,7 +478,7 @@ static int __init esp4_init(void)
 {
         struct xfrm_decap_state decap;
 
-        if (sizeof(struct esp_decap_data)  <
+        if (sizeof(struct esp_decap_data)  >
             sizeof(decap.decap_data)) {
                 extern void decap_data_too_small(void);
 
diff --git a/net/ipv4/ipvs/Makefile b/net/ipv4/ipvs/Makefile
index a788461a40c9..30e85de9ffff 100644
--- a/net/ipv4/ipvs/Makefile
+++ b/net/ipv4/ipvs/Makefile
@@ -11,7 +11,7 @@ ip_vs_proto-objs-$(CONFIG_IP_VS_PROTO_AH) += ip_vs_proto_ah.o
 
 ip_vs-objs :=   ip_vs_conn.o ip_vs_core.o ip_vs_ctl.o ip_vs_sched.o        \
                 ip_vs_xmit.o ip_vs_app.o ip_vs_sync.o                      \
-                ip_vs_est.o ip_vs_proto.o ip_vs_proto_icmp.o               \
+                ip_vs_est.o ip_vs_proto.o                                  \
                 $(ip_vs_proto-objs-y)
 
 
diff --git a/net/ipv4/ipvs/ip_vs_proto.c b/net/ipv4/ipvs/ip_vs_proto.c
index 253c46252bd5..867d4e9c6594 100644
--- a/net/ipv4/ipvs/ip_vs_proto.c
+++ b/net/ipv4/ipvs/ip_vs_proto.c
@@ -216,9 +216,6 @@ int ip_vs_protocol_init(void)
 #ifdef CONFIG_IP_VS_PROTO_UDP
         REGISTER_PROTOCOL(&ip_vs_protocol_udp);
 #endif
-#ifdef CONFIG_IP_VS_PROTO_ICMP
-        REGISTER_PROTOCOL(&ip_vs_protocol_icmp);
-#endif
 #ifdef CONFIG_IP_VS_PROTO_AH
         REGISTER_PROTOCOL(&ip_vs_protocol_ah);
 #endif
diff --git a/net/ipv4/ipvs/ip_vs_proto_icmp.c b/net/ipv4/ipvs/ip_vs_proto_icmp.c
deleted file mode 100644
index 191e94aa1c1f..000000000000
--- a/net/ipv4/ipvs/ip_vs_proto_icmp.c
+++ /dev/null
@@ -1,182 +0,0 @@
-/*
- * ip_vs_proto_icmp.c:  ICMP load balancing support for IP Virtual Server
- *
- * Authors:     Julian Anastasov <ja@ssi.bg>, March 2002
- *
- *              This program is free software; you can redistribute it and/or
- *              modify it under the terms of the GNU General Public License
- *              version 2 as published by the Free Software Foundation;
- *
- */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/icmp.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter_ipv4.h>
-
-#include <net/ip_vs.h>
-
-
-static int icmp_timeouts[1] =           { 1*60*HZ };
-
-static char * icmp_state_name_table[1] = { "ICMP" };
-
-static struct ip_vs_conn *
-icmp_conn_in_get(const struct sk_buff *skb,
-                 struct ip_vs_protocol *pp,
-                 const struct iphdr *iph,
-                 unsigned int proto_off,
-                 int inverse)
-{
-#if 0
-        struct ip_vs_conn *cp;
-
-        if (likely(!inverse)) {
-                cp = ip_vs_conn_in_get(iph->protocol,
-                        iph->saddr, 0,
-                        iph->daddr, 0);
-        } else {
-                cp = ip_vs_conn_in_get(iph->protocol,
-                        iph->daddr, 0,
-                        iph->saddr, 0);
-        }
-
-        return cp;
-
-#else
-        return NULL;
-#endif
-}
-
-static struct ip_vs_conn *
-icmp_conn_out_get(const struct sk_buff *skb,
-                  struct ip_vs_protocol *pp,
-                  const struct iphdr *iph,
-                  unsigned int proto_off,
-                  int inverse)
-{
-#if 0
-        struct ip_vs_conn *cp;
-
-        if (likely(!inverse)) {
-                cp = ip_vs_conn_out_get(iph->protocol,
-                        iph->saddr, 0,
-                        iph->daddr, 0);
-        } else {
-                cp = ip_vs_conn_out_get(IPPROTO_UDP,
-                        iph->daddr, 0,
-                        iph->saddr, 0);
-        }
-
-        return cp;
-#else
-        return NULL;
-#endif
-}
-
-static int
-icmp_conn_schedule(struct sk_buff *skb, struct ip_vs_protocol *pp,
-                   int *verdict, struct ip_vs_conn **cpp)
-{
-        *verdict = NF_ACCEPT;
-        return 0;
-}
-
-static int
-icmp_csum_check(struct sk_buff *skb, struct ip_vs_protocol *pp)
-{
-        if (!(skb->nh.iph->frag_off & __constant_htons(IP_OFFSET))) {
-                if (skb->ip_summed != CHECKSUM_UNNECESSARY) {
-                        if (ip_vs_checksum_complete(skb, skb->nh.iph->ihl * 4)) {
-                                IP_VS_DBG_RL_PKT(0, pp, skb, 0, "Failed checksum for");
-                                return 0;
-                        }
-                }
-        }
-        return 1;
-}
-
-static void
-icmp_debug_packet(struct ip_vs_protocol *pp,
-                  const struct sk_buff *skb,
-                  int offset,
-                  const char *msg)
-{
-        char buf[256];
-        struct iphdr _iph, *ih;
-
-        ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
-        if (ih == NULL)
-                sprintf(buf, "%s TRUNCATED", pp->name);
-        else if (ih->frag_off & __constant_htons(IP_OFFSET))
-                sprintf(buf, "%s %u.%u.%u.%u->%u.%u.%u.%u frag",
-                        pp->name, NIPQUAD(ih->saddr),
-                        NIPQUAD(ih->daddr));
-        else {
-                struct icmphdr _icmph, *ic;
-
-                ic = skb_header_pointer(skb, offset + ih->ihl*4,
-                                        sizeof(_icmph), &_icmph);
-                if (ic == NULL)
-                        sprintf(buf, "%s TRUNCATED to %u bytes\n",
-                                pp->name, skb->len - offset);
-                else
-                        sprintf(buf, "%s %u.%u.%u.%u->%u.%u.%u.%u T:%d C:%d",
-                                pp->name, NIPQUAD(ih->saddr),
-                                NIPQUAD(ih->daddr),
-                                ic->type, ic->code);
-        }
-        printk(KERN_DEBUG "IPVS: %s: %s\n", msg, buf);
-}
-
-static int
-icmp_state_transition(struct ip_vs_conn *cp, int direction,
-                      const struct sk_buff *skb,
-                      struct ip_vs_protocol *pp)
-{
-        cp->timeout = pp->timeout_table[IP_VS_ICMP_S_NORMAL];
-        return 1;
-}
-
-static int
-icmp_set_state_timeout(struct ip_vs_protocol *pp, char *sname, int to)
-{
-        int num;
-        char **names;
-
-        num = IP_VS_ICMP_S_LAST;
-        names = icmp_state_name_table;
-        return ip_vs_set_state_timeout(pp->timeout_table, num, names, sname, to);
-}
-
-
-static void icmp_init(struct ip_vs_protocol *pp)
-{
-        pp->timeout_table = icmp_timeouts;
-}
-
-static void icmp_exit(struct ip_vs_protocol *pp)
-{
-}
-
-struct ip_vs_protocol ip_vs_protocol_icmp = {
-        .name =                 "ICMP",
-        .protocol =             IPPROTO_ICMP,
-        .dont_defrag =          0,
-        .init =                 icmp_init,
-        .exit =                 icmp_exit,
-        .conn_schedule =        icmp_conn_schedule,
-        .conn_in_get =          icmp_conn_in_get,
-        .conn_out_get =         icmp_conn_out_get,
-        .snat_handler =         NULL,
-        .dnat_handler =         NULL,
-        .csum_check =           icmp_csum_check,
-        .state_transition =     icmp_state_transition,
-        .register_app =         NULL,
-        .unregister_app =       NULL,
-        .app_conn_bind =        NULL,
-        .debug_packet =         icmp_debug_packet,
-        .timeout_change =       NULL,
-        .set_state_timeout =    icmp_set_state_timeout,
-};
diff --git a/net/ipv4/multipath_drr.c b/net/ipv4/multipath_drr.c
index 9349686131fc..cf2e6bcf7973 100644
--- a/net/ipv4/multipath_drr.c
+++ b/net/ipv4/multipath_drr.c
@@ -57,7 +57,6 @@ struct multipath_device {
 
 static struct multipath_device state[MULTIPATH_MAX_DEVICECANDIDATES];
 static DEFINE_SPINLOCK(state_lock);
-static struct rtable *last_selection = NULL;
 
 static int inline __multipath_findslot(void)
 {
@@ -111,11 +110,6 @@ struct notifier_block drr_dev_notifier = {
         .notifier_call  = drr_dev_event,
 };
 
-static void drr_remove(struct rtable *rt)
-{
-        if (last_selection == rt)
-                last_selection = NULL;
-}
 
 static void drr_safe_inc(atomic_t *usecount)
 {
@@ -144,14 +138,6 @@ static void drr_select_route(const struct flowi *flp,
         int devidx = -1;
         int cur_min_devidx = -1;
 
-        /* if necessary and possible utilize the old alternative */
-        if ((flp->flags & FLOWI_FLAG_MULTIPATHOLDROUTE) != 0 &&
-            last_selection != NULL) {
-                result = last_selection;
-                *rp = result;
-                return;
-        }
-
         /* 1. make sure all alt. nexthops have the same GC related data */
         /* 2. determine the new candidate to be returned */
         result = NULL;
@@ -229,12 +215,10 @@ static void drr_select_route(const struct flowi *flp,
         }
 
         *rp = result;
-        last_selection = result;
 }
 
 static struct ip_mp_alg_ops drr_ops = {
         .mp_alg_select_route    =       drr_select_route,
-        .mp_alg_remove          =       drr_remove,
 };
 
 static int __init drr_init(void)
@@ -244,7 +228,7 @@ static int __init drr_init(void)
         if (err)
                 return err;
 
-        err = multipath_alg_register(&drr_ops, IP_MP_ALG_RR);
+        err = multipath_alg_register(&drr_ops, IP_MP_ALG_DRR);
         if (err)
                 goto fail;
 
diff --git a/net/ipv4/multipath_rr.c b/net/ipv4/multipath_rr.c
index 554a82568160..061b6b253982 100644
--- a/net/ipv4/multipath_rr.c
+++ b/net/ipv4/multipath_rr.c
@@ -47,29 +47,12 @@
 #include <net/checksum.h>
 #include <net/ip_mp_alg.h>
 
-#define MULTIPATH_MAX_CANDIDATES 40
-
-static struct rtable* last_used = NULL;
-
-static void rr_remove(struct rtable *rt)
-{
-        if (last_used == rt)
-                last_used = NULL;
-}
-
 static void rr_select_route(const struct flowi *flp,
                             struct rtable *first, struct rtable **rp)
 {
         struct rtable *nh, *result, *min_use_cand = NULL;
         int min_use = -1;
 
-        /* if necessary and possible utilize the old alternative */
-        if ((flp->flags & FLOWI_FLAG_MULTIPATHOLDROUTE) != 0 &&
-            last_used != NULL) {
-                result = last_used;
-                goto out;
-        }
-
         /* 1. make sure all alt. nexthops have the same GC related data
          * 2. determine the new candidate to be returned
          */
@@ -90,15 +73,12 @@ static void rr_select_route(const struct flowi *flp,
         if (!result)
                 result = first;
 
-out:
-        last_used = result;
         result->u.dst.__use++;
         *rp = result;
 }
 
 static struct ip_mp_alg_ops rr_ops = {
         .mp_alg_select_route    =       rr_select_route,
-        .mp_alg_remove          =       rr_remove,
 };
 
 static int __init rr_init(void)
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index e5746b674413..eda1fba431a4 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -3,6 +3,7 @@
  * communicating with userspace via netlink.
  *
  * (C) 2000-2002 James Morris <jmorris@intercode.com.au>
+ * (C) 2003-2005 Netfilter Core Team <coreteam@netfilter.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -17,6 +18,7 @@
  * 2005-01-10: Added /proc counter for dropped packets; fixed so
  *             packets aren't delivered to user space if they're going 
  *             to be dropped. 
+ * 2005-05-26: local_bh_{disable,enable} around nf_reinject (Harald Welte)
  *
  */
 #include <linux/module.h>
@@ -71,7 +73,15 @@ static DECLARE_MUTEX(ipqnl_sem);
 static void
 ipq_issue_verdict(struct ipq_queue_entry *entry, int verdict)
 {
+        /* TCP input path (and probably other bits) assume to be called
+         * from softirq context, not from syscall, like ipq_issue_verdict is
+         * called.  TCP input path deadlocks with locks taken from timer
+         * softirq, e.g.  We therefore emulate this by local_bh_disable() */
+
+        local_bh_disable();
         nf_reinject(entry->skb, entry->info, verdict);
+        local_bh_enable();
+
         kfree(entry);
 }
 
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 4a6952e3fee9..7c24e64b443f 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -738,7 +738,7 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
                         unsigned long amount;
 
                         amount = 0;
-                        spin_lock_irq(&sk->sk_receive_queue.lock);
+                        spin_lock_bh(&sk->sk_receive_queue.lock);
                         skb = skb_peek(&sk->sk_receive_queue);
                         if (skb != NULL) {
                                 /*
@@ -748,7 +748,7 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
                                  */
                                 amount = skb->len - sizeof(struct udphdr);
                         }
-                        spin_unlock_irq(&sk->sk_receive_queue.lock);
+                        spin_unlock_bh(&sk->sk_receive_queue.lock);
                         return put_user(amount, (int __user *)arg);
                 }
 
@@ -848,12 +848,12 @@ csum_copy_err:
         /* Clear queue. */
         if (flags&MSG_PEEK) {
                 int clear = 0;
-                spin_lock_irq(&sk->sk_receive_queue.lock);
+                spin_lock_bh(&sk->sk_receive_queue.lock);
                 if (skb == skb_peek(&sk->sk_receive_queue)) {
                         __skb_unlink(skb, &sk->sk_receive_queue);
                         clear = 1;
                 }
-                spin_unlock_irq(&sk->sk_receive_queue.lock);
+                spin_unlock_bh(&sk->sk_receive_queue.lock);
                 if (clear)
                         kfree_skb(skb);
         }
@@ -1334,7 +1334,7 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
                 struct sk_buff_head *rcvq = &sk->sk_receive_queue;
                 struct sk_buff *skb;
 
-                spin_lock_irq(&rcvq->lock);
+                spin_lock_bh(&rcvq->lock);
                 while ((skb = skb_peek(rcvq)) != NULL) {
                         if (udp_checksum_complete(skb)) {
                                 UDP_INC_STATS_BH(UDP_MIB_INERRORS);
@@ -1345,7 +1345,7 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
                                 break;
                         }
                 }
-                spin_unlock_irq(&rcvq->lock);
+                spin_unlock_bh(&rcvq->lock);
 
                 /* nothing to see, move along */
                 if (skb == NULL)
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index a93f6dc51979..0e5f7499debb 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -535,10 +535,12 @@ release:
                 if (err)
                         goto done;
 
-                /* Do not check for fault */
-                if (!freq.flr_label)
-                        copy_to_user(&((struct in6_flowlabel_req __user *) optval)->flr_label,
-                                     &fl->label, sizeof(fl->label));
+                if (!freq.flr_label) {
+                        if (copy_to_user(&((struct in6_flowlabel_req __user *) optval)->flr_label,
+                                         &fl->label, sizeof(fl->label))) {
+                                /* Intentionally ignore fault. */
+                        }
+                }
 
                 sfl1->fl = fl;
                 sfl1->next = np->ipv6_fl_list;
diff --git a/net/ipv6/ipv6_syms.c b/net/ipv6/ipv6_syms.c
index 2f4c91ddc9a3..5ade5a5d1990 100644
--- a/net/ipv6/ipv6_syms.c
+++ b/net/ipv6/ipv6_syms.c
@@ -37,5 +37,4 @@ EXPORT_SYMBOL(in6_dev_finish_destroy);
 EXPORT_SYMBOL(xfrm6_rcv);
 #endif
 EXPORT_SYMBOL(rt6_lookup);
-EXPORT_SYMBOL(fl6_sock_lookup);
 EXPORT_SYMBOL(ipv6_push_nfrag_opts);
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 8a3db9d95bab..d8bd2a569c7c 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -18,7 +18,7 @@
 #include <asm/byteorder.h>
 
 
-#if 1 /* control */
+#if 0 /* control */
 #define DPRINTK(format,args...) printk(KERN_DEBUG format,##args)
 #else
 #define DPRINTK(format,args...)
@@ -73,8 +73,13 @@ static int dsmark_graft(struct Qdisc *sch,unsigned long arg,
 
         DPRINTK("dsmark_graft(sch %p,[qdisc %p],new %p,old %p)\n",sch,p,new,
             old);
-        if (!new)
-                new = &noop_qdisc;
+
+        if (new == NULL) {
+                new = qdisc_create_dflt(sch->dev, &pfifo_qdisc_ops);
+                if (new == NULL)
+                        new = &noop_qdisc;
+        }
+
         sch_tree_lock(sch);
         *old = xchg(&p->q,new);
         if (*old)
@@ -163,14 +168,15 @@ static void dsmark_walk(struct Qdisc *sch,struct qdisc_walker *walker)
                 return;
         for (i = 0; i < p->indices; i++) {
                 if (p->mask[i] == 0xff && !p->value[i])
-                        continue;
+                        goto ignore;
                 if (walker->count >= walker->skip) {
                         if (walker->fn(sch, i+1, walker) < 0) {
                                 walker->stop = 1;
                                 break;
                         }
                 }
-                walker->count++;
+ignore:         
+                walker->count++;
         }
 }