60 files changed, 3751 insertions, 1795 deletions

diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 567b03b1c3..0b3d9f1d80 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -1,35 +1,8 @@
 #
 # IP configuration
 #
-choice 
-        prompt "Choose IP: FIB lookup"
-        depends on INET
-        default IP_FIB_HASH
-
-config IP_FIB_HASH
-        bool "FIB_HASH"
-        ---help---
-        Current FIB is very proven and good enough for most users.
-
-config IP_FIB_TRIE
-        bool "FIB_TRIE"
-        ---help---
-        Use new experimental LC-trie as FIB lookup algoritm. 
-        This improves lookup performance
-        
-        LC-trie is described in:
-        
-        IP-address lookup using LC-tries. Stefan Nilsson and Gunnar Karlsson
-        IEEE Journal on Selected Areas in Communications, 17(6):1083-1092, June 1999
-        An experimental study of compression methods for dynamic tries
-        Stefan Nilsson and Matti Tikkanen. Algorithmica, 33(1):19-33, 2002.
-        http://www.nada.kth.se/~snilsson/public/papers/dyntrie2/
-       
-endchoice
-
 config IP_MULTICAST
         bool "IP: multicasting"
-        depends on INET
         help
           This is code for addressing several networked computers at once,
           enlarging your kernel by about 2 KB. You need multicasting if you
@@ -43,7 +16,6 @@ config IP_MULTICAST
 
 config IP_ADVANCED_ROUTER
         bool "IP: advanced router"
-        depends on INET
         ---help---
           If you intend to run your Linux box mostly as a router, i.e. as a
           computer that forwards and redistributes network packets, say Y; you
@@ -79,6 +51,40 @@ config IP_ADVANCED_ROUTER
 
           If unsure, say N here.
 
+choice 
+        prompt "Choose IP: FIB lookup algorithm (choose FIB_HASH if unsure)"
+        depends on IP_ADVANCED_ROUTER
+        default ASK_IP_FIB_HASH
+
+config ASK_IP_FIB_HASH
+        bool "FIB_HASH"
+        ---help---
+        Current FIB is very proven and good enough for most users.
+
+config IP_FIB_TRIE
+        bool "FIB_TRIE"
+        ---help---
+        Use new experimental LC-trie as FIB lookup algoritm. 
+        This improves lookup performance if you have a large
+        number of routes.
+
+        LC-trie is a longest matching prefix lookup algorithm which
+        performs better than FIB_HASH for large routing tables.
+        But, it consumes more memory and is more complex.
+        
+        LC-trie is described in:
+        
+        IP-address lookup using LC-tries. Stefan Nilsson and Gunnar Karlsson
+        IEEE Journal on Selected Areas in Communications, 17(6):1083-1092, June 1999
+        An experimental study of compression methods for dynamic tries
+        Stefan Nilsson and Matti Tikkanen. Algorithmica, 33(1):19-33, 2002.
+        http://www.nada.kth.se/~snilsson/public/papers/dyntrie2/
+       
+endchoice
+
+config IP_FIB_HASH
+        def_bool ASK_IP_FIB_HASH || !IP_ADVANCED_ROUTER
+
 config IP_MULTIPLE_TABLES
         bool "IP: policy routing"
         depends on IP_ADVANCED_ROUTER
@@ -118,7 +124,7 @@ config IP_ROUTE_MULTIPATH
 
 config IP_ROUTE_MULTIPATH_CACHED
         bool "IP: equal cost multipath with caching support (EXPERIMENTAL)"
-        depends on: IP_ROUTE_MULTIPATH
+        depends on IP_ROUTE_MULTIPATH
         help
           Normally, equal cost multipath routing is not supported by the
           routing cache. If you say Y here, alternative routes are cached
@@ -171,7 +177,6 @@ config IP_ROUTE_VERBOSE
 
 config IP_PNP
         bool "IP: kernel level autoconfiguration"
-        depends on INET
         help
           This enables automatic configuration of IP addresses of devices and
           of the routing table during kernel boot, based on either information
@@ -230,8 +235,6 @@ config IP_PNP_RARP
 #   bool '    IP: ARP support' CONFIG_IP_PNP_ARP                
 config NET_IPIP
         tristate "IP: tunneling"
-        depends on INET
-        select INET_TUNNEL
         ---help---
           Tunneling means encapsulating data of one protocol type within
           another protocol and sending it over a channel that understands the
@@ -248,8 +251,6 @@ config NET_IPIP
 
 config NET_IPGRE
         tristate "IP: GRE tunnels over IP"
-        depends on INET
-        select XFRM
         help
           Tunneling means encapsulating data of one protocol type within
           another protocol and sending it over a channel that understands the
@@ -307,7 +308,7 @@ config IP_PIMSM_V2
 
 config ARPD
         bool "IP: ARP daemon support (EXPERIMENTAL)"
-        depends on INET && EXPERIMENTAL
+        depends on EXPERIMENTAL
         ---help---
           Normally, the kernel maintains an internal cache which maps IP
           addresses to hardware addresses on the local network, so that
@@ -332,7 +333,6 @@ config ARPD
 
 config SYN_COOKIES
         bool "IP: TCP syncookie support (disabled per default)"
-        depends on INET
         ---help---
           Normal TCP/IP networking is open to an attack known as "SYN
           flooding". This denial-of-service attack prevents legitimate remote
@@ -369,7 +369,6 @@ config SYN_COOKIES
 
 config INET_AH
         tristate "IP: AH transformation"
-        depends on INET
         select XFRM
         select CRYPTO
         select CRYPTO_HMAC
@@ -382,7 +381,6 @@ config INET_AH
 
 config INET_ESP
         tristate "IP: ESP transformation"
-        depends on INET
         select XFRM
         select CRYPTO
         select CRYPTO_HMAC
@@ -396,7 +394,6 @@ config INET_ESP
 
 config INET_IPCOMP
         tristate "IP: IPComp transformation"
-        depends on INET
         select XFRM
         select INET_TUNNEL
         select CRYPTO
@@ -409,7 +406,6 @@ config INET_IPCOMP
 
 config INET_TUNNEL
         tristate "IP: tunnel transformation"
-        depends on INET
         select XFRM
         ---help---
           Support for generic IP tunnel transformation, which is required by
@@ -419,7 +415,6 @@ config INET_TUNNEL
 
 config IP_TCPDIAG
         tristate "IP: TCP socket monitoring interface"
-        depends on INET
         default y
         ---help---
           Support for TCP socket monitoring interface used by native Linux
@@ -433,5 +428,108 @@ config IP_TCPDIAG
 config IP_TCPDIAG_IPV6
         def_bool (IP_TCPDIAG=y && IPV6=y) || (IP_TCPDIAG=m && IPV6)
 
+config TCP_CONG_ADVANCED
+        bool "TCP: advanced congestion control"
+        ---help---
+          Support for selection of various TCP congestion control
+          modules.
+
+          Nearly all users can safely say no here, and a safe default
+          selection will be made (BIC-TCP with new Reno as a fallback).
+
+          If unsure, say N.
+
+# TCP Reno is builtin (required as fallback)
+menu "TCP congestion control"
+        depends on TCP_CONG_ADVANCED
+
+config TCP_CONG_BIC
+        tristate "Binary Increase Congestion (BIC) control"
+        default y
+        ---help---
+        BIC-TCP is a sender-side only change that ensures a linear RTT
+        fairness under large windows while offering both scalability and
+        bounded TCP-friendliness. The protocol combines two schemes
+        called additive increase and binary search increase. When the
+        congestion window is large, additive increase with a large
+        increment ensures linear RTT fairness as well as good
+        scalability. Under small congestion windows, binary search
+        increase provides TCP friendliness.
+        See http://www.csc.ncsu.edu/faculty/rhee/export/bitcp/
+
+config TCP_CONG_WESTWOOD
+        tristate "TCP Westwood+"
+        default m
+        ---help---
+        TCP Westwood+ is a sender-side only modification of the TCP Reno
+        protocol stack that optimizes the performance of TCP congestion
+        control. It is based on end-to-end bandwidth estimation to set
+        congestion window and slow start threshold after a congestion
+        episode. Using this estimation, TCP Westwood+ adaptively sets a
+        slow start threshold and a congestion window which takes into
+        account the bandwidth used  at the time congestion is experienced.
+        TCP Westwood+ significantly increases fairness wrt TCP Reno in
+        wired networks and throughput over wireless links.
+
+config TCP_CONG_HTCP
+        tristate "H-TCP"
+        default m
+        ---help---
+        H-TCP is a send-side only modifications of the TCP Reno
+        protocol stack that optimizes the performance of TCP
+        congestion control for high speed network links. It uses a
+        modeswitch to change the alpha and beta parameters of TCP Reno
+        based on network conditions and in a way so as to be fair with
+        other Reno and H-TCP flows.
+
+config TCP_CONG_HSTCP
+        tristate "High Speed TCP"
+        depends on EXPERIMENTAL
+        default n
+        ---help---
+        Sally Floyd's High Speed TCP (RFC 3649) congestion control.
+        A modification to TCP's congestion control mechanism for use
+        with large congestion windows. A table indicates how much to
+        increase the congestion window by when an ACK is received.
+        For more detail see http://www.icir.org/floyd/hstcp.html
+
+config TCP_CONG_HYBLA
+        tristate "TCP-Hybla congestion control algorithm"
+        depends on EXPERIMENTAL
+        default n
+        ---help---
+        TCP-Hybla is a sender-side only change that eliminates penalization of
+        long-RTT, large-bandwidth connections, like when satellite legs are
+        involved, expecially when sharing a common bottleneck with normal
+        terrestrial connections.
+
+config TCP_CONG_VEGAS
+        tristate "TCP Vegas"
+        depends on EXPERIMENTAL
+        default n
+        ---help---
+        TCP Vegas is a sender-side only change to TCP that anticipates
+        the onset of congestion by estimating the bandwidth. TCP Vegas
+        adjusts the sending rate by modifying the congestion
+        window. TCP Vegas should provide less packet loss, but it is
+        not as aggressive as TCP Reno.
+
+config TCP_CONG_SCALABLE
+        tristate "Scalable TCP"
+        depends on EXPERIMENTAL
+        default n
+        ---help---
+        Scalable TCP is a sender-side only change to TCP which uses a
+        MIMD congestion control algorithm which has some nice scaling
+        properties, though is known to have fairness issues.
+        See http://www-lce.eng.cam.ac.uk/~ctk21/scalable/
+
+endmenu
+
+config TCP_CONG_BIC
+        tristate
+        depends on !TCP_CONG_ADVANCED
+        default y
+
 source "net/ipv4/ipvs/Kconfig"
 
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index 65d57d8e1a..55dc6cca1e 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -2,10 +2,11 @@
 # Makefile for the Linux TCP/IP (INET) layer.
 #
 
-obj-y     := utils.o route.o inetpeer.o protocol.o \
+obj-y     := route.o inetpeer.o protocol.o \
              ip_input.o ip_fragment.o ip_forward.o ip_options.o \
              ip_output.o ip_sockglue.o \
-             tcp.o tcp_input.o tcp_output.o tcp_timer.o tcp_ipv4.o tcp_minisocks.o \
+             tcp.o tcp_input.o tcp_output.o tcp_timer.o tcp_ipv4.o \
+             tcp_minisocks.o tcp_cong.o \
              datagram.o raw.o udp.o arp.o icmp.o devinet.o af_inet.o igmp.o \
              sysctl_net_ipv4.o fib_frontend.o fib_semantics.o
 
@@ -30,6 +31,13 @@ obj-$(CONFIG_NETFILTER)	+= netfilter/
 obj-$(CONFIG_IP_VS) += ipvs/
 obj-$(CONFIG_IP_TCPDIAG) += tcp_diag.o 
 obj-$(CONFIG_IP_ROUTE_MULTIPATH_CACHED) += multipath.o
+obj-$(CONFIG_TCP_CONG_BIC) += tcp_bic.o
+obj-$(CONFIG_TCP_CONG_WESTWOOD) += tcp_westwood.o
+obj-$(CONFIG_TCP_CONG_HSTCP) += tcp_highspeed.o
+obj-$(CONFIG_TCP_CONG_HYBLA) += tcp_hybla.o
+obj-$(CONFIG_TCP_CONG_HTCP) += tcp_htcp.o
+obj-$(CONFIG_TCP_CONG_VEGAS) += tcp_vegas.o
+obj-$(CONFIG_TCP_CONG_SCALABLE) += tcp_scalable.o
 
 obj-$(CONFIG_XFRM) += xfrm4_policy.o xfrm4_state.o xfrm4_input.o \
                       xfrm4_output.o
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 658e797792..163ae4068b 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1009,6 +1009,15 @@ static int __init init_ipv4_mibs(void)
 static int ipv4_proc_init(void);
 extern void ipfrag_init(void);
 
+/*
+ *      IP protocol layer initialiser
+ */
+
+static struct packet_type ip_packet_type = {
+        .type = __constant_htons(ETH_P_IP),
+        .func = ip_rcv,
+};
+
 static int __init inet_init(void)
 {
         struct sk_buff *dummy_skb;
@@ -1102,6 +1111,8 @@ static int __init inet_init(void)
 
         ipfrag_init();
 
+        dev_add_pack(&ip_packet_type);
+
         rc = 0;
 out:
         return rc;
@@ -1146,7 +1157,7 @@ static int __init ipv4_proc_init(void)
 #ifdef CONFIG_IP_FIB_TRIE
          if (fib_stat_proc_init())
                  goto out_fib_stat;
- #endif
+#endif
         if (ip_misc_proc_init())
                 goto out_misc;
 out:
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 650dcb12d9..d8a10e3dd7 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1471,7 +1471,7 @@ static void devinet_sysctl_register(struct in_device *in_dev,
          * by sysctl and we wouldn't want anyone to change it under our feet
          * (see SIOCSIFNAME).
          */     
-        dev_name = net_sysctl_strdup(dev_name);
+        dev_name = kstrdup(dev_name, GFP_KERNEL);
         if (!dev_name)
             goto free;
 
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index c886b28ba9..e278cb9d00 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -593,10 +593,13 @@ static void fib_hash_move(struct hlist_head *new_info_hash,
                           struct hlist_head *new_laddrhash,
                           unsigned int new_size)
 {
+        struct hlist_head *old_info_hash, *old_laddrhash;
         unsigned int old_size = fib_hash_size;
-        unsigned int i;
+        unsigned int i, bytes;
 
         write_lock(&fib_info_lock);
+        old_info_hash = fib_info_hash;
+        old_laddrhash = fib_info_laddrhash;
         fib_hash_size = new_size;
 
         for (i = 0; i < old_size; i++) {
@@ -636,6 +639,10 @@ static void fib_hash_move(struct hlist_head *new_info_hash,
         fib_info_laddrhash = new_laddrhash;
 
         write_unlock(&fib_info_lock);
+
+        bytes = old_size * sizeof(struct hlist_head *);
+        fib_hash_free(old_info_hash, bytes);
+        fib_hash_free(old_laddrhash, bytes);
 }
 
 struct fib_info *
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 0671569ee6..45efd5f474 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -43,7 +43,7 @@
  *              2 of the License, or (at your option) any later version.
  */
 
-#define VERSION "0.323"
+#define VERSION "0.325"
 
 #include <linux/config.h>
 #include <asm/uaccess.h>
@@ -90,14 +90,14 @@ typedef unsigned int t_key;
 #define T_LEAF  1
 #define NODE_TYPE_MASK  0x1UL
 #define NODE_PARENT(_node) \
-((struct tnode *)((_node)->_parent & ~NODE_TYPE_MASK))
+        ((struct tnode *)((_node)->_parent & ~NODE_TYPE_MASK))
 #define NODE_SET_PARENT(_node, _ptr) \
-((_node)->_parent = (((unsigned long)(_ptr)) | \
+        ((_node)->_parent = (((unsigned long)(_ptr)) | \
                      ((_node)->_parent & NODE_TYPE_MASK)))
 #define NODE_INIT_PARENT(_node, _type) \
-((_node)->_parent = (_type))
+        ((_node)->_parent = (_type))
 #define NODE_TYPE(_node) \
-((_node)->_parent & NODE_TYPE_MASK)
+        ((_node)->_parent & NODE_TYPE_MASK)
 
 #define IS_TNODE(n) (!(n->_parent & T_LEAF))
 #define IS_LEAF(n) (n->_parent & T_LEAF)
@@ -136,6 +136,7 @@ struct trie_use_stats {
         unsigned int semantic_match_passed;
         unsigned int semantic_match_miss;
         unsigned int null_node_hit;
+        unsigned int resize_node_skipped;
 };
 #endif
 
@@ -146,7 +147,7 @@ struct trie_stat {
         unsigned int leaves;
         unsigned int nullpointers;
         unsigned int nodesizes[MAX_CHILDS];
-};    
+};
 
 struct trie {
         struct node *trie;
@@ -164,8 +165,8 @@ static void put_child(struct trie *t, struct tnode *tn, int i, struct node *n);
 static void tnode_put_child_reorg(struct tnode *tn, int i, struct node *n, int wasfull);
 static int tnode_child_length(struct tnode *tn);
 static struct node *resize(struct trie *t, struct tnode *tn);
-static struct tnode *inflate(struct trie *t, struct tnode *tn);
-static struct tnode *halve(struct trie *t, struct tnode *tn);
+static struct tnode *inflate(struct trie *t, struct tnode *tn, int *err);
+static struct tnode *halve(struct trie *t, struct tnode *tn, int *err);
 static void tnode_free(struct tnode *tn);
 static void trie_dump_seq(struct seq_file *seq, struct trie *t);
 extern struct fib_alias *fib_find_alias(struct list_head *fah, u8 tos, u32 prio);
@@ -184,9 +185,9 @@ static void trie_bug(char *err)
         BUG();
 }
 
-static inline struct node *tnode_get_child(struct tnode *tn, int i) 
+static inline struct node *tnode_get_child(struct tnode *tn, int i)
 {
-        if (i >=  1<<tn->bits) 
+        if (i >= 1<<tn->bits)
                 trie_bug("tnode_get_child");
 
         return tn->child[i];
@@ -201,7 +202,7 @@ static inline int tnode_child_length(struct tnode *tn)
   _________________________________________________________________
   | i | i | i | i | i | i | i | N | N | N | S | S | S | S | S | C |
   ----------------------------------------------------------------
-    0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15 
+    0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15
 
   _________________________________________________________________
   | C | C | C | u | u | u | u | u | u | u | u | u | u | u | u | u |
@@ -225,25 +226,25 @@ static inline t_key tkey_extract_bits(t_key a, int offset, int bits)
 
 static inline int tkey_equals(t_key a, t_key b)
 {
-  return a == b;
+        return a == b;
 }
 
 static inline int tkey_sub_equals(t_key a, int offset, int bits, t_key b)
 {
-     if (bits == 0 || offset >= KEYLENGTH)
-            return 1;
+        if (bits == 0 || offset >= KEYLENGTH)
+                return 1;
         bits = bits > KEYLENGTH ? KEYLENGTH : bits;
         return ((a ^ b) << offset) >> (KEYLENGTH - bits) == 0;
-}       
+}
 
 static inline int tkey_mismatch(t_key a, int offset, t_key b)
 {
         t_key diff = a ^ b;
         int i = offset;
 
-        if(!diff) 
-          return 0;
-        while((diff << i) >> (KEYLENGTH-1) == 0)
+        if (!diff)
+                return 0;
+        while ((diff << i) >> (KEYLENGTH-1) == 0)
                 i++;
         return i;
 }
@@ -313,6 +314,7 @@ static void fn_free_alias(struct fib_alias *fa)
   The bits from (n->pos) to (n->pos + n->bits - 1) - "C" - are the index into 
   n's child array, and will of course be different for each child.
   
+
   The rest of the bits, from (n->pos + n->bits) onward, are completely unknown
   at this point.
 
@@ -320,7 +322,7 @@ static void fn_free_alias(struct fib_alias *fa)
 
 static void check_tnode(struct tnode *tn)
 {
-        if(tn && tn->pos+tn->bits > 32) {
+        if (tn && tn->pos+tn->bits > 32) {
                 printk("TNODE ERROR tn=%p, pos=%d, bits=%d\n", tn, tn->pos, tn->bits);
         }
 }
@@ -331,7 +333,7 @@ static int inflate_threshold = 50;
 static struct leaf *leaf_new(void)
 {
         struct leaf *l = kmalloc(sizeof(struct leaf),  GFP_KERNEL);
-        if(l) {
+        if (l) {
                 NODE_INIT_PARENT(l, T_LEAF);
                 INIT_HLIST_HEAD(&l->list);
         }
@@ -341,8 +343,10 @@ static struct leaf *leaf_new(void)
 static struct leaf_info *leaf_info_new(int plen)
 {
         struct leaf_info *li = kmalloc(sizeof(struct leaf_info),  GFP_KERNEL);
-        li->plen = plen;
-        INIT_LIST_HEAD(&li->falh);
+        if (li) {
+                li->plen = plen;
+                INIT_LIST_HEAD(&li->falh);
+        }
         return li;
 }
 
@@ -356,13 +360,34 @@ static inline void free_leaf_info(struct leaf_info *li)
         kfree(li);
 }
 
+static struct tnode *tnode_alloc(unsigned int size)
+{
+        if (size <= PAGE_SIZE) {
+                return kmalloc(size, GFP_KERNEL);
+        } else {
+                return (struct tnode *)
+                        __get_free_pages(GFP_KERNEL, get_order(size));
+        }
+}
+
+static void __tnode_free(struct tnode *tn)
+{
+        unsigned int size = sizeof(struct tnode) +
+                            (1<<tn->bits) * sizeof(struct node *);
+
+        if (size <= PAGE_SIZE)
+                kfree(tn);
+        else
+                free_pages((unsigned long)tn, get_order(size));
+}
+
 static struct tnode* tnode_new(t_key key, int pos, int bits)
 {
         int nchildren = 1<<bits;
         int sz = sizeof(struct tnode) + nchildren * sizeof(struct node *);
-        struct tnode *tn = kmalloc(sz,  GFP_KERNEL);
+        struct tnode *tn = tnode_alloc(sz);
 
-        if(tn)  {
+        if (tn)  {
                 memset(tn, 0, sz);
                 NODE_INIT_PARENT(tn, T_TNODE);
                 tn->pos = pos;
@@ -371,7 +396,8 @@ static struct tnode* tnode_new(t_key key, int pos, int bits)
                 tn->full_children = 0;
                 tn->empty_children = 1<<bits;
         }
-        if(trie_debug > 0) 
+
+        if (trie_debug > 0)
                 printk("AT %p s=%u %u\n", tn, (unsigned int) sizeof(struct tnode),
                        (unsigned int) (sizeof(struct node) * 1<<bits));
         return tn;
@@ -379,17 +405,17 @@ static struct tnode* tnode_new(t_key key, int pos, int bits)
 
 static void tnode_free(struct tnode *tn)
 {
-        if(!tn) {
+        if (!tn) {
                 trie_bug("tnode_free\n");
         }
-        if(IS_LEAF(tn)) {
+        if (IS_LEAF(tn)) {
                 free_leaf((struct leaf *)tn);
-                if(trie_debug > 0 ) 
+                if (trie_debug > 0 )
                         printk("FL %p \n", tn);
         }
-        else if(IS_TNODE(tn)) { 
-                kfree(tn);
-                if(trie_debug > 0 ) 
+        else if (IS_TNODE(tn)) {
+                __tnode_free(tn);
+                if (trie_debug > 0 )
                         printk("FT %p \n", tn);
         }
         else {
@@ -404,66 +430,67 @@ static void tnode_free(struct tnode *tn)
 
 static inline int tnode_full(struct tnode *tn, struct node *n)
 {
-        if(n == NULL || IS_LEAF(n))
+        if (n == NULL || IS_LEAF(n))
                 return 0;
 
         return ((struct tnode *) n)->pos == tn->pos + tn->bits;
 }
 
-static inline void put_child(struct trie *t, struct tnode *tn, int i, struct node *n) 
+static inline void put_child(struct trie *t, struct tnode *tn, int i, struct node *n)
 {
         tnode_put_child_reorg(tn, i, n, -1);
 }
 
- /* 
+ /*
   * Add a child at position i overwriting the old value.
   * Update the value of full_children and empty_children.
   */
 
-static void tnode_put_child_reorg(struct tnode *tn, int i, struct node *n, int wasfull) 
+static void tnode_put_child_reorg(struct tnode *tn, int i, struct node *n, int wasfull)
 {
         struct node *chi;
         int isfull;
 
-        if(i >=  1<<tn->bits) {
+        if (i >= 1<<tn->bits) {
                 printk("bits=%d, i=%d\n", tn->bits, i);
                 trie_bug("tnode_put_child_reorg bits");
         }
         write_lock_bh(&fib_lock);
-        chi = tn->child[i];     
+        chi = tn->child[i];
 
         /* update emptyChildren */
         if (n == NULL && chi != NULL)
                 tn->empty_children++;
         else if (n != NULL && chi == NULL)
                 tn->empty_children--;
-  
+
         /* update fullChildren */
         if (wasfull == -1)
                 wasfull = tnode_full(tn, chi);
 
         isfull = tnode_full(tn, n);
-        if (wasfull && !isfull) 
+        if (wasfull && !isfull)
                 tn->full_children--;
-        
-        else if (!wasfull && isfull) 
+
+        else if (!wasfull && isfull)
                 tn->full_children++;
-        if(n) 
-                NODE_SET_PARENT(n, tn); 
+        if (n)
+                NODE_SET_PARENT(n, tn);
 
         tn->child[i] = n;
         write_unlock_bh(&fib_lock);
 }
 
-static struct node *resize(struct trie *t, struct tnode *tn) 
+static struct node *resize(struct trie *t, struct tnode *tn)
 {
         int i;
+        int err = 0;
 
         if (!tn)
                 return NULL;
 
-        if(trie_debug) 
-                printk("In tnode_resize %p inflate_threshold=%d threshold=%d\n", 
+        if (trie_debug)
+                printk("In tnode_resize %p inflate_threshold=%d threshold=%d\n",
                       tn, inflate_threshold, halve_threshold);
 
         /* No children */
@@ -480,7 +507,7 @@ static struct node *resize(struct trie *t, struct tnode *tn)
 
                                 /* compress one level */
                                 struct node *n = tn->child[i];
-                                if(n)
+                                if (n)
                                         NODE_INIT_PARENT(n, NODE_TYPE(n));
 
                                 write_unlock_bh(&fib_lock);
@@ -489,77 +516,85 @@ static struct node *resize(struct trie *t, struct tnode *tn)
                         }
                         write_unlock_bh(&fib_lock);
                 }
-        /* 
+        /*
          * Double as long as the resulting node has a number of
          * nonempty nodes that are above the threshold.
          */
 
         /*
-         * From "Implementing a dynamic compressed trie" by Stefan Nilsson of 
-         * the Helsinki University of Technology and Matti Tikkanen of Nokia 
+         * From "Implementing a dynamic compressed trie" by Stefan Nilsson of
+         * the Helsinki University of Technology and Matti Tikkanen of Nokia
          * Telecommunications, page 6:
-         * "A node is doubled if the ratio of non-empty children to all 
+         * "A node is doubled if the ratio of non-empty children to all
          * children in the *doubled* node is at least 'high'."
          *
-         * 'high' in this instance is the variable 'inflate_threshold'. It 
-         * is expressed as a percentage, so we multiply it with 
-         * tnode_child_length() and instead of multiplying by 2 (since the 
-         * child array will be doubled by inflate()) and multiplying 
-         * the left-hand side by 100 (to handle the percentage thing) we 
+         * 'high' in this instance is the variable 'inflate_threshold'. It
+         * is expressed as a percentage, so we multiply it with
+         * tnode_child_length() and instead of multiplying by 2 (since the
+         * child array will be doubled by inflate()) and multiplying
+         * the left-hand side by 100 (to handle the percentage thing) we
          * multiply the left-hand side by 50.
-         * 
-         * The left-hand side may look a bit weird: tnode_child_length(tn) 
-         * - tn->empty_children is of course the number of non-null children 
-         * in the current node. tn->full_children is the number of "full" 
+         *
+         * The left-hand side may look a bit weird: tnode_child_length(tn)
+         * - tn->empty_children is of course the number of non-null children
+         * in the current node. tn->full_children is the number of "full"
          * children, that is non-null tnodes with a skip value of 0.
-         * All of those will be doubled in the resulting inflated tnode, so 
+         * All of those will be doubled in the resulting inflated tnode, so
          * we just count them one extra time here.
-         * 
+         *
          * A clearer way to write this would be:
-         * 
+         *
          * to_be_doubled = tn->full_children;
-         * not_to_be_doubled = tnode_child_length(tn) - tn->empty_children - 
+         * not_to_be_doubled = tnode_child_length(tn) - tn->empty_children -
          *     tn->full_children;
          *
          * new_child_length = tnode_child_length(tn) * 2;
          *
-         * new_fill_factor = 100 * (not_to_be_doubled + 2*to_be_doubled) / 
+         * new_fill_factor = 100 * (not_to_be_doubled + 2*to_be_doubled) /
          *      new_child_length;
          * if (new_fill_factor >= inflate_threshold)
-         * 
-         * ...and so on, tho it would mess up the while() loop.
-         * 
+         *
+         * ...and so on, tho it would mess up the while () loop.
+         *
          * anyway,
          * 100 * (not_to_be_doubled + 2*to_be_doubled) / new_child_length >=
          *      inflate_threshold
-         * 
+         *
          * avoid a division:
          * 100 * (not_to_be_doubled + 2*to_be_doubled) >=
          *      inflate_threshold * new_child_length
-         * 
+         *
          * expand not_to_be_doubled and to_be_doubled, and shorten:
-         * 100 * (tnode_child_length(tn) - tn->empty_children + 
+         * 100 * (tnode_child_length(tn) - tn->empty_children +
          *    tn->full_children ) >= inflate_threshold * new_child_length
-         * 
+         *
          * expand new_child_length:
-         * 100 * (tnode_child_length(tn) - tn->empty_children + 
+         * 100 * (tnode_child_length(tn) - tn->empty_children +
          *    tn->full_children ) >=
          *      inflate_threshold * tnode_child_length(tn) * 2
-         * 
+         *
          * shorten again:
-         * 50 * (tn->full_children + tnode_child_length(tn) - 
-         *    tn->empty_children ) >= inflate_threshold * 
+         * 50 * (tn->full_children + tnode_child_length(tn) -
+         *    tn->empty_children ) >= inflate_threshold *
          *    tnode_child_length(tn)
-         * 
+         *
          */
 
         check_tnode(tn);
 
+        err = 0;
         while ((tn->full_children > 0 &&
                50 * (tn->full_children + tnode_child_length(tn) - tn->empty_children) >=
                                 inflate_threshold * tnode_child_length(tn))) {
 
-                tn = inflate(t, tn);
+                tn = inflate(t, tn, &err);
+
+                if (err) {
+#ifdef CONFIG_IP_FIB_TRIE_STATS
+                        t->stats.resize_node_skipped++;
+#endif
+                        break;
+                }
         }
 
         check_tnode(tn);
@@ -568,23 +603,34 @@ static struct node *resize(struct trie *t, struct tnode *tn)
          * Halve as long as the number of empty children in this
          * node is above threshold.
          */
+
+        err = 0;
         while (tn->bits > 1 &&
                100 * (tnode_child_length(tn) - tn->empty_children) <
-               halve_threshold * tnode_child_length(tn))
+               halve_threshold * tnode_child_length(tn)) {
+
+                tn = halve(t, tn, &err);
+
+                if (err) {
+#ifdef CONFIG_IP_FIB_TRIE_STATS
+                        t->stats.resize_node_skipped++;
+#endif
+                        break;
+                }
+        }
+
 
-                tn = halve(t, tn);
-  
         /* Only one child remains */
 
         if (tn->empty_children == tnode_child_length(tn) - 1)
                 for (i = 0; i < tnode_child_length(tn); i++) {
-                        
+                
                         write_lock_bh(&fib_lock);
                         if (tn->child[i] != NULL) {
                                 /* compress one level */
                                 struct node *n = tn->child[i];
 
-                                if(n)
+                                if (n)
                                         NODE_INIT_PARENT(n, NODE_TYPE(n));
 
                                 write_unlock_bh(&fib_lock);
@@ -597,33 +643,88 @@ static struct node *resize(struct trie *t, struct tnode *tn)
         return (struct node *) tn;
 }
 
-static struct tnode *inflate(struct trie *t, struct tnode *tn)
+static struct tnode *inflate(struct trie *t, struct tnode *tn, int *err)
 {
         struct tnode *inode;
         struct tnode *oldtnode = tn;
         int olen = tnode_child_length(tn);
         int i;
 
-        if(trie_debug) 
+        if (trie_debug)
                 printk("In inflate\n");
 
         tn = tnode_new(oldtnode->key, oldtnode->pos, oldtnode->bits + 1);
 
-        if (!tn)
-                trie_bug("tnode_new failed");
+        if (!tn) {
+                *err = -ENOMEM;
+                return oldtnode;
+        }
+
+        /*
+         * Preallocate and store tnodes before the actual work so we
+         * don't get into an inconsistent state if memory allocation
+         * fails. In case of failure we return the oldnode and  inflate
+         * of tnode is ignored.
+         */
+                
+        for(i = 0; i < olen; i++) {
+                struct tnode *inode = (struct tnode *) tnode_get_child(oldtnode, i);
+
+                if (inode &&
+                    IS_TNODE(inode) &&
+                    inode->pos == oldtnode->pos + oldtnode->bits &&
+                    inode->bits > 1) {
+                        struct tnode *left, *right;
+
+                        t_key m = TKEY_GET_MASK(inode->pos, 1);
+
+                        left = tnode_new(inode->key&(~m), inode->pos + 1,
+                                         inode->bits - 1);
+
+                        if (!left) {
+                                *err = -ENOMEM;
+                                break;
+                        }
+                
+                        right = tnode_new(inode->key|m, inode->pos + 1,
+                                          inode->bits - 1);
+
+                        if (!right) {
+                                *err = -ENOMEM;
+                                break;
+                        }
+
+                        put_child(t, tn, 2*i, (struct node *) left);
+                        put_child(t, tn, 2*i+1, (struct node *) right);
+                }
+        }
+
+        if (*err) {
+                int size = tnode_child_length(tn);
+                int j;
+
+                for(j = 0; j < size; j++)
+                        if (tn->child[j])
+                                tnode_free((struct tnode *)tn->child[j]);
+
+                tnode_free(tn);
+        
+                *err = -ENOMEM;
+                return oldtnode;
+        }
 
         for(i = 0; i < olen; i++) {
                 struct node *node = tnode_get_child(oldtnode, i);
-      
+
                 /* An empty child */
                 if (node == NULL)
                         continue;
 
                 /* A leaf or an internal node with skipped bits */
 
-                if(IS_LEAF(node) || ((struct tnode *) node)->pos >
+                if (IS_LEAF(node) || ((struct tnode *) node)->pos >
                    tn->pos + tn->bits - 1) {
-                        if(tkey_extract_bits(node->key, tn->pos + tn->bits - 1,
+                        if (tkey_extract_bits(node->key, oldtnode->pos + oldtnode->bits,
                                              1) == 0)
                                 put_child(t, tn, 2*i, node);
                         else
@@ -646,44 +747,39 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn)
                         struct tnode *left, *right;
                         int size, j;
 
-                        /* We will replace this node 'inode' with two new 
-                         * ones, 'left' and 'right', each with half of the 
-                         * original children. The two new nodes will have 
-                         * a position one bit further down the key and this 
-                         * means that the "significant" part of their keys 
-                         * (see the discussion near the top of this file) 
-                         * will differ by one bit, which will be "0" in 
-                         * left's key and "1" in right's key. Since we are 
-                         * moving the key position by one step, the bit that 
-                         * we are moving away from - the bit at position 
-                         * (inode->pos) - is the one that will differ between 
+                        /* We will replace this node 'inode' with two new
+                         * ones, 'left' and 'right', each with half of the
+                         * original children. The two new nodes will have
+                         * a position one bit further down the key and this
+                         * means that the "significant" part of their keys
+                         * (see the discussion near the top of this file)
+                         * will differ by one bit, which will be "0" in
+                         * left's key and "1" in right's key. Since we are
+                         * moving the key position by one step, the bit that
+                         * we are moving away from - the bit at position
+                         * (inode->pos) - is the one that will differ between
                          * left and right. So... we synthesize that bit in the
                          * two  new keys.
-                         * The mask 'm' below will be a single "one" bit at 
+                         * The mask 'm' below will be a single "one" bit at
                          * the position (inode->pos)
                          */
 
-                        t_key m = TKEY_GET_MASK(inode->pos, 1);
- 
-                        /* Use the old key, but set the new significant 
-                         *   bit to zero. 
+                        /* Use the old key, but set the new significant
+                         *   bit to zero.
                          */
-                        left = tnode_new(inode->key&(~m), inode->pos + 1,
-                                         inode->bits - 1);
 
-                        if(!left) 
-                                trie_bug("tnode_new failed");
-                        
-                        
-                        /* Use the old key, but set the new significant 
-                         * bit to one. 
-                         */
-                        right = tnode_new(inode->key|m, inode->pos + 1,
-                                          inode->bits - 1);
+                        left = (struct tnode *) tnode_get_child(tn, 2*i);
+                        put_child(t, tn, 2*i, NULL);
+
+                        if (!left)
+                                BUG();
+
+                        right = (struct tnode *) tnode_get_child(tn, 2*i+1);
+                        put_child(t, tn, 2*i+1, NULL);
+
+                        if (!right)
+                                BUG();
 
-                        if(!right) 
-                                trie_bug("tnode_new failed");
-                        
                         size = tnode_child_length(left);
                         for(j = 0; j < size; j++) {
                                 put_child(t, left, j, inode->child[j]);
@@ -699,24 +795,64 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn)
         return tn;
 }
 
-static struct tnode *halve(struct trie *t, struct tnode *tn)
+static struct tnode *halve(struct trie *t, struct tnode *tn, int *err)
 {
         struct tnode *oldtnode = tn;
         struct node *left, *right;
         int i;
         int olen = tnode_child_length(tn);
 
-        if(trie_debug) printk("In halve\n");
-  
-        tn=tnode_new(oldtnode->key, oldtnode->pos, oldtnode->bits - 1);
+        if (trie_debug) printk("In halve\n");
+
+        tn = tnode_new(oldtnode->key, oldtnode->pos, oldtnode->bits - 1);
+
+        if (!tn) {
+                *err = -ENOMEM;
+                return oldtnode;
+        }
+
+        /*
+         * Preallocate and store tnodes before the actual work so we
+         * don't get into an inconsistent state if memory allocation
+         * fails. In case of failure we return the oldnode and halve
+         * of tnode is ignored.
+         */
+
+        for(i = 0; i < olen; i += 2) {
+                left = tnode_get_child(oldtnode, i);
+                right = tnode_get_child(oldtnode, i+1);
+
+                /* Two nonempty children */
+                if (left && right)  {
+                        struct tnode *newBinNode =
+                                tnode_new(left->key, tn->pos + tn->bits, 1);
+
+                        if (!newBinNode) {
+                                *err = -ENOMEM;
+                                break;
+                        }
+                        put_child(t, tn, i/2, (struct node *)newBinNode);
+                }
+        }
+
+        if (*err) {
+                int size = tnode_child_length(tn);
+                int j;
+
+                for(j = 0; j < size; j++)
+                        if (tn->child[j])
+                                tnode_free((struct tnode *)tn->child[j]);
 
-        if(!tn) 
-                trie_bug("tnode_new failed");
+                tnode_free(tn);
+        
+                *err = -ENOMEM;
+                return oldtnode;
+        }
 
         for(i = 0; i < olen; i += 2) {
                 left = tnode_get_child(oldtnode, i);
                 right = tnode_get_child(oldtnode, i+1);
-    
+
                 /* At least one of the children is empty */
                 if (left == NULL) {
                         if (right == NULL)    /* Both are empty */
@@ -724,14 +860,15 @@ static struct tnode *halve(struct trie *t, struct tnode *tn)
                         put_child(t, tn, i/2, right);
                 } else if (right == NULL)
                         put_child(t, tn, i/2, left);
-     
+
                 /* Two nonempty children */
                 else {
                         struct tnode *newBinNode =
-                                tnode_new(left->key, tn->pos + tn->bits, 1);
+                                (struct tnode *) tnode_get_child(tn, i/2);
+                        put_child(t, tn, i/2, NULL);
 
-                        if(!newBinNode) 
-                                trie_bug("tnode_new failed");
+                        if (!newBinNode)
+                                BUG();
 
                         put_child(t, newBinNode, 0, left);
                         put_child(t, newBinNode, 1, right);
@@ -744,7 +881,7 @@ static struct tnode *halve(struct trie *t, struct tnode *tn)
 
 static void *trie_init(struct trie *t)
 {
-        if(t) {
+        if (t) {
                 t->size = 0;
                 t->trie = NULL;
                 t->revision = 0;
@@ -761,8 +898,7 @@ static struct leaf_info *find_leaf_info(struct hlist_head *head, int plen)
         struct leaf_info *li;
 
         hlist_for_each_entry(li, node, head, hlist) {
-                  
-                if ( li->plen == plen )
+                if (li->plen == plen)
                         return li;
         }
         return NULL;
@@ -770,35 +906,35 @@ static struct leaf_info *find_leaf_info(struct hlist_head *head, int plen)
 
 static inline struct list_head * get_fa_head(struct leaf *l, int plen)
 {
-        struct list_head *fa_head=NULL;
+        struct list_head *fa_head = NULL;
         struct leaf_info *li = find_leaf_info(&l->list, plen);
-        
-        if(li) 
+
+        if (li)
                 fa_head = &li->falh;
-        
+
         return fa_head;
 }
 
 static void insert_leaf_info(struct hlist_head *head, struct leaf_info *new)
 {
-        struct leaf_info *li=NULL, *last=NULL;
+        struct leaf_info *li = NULL, *last = NULL;
         struct hlist_node *node, *tmp;
 
         write_lock_bh(&fib_lock);
-        
-        if(hlist_empty(head))
+
+        if (hlist_empty(head))
                 hlist_add_head(&new->hlist, head);
         else {
                 hlist_for_each_entry_safe(li, node, tmp, head, hlist) {
-                        
-                        if (new->plen > li->plen) 
+                
+                        if (new->plen > li->plen)
                                 break;
-                        
+                
                         last = li;
                 }
-                if(last) 
+                if (last)
                         hlist_add_after(&last->hlist, &new->hlist);
-                else 
+                else
                         hlist_add_before(&new->hlist, &li->hlist);
         }
         write_unlock_bh(&fib_lock);
@@ -812,14 +948,14 @@ fib_find_node(struct trie *t, u32 key)
         struct node *n;
 
         pos = 0;
-        n=t->trie;
+        n = t->trie;
 
         while (n != NULL &&  NODE_TYPE(n) == T_TNODE) {
                 tn = (struct tnode *) n;
-                        
+                
                 check_tnode(tn);
-                        
-                if(tkey_sub_equals(tn->key, pos, tn->pos-pos, key)) {
+                
+                if (tkey_sub_equals(tn->key, pos, tn->pos-pos, key)) {
                         pos=tn->pos + tn->bits;
                         n = tnode_get_child(tn, tkey_extract_bits(key, tn->pos, tn->bits));
                 }
@@ -842,23 +978,23 @@ static struct node *trie_rebalance(struct trie *t, struct tnode *tn)
         t_key cindex, key;
         struct tnode *tp = NULL;
 
-        if(!tn) 
+        if (!tn)
                 BUG();
-        
+
         key = tn->key;
         i = 0;
 
         while (tn != NULL && NODE_PARENT(tn) != NULL) {
 
-                if( i > 10 ) {
+                if (i > 10) {
                         printk("Rebalance tn=%p \n", tn);
-                        if(tn)          printk("tn->parent=%p \n", NODE_PARENT(tn));
-                        
+                        if (tn)                 printk("tn->parent=%p \n", NODE_PARENT(tn));
+                
                         printk("Rebalance tp=%p \n", tp);
-                        if(tp)          printk("tp->parent=%p \n", NODE_PARENT(tp));
+                        if (tp)                 printk("tp->parent=%p \n", NODE_PARENT(tp));
                 }
 
-                if( i > 12 ) BUG();
+                if (i > 12) BUG();
                 i++;
 
                 tp = NODE_PARENT(tn);
@@ -866,63 +1002,63 @@ static struct node *trie_rebalance(struct trie *t, struct tnode *tn)
                 wasfull = tnode_full(tp, tnode_get_child(tp, cindex));
                 tn = (struct tnode *) resize (t, (struct tnode *)tn);
                 tnode_put_child_reorg((struct tnode *)tp, cindex,(struct node*)tn, wasfull);
-                
-                if(!NODE_PARENT(tn))
+        
+                if (!NODE_PARENT(tn))
                         break;
 
                 tn = NODE_PARENT(tn);
         }
         /* Handle last (top) tnode */
-        if (IS_TNODE(tn)) 
+        if (IS_TNODE(tn))
                 tn = (struct tnode*) resize(t, (struct tnode *)tn);
 
         return (struct node*) tn;
 }
 
-static struct list_head *
-fib_insert_node(struct trie *t, u32 key, int plen)
+static  struct list_head *
+fib_insert_node(struct trie *t, int *err, u32 key, int plen)
 {
         int pos, newpos;
         struct tnode *tp = NULL, *tn = NULL;
         struct node *n;
         struct leaf *l;
         int missbit;
-        struct list_head *fa_head=NULL;
+        struct list_head *fa_head = NULL;
         struct leaf_info *li;
         t_key cindex;
 
         pos = 0;
-        n=t->trie;
+        n = t->trie;
 
-        /* If we point to NULL, stop. Either the tree is empty and we should 
-         * just put a new leaf in if, or we have reached an empty child slot, 
+        /* If we point to NULL, stop. Either the tree is empty and we should
+         * just put a new leaf in if, or we have reached an empty child slot,
          * and we should just put our new leaf in that.
-         * If we point to a T_TNODE, check if it matches our key. Note that 
-         * a T_TNODE might be skipping any number of bits - its 'pos' need 
+         * If we point to a T_TNODE, check if it matches our key. Note that
+         * a T_TNODE might be skipping any number of bits - its 'pos' need
          * not be the parent's 'pos'+'bits'!
          *
-         * If it does match the current key, get pos/bits from it, extract 
+         * If it does match the current key, get pos/bits from it, extract
          * the index from our key, push the T_TNODE and walk the tree.
          *
          * If it doesn't, we have to replace it with a new T_TNODE.
          *
-         * If we point to a T_LEAF, it might or might not have the same key 
-         * as we do. If it does, just change the value, update the T_LEAF's 
-         * value, and return it. 
+         * If we point to a T_LEAF, it might or might not have the same key
+         * as we do. If it does, just change the value, update the T_LEAF's
+         * value, and return it.
          * If it doesn't, we need to replace it with a T_TNODE.
          */
 
         while (n != NULL &&  NODE_TYPE(n) == T_TNODE) {
                 tn = (struct tnode *) n;
-                        
-                check_tnode(tn);
                 
-                if(tkey_sub_equals(tn->key, pos, tn->pos-pos, key)) {
+                check_tnode(tn);
+        
+                if (tkey_sub_equals(tn->key, pos, tn->pos-pos, key)) {
                         tp = tn;
                         pos=tn->pos + tn->bits;
                         n = tnode_get_child(tn, tkey_extract_bits(key, tn->pos, tn->bits));
 
-                        if(n && NODE_PARENT(n) != tn) {
+                        if (n && NODE_PARENT(n) != tn) {
                                 printk("BUG tn=%p, n->parent=%p\n", tn, NODE_PARENT(n));
                                 BUG();
                         }
@@ -934,23 +1070,24 @@ fib_insert_node(struct trie *t, u32 key, int plen)
         /*
          * n  ----> NULL, LEAF or TNODE
          *
-         * tp is n's (parent) ----> NULL or TNODE  
+         * tp is n's (parent) ----> NULL or TNODE
          */
 
-        if(tp && IS_LEAF(tp))
+        if (tp && IS_LEAF(tp))
                 BUG();
 
-        t->revision++;
 
         /* Case 1: n is a leaf. Compare prefixes */
 
-        if (n != NULL && IS_LEAF(n) && tkey_equals(key, n->key)) { 
+        if (n != NULL && IS_LEAF(n) && tkey_equals(key, n->key)) {
                 struct leaf *l = ( struct leaf *)  n;
-                
+        
                 li = leaf_info_new(plen);
-                
-                if(! li) 
-                        BUG();
+        
+                if (!li) {
+                        *err = -ENOMEM;
+                        goto err;
+                }
 
                 fa_head = &li->falh;
                 insert_leaf_info(&l->list, li);
@@ -959,14 +1096,19 @@ fib_insert_node(struct trie *t, u32 key, int plen)
         t->size++;
         l = leaf_new();
 
-        if(! l) 
-                BUG();
+        if (!l) {
+                *err = -ENOMEM;
+                goto err;
+        }
 
         l->key = key;
         li = leaf_info_new(plen);
 
-        if(! li) 
-                BUG();
+        if (!li) {
+                tnode_free((struct tnode *) l);
+                *err = -ENOMEM;
+                goto err;
+        }
 
         fa_head = &li->falh;
         insert_leaf_info(&l->list, li);
@@ -975,8 +1117,8 @@ fib_insert_node(struct trie *t, u32 key, int plen)
         if (t->trie && n == NULL) {
 
                 NODE_SET_PARENT(l, tp);
-                
-                if (!tp) 
+        
+                if (!tp)
                         BUG();
 
                 else {
@@ -986,8 +1128,8 @@ fib_insert_node(struct trie *t, u32 key, int plen)
         }
         /* Case 3: n is a LEAF or a TNODE and the key doesn't match. */
         else {
-                /* 
-                 *  Add a new tnode here 
+                /*
+                 *  Add a new tnode here
                  *  first tnode need some special handling
                  */
 
@@ -995,39 +1137,46 @@ fib_insert_node(struct trie *t, u32 key, int plen)
                         pos=tp->pos+tp->bits;
                 else
                         pos=0;
-                if(n) {
+                if (n) {
                         newpos = tkey_mismatch(key, pos, n->key);
                         tn = tnode_new(n->key, newpos, 1);
                 }
                 else {
                         newpos = 0;
-                        tn = tnode_new(key, newpos, 1); /* First tnode */ 
+                        tn = tnode_new(key, newpos, 1); /* First tnode */
                 }
-                if(!tn) 
-                        trie_bug("tnode_pfx_new failed");
 
+                if (!tn) {
+                        free_leaf_info(li);
+                        tnode_free((struct tnode *) l);
+                        *err = -ENOMEM;
+                        goto err;
+                }               
+                
                 NODE_SET_PARENT(tn, tp);
 
                 missbit=tkey_extract_bits(key, newpos, 1);
                 put_child(t, tn, missbit, (struct node *)l);
                 put_child(t, tn, 1-missbit, n);
 
-                if(tp) {
+                if (tp) {
                         cindex = tkey_extract_bits(key, tp->pos, tp->bits);
                         put_child(t, (struct tnode *)tp, cindex, (struct node *)tn);
                 }
-                else { 
+                else {
                         t->trie = (struct node*) tn; /* First tnode */
                         tp = tn;
                 }
         }
-        if(tp && tp->pos+tp->bits > 32) {
-                printk("ERROR tp=%p pos=%d, bits=%d, key=%0x plen=%d\n", 
+        if (tp && tp->pos+tp->bits > 32) {
+                printk("ERROR tp=%p pos=%d, bits=%d, key=%0x plen=%d\n",
                        tp, tp->pos, tp->bits, key, plen);
         }
         /* Rebalance the trie */
         t->trie = trie_rebalance(t, tp);
-done:;
+done:
+        t->revision++;
+err:;
         return fa_head;
 }
 
@@ -1037,7 +1186,7 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
 {
         struct trie *t = (struct trie *) tb->tb_data;
         struct fib_alias *fa, *new_fa;
-        struct list_head *fa_head=NULL;
+        struct list_head *fa_head = NULL;
         struct fib_info *fi;
         int plen = r->rtm_dst_len;
         int type = r->rtm_type;
@@ -1050,17 +1199,17 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
                 return -EINVAL;
 
         key = 0;
-        if (rta->rta_dst) 
+        if (rta->rta_dst)
                 memcpy(&key, rta->rta_dst, 4);
 
         key = ntohl(key);
 
-        if(trie_debug)
+        if (trie_debug)
                 printk("Insert table=%d %08x/%d\n", tb->tb_id, key, plen);
 
-        mask =  ntohl( inet_make_mask(plen) );
+        mask = ntohl( inet_make_mask(plen) );
 
-        if(key & ~mask)
+        if (key & ~mask)
                 return -EINVAL;
 
         key = key & mask;
@@ -1069,9 +1218,9 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
                 goto err;
 
         l = fib_find_node(t, key);
-        fa = NULL;      
+        fa = NULL;
 
-        if(l) {
+        if (l) {
                 fa_head = get_fa_head(l, plen);
                 fa = fib_find_alias(fa_head, tos, fi->fib_priority);
         }
@@ -1150,14 +1299,18 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
         new_fa->fa_scope = r->rtm_scope;
         new_fa->fa_state = 0;
 #if 0
-        new_fa->dst  = NULL;
+        new_fa->dst = NULL;
 #endif
         /*
          * Insert new entry to the list.
          */
 
-        if(!fa_head)
-                fa_head = fib_insert_node(t, key, plen);
+        if (!fa_head) {
+                fa_head = fib_insert_node(t, &err, key, plen);
+                err = 0;
+                if (err)
+                        goto out_free_new_fa;
+        }
 
         write_lock_bh(&fib_lock);
 
@@ -1170,40 +1323,43 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
         rtmsg_fib(RTM_NEWROUTE, htonl(key), new_fa, plen, tb->tb_id, nlhdr, req);
 succeeded:
         return 0;
+
+out_free_new_fa:
+        kmem_cache_free(fn_alias_kmem, new_fa);
 out:
         fib_release_info(fi);
-err:;   
+err:;
         return err;
 }
 
-static inline int check_leaf(struct trie *t, struct leaf *l,  t_key key, int *plen, const struct flowi *flp, 
-                             struct fib_result *res, int *err)
+static inline int check_leaf(struct trie *t, struct leaf *l,  t_key key, int *plen, const struct flowi *flp,
+                             struct fib_result *res)
 {
-        int i;
+        int err, i;
         t_key mask;
         struct leaf_info *li;
         struct hlist_head *hhead = &l->list;
         struct hlist_node *node;
-        
+
         hlist_for_each_entry(li, node, hhead, hlist) {
 
                 i = li->plen;
                 mask = ntohl(inet_make_mask(i));
-                if (l->key != (key & mask)) 
+                if (l->key != (key & mask))
                         continue;
 
-                if (((*err) = fib_semantic_match(&li->falh, flp, res, l->key, mask, i)) == 0) {
+                if ((err = fib_semantic_match(&li->falh, flp, res, l->key, mask, i)) <= 0) {
                         *plen = i;
 #ifdef CONFIG_IP_FIB_TRIE_STATS
                         t->stats.semantic_match_passed++;
 #endif
-                        return 1;
+                        return err;
                 }
 #ifdef CONFIG_IP_FIB_TRIE_STATS
                 t->stats.semantic_match_miss++;
 #endif
         }
-        return 0;
+        return 1;
 }
 
 static int
@@ -1221,7 +1377,7 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
         n = t->trie;
 
         read_lock(&fib_lock);
-        if(!n)
+        if (!n)
                 goto failed;
 
 #ifdef CONFIG_IP_FIB_TRIE_STATS
@@ -1230,19 +1386,19 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
 
         /* Just a leaf? */
         if (IS_LEAF(n)) {
-                if( check_leaf(t, (struct leaf *)n, key, &plen, flp, res, &ret) )
+                if ((ret = check_leaf(t, (struct leaf *)n, key, &plen, flp, res)) <= 0)
                         goto found;
                 goto failed;
         }
         pn = (struct tnode *) n;
         chopped_off = 0;
-        
+
         while (pn) {
 
                 pos = pn->pos;
                 bits = pn->bits;
 
-                if(!chopped_off) 
+                if (!chopped_off)
                         cindex = tkey_extract_bits(MASK_PFX(key, current_prefix_length), pos, bits);
 
                 n = tnode_get_child(pn, cindex);
@@ -1262,33 +1418,33 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
                         int mp;
 
                         /*
-                         * It's a tnode, and we can do some extra checks here if we 
+                         * It's a tnode, and we can do some extra checks here if we
                          * like, to avoid descending into a dead-end branch.
-                         * This tnode is in the parent's child array at index 
-                         * key[p_pos..p_pos+p_bits] but potentially with some bits 
-                         * chopped off, so in reality the index may be just a 
+                         * This tnode is in the parent's child array at index
+                         * key[p_pos..p_pos+p_bits] but potentially with some bits
+                         * chopped off, so in reality the index may be just a
                          * subprefix, padded with zero at the end.
-                         * We can also take a look at any skipped bits in this 
-                         * tnode - everything up to p_pos is supposed to be ok, 
+                         * We can also take a look at any skipped bits in this
+                         * tnode - everything up to p_pos is supposed to be ok,
                          * and the non-chopped bits of the index (se previous
-                         * paragraph) are also guaranteed ok, but the rest is 
+                         * paragraph) are also guaranteed ok, but the rest is
                          * considered unknown.
                          *
                          * The skipped bits are key[pos+bits..cn->pos].
                          */
-                        
-                        /* If current_prefix_length < pos+bits, we are already doing 
-                         * actual prefix  matching, which means everything from 
-                         * pos+(bits-chopped_off) onward must be zero along some 
-                         * branch of this subtree - otherwise there is *no* valid 
+                
+                        /* If current_prefix_length < pos+bits, we are already doing
+                         * actual prefix  matching, which means everything from
+                         * pos+(bits-chopped_off) onward must be zero along some
+                         * branch of this subtree - otherwise there is *no* valid
                          * prefix present. Here we can only check the skipped
-                         * bits. Remember, since we have already indexed into the 
-                         * parent's child array, we know that the bits we chopped of 
+                         * bits. Remember, since we have already indexed into the
+                         * parent's child array, we know that the bits we chopped of
                          * *are* zero.
                          */
 
                         /* NOTA BENE: CHECKING ONLY SKIPPED BITS FOR THE NEW NODE HERE */
-                        
+                
                         if (current_prefix_length < pos+bits) {
                                 if (tkey_extract_bits(cn->key, current_prefix_length,
                                                       cn->pos - current_prefix_length) != 0 ||
@@ -1297,13 +1453,13 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
                         }
 
                         /*
-                         * If chopped_off=0, the index is fully validated and we 
-                         * only need to look at the skipped bits for this, the new, 
+                         * If chopped_off=0, the index is fully validated and we
+                         * only need to look at the skipped bits for this, the new,
                          * tnode. What we actually want to do is to find out if
                          * these skipped bits match our key perfectly, or if we will
-                         * have to count on finding a matching prefix further down, 
-                         * because if we do, we would like to have some way of 
-                         * verifying the existence of such a prefix at this point. 
+                         * have to count on finding a matching prefix further down,
+                         * because if we do, we would like to have some way of
+                         * verifying the existence of such a prefix at this point.
                          */
 
                         /* The only thing we can do at this point is to verify that
@@ -1315,22 +1471,22 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
                          * new tnode's key.
                          */
 
-                        /* Note: We aren't very concerned about the piece of the key 
-                         * that precede pn->pos+pn->bits, since these have already been 
-                         * checked. The bits after cn->pos aren't checked since these are 
-                         * by definition "unknown" at this point. Thus, what we want to 
-                         * see is if we are about to enter the "prefix matching" state, 
-                         * and in that case verify that the skipped bits that will prevail 
-                         * throughout this subtree are zero, as they have to be if we are 
+                        /* Note: We aren't very concerned about the piece of the key
+                         * that precede pn->pos+pn->bits, since these have already been
+                         * checked. The bits after cn->pos aren't checked since these are
+                         * by definition "unknown" at this point. Thus, what we want to
+                         * see is if we are about to enter the "prefix matching" state,
+                         * and in that case verify that the skipped bits that will prevail
+                         * throughout this subtree are zero, as they have to be if we are
                          * to find a matching prefix.
                          */
 
                         node_prefix = MASK_PFX(cn->key, cn->pos);
-                        key_prefix =  MASK_PFX(key, cn->pos);
+                        key_prefix = MASK_PFX(key, cn->pos);
                         pref_mismatch = key_prefix^node_prefix;
                         mp = 0;
 
-                        /* In short: If skipped bits in this node do not match the search 
+                        /* In short: If skipped bits in this node do not match the search
                          * key, enter the "prefix matching" state.directly.
                          */
                         if (pref_mismatch) {
@@ -1339,7 +1495,7 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
                                         pref_mismatch = pref_mismatch <<1;
                                 }
                                 key_prefix = tkey_extract_bits(cn->key, mp, cn->pos-mp);
-                                
+                        
                                 if (key_prefix != 0)
                                         goto backtrace;
 
@@ -1350,9 +1506,9 @@ fn_trie_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result
                        pn = (struct tnode *)n; /* Descend */
                        chopped_off = 0;
                        continue;
-                } 
-                if (IS_LEAF(n)) {       
-                        if( check_leaf(t, (struct leaf *)n, key, &plen, flp, res, &ret))
+                }
+                if (IS_LEAF(n)) {
+                        if ((ret = check_leaf(t, (struct leaf *)n, key, &plen, flp, res)) <= 0)
                                 goto found;
                }
 backtrace:
@@ -1366,18 +1522,18 @@ backtrace:
                 /* Decrease current_... with bits chopped off */
                 if (current_prefix_length > pn->pos + pn->bits - chopped_off)
                         current_prefix_length = pn->pos + pn->bits - chopped_off;
-                
+        
                 /*
-                 * Either we do the actual chop off according or if we have 
+                 * Either we do the actual chop off according or if we have
                  * chopped off all bits in this tnode walk up to our parent.
                  */
 
-                if(chopped_off <= pn->bits)
+                if (chopped_off <= pn->bits)
                         cindex &= ~(1 << (chopped_off-1));
                 else {
-                        if( NODE_PARENT(pn) == NULL)
+                        if (NODE_PARENT(pn) == NULL)
                                 goto failed;
-                        
+                
                         /* Get Child's index */
                         cindex = tkey_extract_bits(pn->key, NODE_PARENT(pn)->pos, NODE_PARENT(pn)->bits);
                         pn = NODE_PARENT(pn);
@@ -1387,10 +1543,10 @@ backtrace:
                         t->stats.backtrack++;
 #endif
                         goto backtrace;
-                } 
+                }
         }
 failed:
-        ret =  1;
+        ret = 1;
 found:
         read_unlock(&fib_lock);
         return ret;
@@ -1403,11 +1559,11 @@ static int trie_leaf_remove(struct trie *t, t_key key)
         struct node *n = t->trie;
         struct leaf *l;
 
-        if(trie_debug) 
+        if (trie_debug)
                 printk("entering trie_leaf_remove(%p)\n", n);
 
         /* Note that in the case skipped bits, those bits are *not* checked!
-         * When we finish this, we will have NULL or a T_LEAF, and the 
+         * When we finish this, we will have NULL or a T_LEAF, and the
          * T_LEAF may or may not match our key.
          */
 
@@ -1416,19 +1572,19 @@ static int trie_leaf_remove(struct trie *t, t_key key)
                 check_tnode(tn);
                 n = tnode_get_child(tn ,tkey_extract_bits(key, tn->pos, tn->bits));
 
-                        if(n && NODE_PARENT(n) != tn) {
+                        if (n && NODE_PARENT(n) != tn) {
                                 printk("BUG tn=%p, n->parent=%p\n", tn, NODE_PARENT(n));
                                 BUG();
                         }
         }
         l = (struct leaf *) n;
 
-        if(!n || !tkey_equals(l->key, key)) 
+        if (!n || !tkey_equals(l->key, key))
                 return 0;
-    
-        /* 
-         * Key found. 
-         * Remove the leaf and rebalance the tree 
+
+        /*
+         * Key found.
+         * Remove the leaf and rebalance the tree
          */
 
         t->revision++;
@@ -1437,7 +1593,7 @@ static int trie_leaf_remove(struct trie *t, t_key key)
         tp = NODE_PARENT(n);
         tnode_free((struct tnode *) n);
 
-        if(tp) {
+        if (tp) {
                 cindex = tkey_extract_bits(key, tp->pos, tp->bits);
                 put_child(t, (struct tnode *)tp, cindex, NULL);
                 t->trie = trie_rebalance(t, tp);
@@ -1460,23 +1616,23 @@ fn_trie_delete(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
         struct list_head *fa_head;
         struct leaf *l;
 
-        if (plen > 32) 
+        if (plen > 32)
                 return -EINVAL;
 
         key = 0;
-        if (rta->rta_dst) 
+        if (rta->rta_dst)
                 memcpy(&key, rta->rta_dst, 4);
 
         key = ntohl(key);
-        mask =  ntohl( inet_make_mask(plen) );
+        mask = ntohl( inet_make_mask(plen) );
 
-        if(key & ~mask)
+        if (key & ~mask)
                 return -EINVAL;
 
         key = key & mask;
         l = fib_find_node(t, key);
 
-        if(!l)
+        if (!l)
                 return -ESRCH;
 
         fa_head = get_fa_head(l, plen);
@@ -1522,16 +1678,16 @@ fn_trie_delete(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
 
                 list_del(&fa->fa_list);
 
-                if(list_empty(fa_head)) {
+                if (list_empty(fa_head)) {
                         hlist_del(&li->hlist);
                         kill_li = 1;
                 }
                 write_unlock_bh(&fib_lock);
-                
-                if(kill_li)
+        
+                if (kill_li)
                         free_leaf_info(li);
 
-                if(hlist_empty(&l->list))
+                if (hlist_empty(&l->list))
                         trie_leaf_remove(t, key);
 
                 if (fa->fa_state & FA_S_ACCESSED)
@@ -1550,12 +1706,12 @@ static int trie_flush_list(struct trie *t, struct list_head *head)
 
         list_for_each_entry_safe(fa, fa_node, head, fa_list) {
                 struct fib_info *fi = fa->fa_info;
-                
+        
                 if (fi && (fi->fib_flags&RTNH_F_DEAD)) {
 
-                        write_lock_bh(&fib_lock);       
+                        write_lock_bh(&fib_lock);
                         list_del(&fa->fa_list);
-                        write_unlock_bh(&fib_lock); 
+                        write_unlock_bh(&fib_lock);
 
                         fn_free_alias(fa);
                         found++;
@@ -1572,14 +1728,14 @@ static int trie_flush_leaf(struct trie *t, struct leaf *l)
         struct leaf_info *li = NULL;
 
         hlist_for_each_entry_safe(li, node, tmp, lih, hlist) {
-                        
+                
                 found += trie_flush_list(t, &li->falh);
 
                 if (list_empty(&li->falh)) {
 
-                        write_lock_bh(&fib_lock); 
+                        write_lock_bh(&fib_lock);
                         hlist_del(&li->hlist);
-                        write_unlock_bh(&fib_lock); 
+                        write_unlock_bh(&fib_lock);
 
                         free_leaf_info(li);
                 }
@@ -1593,8 +1749,8 @@ static struct leaf *nextleaf(struct trie *t, struct leaf *thisleaf)
         struct tnode *p;
         int idx;
 
-        if(c == NULL) {
-                if(t->trie == NULL)
+        if (c == NULL) {
+                if (t->trie == NULL)
                         return NULL;
 
                 if (IS_LEAF(t->trie))          /* trie w. just a leaf */
@@ -1602,33 +1758,34 @@ static struct leaf *nextleaf(struct trie *t, struct leaf *thisleaf)
 
                 p = (struct tnode*) t->trie;  /* Start */
         }
-        else 
+        else
                 p = (struct tnode *) NODE_PARENT(c);
+
         while (p) {
                 int pos, last;
 
                 /*  Find the next child of the parent */
-                if(c)
-                        pos  = 1 + tkey_extract_bits(c->key, p->pos, p->bits);
-                else 
+                if (c)
+                        pos = 1 + tkey_extract_bits(c->key, p->pos, p->bits);
+                else
                         pos = 0;
 
                 last = 1 << p->bits;
                 for(idx = pos; idx < last ; idx++) {
-                        if( p->child[idx]) {
+                        if (p->child[idx]) {
 
                                 /* Decend if tnode */
 
                                 while (IS_TNODE(p->child[idx])) {
                                         p = (struct tnode*) p->child[idx];
                                         idx = 0;
-                                        
+                                
                                         /* Rightmost non-NULL branch */
-                                        if( p && IS_TNODE(p) )
-                                                while ( p->child[idx] == NULL && idx < (1 << p->bits) ) idx++;
+                                        if (p && IS_TNODE(p))
+                                                while (p->child[idx] == NULL && idx < (1 << p->bits)) idx++;
 
                                         /* Done with this tnode? */
-                                        if( idx >= (1 << p->bits) || p->child[idx] == NULL ) 
+                                        if (idx >= (1 << p->bits) || p->child[idx] == NULL )
                                                 goto up;
                                 }
                                 return (struct leaf*) p->child[idx];
@@ -1661,7 +1818,7 @@ static int fn_trie_flush(struct fib_table *tb)
         if (ll && hlist_empty(&ll->list))
                 trie_leaf_remove(t, ll->key);
 
-        if(trie_debug) 
+        if (trie_debug)
                 printk("trie_flush found=%d\n", found);
         return found;
 }
@@ -1684,32 +1841,32 @@ fn_trie_select_default(struct fib_table *tb, const struct flowi *flp, struct fib
         order = -1;
 
         read_lock(&fib_lock);
-        
+
         l = fib_find_node(t, 0);
-        if(!l) 
+        if (!l)
                 goto out;
 
         fa_head = get_fa_head(l, 0);
-        if(!fa_head)
+        if (!fa_head)
                 goto out;
 
-        if (list_empty(fa_head)) 
+        if (list_empty(fa_head))
                 goto out;
 
         list_for_each_entry(fa, fa_head, fa_list) {
                 struct fib_info *next_fi = fa->fa_info;
-                
+        
                 if (fa->fa_scope != res->scope ||
                     fa->fa_type != RTN_UNICAST)
                         continue;
-                
+        
                 if (next_fi->fib_priority > res->fi->fib_priority)
                         break;
                 if (!next_fi->fib_nh[0].nh_gw ||
                     next_fi->fib_nh[0].nh_scope != RT_SCOPE_LINK)
                         continue;
                 fa->fa_state |= FA_S_ACCESSED;
-                
+        
                 if (fi == NULL) {
                         if (next_fi != res->fi)
                                 break;
@@ -1747,10 +1904,10 @@ fn_trie_select_default(struct fib_table *tb, const struct flowi *flp, struct fib
         }
         trie_last_dflt = last_idx;
  out:;
-        read_unlock(&fib_lock); 
+        read_unlock(&fib_lock);
 }
 
-static int fn_trie_dump_fa(t_key key, int plen, struct list_head *fah, struct fib_table *tb, 
+static int fn_trie_dump_fa(t_key key, int plen, struct list_head *fah, struct fib_table *tb,
                            struct sk_buff *skb, struct netlink_callback *cb)
 {
         int i, s_i;
@@ -1796,7 +1953,7 @@ static int fn_trie_dump_fa(t_key key, int plen, struct list_head *fah, struct fi
         return skb->len;
 }
 
-static int fn_trie_dump_plen(struct trie *t, int plen, struct fib_table *tb, struct sk_buff *skb, 
+static int fn_trie_dump_plen(struct trie *t, int plen, struct fib_table *tb, struct sk_buff *skb,
                              struct netlink_callback *cb)
 {
         int h, s_h;
@@ -1813,11 +1970,11 @@ static int fn_trie_dump_plen(struct trie *t, int plen, struct fib_table *tb, str
                                sizeof(cb->args) - 3*sizeof(cb->args[0]));
 
                 fa_head = get_fa_head(l, plen);
-                
-                if(!fa_head)
+        
+                if (!fa_head)
                         continue;
 
-                if(list_empty(fa_head))
+                if (list_empty(fa_head))
                         continue;
 
                 if (fn_trie_dump_fa(l->key, plen, fa_head, tb, skb, cb)<0) {
@@ -1893,10 +2050,10 @@ struct fib_table * __init fib_hash_init(int id)
 
         trie_init(t);
 
-        if (id == RT_TABLE_LOCAL) 
-                trie_local=t;
-          else if (id == RT_TABLE_MAIN) 
-                trie_main=t;
+        if (id == RT_TABLE_LOCAL)
+                trie_local = t;
+        else if (id == RT_TABLE_MAIN)
+                trie_main = t;
 
         if (id == RT_TABLE_LOCAL)
                 printk("IPv4 FIB: Using LC-trie version %s\n", VERSION);
@@ -1917,7 +2074,7 @@ static void printbin_seq(struct seq_file *seq, unsigned int v, int bits)
                 seq_printf(seq, "%s", (v & (1<<bits))?"1":"0");
 }
 
-static void printnode_seq(struct seq_file *seq, int indent, struct node *n, 
+static void printnode_seq(struct seq_file *seq, int indent, struct node *n,
                    int pend, int cindex, int bits)
 {
         putspace_seq(seq, indent);
@@ -1935,12 +2092,12 @@ static void printnode_seq(struct seq_file *seq, int indent, struct node *n,
         seq_printf(seq, "%s:%p ", IS_LEAF(n)?"Leaf":"Internal node", n);
 
         if (IS_LEAF(n))
-                seq_printf(seq, "key=%d.%d.%d.%d\n", 
+                seq_printf(seq, "key=%d.%d.%d.%d\n",
                            n->key >> 24, (n->key >> 16) % 256, (n->key >> 8) % 256, n->key % 256);
         else {
-                int plen=((struct tnode *)n)->pos;
+                int plen = ((struct tnode *)n)->pos;
                 t_key prf=MASK_PFX(n->key, plen);
-                seq_printf(seq, "key=%d.%d.%d.%d/%d\n", 
+                seq_printf(seq, "key=%d.%d.%d.%d/%d\n",
                            prf >> 24, (prf >> 16) % 256, (prf >> 8) % 256, prf % 256, plen);
         }
         if (IS_LEAF(n)) {
@@ -1948,14 +2105,14 @@ static void printnode_seq(struct seq_file *seq, int indent, struct node *n,
                 struct fib_alias *fa;
                 int i;
                 for (i=32; i>=0; i--)
-                  if(find_leaf_info(&l->list, i)) {
-                        
+                  if (find_leaf_info(&l->list, i)) {
+                
                                 struct list_head *fa_head = get_fa_head(l, i);
-                                
-                                if(!fa_head)
+                        
+                                if (!fa_head)
                                         continue;
 
-                                if(list_empty(fa_head))
+                                if (list_empty(fa_head))
                                         continue;
 
                                 putspace_seq(seq, indent+2);
@@ -1981,7 +2138,7 @@ static void printnode_seq(struct seq_file *seq, int indent, struct node *n,
                         }
         }
         else if (IS_TNODE(n)) {
-                struct tnode *tn=(struct tnode *)n;
+                struct tnode *tn = (struct tnode *)n;
                 putspace_seq(seq, indent); seq_printf(seq, "|    ");
                 seq_printf(seq, "{key prefix=%08x/", tn->key&TKEY_GET_MASK(0, tn->pos));
                 printbin_seq(seq, tkey_extract_bits(tn->key, 0, tn->pos), tn->pos);
@@ -1997,7 +2154,7 @@ static void printnode_seq(struct seq_file *seq, int indent, struct node *n,
 
 static void trie_dump_seq(struct seq_file *seq, struct trie *t)
 {
-        struct node *n=t->trie;
+        struct node *n = t->trie;
         int cindex=0;
         int indent=1;
         int pend=0;
@@ -2009,7 +2166,7 @@ static void trie_dump_seq(struct seq_file *seq, struct trie *t)
         if (n) {
                 printnode_seq(seq, indent, n, pend, cindex, 0);
                 if (IS_TNODE(n)) {
-                        struct tnode *tn=(struct tnode *)n;
+                        struct tnode *tn = (struct tnode *)n;
                         pend = tn->pos+tn->bits;
                         putspace_seq(seq, indent); seq_printf(seq, "\\--\n");
                         indent += 3;
@@ -2017,42 +2174,42 @@ static void trie_dump_seq(struct seq_file *seq, struct trie *t)
 
                         while (tn && cindex < (1 << tn->bits)) {
                                 if (tn->child[cindex]) {
-                                        
+                                
                                         /* Got a child */
-                                        
+                                
                                         printnode_seq(seq, indent, tn->child[cindex], pend, cindex, tn->bits);
-                                        if (IS_LEAF(tn->child[cindex])) { 
+                                        if (IS_LEAF(tn->child[cindex])) {
                                                 cindex++;
-                                                
+                                        
                                         }
                                         else {
-                                                /* 
-                                                 * New tnode. Decend one level 
+                                                /*
+                                                 * New tnode. Decend one level
                                                  */
-                                                
+                                        
                                                 depth++;
-                                                n=tn->child[cindex];
-                                                tn=(struct tnode *)n;
-                                                pend=tn->pos+tn->bits;
+                                                n = tn->child[cindex];
+                                                tn = (struct tnode *)n;
+                                                pend = tn->pos+tn->bits;
                                                 putspace_seq(seq, indent); seq_printf(seq, "\\--\n");
                                                 indent+=3;
                                                 cindex=0;
                                         }
                                 }
-                                else 
+                                else
                                         cindex++;
 
                                 /*
-                                 * Test if we are done 
+                                 * Test if we are done
                                  */
-                                
+                        
                                 while (cindex >= (1 << tn->bits)) {
 
                                         /*
                                          * Move upwards and test for root
                                          * pop off all traversed  nodes
                                          */
-                                        
+                                
                                         if (NODE_PARENT(tn) == NULL) {
                                                 tn = NULL;
                                                 n = NULL;
@@ -2062,8 +2219,8 @@ static void trie_dump_seq(struct seq_file *seq, struct trie *t)
                                                 cindex = tkey_extract_bits(tn->key, NODE_PARENT(tn)->pos, NODE_PARENT(tn)->bits);
                                                 tn = NODE_PARENT(tn);
                                                 cindex++;
-                                                n=(struct node *)tn;
-                                                pend=tn->pos+tn->bits;
+                                                n = (struct node *)tn;
+                                                pend = tn->pos+tn->bits;
                                                 indent-=3;
                                                 depth--;
                                         }
@@ -2081,36 +2238,36 @@ static struct trie_stat *trie_stat_new(void)
 {
         struct trie_stat *s = kmalloc(sizeof(struct trie_stat), GFP_KERNEL);
         int i;
-        
-        if(s) {
+
+        if (s) {
                 s->totdepth = 0;
                 s->maxdepth = 0;
                 s->tnodes = 0;
                 s->leaves = 0;
                 s->nullpointers = 0;
-                
+        
                 for(i=0; i< MAX_CHILDS; i++)
                         s->nodesizes[i] = 0;
         }
         return s;
-}    
+}
 
 static struct trie_stat *trie_collect_stats(struct trie *t)
 {
-        struct node *n=t->trie;
+        struct node *n = t->trie;
         struct trie_stat *s = trie_stat_new();
         int cindex = 0;
         int indent = 1;
         int pend = 0;
         int depth = 0;
 
-        read_lock(&fib_lock);           
+        read_lock(&fib_lock);   
 
         if (s) {
                 if (n) {
                         if (IS_TNODE(n)) {
                                 struct tnode *tn = (struct tnode *)n;
-                                pend=tn->pos+tn->bits;
+                                pend = tn->pos+tn->bits;
                                 indent += 3;
                                 s->nodesizes[tn->bits]++;
                                 depth++;
@@ -2118,26 +2275,26 @@ static struct trie_stat *trie_collect_stats(struct trie *t)
                                 while (tn && cindex < (1 << tn->bits)) {
                                         if (tn->child[cindex]) {
                                                 /* Got a child */
-                                        
-                                                if (IS_LEAF(tn->child[cindex])) { 
+                                
+                                                if (IS_LEAF(tn->child[cindex])) {
                                                         cindex++;
-                                                
+                                        
                                                         /* stats */
                                                         if (depth > s->maxdepth)
                                                                 s->maxdepth = depth;
                                                         s->totdepth += depth;
                                                         s->leaves++;
                                                 }
-                                        
+                                
                                                 else {
-                                                        /* 
-                                                         * New tnode. Decend one level 
+                                                        /*
+                                                         * New tnode. Decend one level
                                                          */
-                                                
+                                        
                                                         s->tnodes++;
                                                         s->nodesizes[tn->bits]++;
                                                         depth++;
-                                                
+                                        
                                                         n = tn->child[cindex];
                                                         tn = (struct tnode *)n;
                                                         pend = tn->pos+tn->bits;
@@ -2148,13 +2305,13 @@ static struct trie_stat *trie_collect_stats(struct trie *t)
                                         }
                                         else {
                                                 cindex++;
-                                                s->nullpointers++; 
+                                                s->nullpointers++;
                                         }
 
                                         /*
-                                         * Test if we are done 
+                                         * Test if we are done
                                          */
-                                
+                        
                                         while (cindex >= (1 << tn->bits)) {
 
                                                 /*
@@ -2162,7 +2319,7 @@ static struct trie_stat *trie_collect_stats(struct trie *t)
                                                  * pop off all traversed  nodes
                                                  */
 
-                                                
+                                        
                                                 if (NODE_PARENT(tn) == NULL) {
                                                         tn = NULL;
                                                         n = NULL;
@@ -2171,9 +2328,9 @@ static struct trie_stat *trie_collect_stats(struct trie *t)
                                                 else {
                                                         cindex = tkey_extract_bits(tn->key, NODE_PARENT(tn)->pos, NODE_PARENT(tn)->bits);
                                                         tn = NODE_PARENT(tn);
-                                                        cindex++; 
+                                                        cindex++;
                                                         n = (struct node *)tn;
-                                                        pend=tn->pos+tn->bits;
+                                                        pend = tn->pos+tn->bits;
                                                         indent -= 3;
                                                         depth--;
                                                 }
@@ -2184,7 +2341,7 @@ static struct trie_stat *trie_collect_stats(struct trie *t)
                 }
         }
 
-        read_unlock(&fib_lock);         
+        read_unlock(&fib_lock); 
         return s;
 }
 
@@ -2220,7 +2377,7 @@ static void fib_triestat_seq_stop(struct seq_file *seq, void *v)
 
 }
 
-/* 
+/*
  *      This outputs /proc/net/fib_triestats
  *
  *      It always works in backward compatibility mode.
@@ -2246,7 +2403,7 @@ static void collect_and_show(struct trie *t, struct seq_file *seq)
                         avdepth=0;
                 seq_printf(seq, "Aver depth: %d.%02d\n", avdepth / 100, avdepth % 100 );
                 seq_printf(seq, "Max depth: %4d\n", stat->maxdepth);
-                                
+                        
                 seq_printf(seq, "Leaves: %d\n", stat->leaves);
                 bytes += sizeof(struct leaf) * stat->leaves;
                 seq_printf(seq, "Internal nodes: %d\n", stat->tnodes);
@@ -2258,7 +2415,7 @@ static void collect_and_show(struct trie *t, struct seq_file *seq)
                         max--;
                 pointers = 0;
 
-                for (i = 1; i <= max; i++) 
+                for (i = 1; i <= max; i++)
                         if (stat->nodesizes[i] != 0) {
                                 seq_printf(seq, "  %d: %d",  i, stat->nodesizes[i]);
                                 pointers += (1<<i) * stat->nodesizes[i];
@@ -2279,6 +2436,7 @@ static void collect_and_show(struct trie *t, struct seq_file *seq)
         seq_printf(seq,"semantic match passed = %d\n", t->stats.semantic_match_passed);
         seq_printf(seq,"semantic match miss = %d\n", t->stats.semantic_match_miss);
         seq_printf(seq,"null node hit= %d\n", t->stats.null_node_hit);
+        seq_printf(seq,"skipped node resize = %d\n", t->stats.resize_node_skipped);
 #ifdef CLEAR_STATS
         memset(&(t->stats), 0, sizeof(t->stats));
 #endif
@@ -2288,30 +2446,30 @@ static void collect_and_show(struct trie *t, struct seq_file *seq)
 static int fib_triestat_seq_show(struct seq_file *seq, void *v)
 {
         char bf[128];
-    
+
         if (v == SEQ_START_TOKEN) {
-                seq_printf(seq, "Basic info: size of leaf: %Zd bytes, size of tnode: %Zd bytes.\n", 
+                seq_printf(seq, "Basic info: size of leaf: %Zd bytes, size of tnode: %Zd bytes.\n",
                            sizeof(struct leaf), sizeof(struct tnode));
-                if (trie_local) 
+                if (trie_local)
                         collect_and_show(trie_local, seq);
 
-                if (trie_main) 
+                if (trie_main)
                         collect_and_show(trie_main, seq);
         }
         else {
                 snprintf(bf, sizeof(bf),
                          "*\t%08X\t%08X", 200, 400);
-                
+        
                 seq_printf(seq, "%-127s\n", bf);
         }
         return 0;
 }
 
 static struct seq_operations fib_triestat_seq_ops = {
-        .start  = fib_triestat_seq_start,
-        .next   = fib_triestat_seq_next,
-        .stop   = fib_triestat_seq_stop,
-        .show   = fib_triestat_seq_show,
+        .start = fib_triestat_seq_start,
+        .next  = fib_triestat_seq_next,
+        .stop  = fib_triestat_seq_stop,
+        .show  = fib_triestat_seq_show,
 };
 
 static int fib_triestat_seq_open(struct inode *inode, struct file *file)
@@ -2323,7 +2481,7 @@ static int fib_triestat_seq_open(struct inode *inode, struct file *file)
         if (rc)
                 goto out_kfree;
 
-        seq          = file->private_data;
+        seq = file->private_data;
 out:
         return rc;
 out_kfree:
@@ -2331,11 +2489,11 @@ out_kfree:
 }
 
 static struct file_operations fib_triestat_seq_fops = {
-        .owner          = THIS_MODULE,
-        .open           = fib_triestat_seq_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = seq_release_private,
+        .owner  = THIS_MODULE,
+        .open   = fib_triestat_seq_open,
+        .read   = seq_read,
+        .llseek = seq_lseek,
+        .release = seq_release_private,
 };
 
 int __init fib_stat_proc_init(void)
@@ -2380,7 +2538,7 @@ static void fib_trie_seq_stop(struct seq_file *seq, void *v)
 
 }
 
-/* 
+/*
  *      This outputs /proc/net/fib_trie.
  *
  *      It always works in backward compatibility mode.
@@ -2392,10 +2550,10 @@ static int fib_trie_seq_show(struct seq_file *seq, void *v)
         char bf[128];
 
         if (v == SEQ_START_TOKEN) {
-                if (trie_local) 
+                if (trie_local)
                         trie_dump_seq(seq, trie_local);
 
-                if (trie_main) 
+                if (trie_main)
                         trie_dump_seq(seq, trie_main);
         }
 
@@ -2409,10 +2567,10 @@ static int fib_trie_seq_show(struct seq_file *seq, void *v)
 }
 
 static struct seq_operations fib_trie_seq_ops = {
-        .start  = fib_trie_seq_start,
-        .next   = fib_trie_seq_next,
-        .stop   = fib_trie_seq_stop,
-        .show   = fib_trie_seq_show,
+        .start = fib_trie_seq_start,
+        .next  = fib_trie_seq_next,
+        .stop  = fib_trie_seq_stop,
+        .show  = fib_trie_seq_show,
 };
 
 static int fib_trie_seq_open(struct inode *inode, struct file *file)
@@ -2424,7 +2582,7 @@ static int fib_trie_seq_open(struct inode *inode, struct file *file)
         if (rc)
                 goto out_kfree;
 
-        seq          = file->private_data;
+        seq = file->private_data;
 out:
         return rc;
 out_kfree:
@@ -2432,11 +2590,11 @@ out_kfree:
 }
 
 static struct file_operations fib_trie_seq_fops = {
-        .owner          = THIS_MODULE,
-        .open           = fib_trie_seq_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = seq_release_private,
+        .owner  = THIS_MODULE,
+        .open   = fib_trie_seq_open,
+        .read   = seq_read,
+        .llseek = seq_lseek,
+        .release= seq_release_private,
 };
 
 int __init fib_proc_init(void)
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index cb75948497..badfc58499 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -349,12 +349,12 @@ static void icmp_push_reply(struct icmp_bxm *icmp_param,
 {
         struct sk_buff *skb;
 
-        ip_append_data(icmp_socket->sk, icmp_glue_bits, icmp_param,
-                       icmp_param->data_len+icmp_param->head_len,
-                       icmp_param->head_len,
-                       ipc, rt, MSG_DONTWAIT);
-
-        if ((skb = skb_peek(&icmp_socket->sk->sk_write_queue)) != NULL) {
+        if (ip_append_data(icmp_socket->sk, icmp_glue_bits, icmp_param,
+                           icmp_param->data_len+icmp_param->head_len,
+                           icmp_param->head_len,
+                           ipc, rt, MSG_DONTWAIT) < 0)
+                ip_flush_pending_frames(icmp_socket->sk);
+        else if ((skb = skb_peek(&icmp_socket->sk->sk_write_queue)) != NULL) {
                 struct icmphdr *icmph = skb->h.icmph;
                 unsigned int csum = 0;
                 struct sk_buff *skb1;
@@ -936,8 +936,7 @@ int icmp_rcv(struct sk_buff *skb)
         case CHECKSUM_HW:
                 if (!(u16)csum_fold(skb->csum))
                         break;
-                NETDEBUG(if (net_ratelimit())
-                                printk(KERN_DEBUG "icmp v4 hw csum failure\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "icmp v4 hw csum failure\n"));
         case CHECKSUM_NONE:
                 if ((u16)csum_fold(skb_checksum(skb, 0, skb->len, 0)))
                         goto error;
@@ -970,7 +969,8 @@ int icmp_rcv(struct sk_buff *skb)
                  *      RFC 1122: 3.2.2.8 An ICMP_TIMESTAMP MAY be silently
                  *        discarded if to broadcast/multicast.
                  */
-                if (icmph->type == ICMP_ECHO &&
+                if ((icmph->type == ICMP_ECHO ||
+                     icmph->type == ICMP_TIMESTAMP) &&
                     sysctl_icmp_echo_ignore_broadcasts) {
                         goto error;
                 }
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 1f3183168a..5088f90835 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1615,9 +1615,10 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
 {
         int err;
         u32 addr = imr->imr_multiaddr.s_addr;
-        struct ip_mc_socklist *iml, *i;
+        struct ip_mc_socklist *iml=NULL, *i;
         struct in_device *in_dev;
         struct inet_sock *inet = inet_sk(sk);
+        int ifindex;
         int count = 0;
 
         if (!MULTICAST(addr))
@@ -1633,37 +1634,30 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
                 goto done;
         }
 
-        iml = (struct ip_mc_socklist *)sock_kmalloc(sk, sizeof(*iml), GFP_KERNEL);
-
         err = -EADDRINUSE;
+        ifindex = imr->imr_ifindex;
         for (i = inet->mc_list; i; i = i->next) {
-                if (memcmp(&i->multi, imr, sizeof(*imr)) == 0) {
-                        /* New style additions are reference counted */
-                        if (imr->imr_address.s_addr == 0) {
-                                i->count++;
-                                err = 0;
-                        }
+                if (i->multi.imr_multiaddr.s_addr == addr &&
+                    i->multi.imr_ifindex == ifindex)
                         goto done;
-                }
                 count++;
         }
         err = -ENOBUFS;
-        if (iml == NULL || count >= sysctl_igmp_max_memberships)
+        if (count >= sysctl_igmp_max_memberships)
+                goto done;
+        iml = (struct ip_mc_socklist *)sock_kmalloc(sk,sizeof(*iml),GFP_KERNEL);
+        if (iml == NULL)
                 goto done;
+
         memcpy(&iml->multi, imr, sizeof(*imr));
         iml->next = inet->mc_list;
-        iml->count = 1;
         iml->sflist = NULL;
         iml->sfmode = MCAST_EXCLUDE;
         inet->mc_list = iml;
         ip_mc_inc_group(in_dev, addr);
-        iml = NULL;
         err = 0;
-
 done:
         rtnl_shunlock();
-        if (iml)
-                sock_kfree_s(sk, iml, sizeof(*iml));
         return err;
 }
 
@@ -1693,30 +1687,25 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct ip_mc_socklist *iml, **imlp;
+        struct in_device *in_dev;
+        u32 group = imr->imr_multiaddr.s_addr;
+        u32 ifindex;
 
         rtnl_lock();
+        in_dev = ip_mc_find_dev(imr);
+        if (!in_dev) {
+                rtnl_unlock();
+                return -ENODEV;
+        }
+        ifindex = imr->imr_ifindex;
         for (imlp = &inet->mc_list; (iml = *imlp) != NULL; imlp = &iml->next) {
-                if (iml->multi.imr_multiaddr.s_addr==imr->imr_multiaddr.s_addr &&
-                    iml->multi.imr_address.s_addr==imr->imr_address.s_addr &&
-                    (!imr->imr_ifindex || iml->multi.imr_ifindex==imr->imr_ifindex)) {
-                        struct in_device *in_dev;
-
-                        in_dev = inetdev_by_index(iml->multi.imr_ifindex);
-                        if (in_dev)
-                                (void) ip_mc_leave_src(sk, iml, in_dev);
-                        if (--iml->count) {
-                                rtnl_unlock();
-                                if (in_dev)
-                                        in_dev_put(in_dev);
-                                return 0;
-                        }
+                if (iml->multi.imr_multiaddr.s_addr == group &&
+                    iml->multi.imr_ifindex == ifindex) {
+                        (void) ip_mc_leave_src(sk, iml, in_dev);
 
                         *imlp = iml->next;
 
-                        if (in_dev) {
-                                ip_mc_dec_group(in_dev, imr->imr_multiaddr.s_addr);
-                                in_dev_put(in_dev);
-                        }
+                        ip_mc_dec_group(in_dev, group);
                         rtnl_unlock();
                         sock_kfree_s(sk, iml, sizeof(*iml));
                         return 0;
@@ -1736,6 +1725,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
         struct in_device *in_dev = NULL;
         struct inet_sock *inet = inet_sk(sk);
         struct ip_sf_socklist *psl;
+        int leavegroup = 0;
         int i, j, rv;
 
         if (!MULTICAST(addr))
@@ -1755,15 +1745,20 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
         err = -EADDRNOTAVAIL;
 
         for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
-                if (memcmp(&pmc->multi, mreqs, 2*sizeof(__u32)) == 0)
+                if (pmc->multi.imr_multiaddr.s_addr == imr.imr_multiaddr.s_addr
+                    && pmc->multi.imr_ifindex == imr.imr_ifindex)
                         break;
         }
-        if (!pmc)               /* must have a prior join */
+        if (!pmc) {             /* must have a prior join */
+                err = -EINVAL;
                 goto done;
+        }
         /* if a source filter was set, must be the same mode as before */
         if (pmc->sflist) {
-                if (pmc->sfmode != omode)
+                if (pmc->sfmode != omode) {
+                        err = -EINVAL;
                         goto done;
+                }
         } else if (pmc->sfmode != omode) {
                 /* allow mode switches for empty-set filters */
                 ip_mc_add_src(in_dev, &mreqs->imr_multiaddr, omode, 0, NULL, 0);
@@ -1775,7 +1770,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
         psl = pmc->sflist;
         if (!add) {
                 if (!psl)
-                        goto done;
+                        goto done;      /* err = -EADDRNOTAVAIL */
                 rv = !0;
                 for (i=0; i<psl->sl_count; i++) {
                         rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
@@ -1784,7 +1779,13 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                                 break;
                 }
                 if (rv)         /* source not found */
+                        goto done;      /* err = -EADDRNOTAVAIL */
+
+                /* special case - (INCLUDE, empty) == LEAVE_GROUP */
+                if (psl->sl_count == 1 && omode == MCAST_INCLUDE) {
+                        leavegroup = 1;
                         goto done;
+                }
 
                 /* update the interface filter */
                 ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, omode, 1, 
@@ -1842,18 +1843,21 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                 &mreqs->imr_sourceaddr, 1);
 done:
         rtnl_shunlock();
+        if (leavegroup)
+                return ip_mc_leave_group(sk, &imr);
         return err;
 }
 
 int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
 {
-        int err;
+        int err = 0;
         struct ip_mreqn imr;
         u32 addr = msf->imsf_multiaddr;
         struct ip_mc_socklist *pmc;
         struct in_device *in_dev;
         struct inet_sock *inet = inet_sk(sk);
         struct ip_sf_socklist *newpsl, *psl;
+        int leavegroup = 0;
 
         if (!MULTICAST(addr))
                 return -EINVAL;
@@ -1872,15 +1876,22 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
                 err = -ENODEV;
                 goto done;
         }
-        err = -EADDRNOTAVAIL;
+
+        /* special case - (INCLUDE, empty) == LEAVE_GROUP */
+        if (msf->imsf_fmode == MCAST_INCLUDE && msf->imsf_numsrc == 0) {
+                leavegroup = 1;
+                goto done;
+        }
 
         for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
                 if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
                     pmc->multi.imr_ifindex == imr.imr_ifindex)
                         break;
         }
-        if (!pmc)               /* must have a prior join */
+        if (!pmc) {             /* must have a prior join */
+                err = -EINVAL;
                 goto done;
+        }
         if (msf->imsf_numsrc) {
                 newpsl = (struct ip_sf_socklist *)sock_kmalloc(sk,
                                 IP_SFLSIZE(msf->imsf_numsrc), GFP_KERNEL);
@@ -1909,8 +1920,11 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
                         0, NULL, 0);
         pmc->sflist = newpsl;
         pmc->sfmode = msf->imsf_fmode;
+        err = 0;
 done:
         rtnl_shunlock();
+        if (leavegroup)
+                err = ip_mc_leave_group(sk, &imr);
         return err;
 }
 
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 95473953c4..ab18a853d7 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -450,10 +450,13 @@ static void peer_check_expire(unsigned long dummy)
         /* Trigger the timer after inet_peer_gc_mintime .. inet_peer_gc_maxtime
          * interval depending on the total number of entries (more entries,
          * less interval). */
-        peer_periodic_timer.expires = jiffies
-                + inet_peer_gc_maxtime
-                - (inet_peer_gc_maxtime - inet_peer_gc_mintime) / HZ *
-                        peer_total / inet_peer_threshold * HZ;
+        if (peer_total >= inet_peer_threshold)
+                peer_periodic_timer.expires = jiffies + inet_peer_gc_mintime;
+        else
+                peer_periodic_timer.expires = jiffies
+                        + inet_peer_gc_maxtime
+                        - (inet_peer_gc_maxtime - inet_peer_gc_mintime) / HZ *
+                                peer_total / inet_peer_threshold * HZ;
         add_timer(&peer_periodic_timer);
 }
 
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 7f68e27eb4..eb377ae153 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -377,7 +377,7 @@ static struct ipq *ip_frag_create(unsigned hash, struct iphdr *iph, u32 user)
         return ip_frag_intern(hash, qp);
 
 out_nomem:
-        NETDEBUG(if (net_ratelimit()) printk(KERN_ERR "ip_frag_create: no memory left !\n"));
+        LIMIT_NETDEBUG(printk(KERN_ERR "ip_frag_create: no memory left !\n"));
         return NULL;
 }
 
@@ -625,10 +625,8 @@ static struct sk_buff *ip_frag_reasm(struct ipq *qp, struct net_device *dev)
         return head;
 
 out_nomem:
-        NETDEBUG(if (net_ratelimit())
-                 printk(KERN_ERR 
-                        "IP: queue_glue: no memory for gluing queue %p\n",
-                        qp));
+        LIMIT_NETDEBUG(printk(KERN_ERR "IP: queue_glue: no memory for gluing "
+                              "queue %p\n", qp));
         goto out_fail;
 out_oversize:
         if (net_ratelimit())
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 8848355222..f0d5740d7e 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -290,7 +290,6 @@ static struct ip_tunnel * ipgre_tunnel_locate(struct ip_tunnel_parm *parms, int
 
         dev_hold(dev);
         ipgre_tunnel_link(nt);
-        /* Do not decrement MOD_USE_COUNT here. */
         return nt;
 
 failed:
@@ -1277,12 +1276,28 @@ err1:
         goto out;
 }
 
-static void ipgre_fini(void)
+static void __exit ipgre_destroy_tunnels(void)
+{
+        int prio;
+
+        for (prio = 0; prio < 4; prio++) {
+                int h;
+                for (h = 0; h < HASH_SIZE; h++) {
+                        struct ip_tunnel *t;
+                        while ((t = tunnels[prio][h]) != NULL)
+                                unregister_netdevice(t->dev);
+                }
+        }
+}
+
+static void __exit ipgre_fini(void)
 {
         if (inet_del_protocol(&ipgre_protocol, IPPROTO_GRE) < 0)
                 printk(KERN_INFO "ipgre close: can't remove protocol\n");
 
-        unregister_netdev(ipgre_fb_tunnel_dev);
+        rtnl_lock();
+        ipgre_destroy_tunnels();
+        rtnl_unlock();
 }
 
 module_init(ipgre_init);
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index af2ec88bbb..c703528e0b 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -283,14 +283,18 @@ static inline int ip_rcv_finish(struct sk_buff *skb)
 {
         struct net_device *dev = skb->dev;
         struct iphdr *iph = skb->nh.iph;
+        int err;
 
         /*
          *      Initialise the virtual path cache for the packet. It describes
          *      how the packet travels inside Linux networking.
          */ 
         if (skb->dst == NULL) {
-                if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))
+                if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
+                        if (err == -EHOSTUNREACH)
+                                IP_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
                         goto drop; 
+                }
         }
 
 #ifdef CONFIG_NET_CLS_ROUTE
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index ee07aec215..80d13103b2 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -107,7 +107,6 @@ static int ip_dev_loopback_xmit(struct sk_buff *newskb)
         newskb->pkt_type = PACKET_LOOPBACK;
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
         BUG_TRAP(newskb->dst);
-        nf_reset(newskb);
         netif_rx(newskb);
         return 0;
 }
@@ -188,8 +187,6 @@ static inline int ip_finish_output2(struct sk_buff *skb)
                 skb = skb2;
         }
 
-        nf_reset(skb);
-
         if (hh) {
                 int hh_alen;
 
@@ -383,7 +380,6 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->pkt_type = from->pkt_type;
         to->priority = from->priority;
         to->protocol = from->protocol;
-        to->security = from->security;
         dst_release(to->dst);
         to->dst = dst_clone(from->dst);
         to->dev = from->dev;
@@ -1323,23 +1319,8 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
         ip_rt_put(rt);
 }
 
-/*
- *      IP protocol layer initialiser
- */
-
-static struct packet_type ip_packet_type = {
-        .type = __constant_htons(ETH_P_IP),
-        .func = ip_rcv,
-};
-
-/*
- *      IP registers the packet type and then calls the subprotocol initialisers
- */
-
 void __init ip_init(void)
 {
-        dev_add_pack(&ip_packet_type);
-
         ip_rt_init();
         inet_initpeers();
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index f8b172f898..ff4bd067b3 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -677,11 +677,11 @@ int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
                                 mreq.imr_address.s_addr = mreqs.imr_interface;
                                 mreq.imr_ifindex = 0;
                                 err = ip_mc_join_group(sk, &mreq);
-                                if (err)
+                                if (err && err != -EADDRINUSE)
                                         break;
                                 omode = MCAST_INCLUDE;
                                 add = 1;
-                        } else /*IP_DROP_SOURCE_MEMBERSHIP */ {
+                        } else /* IP_DROP_SOURCE_MEMBERSHIP */ {
                                 omode = MCAST_INCLUDE;
                                 add = 0;
                         }
@@ -754,7 +754,7 @@ int ip_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
                                 mreq.imr_address.s_addr = 0;
                                 mreq.imr_ifindex = greqs.gsr_interface;
                                 err = ip_mc_join_group(sk, &mreq);
-                                if (err)
+                                if (err && err != -EADDRINUSE)
                                         break;
                                 greqs.gsr_interface = mreq.imr_ifindex;
                                 omode = MCAST_INCLUDE;
@@ -848,6 +848,9 @@ mc_msf_out:
  
                 case IP_IPSEC_POLICY:
                 case IP_XFRM_POLICY:
+                        err = -EPERM;
+                        if (!capable(CAP_NET_ADMIN))
+                                break;
                         err = xfrm_user_policy(sk, optname, optval, optlen);
                         break;
 
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 2065944fd9..7ded6e60f4 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -358,7 +358,7 @@ static struct crypto_tfm **ipcomp_alloc_tfms(const char *alg_name)
         int cpu;
 
         /* This can be any valid CPU ID so we don't need locking. */
-        cpu = smp_processor_id();
+        cpu = raw_smp_processor_id();
 
         list_for_each_entry(pos, &ipcomp_tfms_list, list) {
                 struct crypto_tfm *tfm;
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index f2509034ce..d2bf8e1930 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1149,8 +1149,10 @@ static int __init ic_dynamic(void)
                 ic_rarp_cleanup();
 #endif
 
-        if (!ic_got_reply)
+        if (!ic_got_reply) {
+                ic_myaddr = INADDR_NONE;
                 return -1;
+        }
 
         printk("IP-Config: Got %s answer from %u.%u.%u.%u, ",
                 ((ic_got_reply & IC_RARP) ? "RARP" 
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 68a78731f7..c05c1df0bb 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -255,7 +255,6 @@ static struct ip_tunnel * ipip_tunnel_locate(struct ip_tunnel_parm *parms, int c
 
         dev_hold(dev);
         ipip_tunnel_link(nt);
-        /* Do not decrement MOD_USE_COUNT here. */
         return nt;
 
 failed:
@@ -273,7 +272,7 @@ static void ipip_tunnel_uninit(struct net_device *dev)
         dev_put(dev);
 }
 
-static void ipip_err(struct sk_buff *skb, void *__unused)
+static void ipip_err(struct sk_buff *skb, u32 info)
 {
 #ifndef I_WISH_WORLD_WERE_PERFECT
 
@@ -852,11 +851,39 @@ static int __init ipip_fb_tunnel_init(struct net_device *dev)
         return 0;
 }
 
+#ifdef CONFIG_INET_TUNNEL
 static struct xfrm_tunnel ipip_handler = {
         .handler        =       ipip_rcv,
         .err_handler    =       ipip_err,
 };
 
+static inline int ipip_register(void)
+{
+        return xfrm4_tunnel_register(&ipip_handler);
+}
+
+static inline int ipip_unregister(void)
+{
+        return xfrm4_tunnel_deregister(&ipip_handler);
+}
+#else
+static struct net_protocol ipip_protocol = {
+        .handler        =       ipip_rcv,
+        .err_handler    =       ipip_err,
+        .no_policy      =       1,
+};
+
+static inline int ipip_register(void)
+{
+        return inet_add_protocol(&ipip_protocol, IPPROTO_IPIP);
+}
+
+static inline int ipip_unregister(void)
+{
+        return inet_del_protocol(&ipip_protocol, IPPROTO_IPIP);
+}
+#endif
+
 static char banner[] __initdata =
         KERN_INFO "IPv4 over IPv4 tunneling driver\n";
 
@@ -866,7 +893,7 @@ static int __init ipip_init(void)
 
         printk(banner);
 
-        if (xfrm4_tunnel_register(&ipip_handler) < 0) {
+        if (ipip_register() < 0) {
                 printk(KERN_INFO "ipip init: can't register tunnel\n");
                 return -EAGAIN;
         }
@@ -888,16 +915,33 @@ static int __init ipip_init(void)
  err2:
         free_netdev(ipip_fb_tunnel_dev);
  err1:
-        xfrm4_tunnel_deregister(&ipip_handler);
+        ipip_unregister();
         goto out;
 }
 
+static void __exit ipip_destroy_tunnels(void)
+{
+        int prio;
+
+        for (prio = 1; prio < 4; prio++) {
+                int h;
+                for (h = 0; h < HASH_SIZE; h++) {
+                        struct ip_tunnel *t;
+                        while ((t = tunnels[prio][h]) != NULL)
+                                unregister_netdevice(t->dev);
+                }
+        }
+}
+
 static void __exit ipip_fini(void)
 {
-        if (xfrm4_tunnel_deregister(&ipip_handler) < 0)
+        if (ipip_unregister() < 0)
                 printk(KERN_INFO "ipip close: can't deregister tunnel\n");
 
-        unregister_netdev(ipip_fb_tunnel_dev);
+        rtnl_lock();
+        ipip_destroy_tunnels();
+        unregister_netdevice(ipip_fb_tunnel_dev);
+        rtnl_unlock();
 }
 
 module_init(ipip_init);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index e4f809a93f..dc806b5784 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -297,6 +297,7 @@ static int vif_delete(int vifi)
 static void ipmr_destroy_unres(struct mfc_cache *c)
 {
         struct sk_buff *skb;
+        struct nlmsgerr *e;
 
         atomic_dec(&cache_resolve_queue_len);
 
@@ -306,7 +307,9 @@ static void ipmr_destroy_unres(struct mfc_cache *c)
                         nlh->nlmsg_type = NLMSG_ERROR;
                         nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr));
                         skb_trim(skb, nlh->nlmsg_len);
-                        ((struct nlmsgerr*)NLMSG_DATA(nlh))->error = -ETIMEDOUT;
+                        e = NLMSG_DATA(nlh);
+                        e->error = -ETIMEDOUT;
+                        memset(&e->msg, 0, sizeof(e->msg));
                         netlink_unicast(rtnl, skb, NETLINK_CB(skb).dst_pid, MSG_DONTWAIT);
                 } else
                         kfree_skb(skb);
@@ -359,7 +362,7 @@ out:
 
 /* Fill oifs list. It is called under write locked mrt_lock. */
 
-static void ipmr_update_threshoulds(struct mfc_cache *cache, unsigned char *ttls)
+static void ipmr_update_thresholds(struct mfc_cache *cache, unsigned char *ttls)
 {
         int vifi;
 
@@ -499,6 +502,7 @@ static struct mfc_cache *ipmr_cache_alloc_unres(void)
 static void ipmr_cache_resolve(struct mfc_cache *uc, struct mfc_cache *c)
 {
         struct sk_buff *skb;
+        struct nlmsgerr *e;
 
         /*
          *      Play the pending entries through our router
@@ -515,7 +519,9 @@ static void ipmr_cache_resolve(struct mfc_cache *uc, struct mfc_cache *c)
                                 nlh->nlmsg_type = NLMSG_ERROR;
                                 nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr));
                                 skb_trim(skb, nlh->nlmsg_len);
-                                ((struct nlmsgerr*)NLMSG_DATA(nlh))->error = -EMSGSIZE;
+                                e = NLMSG_DATA(nlh);
+                                e->error = -EMSGSIZE;
+                                memset(&e->msg, 0, sizeof(e->msg));
                         }
                         err = netlink_unicast(rtnl, skb, NETLINK_CB(skb).dst_pid, MSG_DONTWAIT);
                 } else
@@ -721,7 +727,7 @@ static int ipmr_mfc_add(struct mfcctl *mfc, int mrtsock)
         if (c != NULL) {
                 write_lock_bh(&mrt_lock);
                 c->mfc_parent = mfc->mfcc_parent;
-                ipmr_update_threshoulds(c, mfc->mfcc_ttls);
+                ipmr_update_thresholds(c, mfc->mfcc_ttls);
                 if (!mrtsock)
                         c->mfc_flags |= MFC_STATIC;
                 write_unlock_bh(&mrt_lock);
@@ -738,7 +744,7 @@ static int ipmr_mfc_add(struct mfcctl *mfc, int mrtsock)
         c->mfc_origin=mfc->mfcc_origin.s_addr;
         c->mfc_mcastgrp=mfc->mfcc_mcastgrp.s_addr;
         c->mfc_parent=mfc->mfcc_parent;
-        ipmr_update_threshoulds(c, mfc->mfcc_ttls);
+        ipmr_update_thresholds(c, mfc->mfcc_ttls);
         if (!mrtsock)
                 c->mfc_flags |= MFC_STATIC;
 
diff --git a/net/ipv4/ipvs/Kconfig b/net/ipv4/ipvs/Kconfig
index 63a82b4b64..c9820bfc49 100644
--- a/net/ipv4/ipvs/Kconfig
+++ b/net/ipv4/ipvs/Kconfig
@@ -2,11 +2,11 @@
 # IP Virtual Server configuration
 #
 menu    "IP: Virtual Server Configuration"
-        depends on INET && NETFILTER
+        depends on NETFILTER
 
 config  IP_VS
         tristate "IP virtual server support (EXPERIMENTAL)"
-        depends on INET && NETFILTER
+        depends on NETFILTER
         ---help---
           IP Virtual Server support will let you build a high-performance
           virtual server based on cluster of two or more real servers. This
diff --git a/net/ipv4/ipvs/ip_vs_conn.c b/net/ipv4/ipvs/ip_vs_conn.c
index fd6feb5499..d0145a8b15 100644
--- a/net/ipv4/ipvs/ip_vs_conn.c
+++ b/net/ipv4/ipvs/ip_vs_conn.c
@@ -548,7 +548,6 @@ void ip_vs_conn_expire_now(struct ip_vs_conn *cp)
 {
         if (del_timer(&cp->timer))
                 mod_timer(&cp->timer, jiffies);
-        __ip_vs_conn_put(cp);
 }
 
 
@@ -759,12 +758,11 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
         return 1;
 }
 
-
+/* Called from keventd and must protect itself from softirqs */
 void ip_vs_random_dropentry(void)
 {
         int idx;
         struct ip_vs_conn *cp;
-        struct ip_vs_conn *ct;
 
         /*
          * Randomly scan 1/32 of the whole table every second
@@ -775,7 +773,7 @@ void ip_vs_random_dropentry(void)
                 /*
                  *  Lock is actually needed in this loop.
                  */
-                ct_write_lock(hash);
+                ct_write_lock_bh(hash);
 
                 list_for_each_entry(cp, &ip_vs_conn_tab[hash], c_list) {
                         if (!cp->cport && !(cp->flags & IP_VS_CONN_F_NO_CPORT))
@@ -801,23 +799,14 @@ void ip_vs_random_dropentry(void)
                                         continue;
                         }
 
-                        /*
-                         * Drop the entry, and drop its ct if not referenced
-                         */
-                        atomic_inc(&cp->refcnt);
-                        ct_write_unlock(hash);
-
-                        if ((ct = cp->control))
-                                atomic_inc(&ct->refcnt);
                         IP_VS_DBG(4, "del connection\n");
                         ip_vs_conn_expire_now(cp);
-                        if (ct) {
+                        if (cp->control) {
                                 IP_VS_DBG(4, "del conn template\n");
-                                ip_vs_conn_expire_now(ct);
+                                ip_vs_conn_expire_now(cp->control);
                         }
-                        ct_write_lock(hash);
                 }
-                ct_write_unlock(hash);
+                ct_write_unlock_bh(hash);
         }
 }
 
@@ -829,7 +818,6 @@ static void ip_vs_conn_flush(void)
 {
         int idx;
         struct ip_vs_conn *cp;
-        struct ip_vs_conn *ct;
 
   flush_again:
         for (idx=0; idx<IP_VS_CONN_TAB_SIZE; idx++) {
@@ -839,18 +827,13 @@ static void ip_vs_conn_flush(void)
                 ct_write_lock_bh(idx);
 
                 list_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {
-                        atomic_inc(&cp->refcnt);
-                        ct_write_unlock(idx);
 
-                        if ((ct = cp->control))
-                                atomic_inc(&ct->refcnt);
                         IP_VS_DBG(4, "del connection\n");
                         ip_vs_conn_expire_now(cp);
-                        if (ct) {
+                        if (cp->control) {
                                 IP_VS_DBG(4, "del conn template\n");
-                                ip_vs_conn_expire_now(ct);
+                                ip_vs_conn_expire_now(cp->control);
                         }
-                        ct_write_lock(idx);
                 }
                 ct_write_unlock_bh(idx);
         }
diff --git a/net/ipv4/ipvs/ip_vs_ctl.c b/net/ipv4/ipvs/ip_vs_ctl.c
index 218d970103..7d99ede2ef 100644
--- a/net/ipv4/ipvs/ip_vs_ctl.c
+++ b/net/ipv4/ipvs/ip_vs_ctl.c
@@ -90,7 +90,8 @@ int ip_vs_get_debug_level(void)
 #endif
 
 /*
- *      update_defense_level is called from keventd and from sysctl.
+ *      update_defense_level is called from keventd and from sysctl,
+ *      so it needs to protect itself from softirqs
  */
 static void update_defense_level(void)
 {
@@ -110,6 +111,8 @@ static void update_defense_level(void)
 
         nomem = (availmem < sysctl_ip_vs_amemthresh);
 
+        local_bh_disable();
+
         /* drop_entry */
         spin_lock(&__ip_vs_dropentry_lock);
         switch (sysctl_ip_vs_drop_entry) {
@@ -206,6 +209,8 @@ static void update_defense_level(void)
         if (to_change >= 0)
                 ip_vs_protocol_timeout_change(sysctl_ip_vs_secure_tcp>1);
         write_unlock(&__ip_vs_securetcp_lock);
+
+        local_bh_enable();
 }
 
 
@@ -1360,9 +1365,7 @@ proc_do_defense_mode(ctl_table *table, int write, struct file * filp,
                         /* Restore the correct value */
                         *valp = val;
                 } else {
-                        local_bh_disable();
                         update_defense_level();
-                        local_bh_enable();
                 }
         }
         return rc;
@@ -2059,7 +2062,7 @@ ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
         dst->addr = src->addr;
         dst->port = src->port;
         dst->fwmark = src->fwmark;
-        strcpy(dst->sched_name, src->scheduler->name);
+        strlcpy(dst->sched_name, src->scheduler->name, sizeof(dst->sched_name));
         dst->flags = src->flags;
         dst->timeout = src->timeout / HZ;
         dst->netmask = src->netmask;
@@ -2080,6 +2083,7 @@ __ip_vs_get_service_entries(const struct ip_vs_get_services *get,
                 list_for_each_entry(svc, &ip_vs_svc_table[idx], s_list) {
                         if (count >= get->num_services)
                                 goto out;
+                        memset(&entry, 0, sizeof(entry));
                         ip_vs_copy_service(&entry, svc);
                         if (copy_to_user(&uptr->entrytable[count],
                                          &entry, sizeof(entry))) {
@@ -2094,6 +2098,7 @@ __ip_vs_get_service_entries(const struct ip_vs_get_services *get,
                 list_for_each_entry(svc, &ip_vs_svc_fwm_table[idx], f_list) {
                         if (count >= get->num_services)
                                 goto out;
+                        memset(&entry, 0, sizeof(entry));
                         ip_vs_copy_service(&entry, svc);
                         if (copy_to_user(&uptr->entrytable[count],
                                          &entry, sizeof(entry))) {
@@ -2304,12 +2309,12 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
                 memset(&d, 0, sizeof(d));
                 if (ip_vs_sync_state & IP_VS_STATE_MASTER) {
                         d[0].state = IP_VS_STATE_MASTER;
-                        strcpy(d[0].mcast_ifn, ip_vs_master_mcast_ifn);
+                        strlcpy(d[0].mcast_ifn, ip_vs_master_mcast_ifn, sizeof(d[0].mcast_ifn));
                         d[0].syncid = ip_vs_master_syncid;
                 }
                 if (ip_vs_sync_state & IP_VS_STATE_BACKUP) {
                         d[1].state = IP_VS_STATE_BACKUP;
-                        strcpy(d[1].mcast_ifn, ip_vs_backup_mcast_ifn);
+                        strlcpy(d[1].mcast_ifn, ip_vs_backup_mcast_ifn, sizeof(d[1].mcast_ifn));
                         d[1].syncid = ip_vs_backup_syncid;
                 }
                 if (copy_to_user(user, &d, sizeof(d)) != 0)
diff --git a/net/ipv4/ipvs/ip_vs_sync.c b/net/ipv4/ipvs/ip_vs_sync.c
index 25c479550a..574d1f509b 100644
--- a/net/ipv4/ipvs/ip_vs_sync.c
+++ b/net/ipv4/ipvs/ip_vs_sync.c
@@ -839,10 +839,10 @@ int start_sync_thread(int state, char *mcast_ifn, __u8 syncid)
 
         ip_vs_sync_state |= state;
         if (state == IP_VS_STATE_MASTER) {
-                strcpy(ip_vs_master_mcast_ifn, mcast_ifn);
+                strlcpy(ip_vs_master_mcast_ifn, mcast_ifn, sizeof(ip_vs_master_mcast_ifn));
                 ip_vs_master_syncid = syncid;
         } else {
-                strcpy(ip_vs_backup_mcast_ifn, mcast_ifn);
+                strlcpy(ip_vs_backup_mcast_ifn, mcast_ifn, sizeof(ip_vs_backup_mcast_ifn));
                 ip_vs_backup_syncid = syncid;
         }
 
diff --git a/net/ipv4/netfilter/ip_conntrack_amanda.c b/net/ipv4/netfilter/ip_conntrack_amanda.c
index a78a320eee..01e1b58322 100644
--- a/net/ipv4/netfilter/ip_conntrack_amanda.c
+++ b/net/ipv4/netfilter/ip_conntrack_amanda.c
@@ -101,14 +101,13 @@ static int help(struct sk_buff **pskb,
                 if (port == 0 || len > 5)
                         break;
 
-                exp = ip_conntrack_expect_alloc();
+                exp = ip_conntrack_expect_alloc(ct);
                 if (exp == NULL) {
                         ret = NF_DROP;
                         goto out;
                 }
 
                 exp->expectfn = NULL;
-                exp->master = ct;
 
                 exp->tuple.src.ip = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.ip;
                 exp->tuple.src.u.tcp.port = 0;
@@ -126,10 +125,9 @@ static int help(struct sk_buff **pskb,
                         ret = ip_nat_amanda_hook(pskb, ctinfo,
                                                  tmp - amanda_buffer,
                                                  len, exp);
-                else if (ip_conntrack_expect_related(exp) != 0) {
-                        ip_conntrack_expect_free(exp);
+                else if (ip_conntrack_expect_related(exp) != 0)
                         ret = NF_DROP;
-                }
+                ip_conntrack_expect_put(exp);
         }
 
 out:
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 4b78ebeb66..a7f0c821a9 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -137,19 +137,12 @@ ip_ct_invert_tuple(struct ip_conntrack_tuple *inverse,
 
 
 /* ip_conntrack_expect helper functions */
-static void destroy_expect(struct ip_conntrack_expect *exp)
-{
-        ip_conntrack_put(exp->master);
-        IP_NF_ASSERT(!timer_pending(&exp->timeout));
-        kmem_cache_free(ip_conntrack_expect_cachep, exp);
-        CONNTRACK_STAT_INC(expect_delete);
-}
-
 static void unlink_expect(struct ip_conntrack_expect *exp)
 {
         ASSERT_WRITE_LOCK(&ip_conntrack_lock);
+        IP_NF_ASSERT(!timer_pending(&exp->timeout));
         list_del(&exp->list);
-        /* Logically in destroy_expect, but we hold the lock here. */
+        CONNTRACK_STAT_INC(expect_delete);
         exp->master->expecting--;
 }
 
@@ -160,7 +153,7 @@ static void expectation_timed_out(unsigned long ul_expect)
         write_lock_bh(&ip_conntrack_lock);
         unlink_expect(exp);
         write_unlock_bh(&ip_conntrack_lock);
-        destroy_expect(exp);
+        ip_conntrack_expect_put(exp);
 }
 
 /* If an expectation for this connection is found, it gets delete from
@@ -198,7 +191,7 @@ static void remove_expectations(struct ip_conntrack *ct)
         list_for_each_entry_safe(i, tmp, &ip_conntrack_expect_list, list) {
                 if (i->master == ct && del_timer(&i->timeout)) {
                         unlink_expect(i);
-                        destroy_expect(i);
+                        ip_conntrack_expect_put(i);
                 }
         }
 }
@@ -517,9 +510,14 @@ init_conntrack(const struct ip_conntrack_tuple *tuple,
                 /* Welcome, Mr. Bond.  We've been expecting you... */
                 __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
                 conntrack->master = exp->master;
-#if CONFIG_IP_NF_CONNTRACK_MARK
+#ifdef CONFIG_IP_NF_CONNTRACK_MARK
                 conntrack->mark = exp->master->mark;
 #endif
+#if defined(CONFIG_IP_NF_TARGET_MASQUERADE) || \
+    defined(CONFIG_IP_NF_TARGET_MASQUERADE_MODULE)
+                /* this is ugly, but there is no other place where to put it */
+                conntrack->nat.masq_index = exp->master->nat.masq_index;
+#endif
                 nf_conntrack_get(&conntrack->master->ct_general);
                 CONNTRACK_STAT_INC(expect_new);
         } else {
@@ -537,7 +535,7 @@ init_conntrack(const struct ip_conntrack_tuple *tuple,
         if (exp) {
                 if (exp->expectfn)
                         exp->expectfn(conntrack, exp);
-                destroy_expect(exp);
+                ip_conntrack_expect_put(exp);
         }
 
         return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
@@ -729,14 +727,14 @@ void ip_conntrack_unexpect_related(struct ip_conntrack_expect *exp)
                 if (expect_matches(i, exp) && del_timer(&i->timeout)) {
                         unlink_expect(i);
                         write_unlock_bh(&ip_conntrack_lock);
-                        destroy_expect(i);
+                        ip_conntrack_expect_put(i);
                         return;
                 }
         }
         write_unlock_bh(&ip_conntrack_lock);
 }
 
-struct ip_conntrack_expect *ip_conntrack_expect_alloc(void)
+struct ip_conntrack_expect *ip_conntrack_expect_alloc(struct ip_conntrack *me)
 {
         struct ip_conntrack_expect *new;
 
@@ -745,18 +743,23 @@ struct ip_conntrack_expect *ip_conntrack_expect_alloc(void)
                 DEBUGP("expect_related: OOM allocating expect\n");
                 return NULL;
         }
-        new->master = NULL;
+        new->master = me;
+        atomic_inc(&new->master->ct_general.use);
+        atomic_set(&new->use, 1);
         return new;
 }
 
-void ip_conntrack_expect_free(struct ip_conntrack_expect *expect)
+void ip_conntrack_expect_put(struct ip_conntrack_expect *exp)
 {
-        kmem_cache_free(ip_conntrack_expect_cachep, expect);
+        if (atomic_dec_and_test(&exp->use)) {
+                ip_conntrack_put(exp->master);
+                kmem_cache_free(ip_conntrack_expect_cachep, exp);
+        }
 }
 
 static void ip_conntrack_expect_insert(struct ip_conntrack_expect *exp)
 {
-        atomic_inc(&exp->master->ct_general.use);
+        atomic_inc(&exp->use);
         exp->master->expecting++;
         list_add(&exp->list, &ip_conntrack_expect_list);
 
@@ -778,7 +781,7 @@ static void evict_oldest_expect(struct ip_conntrack *master)
                 if (i->master == master) {
                         if (del_timer(&i->timeout)) {
                                 unlink_expect(i);
-                                destroy_expect(i);
+                                ip_conntrack_expect_put(i);
                         }
                         break;
                 }
@@ -810,8 +813,6 @@ int ip_conntrack_expect_related(struct ip_conntrack_expect *expect)
                         /* Refresh timer: if it's dying, ignore.. */
                         if (refresh_timer(i)) {
                                 ret = 0;
-                                /* We don't need the one they've given us. */
-                                ip_conntrack_expect_free(expect);
                                 goto out;
                         }
                 } else if (expect_clash(i, expect)) {
@@ -881,7 +882,7 @@ void ip_conntrack_helper_unregister(struct ip_conntrack_helper *me)
         list_for_each_entry_safe(exp, tmp, &ip_conntrack_expect_list, list) {
                 if (exp->master->helper == me && del_timer(&exp->timeout)) {
                         unlink_expect(exp);
-                        destroy_expect(exp);
+                        ip_conntrack_expect_put(exp);
                 }
         }
         /* Get rid of expecteds, set helpers to NULL. */
@@ -1111,6 +1112,9 @@ void ip_conntrack_cleanup(void)
                 schedule();
                 goto i_see_dead_people;
         }
+        /* wait until all references to ip_conntrack_untracked are dropped */
+        while (atomic_read(&ip_conntrack_untracked.ct_general.use) > 1)
+                schedule();
 
         kmem_cache_destroy(ip_conntrack_cachep);
         kmem_cache_destroy(ip_conntrack_expect_cachep);
diff --git a/net/ipv4/netfilter/ip_conntrack_ftp.c b/net/ipv4/netfilter/ip_conntrack_ftp.c
index fea6dd2a00..7a3b773be3 100644
--- a/net/ipv4/netfilter/ip_conntrack_ftp.c
+++ b/net/ipv4/netfilter/ip_conntrack_ftp.c
@@ -376,7 +376,7 @@ static int help(struct sk_buff **pskb,
                fb_ptr + matchoff, matchlen, ntohl(th->seq) + matchoff);
                          
         /* Allocate expectation which will be inserted */
-        exp = ip_conntrack_expect_alloc();
+        exp = ip_conntrack_expect_alloc(ct);
         if (exp == NULL) {
                 ret = NF_DROP;
                 goto out;
@@ -403,8 +403,7 @@ static int help(struct sk_buff **pskb,
                    networks, or the packet filter itself). */
                 if (!loose) {
                         ret = NF_ACCEPT;
-                        ip_conntrack_expect_free(exp);
-                        goto out_update_nl;
+                        goto out_put_expect;
                 }
                 exp->tuple.dst.ip = htonl((array[0] << 24) | (array[1] << 16)
                                          | (array[2] << 8) | array[3]);
@@ -419,7 +418,6 @@ static int help(struct sk_buff **pskb,
                   { 0xFFFFFFFF, { .tcp = { 0xFFFF } }, 0xFF }});
 
         exp->expectfn = NULL;
-        exp->master = ct;
 
         /* Now, NAT might want to mangle the packet, and register the
          * (possibly changed) expectation itself. */
@@ -428,13 +426,15 @@ static int help(struct sk_buff **pskb,
                                       matchoff, matchlen, exp, &seq);
         else {
                 /* Can't expect this?  Best to drop packet now. */
-                if (ip_conntrack_expect_related(exp) != 0) {
-                        ip_conntrack_expect_free(exp);
+                if (ip_conntrack_expect_related(exp) != 0)
                         ret = NF_DROP;
-                } else
+                else
                         ret = NF_ACCEPT;
         }
 
+out_put_expect:
+        ip_conntrack_expect_put(exp);
+
 out_update_nl:
         /* Now if this ends in \n, update ftp info.  Seq may have been
          * adjusted by NAT code. */
diff --git a/net/ipv4/netfilter/ip_conntrack_irc.c b/net/ipv4/netfilter/ip_conntrack_irc.c
index cd98772cc3..4a28f297d5 100644
--- a/net/ipv4/netfilter/ip_conntrack_irc.c
+++ b/net/ipv4/netfilter/ip_conntrack_irc.c
@@ -197,7 +197,7 @@ static int help(struct sk_buff **pskb,
                                 continue;
                         }
 
-                        exp = ip_conntrack_expect_alloc();
+                        exp = ip_conntrack_expect_alloc(ct);
                         if (exp == NULL) {
                                 ret = NF_DROP;
                                 goto out;
@@ -221,16 +221,14 @@ static int help(struct sk_buff **pskb,
                                 { { 0, { 0 } },
                                   { 0xFFFFFFFF, { .tcp = { 0xFFFF } }, 0xFF }});
                         exp->expectfn = NULL;
-                        exp->master = ct;
                         if (ip_nat_irc_hook)
                                 ret = ip_nat_irc_hook(pskb, ctinfo, 
                                                       addr_beg_p - ib_ptr,
                                                       addr_end_p - addr_beg_p,
                                                       exp);
-                        else if (ip_conntrack_expect_related(exp) != 0) {
-                                ip_conntrack_expect_free(exp);
+                        else if (ip_conntrack_expect_related(exp) != 0)
                                 ret = NF_DROP;
-                        }
+                        ip_conntrack_expect_put(exp);
                         goto out;
                 } /* for .. NUM_DCCPROTO */
         } /* while data < ... */
diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
index 42dc951028..61798c46e9 100644
--- a/net/ipv4/netfilter/ip_conntrack_standalone.c
+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
@@ -432,6 +432,13 @@ static unsigned int ip_conntrack_defrag(unsigned int hooknum,
                                         const struct net_device *out,
                                         int (*okfn)(struct sk_buff *))
 {
+#if !defined(CONFIG_IP_NF_NAT) && !defined(CONFIG_IP_NF_NAT_MODULE)
+        /* Previously seen (loopback)?  Ignore.  Do this before
+           fragment check. */
+        if ((*pskb)->nfct)
+                return NF_ACCEPT;
+#endif
+
         /* Gather fragments. */
         if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
                 *pskb = ip_ct_gather_frags(*pskb,
@@ -978,7 +985,7 @@ EXPORT_SYMBOL(ip_ct_refresh_acct);
 EXPORT_SYMBOL(ip_ct_protos);
 EXPORT_SYMBOL(ip_ct_find_proto);
 EXPORT_SYMBOL(ip_conntrack_expect_alloc);
-EXPORT_SYMBOL(ip_conntrack_expect_free);
+EXPORT_SYMBOL(ip_conntrack_expect_put);
 EXPORT_SYMBOL(ip_conntrack_expect_related);
 EXPORT_SYMBOL(ip_conntrack_unexpect_related);
 EXPORT_SYMBOL(ip_conntrack_tuple_taken);
diff --git a/net/ipv4/netfilter/ip_conntrack_tftp.c b/net/ipv4/netfilter/ip_conntrack_tftp.c
index 992fac3e36..f8ff170f39 100644
--- a/net/ipv4/netfilter/ip_conntrack_tftp.c
+++ b/net/ipv4/netfilter/ip_conntrack_tftp.c
@@ -65,7 +65,7 @@ static int tftp_help(struct sk_buff **pskb,
                 DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
                 DUMP_TUPLE(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 
-                exp = ip_conntrack_expect_alloc();
+                exp = ip_conntrack_expect_alloc(ct);
                 if (exp == NULL)
                         return NF_DROP;
 
@@ -75,17 +75,15 @@ static int tftp_help(struct sk_buff **pskb,
                 exp->mask.dst.u.udp.port = 0xffff;
                 exp->mask.dst.protonum = 0xff;
                 exp->expectfn = NULL;
-                exp->master = ct;
 
                 DEBUGP("expect: ");
                 DUMP_TUPLE(&exp->tuple);
                 DUMP_TUPLE(&exp->mask);
                 if (ip_nat_tftp_hook)
                         ret = ip_nat_tftp_hook(pskb, ctinfo, exp);
-                else if (ip_conntrack_expect_related(exp) != 0) {
-                        ip_conntrack_expect_free(exp);
+                else if (ip_conntrack_expect_related(exp) != 0)
                         ret = NF_DROP;
-                }
+                ip_conntrack_expect_put(exp);
                 break;
         case TFTP_OPCODE_DATA:
         case TFTP_OPCODE_ACK:
diff --git a/net/ipv4/netfilter/ip_nat_amanda.c b/net/ipv4/netfilter/ip_nat_amanda.c
index da1f412583..706c8074f4 100644
--- a/net/ipv4/netfilter/ip_nat_amanda.c
+++ b/net/ipv4/netfilter/ip_nat_amanda.c
@@ -56,10 +56,8 @@ static unsigned int help(struct sk_buff **pskb,
                         break;
         }
 
-        if (port == 0) {
-                ip_conntrack_expect_free(exp);
+        if (port == 0)
                 return NF_DROP;
-        }
 
         sprintf(buffer, "%u", port);
         ret = ip_nat_mangle_udp_packet(pskb, exp->master, ctinfo,
diff --git a/net/ipv4/netfilter/ip_nat_ftp.c b/net/ipv4/netfilter/ip_nat_ftp.c
index c6000e794a..d83757a70d 100644
--- a/net/ipv4/netfilter/ip_nat_ftp.c
+++ b/net/ipv4/netfilter/ip_nat_ftp.c
@@ -143,10 +143,8 @@ static unsigned int ip_nat_ftp(struct sk_buff **pskb,
                         break;
         }
 
-        if (port == 0) {
-                ip_conntrack_expect_free(exp);
+        if (port == 0)
                 return NF_DROP;
-        }
 
         if (!mangle[type](pskb, newip, port, matchoff, matchlen, ct, ctinfo,
                           seq)) {
diff --git a/net/ipv4/netfilter/ip_nat_irc.c b/net/ipv4/netfilter/ip_nat_irc.c
index 9c1ca3381d..de31942bab 100644
--- a/net/ipv4/netfilter/ip_nat_irc.c
+++ b/net/ipv4/netfilter/ip_nat_irc.c
@@ -65,10 +65,8 @@ static unsigned int help(struct sk_buff **pskb,
                         break;
         }
 
-        if (port == 0) {
-                ip_conntrack_expect_free(exp);
+        if (port == 0)
                 return NF_DROP;
-        }
 
         /*      strlen("\1DCC CHAT chat AAAAAAAA P\1\n")=27
          *      strlen("\1DCC SCHAT chat AAAAAAAA P\1\n")=28
diff --git a/net/ipv4/netfilter/ip_nat_proto_icmp.c b/net/ipv4/netfilter/ip_nat_proto_icmp.c
index a558cf0eee..6596c9ee16 100644
--- a/net/ipv4/netfilter/ip_nat_proto_icmp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_icmp.c
@@ -35,16 +35,17 @@ icmp_unique_tuple(struct ip_conntrack_tuple *tuple,
                   const struct ip_conntrack *conntrack)
 {
         static u_int16_t id;
-        unsigned int range_size
-                = (unsigned int)range->max.icmp.id - range->min.icmp.id + 1;
+        unsigned int range_size;
         unsigned int i;
 
+        range_size = ntohs(range->max.icmp.id) - ntohs(range->min.icmp.id) + 1;
         /* If no range specified... */
         if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED))
                 range_size = 0xFFFF;
 
         for (i = 0; i < range_size; i++, id++) {
-                tuple->src.u.icmp.id = range->min.icmp.id + (id % range_size);
+                tuple->src.u.icmp.id = htons(ntohs(range->min.icmp.id) +
+                                             (id % range_size));
                 if (!ip_nat_used_tuple(tuple, conntrack))
                         return 1;
         }
diff --git a/net/ipv4/netfilter/ip_nat_proto_tcp.c b/net/ipv4/netfilter/ip_nat_proto_tcp.c
index a91cfceff2..a98e36d2b3 100644
--- a/net/ipv4/netfilter/ip_nat_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_tcp.c
@@ -40,7 +40,8 @@ tcp_unique_tuple(struct ip_conntrack_tuple *tuple,
                  enum ip_nat_manip_type maniptype,
                  const struct ip_conntrack *conntrack)
 {
-        static u_int16_t port, *portptr;
+        static u_int16_t port;
+        u_int16_t *portptr;
         unsigned int range_size, min, i;
 
         if (maniptype == IP_NAT_MANIP_SRC)
diff --git a/net/ipv4/netfilter/ip_nat_proto_udp.c b/net/ipv4/netfilter/ip_nat_proto_udp.c
index c669e3b5f5..9f66e56256 100644
--- a/net/ipv4/netfilter/ip_nat_proto_udp.c
+++ b/net/ipv4/netfilter/ip_nat_proto_udp.c
@@ -41,7 +41,8 @@ udp_unique_tuple(struct ip_conntrack_tuple *tuple,
                  enum ip_nat_manip_type maniptype,
                  const struct ip_conntrack *conntrack)
 {
-        static u_int16_t port, *portptr;
+        static u_int16_t port;
+        u_int16_t *portptr;
         unsigned int range_size, min, i;
 
         if (maniptype == IP_NAT_MANIP_SRC)
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index bc59d0d6e8..91d5ea1dbb 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -102,6 +102,10 @@ ip_nat_fn(unsigned int hooknum,
                 return NF_ACCEPT;
         }
 
+        /* Don't try to NAT if this packet is not conntracked */
+        if (ct == &ip_conntrack_untracked)
+                return NF_ACCEPT;
+
         switch (ctinfo) {
         case IP_CT_RELATED:
         case IP_CT_RELATED+IP_CT_IS_REPLY:
diff --git a/net/ipv4/netfilter/ip_nat_tftp.c b/net/ipv4/netfilter/ip_nat_tftp.c
index 0343e0d646..2215317c76 100644
--- a/net/ipv4/netfilter/ip_nat_tftp.c
+++ b/net/ipv4/netfilter/ip_nat_tftp.c
@@ -45,10 +45,8 @@ static unsigned int help(struct sk_buff **pskb,
         exp->saved_proto.udp.port = exp->tuple.dst.u.tcp.port;
         exp->dir = IP_CT_DIR_REPLY;
         exp->expectfn = ip_nat_follow_master;
-        if (ip_conntrack_expect_related(exp) != 0) {
-                ip_conntrack_expect_free(exp);
+        if (ip_conntrack_expect_related(exp) != 0)
                 return NF_DROP;
-        }
         return NF_ACCEPT;
 }
 
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index eda1fba431..c6baa81743 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -214,6 +214,12 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
                 break;
         
         case IPQ_COPY_PACKET:
+                if (entry->skb->ip_summed == CHECKSUM_HW &&
+                    (*errp = skb_checksum_help(entry->skb,
+                                               entry->info->outdev == NULL))) {
+                        read_unlock_bh(&queue_lock);
+                        return NULL;
+                }
                 if (copy_range == 0 || copy_range > entry->skb->len)
                         data_len = entry->skb->len;
                 else
@@ -385,6 +391,7 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
         if (!skb_ip_make_writable(&e->skb, v->data_len))
                 return -ENOMEM;
         memcpy(e->skb->data, v->payload, v->data_len);
+        e->skb->ip_summed = CHECKSUM_NONE;
         e->skb->nfcache |= NFC_ALTERED;
 
         /*
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index dc4362b57c..6706d3a1bc 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -30,7 +30,7 @@
 #include <linux/netfilter_ipv4/ipt_CLUSTERIP.h>
 #include <linux/netfilter_ipv4/ip_conntrack.h>
 
-#define CLUSTERIP_VERSION "0.6"
+#define CLUSTERIP_VERSION "0.7"
 
 #define DEBUG_CLUSTERIP
 
@@ -339,7 +339,7 @@ target(struct sk_buff **pskb,
          * error messages (RELATED) and information requests (see below) */
         if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP
             && (ctinfo == IP_CT_RELATED 
-                || ctinfo == IP_CT_IS_REPLY+IP_CT_IS_REPLY))
+                || ctinfo == IP_CT_RELATED+IP_CT_IS_REPLY))
                 return IPT_CONTINUE;
 
         /* ip_conntrack_icmp guarantees us that we only have ICMP_ECHO, 
@@ -524,8 +524,9 @@ arp_mangle(unsigned int hook,
             || arp->ar_pln != 4 || arp->ar_hln != ETH_ALEN)
                 return NF_ACCEPT;
 
-        /* we only want to mangle arp replies */
-        if (arp->ar_op != htons(ARPOP_REPLY))
+        /* we only want to mangle arp requests and replies */
+        if (arp->ar_op != htons(ARPOP_REPLY)
+            && arp->ar_op != htons(ARPOP_REQUEST))
                 return NF_ACCEPT;
 
         payload = (void *)(arp+1);
diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
index ada9911118..94a0ce1c1c 100644
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ b/net/ipv4/netfilter/ipt_ECN.c
@@ -61,16 +61,20 @@ set_ect_tcp(struct sk_buff **pskb, const struct ipt_ECN_info *einfo, int inward)
         if (!tcph)
                 return 0;
 
-        if (!(einfo->operation & IPT_ECN_OP_SET_ECE
-              || tcph->ece == einfo->proto.tcp.ece)
-            && (!(einfo->operation & IPT_ECN_OP_SET_CWR
-                  || tcph->cwr == einfo->proto.tcp.cwr)))
+        if ((!(einfo->operation & IPT_ECN_OP_SET_ECE) ||
+             tcph->ece == einfo->proto.tcp.ece) &&
+            ((!(einfo->operation & IPT_ECN_OP_SET_CWR) ||
+             tcph->cwr == einfo->proto.tcp.cwr)))
                 return 1;
 
         if (!skb_ip_make_writable(pskb, (*pskb)->nh.iph->ihl*4+sizeof(*tcph)))
                 return 0;
         tcph = (void *)(*pskb)->nh.iph + (*pskb)->nh.iph->ihl*4;
 
+        if ((*pskb)->ip_summed == CHECKSUM_HW &&
+            skb_checksum_help(*pskb, inward))
+                return 0;
+
         diffs[0] = ((u_int16_t *)tcph)[6];
         if (einfo->operation & IPT_ECN_OP_SET_ECE)
                 tcph->ece = einfo->proto.tcp.ece;
@@ -79,13 +83,10 @@ set_ect_tcp(struct sk_buff **pskb, const struct ipt_ECN_info *einfo, int inward)
         diffs[1] = ((u_int16_t *)tcph)[6];
         diffs[0] = diffs[0] ^ 0xFFFF;
 
-        if ((*pskb)->ip_summed != CHECKSUM_HW)
+        if ((*pskb)->ip_summed != CHECKSUM_UNNECESSARY)
                 tcph->check = csum_fold(csum_partial((char *)diffs,
                                                      sizeof(diffs),
                                                      tcph->check^0xFFFF));
-        else
-                if (skb_checksum_help(*pskb, inward))
-                        return 0;
         (*pskb)->nfcache |= NFC_ALTERED;
         return 1;
 }
diff --git a/net/ipv4/netfilter/ipt_TCPMSS.c b/net/ipv4/netfilter/ipt_TCPMSS.c
index 1049050b2b..7b84a25444 100644
--- a/net/ipv4/netfilter/ipt_TCPMSS.c
+++ b/net/ipv4/netfilter/ipt_TCPMSS.c
@@ -61,6 +61,10 @@ ipt_tcpmss_target(struct sk_buff **pskb,
         if (!skb_ip_make_writable(pskb, (*pskb)->len))
                 return NF_DROP;
 
+        if ((*pskb)->ip_summed == CHECKSUM_HW &&
+            skb_checksum_help(*pskb, out == NULL))
+                return NF_DROP;
+
         iph = (*pskb)->nh.iph;
         tcplen = (*pskb)->len - iph->ihl*4;
 
@@ -186,9 +190,6 @@ ipt_tcpmss_target(struct sk_buff **pskb,
                newmss);
 
  retmodified:
-        /* We never hw checksum SYN packets.  */
-        BUG_ON((*pskb)->ip_summed == CHECKSUM_HW);
-
         (*pskb)->nfcache |= NFC_UNKNOWN | NFC_ALTERED;
         return IPT_CONTINUE;
 }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index f4d53c9198..d675ff80b0 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -54,6 +54,7 @@
  *              Marc Boucher    :       routing by fwmark
  *      Robert Olsson           :       Added rt_cache statistics
  *      Arnaldo C. Melo         :       Convert proc stuff to seq_file
+ *      Eric Dumazet            :       hashed spinlocks and rt_check_expire() fixes.
  *
  *              This program is free software; you can redistribute it and/or
  *              modify it under the terms of the GNU General Public License
@@ -70,6 +71,7 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
+#include <linux/bootmem.h>
 #include <linux/string.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
@@ -201,8 +203,37 @@ __u8 ip_tos2prio[16] = {
 
 struct rt_hash_bucket {
         struct rtable   *chain;
-        spinlock_t      lock;
-} __attribute__((__aligned__(8)));
+};
+#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
+/*
+ * Instead of using one spinlock for each rt_hash_bucket, we use a table of spinlocks
+ * The size of this table is a power of two and depends on the number of CPUS.
+ */
+#if NR_CPUS >= 32
+#define RT_HASH_LOCK_SZ 4096
+#elif NR_CPUS >= 16
+#define RT_HASH_LOCK_SZ 2048
+#elif NR_CPUS >= 8
+#define RT_HASH_LOCK_SZ 1024
+#elif NR_CPUS >= 4
+#define RT_HASH_LOCK_SZ 512
+#else
+#define RT_HASH_LOCK_SZ 256
+#endif
+
+static spinlock_t       *rt_hash_locks;
+# define rt_hash_lock_addr(slot) &rt_hash_locks[(slot) & (RT_HASH_LOCK_SZ - 1)]
+# define rt_hash_lock_init()    { \
+                int i; \
+                rt_hash_locks = kmalloc(sizeof(spinlock_t) * RT_HASH_LOCK_SZ, GFP_KERNEL); \
+                if (!rt_hash_locks) panic("IP: failed to allocate rt_hash_locks\n"); \
+                for (i = 0; i < RT_HASH_LOCK_SZ; i++) \
+                        spin_lock_init(&rt_hash_locks[i]); \
+                }
+#else
+# define rt_hash_lock_addr(slot) NULL
+# define rt_hash_lock_init()
+#endif
 
 static struct rt_hash_bucket    *rt_hash_table;
 static unsigned                 rt_hash_mask;
@@ -575,19 +606,26 @@ static struct rtable **rt_remove_balanced_route(struct rtable **chain_head,
 /* This runs via a timer and thus is always in BH context. */
 static void rt_check_expire(unsigned long dummy)
 {
-        static int rover;
-        int i = rover, t;
+        static unsigned int rover;
+        unsigned int i = rover, goal;
         struct rtable *rth, **rthp;
         unsigned long now = jiffies;
-
-        for (t = ip_rt_gc_interval << rt_hash_log; t >= 0;
-             t -= ip_rt_gc_timeout) {
+        u64 mult;
+
+        mult = ((u64)ip_rt_gc_interval) << rt_hash_log;
+        if (ip_rt_gc_timeout > 1)
+                do_div(mult, ip_rt_gc_timeout);
+        goal = (unsigned int)mult;
+        if (goal > rt_hash_mask) goal = rt_hash_mask + 1;
+        for (; goal > 0; goal--) {
                 unsigned long tmo = ip_rt_gc_timeout;
 
                 i = (i + 1) & rt_hash_mask;
                 rthp = &rt_hash_table[i].chain;
 
-                spin_lock(&rt_hash_table[i].lock);
+                if (*rthp == 0)
+                        continue;
+                spin_lock(rt_hash_lock_addr(i));
                 while ((rth = *rthp) != NULL) {
                         if (rth->u.dst.expires) {
                                 /* Entry is expired even if it is in use */
@@ -620,14 +658,14 @@ static void rt_check_expire(unsigned long dummy)
                         rt_free(rth);
 #endif /* CONFIG_IP_ROUTE_MULTIPATH_CACHED */
                 }
-                spin_unlock(&rt_hash_table[i].lock);
+                spin_unlock(rt_hash_lock_addr(i));
 
                 /* Fallback loop breaker. */
                 if (time_after(jiffies, now))
                         break;
         }
         rover = i;
-        mod_timer(&rt_periodic_timer, now + ip_rt_gc_interval);
+        mod_timer(&rt_periodic_timer, jiffies + ip_rt_gc_interval);
 }
 
 /* This can run from both BH and non-BH contexts, the latter
@@ -643,11 +681,11 @@ static void rt_run_flush(unsigned long dummy)
         get_random_bytes(&rt_hash_rnd, 4);
 
         for (i = rt_hash_mask; i >= 0; i--) {
-                spin_lock_bh(&rt_hash_table[i].lock);
+                spin_lock_bh(rt_hash_lock_addr(i));
                 rth = rt_hash_table[i].chain;
                 if (rth)
                         rt_hash_table[i].chain = NULL;
-                spin_unlock_bh(&rt_hash_table[i].lock);
+                spin_unlock_bh(rt_hash_lock_addr(i));
 
                 for (; rth; rth = next) {
                         next = rth->u.rt_next;
@@ -780,7 +818,7 @@ static int rt_garbage_collect(void)
 
                         k = (k + 1) & rt_hash_mask;
                         rthp = &rt_hash_table[k].chain;
-                        spin_lock_bh(&rt_hash_table[k].lock);
+                        spin_lock_bh(rt_hash_lock_addr(k));
                         while ((rth = *rthp) != NULL) {
                                 if (!rt_may_expire(rth, tmo, expire)) {
                                         tmo >>= 1;
@@ -812,7 +850,7 @@ static int rt_garbage_collect(void)
                                 goal--;
 #endif /* CONFIG_IP_ROUTE_MULTIPATH_CACHED */
                         }
-                        spin_unlock_bh(&rt_hash_table[k].lock);
+                        spin_unlock_bh(rt_hash_lock_addr(k));
                         if (goal <= 0)
                                 break;
                 }
@@ -882,7 +920,7 @@ restart:
 
         rthp = &rt_hash_table[hash].chain;
 
-        spin_lock_bh(&rt_hash_table[hash].lock);
+        spin_lock_bh(rt_hash_lock_addr(hash));
         while ((rth = *rthp) != NULL) {
 #ifdef CONFIG_IP_ROUTE_MULTIPATH_CACHED
                 if (!(rth->u.dst.flags & DST_BALANCED) &&
@@ -908,7 +946,7 @@ restart:
                         rth->u.dst.__use++;
                         dst_hold(&rth->u.dst);
                         rth->u.dst.lastuse = now;
-                        spin_unlock_bh(&rt_hash_table[hash].lock);
+                        spin_unlock_bh(rt_hash_lock_addr(hash));
 
                         rt_drop(rt);
                         *rp = rth;
@@ -949,7 +987,7 @@ restart:
         if (rt->rt_type == RTN_UNICAST || rt->fl.iif == 0) {
                 int err = arp_bind_neighbour(&rt->u.dst);
                 if (err) {
-                        spin_unlock_bh(&rt_hash_table[hash].lock);
+                        spin_unlock_bh(rt_hash_lock_addr(hash));
 
                         if (err != -ENOBUFS) {
                                 rt_drop(rt);
@@ -990,7 +1028,7 @@ restart:
         }
 #endif
         rt_hash_table[hash].chain = rt;
-        spin_unlock_bh(&rt_hash_table[hash].lock);
+        spin_unlock_bh(rt_hash_lock_addr(hash));
         *rp = rt;
         return 0;
 }
@@ -1058,7 +1096,7 @@ static void rt_del(unsigned hash, struct rtable *rt)
 {
         struct rtable **rthp;
 
-        spin_lock_bh(&rt_hash_table[hash].lock);
+        spin_lock_bh(rt_hash_lock_addr(hash));
         ip_rt_put(rt);
         for (rthp = &rt_hash_table[hash].chain; *rthp;
              rthp = &(*rthp)->u.rt_next)
@@ -1067,7 +1105,7 @@ static void rt_del(unsigned hash, struct rtable *rt)
                         rt_free(rt);
                         break;
                 }
-        spin_unlock_bh(&rt_hash_table[hash].lock);
+        spin_unlock_bh(rt_hash_lock_addr(hash));
 }
 
 void ip_rt_redirect(u32 old_gw, u32 daddr, u32 new_gw,
@@ -1647,7 +1685,7 @@ static void ip_handle_martian_source(struct net_device *dev,
                 printk(KERN_WARNING "martian source %u.%u.%u.%u from "
                         "%u.%u.%u.%u, on dev %s\n",
                         NIPQUAD(daddr), NIPQUAD(saddr), dev->name);
-                if (dev->hard_header_len) {
+                if (dev->hard_header_len && skb->mac.raw) {
                         int i;
                         unsigned char *p = skb->mac.raw;
                         printk(KERN_WARNING "ll header: ");
@@ -1767,7 +1805,7 @@ static inline int ip_mkroute_input_def(struct sk_buff *skb,
                                        struct in_device *in_dev,
                                        u32 daddr, u32 saddr, u32 tos)
 {
-        struct rtable* rth;
+        struct rtable* rth = NULL;
         int err;
         unsigned hash;
 
@@ -1794,7 +1832,7 @@ static inline int ip_mkroute_input(struct sk_buff *skb,
                                    u32 daddr, u32 saddr, u32 tos)
 {
 #ifdef CONFIG_IP_ROUTE_MULTIPATH_CACHED
-        struct rtable* rth;
+        struct rtable* rth = NULL;
         unsigned char hop, hopcount, lasthop;
         int err = -EINVAL;
         unsigned int hash;
@@ -1909,7 +1947,7 @@ static int ip_route_input_slow(struct sk_buff *skb, u32 daddr, u32 saddr,
          */
         if ((err = fib_lookup(&fl, &res)) != 0) {
                 if (!IN_DEV_FORWARD(in_dev))
-                        goto e_inval;
+                        goto e_hostunreach;
                 goto no_route;
         }
         free_res = 1;
@@ -1933,7 +1971,7 @@ static int ip_route_input_slow(struct sk_buff *skb, u32 daddr, u32 saddr,
         }
 
         if (!IN_DEV_FORWARD(in_dev))
-                goto e_inval;
+                goto e_hostunreach;
         if (res.type != RTN_UNICAST)
                 goto martian_destination;
 
@@ -2025,6 +2063,11 @@ martian_destination:
                         "%u.%u.%u.%u, dev %s\n",
                         NIPQUAD(daddr), NIPQUAD(saddr), dev->name);
 #endif
+
+e_hostunreach:
+        err = -EHOSTUNREACH;
+        goto done;
+
 e_inval:
         err = -EINVAL;
         goto done;
@@ -2239,7 +2282,7 @@ static inline int ip_mkroute_output_def(struct rtable **rp,
                                         struct net_device *dev_out,
                                         unsigned flags)
 {
-        struct rtable *rth;
+        struct rtable *rth = NULL;
         int err = __mkroute_output(&rth, res, fl, oldflp, dev_out, flags);
         unsigned hash;
         if (err == 0) {
@@ -2267,7 +2310,7 @@ static inline int ip_mkroute_output(struct rtable** rp,
         unsigned char hop;
         unsigned hash;
         int err = -EINVAL;
-        struct rtable *rth;
+        struct rtable *rth = NULL;
 
         if (res->fi && res->fi->fib_nhs > 1) {
                 unsigned char hopcount = res->fi->fib_nhs;
@@ -3068,12 +3111,14 @@ __setup("rhash_entries=", set_rhash_entries);
 
 int __init ip_rt_init(void)
 {
-        int i, order, goal, rc = 0;
+        int rc = 0;
 
         rt_hash_rnd = (int) ((num_physpages ^ (num_physpages>>8)) ^
                              (jiffies ^ (jiffies >> 7)));
 
 #ifdef CONFIG_NET_CLS_ROUTE
+        {
+        int order;
         for (order = 0;
              (PAGE_SIZE << order) < 256 * sizeof(struct ip_rt_acct) * NR_CPUS; order++)
                 /* NOTHING */;
@@ -3081,6 +3126,7 @@ int __init ip_rt_init(void)
         if (!ip_rt_acct)
                 panic("IP: failed to allocate ip_rt_acct\n");
         memset(ip_rt_acct, 0, PAGE_SIZE << order);
+        }
 #endif
 
         ipv4_dst_ops.kmem_cachep = kmem_cache_create("ip_dst_cache",
@@ -3091,36 +3137,19 @@ int __init ip_rt_init(void)
         if (!ipv4_dst_ops.kmem_cachep)
                 panic("IP: failed to allocate ip_dst_cache\n");
 
-        goal = num_physpages >> (26 - PAGE_SHIFT);
-        if (rhash_entries)
-                goal = (rhash_entries * sizeof(struct rt_hash_bucket)) >> PAGE_SHIFT;
-        for (order = 0; (1UL << order) < goal; order++)
-                /* NOTHING */;
-
-        do {
-                rt_hash_mask = (1UL << order) * PAGE_SIZE /
-                        sizeof(struct rt_hash_bucket);
-                while (rt_hash_mask & (rt_hash_mask - 1))
-                        rt_hash_mask--;
-                rt_hash_table = (struct rt_hash_bucket *)
-                        __get_free_pages(GFP_ATOMIC, order);
-        } while (rt_hash_table == NULL && --order > 0);
-
-        if (!rt_hash_table)
-                panic("Failed to allocate IP route cache hash table\n");
-
-        printk(KERN_INFO "IP: routing cache hash table of %u buckets, %ldKbytes\n",
-               rt_hash_mask,
-               (long) (rt_hash_mask * sizeof(struct rt_hash_bucket)) / 1024);
-
-        for (rt_hash_log = 0; (1 << rt_hash_log) != rt_hash_mask; rt_hash_log++)
-                /* NOTHING */;
-
-        rt_hash_mask--;
-        for (i = 0; i <= rt_hash_mask; i++) {
-                spin_lock_init(&rt_hash_table[i].lock);
-                rt_hash_table[i].chain = NULL;
-        }
+        rt_hash_table = (struct rt_hash_bucket *)
+                alloc_large_system_hash("IP route cache",
+                                        sizeof(struct rt_hash_bucket),
+                                        rhash_entries,
+                                        (num_physpages >= 128 * 1024) ?
+                                                (27 - PAGE_SHIFT) :
+                                                (29 - PAGE_SHIFT),
+                                        HASH_HIGHMEM,
+                                        &rt_hash_log,
+                                        &rt_hash_mask,
+                                        0);
+        memset(rt_hash_table, 0, (rt_hash_mask + 1) * sizeof(struct rt_hash_bucket));
+        rt_hash_lock_init();
 
         ipv4_dst_ops.gc_thresh = (rt_hash_mask + 1);
         ip_rt_max_size = (rt_hash_mask + 1) * 16;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 23068bddbf..e328945324 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -118,6 +118,45 @@ static int ipv4_sysctl_forward_strategy(ctl_table *table,
         return 1;
 }
 
+static int proc_tcp_congestion_control(ctl_table *ctl, int write, struct file * filp,
+                                       void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        char val[TCP_CA_NAME_MAX];
+        ctl_table tbl = {
+                .data = val,
+                .maxlen = TCP_CA_NAME_MAX,
+        };
+        int ret;
+
+        tcp_get_default_congestion_control(val);
+
+        ret = proc_dostring(&tbl, write, filp, buffer, lenp, ppos);
+        if (write && ret == 0)
+                ret = tcp_set_default_congestion_control(val);
+        return ret;
+}
+
+int sysctl_tcp_congestion_control(ctl_table *table, int __user *name, int nlen,
+                                  void __user *oldval, size_t __user *oldlenp,
+                                  void __user *newval, size_t newlen,
+                                  void **context)
+{
+        char val[TCP_CA_NAME_MAX];
+        ctl_table tbl = {
+                .data = val,
+                .maxlen = TCP_CA_NAME_MAX,
+        };
+        int ret;
+
+        tcp_get_default_congestion_control(val);
+        ret = sysctl_string(&tbl, name, nlen, oldval, oldlenp, newval, newlen,
+                            context);
+        if (ret == 0 && newval && newlen)
+                ret = tcp_set_default_congestion_control(val);
+        return ret;
+}
+
+
 ctl_table ipv4_table[] = {
         {
                 .ctl_name       = NET_IPV4_TCP_TIMESTAMPS,
@@ -612,70 +651,6 @@ ctl_table ipv4_table[] = {
                 .proc_handler   = &proc_dointvec,
         },
         {
-                .ctl_name       = NET_TCP_WESTWOOD, 
-                .procname       = "tcp_westwood",
-                .data           = &sysctl_tcp_westwood,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
-                .ctl_name       = NET_TCP_VEGAS,
-                .procname       = "tcp_vegas_cong_avoid",
-                .data           = &sysctl_tcp_vegas_cong_avoid,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
-                .ctl_name       = NET_TCP_VEGAS_ALPHA,
-                .procname       = "tcp_vegas_alpha",
-                .data           = &sysctl_tcp_vegas_alpha,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
-                .ctl_name       = NET_TCP_VEGAS_BETA,
-                .procname       = "tcp_vegas_beta",
-                .data           = &sysctl_tcp_vegas_beta,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
-                .ctl_name       = NET_TCP_VEGAS_GAMMA,
-                .procname       = "tcp_vegas_gamma",
-                .data           = &sysctl_tcp_vegas_gamma,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
-                .ctl_name       = NET_TCP_BIC,
-                .procname       = "tcp_bic",
-                .data           = &sysctl_tcp_bic,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
-                .ctl_name       = NET_TCP_BIC_FAST_CONVERGENCE,
-                .procname       = "tcp_bic_fast_convergence",
-                .data           = &sysctl_tcp_bic_fast_convergence,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
-                .ctl_name       = NET_TCP_BIC_LOW_WINDOW,
-                .procname       = "tcp_bic_low_window",
-                .data           = &sysctl_tcp_bic_low_window,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
-        },
-        {
                 .ctl_name       = NET_TCP_MODERATE_RCVBUF,
                 .procname       = "tcp_moderate_rcvbuf",
                 .data           = &sysctl_tcp_moderate_rcvbuf,
@@ -692,13 +667,14 @@ ctl_table ipv4_table[] = {
                 .proc_handler   = &proc_dointvec,
         },
         {
-                .ctl_name       = NET_TCP_BIC_BETA,
-                .procname       = "tcp_bic_beta",
-                .data           = &sysctl_tcp_bic_beta,
-                .maxlen         = sizeof(int),
+                .ctl_name       = NET_TCP_CONG_CONTROL,
+                .procname       = "tcp_congestion_control",
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec,
+                .maxlen         = TCP_CA_NAME_MAX,
+                .proc_handler   = &proc_tcp_congestion_control,
+                .strategy       = &sysctl_tcp_congestion_control,
         },
+
         { .ctl_name = 0 }
 };
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 674bbd8cfd..69b1fcf700 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -584,7 +584,7 @@ static inline void skb_entail(struct sock *sk, struct tcp_sock *tp,
         sk_charge_skb(sk, skb);
         if (!sk->sk_send_head)
                 sk->sk_send_head = skb;
-        else if (tp->nonagle&TCP_NAGLE_PUSH)
+        if (tp->nonagle & TCP_NAGLE_PUSH)
                 tp->nonagle &= ~TCP_NAGLE_PUSH; 
 }
 
@@ -615,7 +615,7 @@ static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffse
                          size_t psize, int flags)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        int mss_now;
+        int mss_now, size_goal;
         int err;
         ssize_t copied;
         long timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
@@ -628,6 +628,7 @@ static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffse
         clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
 
         mss_now = tcp_current_mss(sk, !(flags&MSG_OOB));
+        size_goal = tp->xmit_size_goal;
         copied = 0;
 
         err = -EPIPE;
@@ -641,7 +642,7 @@ static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffse
                 int offset = poffset % PAGE_SIZE;
                 int size = min_t(size_t, psize, PAGE_SIZE - offset);
 
-                if (!sk->sk_send_head || (copy = mss_now - skb->len) <= 0) {
+                if (!sk->sk_send_head || (copy = size_goal - skb->len) <= 0) {
 new_segment:
                         if (!sk_stream_memory_free(sk))
                                 goto wait_for_sndbuf;
@@ -652,7 +653,7 @@ new_segment:
                                 goto wait_for_memory;
 
                         skb_entail(sk, tp, skb);
-                        copy = mss_now;
+                        copy = size_goal;
                 }
 
                 if (copy > size)
@@ -693,7 +694,7 @@ new_segment:
                 if (!(psize -= copy))
                         goto out;
 
-                if (skb->len != mss_now || (flags & MSG_OOB))
+                if (skb->len < mss_now || (flags & MSG_OOB))
                         continue;
 
                 if (forced_push(tp)) {
@@ -713,6 +714,7 @@ wait_for_memory:
                         goto do_error;
 
                 mss_now = tcp_current_mss(sk, !(flags&MSG_OOB));
+                size_goal = tp->xmit_size_goal;
         }
 
 out:
@@ -754,15 +756,20 @@ ssize_t tcp_sendpage(struct socket *sock, struct page *page, int offset,
 
 static inline int select_size(struct sock *sk, struct tcp_sock *tp)
 {
-        int tmp = tp->mss_cache_std;
+        int tmp = tp->mss_cache;
 
         if (sk->sk_route_caps & NETIF_F_SG) {
-                int pgbreak = SKB_MAX_HEAD(MAX_TCP_HEADER);
+                if (sk->sk_route_caps & NETIF_F_TSO)
+                        tmp = 0;
+                else {
+                        int pgbreak = SKB_MAX_HEAD(MAX_TCP_HEADER);
 
-                if (tmp >= pgbreak &&
-                    tmp <= pgbreak + (MAX_SKB_FRAGS - 1) * PAGE_SIZE)
-                        tmp = pgbreak;
+                        if (tmp >= pgbreak &&
+                            tmp <= pgbreak + (MAX_SKB_FRAGS - 1) * PAGE_SIZE)
+                                tmp = pgbreak;
+                }
         }
+
         return tmp;
 }
 
@@ -773,7 +780,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
         int iovlen, flags;
-        int mss_now;
+        int mss_now, size_goal;
         int err, copied;
         long timeo;
 
@@ -792,6 +799,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
 
         mss_now = tcp_current_mss(sk, !(flags&MSG_OOB));
+        size_goal = tp->xmit_size_goal;
 
         /* Ok commence sending. */
         iovlen = msg->msg_iovlen;
@@ -814,7 +822,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         skb = sk->sk_write_queue.prev;
 
                         if (!sk->sk_send_head ||
-                            (copy = mss_now - skb->len) <= 0) {
+                            (copy = size_goal - skb->len) <= 0) {
 
 new_segment:
                                 /* Allocate new segment. If the interface is SG,
@@ -837,7 +845,7 @@ new_segment:
                                         skb->ip_summed = CHECKSUM_HW;
 
                                 skb_entail(sk, tp, skb);
-                                copy = mss_now;
+                                copy = size_goal;
                         }
 
                         /* Try to append data to the end of skb. */
@@ -872,11 +880,6 @@ new_segment:
                                         tcp_mark_push(tp, skb);
                                         goto new_segment;
                                 } else if (page) {
-                                        /* If page is cached, align
-                                         * offset to L1 cache boundary
-                                         */
-                                        off = (off + L1_CACHE_BYTES - 1) &
-                                              ~(L1_CACHE_BYTES - 1);
                                         if (off == PAGE_SIZE) {
                                                 put_page(page);
                                                 TCP_PAGE(sk) = page = NULL;
@@ -937,7 +940,7 @@ new_segment:
                         if ((seglen -= copy) == 0 && iovlen == 0)
                                 goto out;
 
-                        if (skb->len != mss_now || (flags & MSG_OOB))
+                        if (skb->len < mss_now || (flags & MSG_OOB))
                                 continue;
 
                         if (forced_push(tp)) {
@@ -957,6 +960,7 @@ wait_for_memory:
                                 goto do_error;
 
                         mss_now = tcp_current_mss(sk, !(flags&MSG_OOB));
+                        size_goal = tp->xmit_size_goal;
                 }
         }
 
@@ -1101,7 +1105,7 @@ static void tcp_prequeue_process(struct sock *sk)
         struct sk_buff *skb;
         struct tcp_sock *tp = tcp_sk(sk);
 
-        NET_ADD_STATS_USER(LINUX_MIB_TCPPREQUEUED, skb_queue_len(&tp->ucopy.prequeue));
+        NET_INC_STATS_USER(LINUX_MIB_TCPPREQUEUED);
 
         /* RX process wants to run with disabled BHs, though it is not
          * necessary */
@@ -1365,7 +1369,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                          * is not empty. It is more elegant, but eats cycles,
                          * unfortunately.
                          */
-                        if (skb_queue_len(&tp->ucopy.prequeue))
+                        if (!skb_queue_empty(&tp->ucopy.prequeue))
                                 goto do_prequeue;
 
                         /* __ Set realtime policy in scheduler __ */
@@ -1390,7 +1394,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         }
 
                         if (tp->rcv_nxt == tp->copied_seq &&
-                            skb_queue_len(&tp->ucopy.prequeue)) {
+                            !skb_queue_empty(&tp->ucopy.prequeue)) {
 do_prequeue:
                                 tcp_prequeue_process(sk);
 
@@ -1472,7 +1476,7 @@ skip_copy:
         } while (len > 0);
 
         if (user_recv) {
-                if (skb_queue_len(&tp->ucopy.prequeue)) {
+                if (!skb_queue_empty(&tp->ucopy.prequeue)) {
                         int chunk;
 
                         tp->ucopy.len = copied > 0 ? len : 0;
@@ -1927,6 +1931,25 @@ int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
                 return tp->af_specific->setsockopt(sk, level, optname,
                                                    optval, optlen);
 
+        /* This is a string value all the others are int's */
+        if (optname == TCP_CONGESTION) {
+                char name[TCP_CA_NAME_MAX];
+
+                if (optlen < 1)
+                        return -EINVAL;
+
+                val = strncpy_from_user(name, optval,
+                                        min(TCP_CA_NAME_MAX-1, optlen));
+                if (val < 0)
+                        return -EFAULT;
+                name[val] = 0;
+
+                lock_sock(sk);
+                err = tcp_set_congestion_control(tp, name);
+                release_sock(sk);
+                return err;
+        }
+
         if (optlen < sizeof(int))
                 return -EINVAL;
 
@@ -2109,7 +2132,7 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
 
         info->tcpi_rto = jiffies_to_usecs(tp->rto);
         info->tcpi_ato = jiffies_to_usecs(tp->ack.ato);
-        info->tcpi_snd_mss = tp->mss_cache_std;
+        info->tcpi_snd_mss = tp->mss_cache;
         info->tcpi_rcv_mss = tp->ack.rcv_mss;
 
         info->tcpi_unacked = tp->packets_out;
@@ -2159,7 +2182,7 @@ int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
 
         switch (optname) {
         case TCP_MAXSEG:
-                val = tp->mss_cache_std;
+                val = tp->mss_cache;
                 if (!val && ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
                         val = tp->rx_opt.user_mss;
                 break;
@@ -2211,6 +2234,16 @@ int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
         case TCP_QUICKACK:
                 val = !tp->ack.pingpong;
                 break;
+
+        case TCP_CONGESTION:
+                if (get_user(len, optlen))
+                        return -EFAULT;
+                len = min_t(unsigned int, len, TCP_CA_NAME_MAX);
+                if (put_user(len, optlen))
+                        return -EFAULT;
+                if (copy_to_user(optval, tp->ca_ops->name, len))
+                        return -EFAULT;
+                return 0;
         default:
                 return -ENOPROTOOPT;
         };
@@ -2224,7 +2257,7 @@ int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
 
 
 extern void __skb_cb_too_small_for_tcp(int, int);
-extern void tcpdiag_init(void);
+extern struct tcp_congestion_ops tcp_reno;
 
 static __initdata unsigned long thash_entries;
 static int __init set_thash_entries(char *str)
@@ -2333,6 +2366,8 @@ void __init tcp_init(void)
         printk(KERN_INFO "TCP: Hash tables configured "
                "(established %d bind %d)\n",
                tcp_ehash_size << 1, tcp_bhash_size);
+
+        tcp_register_congestion_control(&tcp_reno);
 }
 
 EXPORT_SYMBOL(tcp_accept);
diff --git a/net/ipv4/tcp_bic.c b/net/ipv4/tcp_bic.c
new file mode 100644
index 0000000000..ec38d45d66
--- /dev/null
+++ b/net/ipv4/tcp_bic.c
@@ -0,0 +1,331 @@
+/*
+ * Binary Increase Congestion control for TCP
+ *
+ * This is from the implementation of BICTCP in
+ * Lison-Xu, Kahaled Harfoush, and Injong Rhee.
+ *  "Binary Increase Congestion Control for Fast, Long Distance
+ *  Networks" in InfoComm 2004
+ * Available from:
+ *  http://www.csc.ncsu.edu/faculty/rhee/export/bitcp.pdf
+ *
+ * Unless BIC is enabled and congestion window is large
+ * this behaves the same as the original Reno.
+ */
+
+#include <linux/config.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <net/tcp.h>
+
+
+#define BICTCP_BETA_SCALE    1024       /* Scale factor beta calculation
+                                         * max_cwnd = snd_cwnd * beta
+                                         */
+#define BICTCP_B                4        /*
+                                          * In binary search,
+                                          * go to point (max+min)/N
+                                          */
+
+static int fast_convergence = 1;
+static int max_increment = 32;
+static int low_window = 14;
+static int beta = 819;          /* = 819/1024 (BICTCP_BETA_SCALE) */
+static int low_utilization_threshold = 153;
+static int low_utilization_period = 2;
+static int initial_ssthresh = 100;
+static int smooth_part = 20;
+
+module_param(fast_convergence, int, 0644);
+MODULE_PARM_DESC(fast_convergence, "turn on/off fast convergence");
+module_param(max_increment, int, 0644);
+MODULE_PARM_DESC(max_increment, "Limit on increment allowed during binary search");
+module_param(low_window, int, 0644);
+MODULE_PARM_DESC(low_window, "lower bound on congestion window (for TCP friendliness)");
+module_param(beta, int, 0644);
+MODULE_PARM_DESC(beta, "beta for multiplicative increase");
+module_param(low_utilization_threshold, int, 0644);
+MODULE_PARM_DESC(low_utilization_threshold, "percent (scaled by 1024) for low utilization mode");
+module_param(low_utilization_period, int, 0644);
+MODULE_PARM_DESC(low_utilization_period, "if average delay exceeds then goto to low utilization mode (seconds)");
+module_param(initial_ssthresh, int, 0644);
+MODULE_PARM_DESC(initial_ssthresh, "initial value of slow start threshold");
+module_param(smooth_part, int, 0644);
+MODULE_PARM_DESC(smooth_part, "log(B/(B*Smin))/log(B/(B-1))+B, # of RTT from Wmax-B to Wmax");
+
+
+/* BIC TCP Parameters */
+struct bictcp {
+        u32     cnt;            /* increase cwnd by 1 after ACKs */
+        u32     last_max_cwnd;  /* last maximum snd_cwnd */
+        u32     loss_cwnd;      /* congestion window at last loss */
+        u32     last_cwnd;      /* the last snd_cwnd */
+        u32     last_time;      /* time when updated last_cwnd */
+        u32     delay_min;      /* min delay */
+        u32     delay_max;      /* max delay */
+        u32     last_delay;
+        u8      low_utilization;/* 0: high; 1: low */
+        u32     low_utilization_start;  /* starting time of low utilization detection*/
+        u32     epoch_start;    /* beginning of an epoch */
+#define ACK_RATIO_SHIFT 4
+        u32     delayed_ack;    /* estimate the ratio of Packets/ACKs << 4 */
+};
+
+static inline void bictcp_reset(struct bictcp *ca)
+{
+        ca->cnt = 0;
+        ca->last_max_cwnd = 0;
+        ca->loss_cwnd = 0;
+        ca->last_cwnd = 0;
+        ca->last_time = 0;
+        ca->delay_min = 0;
+        ca->delay_max = 0;
+        ca->last_delay = 0;
+        ca->low_utilization = 0;
+        ca->low_utilization_start = 0;
+        ca->epoch_start = 0;
+        ca->delayed_ack = 2 << ACK_RATIO_SHIFT;
+}
+
+static void bictcp_init(struct tcp_sock *tp)
+{
+        bictcp_reset(tcp_ca(tp));
+        if (initial_ssthresh)
+                tp->snd_ssthresh = initial_ssthresh;
+}
+
+/*
+ * Compute congestion window to use.
+ */
+static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
+{
+        if (ca->last_cwnd == cwnd &&
+            (s32)(tcp_time_stamp - ca->last_time) <= HZ / 32)
+                return;
+
+        ca->last_cwnd = cwnd;
+        ca->last_time = tcp_time_stamp;
+
+        if (ca->epoch_start == 0) /* record the beginning of an epoch */
+                ca->epoch_start = tcp_time_stamp;
+
+        /* start off normal */
+        if (cwnd <= low_window) {
+                ca->cnt = cwnd;
+                return;
+        }
+
+        /* binary increase */
+        if (cwnd < ca->last_max_cwnd) {
+                __u32   dist = (ca->last_max_cwnd - cwnd)
+                        / BICTCP_B;
+
+                if (dist > max_increment)
+                        /* linear increase */
+                        ca->cnt = cwnd / max_increment;
+                else if (dist <= 1U)
+                        /* binary search increase */
+                        ca->cnt = (cwnd * smooth_part) / BICTCP_B;
+                else
+                        /* binary search increase */
+                        ca->cnt = cwnd / dist;
+        } else {
+                /* slow start AMD linear increase */
+                if (cwnd < ca->last_max_cwnd + BICTCP_B)
+                        /* slow start */
+                        ca->cnt = (cwnd * smooth_part) / BICTCP_B;
+                else if (cwnd < ca->last_max_cwnd + max_increment*(BICTCP_B-1))
+                        /* slow start */
+                        ca->cnt = (cwnd * (BICTCP_B-1))
+                                / cwnd-ca->last_max_cwnd;
+                else
+                        /* linear increase */
+                        ca->cnt = cwnd / max_increment;
+        }
+
+        /* if in slow start or link utilization is very low */
+        if ( ca->loss_cwnd == 0 ||
+             (cwnd > ca->loss_cwnd && ca->low_utilization)) {
+                if (ca->cnt > 20) /* increase cwnd 5% per RTT */
+                        ca->cnt = 20;
+        }
+
+        ca->cnt = (ca->cnt << ACK_RATIO_SHIFT) / ca->delayed_ack;
+        if (ca->cnt == 0)                       /* cannot be zero */
+                ca->cnt = 1;
+}
+
+
+/* Detect low utilization in congestion avoidance */
+static inline void bictcp_low_utilization(struct tcp_sock *tp, int flag)
+{
+        struct bictcp *ca = tcp_ca(tp);
+        u32 dist, delay;
+
+        /* No time stamp */
+        if (!(tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr) ||
+             /* Discard delay samples right after fast recovery */
+             tcp_time_stamp < ca->epoch_start + HZ ||
+             /* this delay samples may not be accurate */
+             flag == 0) {
+                ca->last_delay = 0;
+                goto notlow;
+        }
+
+        delay = ca->last_delay<<3;      /* use the same scale as tp->srtt*/
+        ca->last_delay = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
+        if (delay == 0)                 /* no previous delay sample */
+                goto notlow;
+
+        /* first time call or link delay decreases */
+        if (ca->delay_min == 0 || ca->delay_min > delay) {
+                ca->delay_min = ca->delay_max = delay;
+                goto notlow;
+        }
+
+        if (ca->delay_max < delay)
+                ca->delay_max = delay;
+
+        /* utilization is low, if avg delay < dist*threshold
+           for checking_period time */
+        dist = ca->delay_max - ca->delay_min;
+        if (dist <= ca->delay_min>>6 ||
+            tp->srtt - ca->delay_min >=  (dist*low_utilization_threshold)>>10)
+                goto notlow;
+
+        if (ca->low_utilization_start == 0) {
+                ca->low_utilization = 0;
+                ca->low_utilization_start = tcp_time_stamp;
+        } else if ((s32)(tcp_time_stamp - ca->low_utilization_start)
+                        > low_utilization_period*HZ) {
+                ca->low_utilization = 1;
+        }
+
+        return;
+
+ notlow:
+        ca->low_utilization = 0;
+        ca->low_utilization_start = 0;
+
+}
+
+static void bictcp_cong_avoid(struct tcp_sock *tp, u32 ack,
+                              u32 seq_rtt, u32 in_flight, int data_acked)
+{
+        struct bictcp *ca = tcp_ca(tp);
+
+        bictcp_low_utilization(tp, data_acked);
+
+        if (in_flight < tp->snd_cwnd)
+                return;
+
+        if (tp->snd_cwnd <= tp->snd_ssthresh) {
+                /* In "safe" area, increase. */
+                if (tp->snd_cwnd < tp->snd_cwnd_clamp)
+                        tp->snd_cwnd++;
+        } else {
+                bictcp_update(ca, tp->snd_cwnd);
+
+                /* In dangerous area, increase slowly.
+                 * In theory this is tp->snd_cwnd += 1 / tp->snd_cwnd
+                 */
+                if (tp->snd_cwnd_cnt >= ca->cnt) {
+                        if (tp->snd_cwnd < tp->snd_cwnd_clamp)
+                                tp->snd_cwnd++;
+                        tp->snd_cwnd_cnt = 0;
+                } else
+                        tp->snd_cwnd_cnt++;
+        }
+
+}
+
+/*
+ *      behave like Reno until low_window is reached,
+ *      then increase congestion window slowly
+ */
+static u32 bictcp_recalc_ssthresh(struct tcp_sock *tp)
+{
+        struct bictcp *ca = tcp_ca(tp);
+
+        ca->epoch_start = 0;    /* end of epoch */
+
+        /* in case of wrong delay_max*/
+        if (ca->delay_min > 0 && ca->delay_max > ca->delay_min)
+                ca->delay_max = ca->delay_min
+                        + ((ca->delay_max - ca->delay_min)* 90) / 100;
+
+        /* Wmax and fast convergence */
+        if (tp->snd_cwnd < ca->last_max_cwnd && fast_convergence)
+                ca->last_max_cwnd = (tp->snd_cwnd * (BICTCP_BETA_SCALE + beta))
+                        / (2 * BICTCP_BETA_SCALE);
+        else
+                ca->last_max_cwnd = tp->snd_cwnd;
+
+        ca->loss_cwnd = tp->snd_cwnd;
+
+
+        if (tp->snd_cwnd <= low_window)
+                return max(tp->snd_cwnd >> 1U, 2U);
+        else
+                return max((tp->snd_cwnd * beta) / BICTCP_BETA_SCALE, 2U);
+}
+
+static u32 bictcp_undo_cwnd(struct tcp_sock *tp)
+{
+        struct bictcp *ca = tcp_ca(tp);
+
+        return max(tp->snd_cwnd, ca->last_max_cwnd);
+}
+
+static u32 bictcp_min_cwnd(struct tcp_sock *tp)
+{
+        return tp->snd_ssthresh;
+}
+
+static void bictcp_state(struct tcp_sock *tp, u8 new_state)
+{
+        if (new_state == TCP_CA_Loss)
+                bictcp_reset(tcp_ca(tp));
+}
+
+/* Track delayed acknowledgement ratio using sliding window
+ * ratio = (15*ratio + sample) / 16
+ */
+static void bictcp_acked(struct tcp_sock *tp, u32 cnt)
+{
+        if (cnt > 0 &&  tp->ca_state == TCP_CA_Open) {
+                struct bictcp *ca = tcp_ca(tp);
+                cnt -= ca->delayed_ack >> ACK_RATIO_SHIFT;
+                ca->delayed_ack += cnt;
+        }
+}
+
+
+static struct tcp_congestion_ops bictcp = {
+        .init           = bictcp_init,
+        .ssthresh       = bictcp_recalc_ssthresh,
+        .cong_avoid     = bictcp_cong_avoid,
+        .set_state      = bictcp_state,
+        .undo_cwnd      = bictcp_undo_cwnd,
+        .min_cwnd       = bictcp_min_cwnd,
+        .pkts_acked     = bictcp_acked,
+        .owner          = THIS_MODULE,
+        .name           = "bic",
+};
+
+static int __init bictcp_register(void)
+{
+        BUG_ON(sizeof(struct bictcp) > TCP_CA_PRIV_SIZE);
+        return tcp_register_congestion_control(&bictcp);
+}
+
+static void __exit bictcp_unregister(void)
+{
+        tcp_unregister_congestion_control(&bictcp);
+}
+
+module_init(bictcp_register);
+module_exit(bictcp_unregister);
+
+MODULE_AUTHOR("Stephen Hemminger");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("BIC TCP");
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
new file mode 100644
index 0000000000..4970d10a77
--- /dev/null
+++ b/net/ipv4/tcp_cong.c
@@ -0,0 +1,237 @@
+/*
+ * Plugable TCP congestion control support and newReno
+ * congestion control.
+ * Based on ideas from I/O scheduler suport and Web100.
+ *
+ * Copyright (C) 2005 Stephen Hemminger <shemminger@osdl.org>
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/mm.h>
+#include <linux/types.h>
+#include <linux/list.h>
+#include <net/tcp.h>
+
+static DEFINE_SPINLOCK(tcp_cong_list_lock);
+static LIST_HEAD(tcp_cong_list);
+
+/* Simple linear search, don't expect many entries! */
+static struct tcp_congestion_ops *tcp_ca_find(const char *name)
+{
+        struct tcp_congestion_ops *e;
+
+        list_for_each_entry_rcu(e, &tcp_cong_list, list) {
+                if (strcmp(e->name, name) == 0)
+                        return e;
+        }
+
+        return NULL;
+}
+
+/*
+ * Attach new congestion control algorthim to the list
+ * of available options.
+ */
+int tcp_register_congestion_control(struct tcp_congestion_ops *ca)
+{
+        int ret = 0;
+
+        /* all algorithms must implement ssthresh and cong_avoid ops */
+        if (!ca->ssthresh || !ca->cong_avoid || !ca->min_cwnd) {
+                printk(KERN_ERR "TCP %s does not implement required ops\n",
+                       ca->name);
+                return -EINVAL;
+        }
+
+        spin_lock(&tcp_cong_list_lock);
+        if (tcp_ca_find(ca->name)) {
+                printk(KERN_NOTICE "TCP %s already registered\n", ca->name);
+                ret = -EEXIST;
+        } else {
+                list_add_rcu(&ca->list, &tcp_cong_list);
+                printk(KERN_INFO "TCP %s registered\n", ca->name);
+        }
+        spin_unlock(&tcp_cong_list_lock);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(tcp_register_congestion_control);
+
+/*
+ * Remove congestion control algorithm, called from
+ * the module's remove function.  Module ref counts are used
+ * to ensure that this can't be done till all sockets using
+ * that method are closed.
+ */
+void tcp_unregister_congestion_control(struct tcp_congestion_ops *ca)
+{
+        spin_lock(&tcp_cong_list_lock);
+        list_del_rcu(&ca->list);
+        spin_unlock(&tcp_cong_list_lock);
+}
+EXPORT_SYMBOL_GPL(tcp_unregister_congestion_control);
+
+/* Assign choice of congestion control. */
+void tcp_init_congestion_control(struct tcp_sock *tp)
+{
+        struct tcp_congestion_ops *ca;
+
+        if (tp->ca_ops != &tcp_init_congestion_ops)
+                return;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(ca, &tcp_cong_list, list) {
+                if (try_module_get(ca->owner)) {
+                        tp->ca_ops = ca;
+                        break;
+                }
+
+        }
+        rcu_read_unlock();
+
+        if (tp->ca_ops->init)
+                tp->ca_ops->init(tp);
+}
+
+/* Manage refcounts on socket close. */
+void tcp_cleanup_congestion_control(struct tcp_sock *tp)
+{
+        if (tp->ca_ops->release)
+                tp->ca_ops->release(tp);
+        module_put(tp->ca_ops->owner);
+}
+
+/* Used by sysctl to change default congestion control */
+int tcp_set_default_congestion_control(const char *name)
+{
+        struct tcp_congestion_ops *ca;
+        int ret = -ENOENT;
+
+        spin_lock(&tcp_cong_list_lock);
+        ca = tcp_ca_find(name);
+#ifdef CONFIG_KMOD
+        if (!ca) {
+                spin_unlock(&tcp_cong_list_lock);
+
+                request_module("tcp_%s", name);
+                spin_lock(&tcp_cong_list_lock);
+                ca = tcp_ca_find(name);
+        }
+#endif
+
+        if (ca) {
+                list_move(&ca->list, &tcp_cong_list);
+                ret = 0;
+        }
+        spin_unlock(&tcp_cong_list_lock);
+
+        return ret;
+}
+
+/* Get current default congestion control */
+void tcp_get_default_congestion_control(char *name)
+{
+        struct tcp_congestion_ops *ca;
+        /* We will always have reno... */
+        BUG_ON(list_empty(&tcp_cong_list));
+
+        rcu_read_lock();
+        ca = list_entry(tcp_cong_list.next, struct tcp_congestion_ops, list);
+        strncpy(name, ca->name, TCP_CA_NAME_MAX);
+        rcu_read_unlock();
+}
+
+/* Change congestion control for socket */
+int tcp_set_congestion_control(struct tcp_sock *tp, const char *name)
+{
+        struct tcp_congestion_ops *ca;
+        int err = 0;
+
+        rcu_read_lock();
+        ca = tcp_ca_find(name);
+        if (ca == tp->ca_ops)
+                goto out;
+
+        if (!ca)
+                err = -ENOENT;
+
+        else if (!try_module_get(ca->owner))
+                err = -EBUSY;
+
+        else {
+                tcp_cleanup_congestion_control(tp);
+                tp->ca_ops = ca;
+                if (tp->ca_ops->init)
+                        tp->ca_ops->init(tp);
+        }
+ out:
+        rcu_read_unlock();
+        return err;
+}
+
+/*
+ * TCP Reno congestion control
+ * This is special case used for fallback as well.
+ */
+/* This is Jacobson's slow start and congestion avoidance.
+ * SIGCOMM '88, p. 328.
+ */
+void tcp_reno_cong_avoid(struct tcp_sock *tp, u32 ack, u32 rtt, u32 in_flight,
+                         int flag)
+{
+        if (in_flight < tp->snd_cwnd)
+                return;
+
+        if (tp->snd_cwnd <= tp->snd_ssthresh) {
+                /* In "safe" area, increase. */
+                if (tp->snd_cwnd < tp->snd_cwnd_clamp)
+                        tp->snd_cwnd++;
+        } else {
+                /* In dangerous area, increase slowly.
+                 * In theory this is tp->snd_cwnd += 1 / tp->snd_cwnd
+                 */
+                if (tp->snd_cwnd_cnt >= tp->snd_cwnd) {
+                        if (tp->snd_cwnd < tp->snd_cwnd_clamp)
+                                tp->snd_cwnd++;
+                        tp->snd_cwnd_cnt = 0;
+                } else
+                        tp->snd_cwnd_cnt++;
+        }
+}
+EXPORT_SYMBOL_GPL(tcp_reno_cong_avoid);
+
+/* Slow start threshold is half the congestion window (min 2) */
+u32 tcp_reno_ssthresh(struct tcp_sock *tp)
+{
+        return max(tp->snd_cwnd >> 1U, 2U);
+}
+EXPORT_SYMBOL_GPL(tcp_reno_ssthresh);
+
+/* Lower bound on congestion window. */
+u32 tcp_reno_min_cwnd(struct tcp_sock *tp)
+{
+        return tp->snd_ssthresh/2;
+}
+EXPORT_SYMBOL_GPL(tcp_reno_min_cwnd);
+
+struct tcp_congestion_ops tcp_reno = {
+        .name           = "reno",
+        .owner          = THIS_MODULE,
+        .ssthresh       = tcp_reno_ssthresh,
+        .cong_avoid     = tcp_reno_cong_avoid,
+        .min_cwnd       = tcp_reno_min_cwnd,
+};
+
+/* Initial congestion control used (until SYN)
+ * really reno under another name so we can tell difference
+ * during tcp_set_default_congestion_control
+ */
+struct tcp_congestion_ops tcp_init_congestion_ops  = {
+        .name           = "",
+        .owner          = THIS_MODULE,
+        .ssthresh       = tcp_reno_ssthresh,
+        .cong_avoid     = tcp_reno_cong_avoid,
+        .min_cwnd       = tcp_reno_min_cwnd,
+};
+EXPORT_SYMBOL_GPL(tcp_init_congestion_ops);
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index 634befc079..f66945cb15 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -42,15 +42,8 @@ struct tcpdiag_entry
 
 static struct sock *tcpnl;
 
-
 #define TCPDIAG_PUT(skb, attrtype, attrlen) \
-({ int rtalen = RTA_LENGTH(attrlen);        \
-   struct rtattr *rta;                      \
-   if (skb_tailroom(skb) < RTA_ALIGN(rtalen)) goto nlmsg_failure; \
-   rta = (void*)__skb_put(skb, RTA_ALIGN(rtalen)); \
-   rta->rta_type = attrtype;                \
-   rta->rta_len = rtalen;                   \
-   RTA_DATA(rta); })
+        RTA_DATA(__RTA_PUT(skb, attrtype, attrlen))
 
 static int tcpdiag_fill(struct sk_buff *skb, struct sock *sk,
                         int ext, u32 pid, u32 seq, u16 nlmsg_flags)
@@ -61,7 +54,6 @@ static int tcpdiag_fill(struct sk_buff *skb, struct sock *sk,
         struct nlmsghdr  *nlh;
         struct tcp_info  *info = NULL;
         struct tcpdiag_meminfo  *minfo = NULL;
-        struct tcpvegas_info *vinfo = NULL;
         unsigned char    *b = skb->tail;
 
         nlh = NLMSG_PUT(skb, pid, seq, TCPDIAG_GETSOCK, sizeof(*r));
@@ -73,9 +65,11 @@ static int tcpdiag_fill(struct sk_buff *skb, struct sock *sk,
                 if (ext & (1<<(TCPDIAG_INFO-1)))
                         info = TCPDIAG_PUT(skb, TCPDIAG_INFO, sizeof(*info));
                 
-                if ((tcp_is_westwood(tp) || tcp_is_vegas(tp))
-                    && (ext & (1<<(TCPDIAG_VEGASINFO-1))))
-                        vinfo = TCPDIAG_PUT(skb, TCPDIAG_VEGASINFO, sizeof(*vinfo));
+                if (ext & (1<<(TCPDIAG_CONG-1))) {
+                        size_t len = strlen(tp->ca_ops->name);
+                        strcpy(TCPDIAG_PUT(skb, TCPDIAG_CONG, len+1),
+                               tp->ca_ops->name);
+                }
         }
         r->tcpdiag_family = sk->sk_family;
         r->tcpdiag_state = sk->sk_state;
@@ -166,23 +160,13 @@ static int tcpdiag_fill(struct sk_buff *skb, struct sock *sk,
         if (info) 
                 tcp_get_info(sk, info);
 
-        if (vinfo) {
-                if (tcp_is_vegas(tp)) {
-                        vinfo->tcpv_enabled = tp->vegas.doing_vegas_now;
-                        vinfo->tcpv_rttcnt = tp->vegas.cntRTT;
-                        vinfo->tcpv_rtt = jiffies_to_usecs(tp->vegas.baseRTT);
-                        vinfo->tcpv_minrtt = jiffies_to_usecs(tp->vegas.minRTT);
-                } else {
-                        vinfo->tcpv_enabled = 0;
-                        vinfo->tcpv_rttcnt = 0;
-                        vinfo->tcpv_rtt = jiffies_to_usecs(tp->westwood.rtt);
-                        vinfo->tcpv_minrtt = jiffies_to_usecs(tp->westwood.rtt_min);
-                }
-        }
+        if (sk->sk_state < TCP_TIME_WAIT && tp->ca_ops->get_info)
+                tp->ca_ops->get_info(tp, ext, skb);
 
         nlh->nlmsg_len = skb->tail - b;
         return skb->len;
 
+rtattr_failure:
 nlmsg_failure:
         skb_trim(skb, b - skb->data);
         return -1;
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c
new file mode 100644
index 0000000000..36c51f8136
--- /dev/null
+++ b/net/ipv4/tcp_highspeed.c
@@ -0,0 +1,181 @@
+/*
+ * Sally Floyd's High Speed TCP (RFC 3649) congestion control
+ *
+ * See http://www.icir.org/floyd/hstcp.html
+ *
+ * John Heffner <jheffner@psc.edu>
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <net/tcp.h>
+
+
+/* From AIMD tables from RFC 3649 appendix B,
+ * with fixed-point MD scaled <<8.
+ */
+static const struct hstcp_aimd_val {
+        unsigned int cwnd;
+        unsigned int md;
+} hstcp_aimd_vals[] = {
+ {     38,  128, /*  0.50 */ },
+ {    118,  112, /*  0.44 */ },
+ {    221,  104, /*  0.41 */ },
+ {    347,   98, /*  0.38 */ },
+ {    495,   93, /*  0.37 */ },
+ {    663,   89, /*  0.35 */ },
+ {    851,   86, /*  0.34 */ },
+ {   1058,   83, /*  0.33 */ },
+ {   1284,   81, /*  0.32 */ },
+ {   1529,   78, /*  0.31 */ },
+ {   1793,   76, /*  0.30 */ },
+ {   2076,   74, /*  0.29 */ },
+ {   2378,   72, /*  0.28 */ },
+ {   2699,   71, /*  0.28 */ },
+ {   3039,   69, /*  0.27 */ },
+ {   3399,   68, /*  0.27 */ },
+ {   3778,   66, /*  0.26 */ },
+ {   4177,   65, /*  0.26 */ },
+ {   4596,   64, /*  0.25 */ },
+ {   5036,   62, /*  0.25 */ },
+ {   5497,   61, /*  0.24 */ },
+ {   5979,   60, /*  0.24 */ },
+ {   6483,   59, /*  0.23 */ },
+ {   7009,   58, /*  0.23 */ },
+ {   7558,   57, /*  0.22 */ },
+ {   8130,   56, /*  0.22 */ },
+ {   8726,   55, /*  0.22 */ },
+ {   9346,   54, /*  0.21 */ },
+ {   9991,   53, /*  0.21 */ },
+ {  10661,   52, /*  0.21 */ },
+ {  11358,   52, /*  0.20 */ },
+ {  12082,   51, /*  0.20 */ },
+ {  12834,   50, /*  0.20 */ },
+ {  13614,   49, /*  0.19 */ },
+ {  14424,   48, /*  0.19 */ },
+ {  15265,   48, /*  0.19 */ },
+ {  16137,   47, /*  0.19 */ },
+ {  17042,   46, /*  0.18 */ },
+ {  17981,   45, /*  0.18 */ },
+ {  18955,   45, /*  0.18 */ },
+ {  19965,   44, /*  0.17 */ },
+ {  21013,   43, /*  0.17 */ },
+ {  22101,   43, /*  0.17 */ },
+ {  23230,   42, /*  0.17 */ },
+ {  24402,   41, /*  0.16 */ },
+ {  25618,   41, /*  0.16 */ },
+ {  26881,   40, /*  0.16 */ },
+ {  28193,   39, /*  0.16 */ },
+ {  29557,   39, /*  0.15 */ },
+ {  30975,   38, /*  0.15 */ },
+ {  32450,   38, /*  0.15 */ },
+ {  33986,   37, /*  0.15 */ },
+ {  35586,   36, /*  0.14 */ },
+ {  37253,   36, /*  0.14 */ },
+ {  38992,   35, /*  0.14 */ },
+ {  40808,   35, /*  0.14 */ },
+ {  42707,   34, /*  0.13 */ },
+ {  44694,   33, /*  0.13 */ },
+ {  46776,   33, /*  0.13 */ },
+ {  48961,   32, /*  0.13 */ },
+ {  51258,   32, /*  0.13 */ },
+ {  53677,   31, /*  0.12 */ },
+ {  56230,   30, /*  0.12 */ },
+ {  58932,   30, /*  0.12 */ },
+ {  61799,   29, /*  0.12 */ },
+ {  64851,   28, /*  0.11 */ },
+ {  68113,   28, /*  0.11 */ },
+ {  71617,   27, /*  0.11 */ },
+ {  75401,   26, /*  0.10 */ },
+ {  79517,   26, /*  0.10 */ },
+ {  84035,   25, /*  0.10 */ },
+ {  89053,   24, /*  0.10 */ },
+};
+
+#define HSTCP_AIMD_MAX  ARRAY_SIZE(hstcp_aimd_vals)
+
+struct hstcp {
+        u32     ai;
+};
+
+static void hstcp_init(struct tcp_sock *tp)
+{
+        struct hstcp *ca = tcp_ca(tp);
+
+        ca->ai = 0;
+
+        /* Ensure the MD arithmetic works.  This is somewhat pedantic,
+         * since I don't think we will see a cwnd this large. :) */
+        tp->snd_cwnd_clamp = min_t(u32, tp->snd_cwnd_clamp, 0xffffffff/128);
+}
+
+static void hstcp_cong_avoid(struct tcp_sock *tp, u32 adk, u32 rtt,
+                             u32 in_flight, int good)
+{
+        struct hstcp *ca = tcp_ca(tp);
+
+        if (in_flight < tp->snd_cwnd)
+                return;
+
+        if (tp->snd_cwnd <= tp->snd_ssthresh) {
+                if (tp->snd_cwnd < tp->snd_cwnd_clamp)
+                        tp->snd_cwnd++;
+        } else {
+                /* Update AIMD parameters */
+                if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) {
+                        while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
+                               ca->ai < HSTCP_AIMD_MAX)
+                                ca->ai++;
+                } else if (tp->snd_cwnd < hstcp_aimd_vals[ca->ai].cwnd) {
+                        while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
+                               ca->ai > 0)
+                                ca->ai--;
+                }
+
+                /* Do additive increase */
+                if (tp->snd_cwnd < tp->snd_cwnd_clamp) {
+                        tp->snd_cwnd_cnt += ca->ai;
+                        if (tp->snd_cwnd_cnt >= tp->snd_cwnd) {
+                                tp->snd_cwnd++;
+                                tp->snd_cwnd_cnt -= tp->snd_cwnd;
+                        }
+                }
+        }
+}
+
+static u32 hstcp_ssthresh(struct tcp_sock *tp)
+{
+        struct hstcp *ca = tcp_ca(tp);
+
+        /* Do multiplicative decrease */
+        return max(tp->snd_cwnd - ((tp->snd_cwnd * hstcp_aimd_vals[ca->ai].md) >> 8), 2U);
+}
+
+
+static struct tcp_congestion_ops tcp_highspeed = {
+        .init           = hstcp_init,
+        .ssthresh       = hstcp_ssthresh,
+        .cong_avoid     = hstcp_cong_avoid,
+        .min_cwnd       = tcp_reno_min_cwnd,
+
+        .owner          = THIS_MODULE,
+        .name           = "highspeed"
+};
+
+static int __init hstcp_register(void)
+{
+        BUG_ON(sizeof(struct hstcp) > TCP_CA_PRIV_SIZE);
+        return tcp_register_congestion_control(&tcp_highspeed);
+}
+
+static void __exit hstcp_unregister(void)
+{
+        tcp_unregister_congestion_control(&tcp_highspeed);
+}
+
+module_init(hstcp_register);
+module_exit(hstcp_unregister);
+
+MODULE_AUTHOR("John Heffner");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("High Speed TCP");
diff --git a/net/ipv4/tcp_htcp.c b/net/ipv4/tcp_htcp.c
new file mode 100644
index 0000000000..40168275ac
--- /dev/null
+++ b/net/ipv4/tcp_htcp.c
@@ -0,0 +1,289 @@
+/*
+ * H-TCP congestion control. The algorithm is detailed in:
+ * R.N.Shorten, D.J.Leith:
+ *   "H-TCP: TCP for high-speed and long-distance networks"
+ *   Proc. PFLDnet, Argonne, 2004.
+ * http://www.hamilton.ie/net/htcp3.pdf
+ */
+
+#include <linux/config.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <net/tcp.h>
+
+#define ALPHA_BASE      (1<<7)  /* 1.0 with shift << 7 */
+#define BETA_MIN        (1<<6)  /* 0.5 with shift << 7 */
+#define BETA_MAX        102     /* 0.8 with shift << 7 */
+
+static int use_rtt_scaling = 1;
+module_param(use_rtt_scaling, int, 0644);
+MODULE_PARM_DESC(use_rtt_scaling, "turn on/off RTT scaling");
+
+static int use_bandwidth_switch = 1;
+module_param(use_bandwidth_switch, int, 0644);
+MODULE_PARM_DESC(use_bandwidth_switch, "turn on/off bandwidth switcher");
+
+struct htcp {
+        u16     alpha;          /* Fixed point arith, << 7 */
+        u8      beta;           /* Fixed point arith, << 7 */
+        u8      modeswitch;     /* Delay modeswitch until we had at least one congestion event */
+        u8      ccount;         /* Number of RTTs since last congestion event */
+        u8      undo_ccount;
+        u16     packetcount;
+        u32     minRTT;
+        u32     maxRTT;
+        u32     snd_cwnd_cnt2;
+
+        u32     undo_maxRTT;
+        u32     undo_old_maxB;
+
+        /* Bandwidth estimation */
+        u32     minB;
+        u32     maxB;
+        u32     old_maxB;
+        u32     Bi;
+        u32     lasttime;
+};
+
+static inline void htcp_reset(struct htcp *ca)
+{
+        ca->undo_ccount = ca->ccount;
+        ca->undo_maxRTT = ca->maxRTT;
+        ca->undo_old_maxB = ca->old_maxB;
+
+        ca->ccount = 0;
+        ca->snd_cwnd_cnt2 = 0;
+}
+
+static u32 htcp_cwnd_undo(struct tcp_sock *tp)
+{
+        struct htcp *ca = tcp_ca(tp);
+        ca->ccount = ca->undo_ccount;
+        ca->maxRTT = ca->undo_maxRTT;
+        ca->old_maxB = ca->undo_old_maxB;
+        return max(tp->snd_cwnd, (tp->snd_ssthresh<<7)/ca->beta);
+}
+
+static inline void measure_rtt(struct tcp_sock *tp)
+{
+        struct htcp *ca = tcp_ca(tp);
+        u32 srtt = tp->srtt>>3;
+
+        /* keep track of minimum RTT seen so far, minRTT is zero at first */
+        if (ca->minRTT > srtt || !ca->minRTT)
+                ca->minRTT = srtt;
+
+        /* max RTT */
+        if (tp->ca_state == TCP_CA_Open && tp->snd_ssthresh < 0xFFFF && ca->ccount > 3) {
+                if (ca->maxRTT < ca->minRTT)
+                        ca->maxRTT = ca->minRTT;
+                if (ca->maxRTT < srtt && srtt <= ca->maxRTT+HZ/50)
+                        ca->maxRTT = srtt;
+        }
+}
+
+static void measure_achieved_throughput(struct tcp_sock *tp, u32 pkts_acked)
+{
+        struct htcp *ca = tcp_ca(tp);
+        u32 now = tcp_time_stamp;
+
+        /* achieved throughput calculations */
+        if (tp->ca_state != TCP_CA_Open && tp->ca_state != TCP_CA_Disorder) {
+                ca->packetcount = 0;
+                ca->lasttime = now;
+                return;
+        }
+
+        ca->packetcount += pkts_acked;
+
+        if (ca->packetcount >= tp->snd_cwnd - (ca->alpha>>7? : 1)
+                        && now - ca->lasttime >= ca->minRTT
+                        && ca->minRTT > 0) {
+                __u32 cur_Bi = ca->packetcount*HZ/(now - ca->lasttime);
+                if (ca->ccount <= 3) {
+                        /* just after backoff */
+                        ca->minB = ca->maxB = ca->Bi = cur_Bi;
+                } else {
+                        ca->Bi = (3*ca->Bi + cur_Bi)/4;
+                        if (ca->Bi > ca->maxB)
+                                ca->maxB = ca->Bi;
+                        if (ca->minB > ca->maxB)
+                                ca->minB = ca->maxB;
+                }
+                ca->packetcount = 0;
+                ca->lasttime = now;
+        }
+}
+
+static inline void htcp_beta_update(struct htcp *ca, u32 minRTT, u32 maxRTT)
+{
+        if (use_bandwidth_switch) {
+                u32 maxB = ca->maxB;
+                u32 old_maxB = ca->old_maxB;
+                ca->old_maxB = ca->maxB;
+
+                if (!between(5*maxB, 4*old_maxB, 6*old_maxB)) {
+                        ca->beta = BETA_MIN;
+                        ca->modeswitch = 0;
+                        return;
+                }
+        }
+
+        if (ca->modeswitch && minRTT > max(HZ/100, 1) && maxRTT) {
+                ca->beta = (minRTT<<7)/maxRTT;
+                if (ca->beta < BETA_MIN)
+                        ca->beta = BETA_MIN;
+                else if (ca->beta > BETA_MAX)
+                        ca->beta = BETA_MAX;
+        } else {
+                ca->beta = BETA_MIN;
+                ca->modeswitch = 1;
+        }
+}
+
+static inline void htcp_alpha_update(struct htcp *ca)
+{
+        u32 minRTT = ca->minRTT;
+        u32 factor = 1;
+        u32 diff = ca->ccount * minRTT; /* time since last backoff */
+
+        if (diff > HZ) {
+                diff -= HZ;
+                factor = 1+ ( 10*diff + ((diff/2)*(diff/2)/HZ) )/HZ;
+        }
+
+        if (use_rtt_scaling && minRTT) {
+                u32 scale = (HZ<<3)/(10*minRTT);
+                scale = min(max(scale, 1U<<2), 10U<<3); /* clamping ratio to interval [0.5,10]<<3 */
+                factor = (factor<<3)/scale;
+                if (!factor)
+                        factor = 1;
+        }
+
+        ca->alpha = 2*factor*((1<<7)-ca->beta);
+        if (!ca->alpha)
+                ca->alpha = ALPHA_BASE;
+}
+
+/* After we have the rtt data to calculate beta, we'd still prefer to wait one
+ * rtt before we adjust our beta to ensure we are working from a consistent
+ * data.
+ *
+ * This function should be called when we hit a congestion event since only at
+ * that point do we really have a real sense of maxRTT (the queues en route
+ * were getting just too full now).
+ */
+static void htcp_param_update(struct tcp_sock *tp)
+{
+        struct htcp *ca = tcp_ca(tp);
+        u32 minRTT = ca->minRTT;
+        u32 maxRTT = ca->maxRTT;
+
+        htcp_beta_update(ca, minRTT, maxRTT);
+        htcp_alpha_update(ca);
+
+        /* add slowly fading memory for maxRTT to accommodate routing changes etc */
+        if (minRTT > 0 && maxRTT > minRTT)
+                ca->maxRTT = minRTT + ((maxRTT-minRTT)*95)/100;
+}
+
+static u32 htcp_recalc_ssthresh(struct tcp_sock *tp)
+{
+        struct htcp *ca = tcp_ca(tp);
+        htcp_param_update(tp);
+        return max((tp->snd_cwnd * ca->beta) >> 7, 2U);
+}
+
+static void htcp_cong_avoid(struct tcp_sock *tp, u32 ack, u32 rtt,
+                            u32 in_flight, int data_acked)
+{
+        struct htcp *ca = tcp_ca(tp);
+
+        if (in_flight < tp->snd_cwnd)
+                return;
+
+        if (tp->snd_cwnd <= tp->snd_ssthresh) {
+                /* In "safe" area, increase. */
+                if (tp->snd_cwnd < tp->snd_cwnd_clamp)
+                        tp->snd_cwnd++;
+        } else {
+                measure_rtt(tp);
+
+                /* keep track of number of round-trip times since last backoff event */
+                if (ca->snd_cwnd_cnt2++ > tp->snd_cwnd) {
+                        ca->ccount++;
+                        ca->snd_cwnd_cnt2 = 0;
+                        htcp_alpha_update(ca);
+                }
+
+                /* In dangerous area, increase slowly.
+                 * In theory this is tp->snd_cwnd += alpha / tp->snd_cwnd
+                 */
+                if ((tp->snd_cwnd_cnt++ * ca->alpha)>>7 >= tp->snd_cwnd) {
+                        if (tp->snd_cwnd < tp->snd_cwnd_clamp)
+                                tp->snd_cwnd++;
+                        tp->snd_cwnd_cnt = 0;
+                        ca->ccount++;
+                }
+        }
+}
+
+/* Lower bound on congestion window. */
+static u32 htcp_min_cwnd(struct tcp_sock *tp)
+{
+        return tp->snd_ssthresh;
+}
+
+
+static void htcp_init(struct tcp_sock *tp)
+{
+        struct htcp *ca = tcp_ca(tp);
+
+        memset(ca, 0, sizeof(struct htcp));
+        ca->alpha = ALPHA_BASE;
+        ca->beta = BETA_MIN;
+}
+
+static void htcp_state(struct tcp_sock *tp, u8 new_state)
+{
+        switch (new_state) {
+        case TCP_CA_CWR:
+        case TCP_CA_Recovery:
+        case TCP_CA_Loss:
+                htcp_reset(tcp_ca(tp));
+                break;
+        }
+}
+
+static struct tcp_congestion_ops htcp = {
+        .init           = htcp_init,
+        .ssthresh       = htcp_recalc_ssthresh,
+        .min_cwnd       = htcp_min_cwnd,
+        .cong_avoid     = htcp_cong_avoid,
+        .set_state      = htcp_state,
+        .undo_cwnd      = htcp_cwnd_undo,
+        .pkts_acked     = measure_achieved_throughput,
+        .owner          = THIS_MODULE,
+        .name           = "htcp",
+};
+
+static int __init htcp_register(void)
+{
+        BUG_ON(sizeof(struct htcp) > TCP_CA_PRIV_SIZE);
+        BUILD_BUG_ON(BETA_MIN >= BETA_MAX);
+        if (!use_bandwidth_switch)
+                htcp.pkts_acked = NULL;
+        return tcp_register_congestion_control(&htcp);
+}
+
+static void __exit htcp_unregister(void)
+{
+        tcp_unregister_congestion_control(&htcp);
+}
+
+module_init(htcp_register);
+module_exit(htcp_unregister);
+
+MODULE_AUTHOR("Baruch Even");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("H-TCP");
diff --git a/net/ipv4/tcp_hybla.c b/net/ipv4/tcp_hybla.c
new file mode 100644
index 0000000000..13a66342c3
--- /dev/null
+++ b/net/ipv4/tcp_hybla.c
@@ -0,0 +1,187 @@
+/*
+ * TCP HYBLA
+ *
+ * TCP-HYBLA Congestion control algorithm, based on:
+ *   C.Caini, R.Firrincieli, "TCP-Hybla: A TCP Enhancement
+ *   for Heterogeneous Networks",
+ *   International Journal on satellite Communications,
+ *                                     September 2004
+ *    Daniele Lacamera
+ *    root at danielinux.net
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <net/tcp.h>
+
+/* Tcp Hybla structure. */
+struct hybla {
+        u8    hybla_en;
+        u32   snd_cwnd_cents; /* Keeps increment values when it is <1, <<7 */
+        u32   rho;            /* Rho parameter, integer part  */
+        u32   rho2;           /* Rho * Rho, integer part */
+        u32   rho_3ls;        /* Rho parameter, <<3 */
+        u32   rho2_7ls;       /* Rho^2, <<7     */
+        u32   minrtt;         /* Minimum smoothed round trip time value seen */
+};
+
+/* Hybla reference round trip time (default= 1/40 sec = 25 ms),
+   expressed in jiffies */
+static int rtt0 = 25;
+module_param(rtt0, int, 0644);
+MODULE_PARM_DESC(rtt0, "reference rout trip time (ms)");
+
+
+/* This is called to refresh values for hybla parameters */
+static inline void hybla_recalc_param (struct tcp_sock *tp)
+{
+        struct hybla *ca = tcp_ca(tp);
+
+        ca->rho_3ls = max_t(u32, tp->srtt / msecs_to_jiffies(rtt0), 8);
+        ca->rho = ca->rho_3ls >> 3;
+        ca->rho2_7ls = (ca->rho_3ls * ca->rho_3ls) << 1;
+        ca->rho2 = ca->rho2_7ls >>7;
+}
+
+static void hybla_init(struct tcp_sock *tp)
+{
+        struct hybla *ca = tcp_ca(tp);
+
+        ca->rho = 0;
+        ca->rho2 = 0;
+        ca->rho_3ls = 0;
+        ca->rho2_7ls = 0;
+        ca->snd_cwnd_cents = 0;
+        ca->hybla_en = 1;
+        tp->snd_cwnd = 2;
+        tp->snd_cwnd_clamp = 65535;
+
+        /* 1st Rho measurement based on initial srtt */
+        hybla_recalc_param(tp);
+
+        /* set minimum rtt as this is the 1st ever seen */
+        ca->minrtt = tp->srtt;
+        tp->snd_cwnd = ca->rho;
+}
+
+static void hybla_state(struct tcp_sock *tp, u8 ca_state)
+{
+        struct hybla *ca = tcp_ca(tp);
+
+        ca->hybla_en = (ca_state == TCP_CA_Open);
+}
+
+static inline u32 hybla_fraction(u32 odds)
+{
+        static const u32 fractions[] = {
+                128, 139, 152, 165, 181, 197, 215, 234,
+        };
+
+        return (odds < ARRAY_SIZE(fractions)) ? fractions[odds] : 128;
+}
+
+/* TCP Hybla main routine.
+ * This is the algorithm behavior:
+ *     o Recalc Hybla parameters if min_rtt has changed
+ *     o Give cwnd a new value based on the model proposed
+ *     o remember increments <1
+ */
+static void hybla_cong_avoid(struct tcp_sock *tp, u32 ack, u32 rtt,
+                            u32 in_flight, int flag)
+{
+        struct hybla *ca = tcp_ca(tp);
+        u32 increment, odd, rho_fractions;
+        int is_slowstart = 0;
+
+        /*  Recalculate rho only if this srtt is the lowest */
+        if (tp->srtt < ca->minrtt){
+                hybla_recalc_param(tp);
+                ca->minrtt = tp->srtt;
+        }
+
+        if (!ca->hybla_en)
+                return tcp_reno_cong_avoid(tp, ack, rtt, in_flight, flag);
+
+        if (in_flight < tp->snd_cwnd)
+                return;
+
+        if (ca->rho == 0)
+                hybla_recalc_param(tp);
+
+        rho_fractions = ca->rho_3ls - (ca->rho << 3);
+
+        if (tp->snd_cwnd < tp->snd_ssthresh) {
+                /*
+                 * slow start
+                 *      INC = 2^RHO - 1
+                 * This is done by splitting the rho parameter
+                 * into 2 parts: an integer part and a fraction part.
+                 * Inrement<<7 is estimated by doing:
+                 *             [2^(int+fract)]<<7
+                 * that is equal to:
+                 *             (2^int)  *  [(2^fract) <<7]
+                 * 2^int is straightly computed as 1<<int,
+                 * while we will use hybla_slowstart_fraction_increment() to
+                 * calculate 2^fract in a <<7 value.
+                 */
+                is_slowstart = 1;
+                increment = ((1 << ca->rho) * hybla_fraction(rho_fractions))
+                        - 128;
+        } else {
+                /*
+                 * congestion avoidance
+                 * INC = RHO^2 / W
+                 * as long as increment is estimated as (rho<<7)/window
+                 * it already is <<7 and we can easily count its fractions.
+                 */
+                increment = ca->rho2_7ls / tp->snd_cwnd;
+                if (increment < 128)
+                        tp->snd_cwnd_cnt++;
+        }
+
+        odd = increment % 128;
+        tp->snd_cwnd += increment >> 7;
+        ca->snd_cwnd_cents += odd;
+
+        /* check when fractions goes >=128 and increase cwnd by 1. */
+        while(ca->snd_cwnd_cents >= 128) {
+                tp->snd_cwnd++;
+                ca->snd_cwnd_cents -= 128;
+                tp->snd_cwnd_cnt = 0;
+        }
+
+        /* clamp down slowstart cwnd to ssthresh value. */
+        if (is_slowstart)
+                tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
+
+        tp->snd_cwnd = min_t(u32, tp->snd_cwnd, tp->snd_cwnd_clamp);
+}
+
+static struct tcp_congestion_ops tcp_hybla = {
+        .init           = hybla_init,
+        .ssthresh       = tcp_reno_ssthresh,
+        .min_cwnd       = tcp_reno_min_cwnd,
+        .cong_avoid     = hybla_cong_avoid,
+        .set_state      = hybla_state,
+
+        .owner          = THIS_MODULE,
+        .name           = "hybla"
+};
+
+static int __init hybla_register(void)
+{
+        BUG_ON(sizeof(struct hybla) > TCP_CA_PRIV_SIZE);
+        return tcp_register_congestion_control(&tcp_hybla);
+}
+
+static void __exit hybla_unregister(void)
+{
+        tcp_unregister_congestion_control(&tcp_hybla);
+}
+
+module_init(hybla_register);
+module_exit(hybla_unregister);
+
+MODULE_AUTHOR("Daniele Lacamera");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("TCP Hybla");
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 5bad504630..53a8a5399f 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -61,7 +61,6 @@
  *              Panu Kuhlberg:          Experimental audit of TCP (re)transmission
  *                                      engine. Lots of bugs are found.
  *              Pasi Sarolahti:         F-RTO for dealing with spurious RTOs
- *              Angelo Dell'Aera:       TCP Westwood+ support
  */
 
 #include <linux/config.h>
@@ -88,23 +87,9 @@ int sysctl_tcp_rfc1337;
 int sysctl_tcp_max_orphans = NR_FILE;
 int sysctl_tcp_frto;
 int sysctl_tcp_nometrics_save;
-int sysctl_tcp_westwood;
-int sysctl_tcp_vegas_cong_avoid;
 
 int sysctl_tcp_moderate_rcvbuf = 1;
 
-/* Default values of the Vegas variables, in fixed-point representation
- * with V_PARAM_SHIFT bits to the right of the binary point.
- */
-#define V_PARAM_SHIFT 1
-int sysctl_tcp_vegas_alpha = 1<<V_PARAM_SHIFT;
-int sysctl_tcp_vegas_beta  = 3<<V_PARAM_SHIFT;
-int sysctl_tcp_vegas_gamma = 1<<V_PARAM_SHIFT;
-int sysctl_tcp_bic = 1;
-int sysctl_tcp_bic_fast_convergence = 1;
-int sysctl_tcp_bic_low_window = 14;
-int sysctl_tcp_bic_beta = 819;          /* = 819/1024 (BICTCP_BETA_SCALE) */
-
 #define FLAG_DATA               0x01 /* Incoming frame contained data.          */
 #define FLAG_WIN_UPDATE         0x02 /* Incoming ACK was a window update.       */
 #define FLAG_DATA_ACKED         0x04 /* This ACK acknowledged new data.         */
@@ -333,15 +318,6 @@ static void tcp_init_buffer_space(struct sock *sk)
         tp->snd_cwnd_stamp = tcp_time_stamp;
 }
 
-static void init_bictcp(struct tcp_sock *tp)
-{
-        tp->bictcp.cnt = 0;
-
-        tp->bictcp.last_max_cwnd = 0;
-        tp->bictcp.last_cwnd = 0;
-        tp->bictcp.last_stamp = 0;
-}
-
 /* 5. Recalculate window clamp after socket hit its memory bounds. */
 static void tcp_clamp_window(struct sock *sk, struct tcp_sock *tp)
 {
@@ -558,45 +534,6 @@ static void tcp_event_data_recv(struct sock *sk, struct tcp_sock *tp, struct sk_
                 tcp_grow_window(sk, tp, skb);
 }
 
-/* When starting a new connection, pin down the current choice of 
- * congestion algorithm.
- */
-void tcp_ca_init(struct tcp_sock *tp)
-{
-        if (sysctl_tcp_westwood) 
-                tp->adv_cong = TCP_WESTWOOD;
-        else if (sysctl_tcp_bic)
-                tp->adv_cong = TCP_BIC;
-        else if (sysctl_tcp_vegas_cong_avoid) {
-                tp->adv_cong = TCP_VEGAS;
-                tp->vegas.baseRTT = 0x7fffffff;
-                tcp_vegas_enable(tp);
-        } 
-}
-
-/* Do RTT sampling needed for Vegas.
- * Basically we:
- *   o min-filter RTT samples from within an RTT to get the current
- *     propagation delay + queuing delay (we are min-filtering to try to
- *     avoid the effects of delayed ACKs)
- *   o min-filter RTT samples from a much longer window (forever for now)
- *     to find the propagation delay (baseRTT)
- */
-static inline void vegas_rtt_calc(struct tcp_sock *tp, __u32 rtt)
-{
-        __u32 vrtt = rtt + 1; /* Never allow zero rtt or baseRTT */
-
-        /* Filter to find propagation delay: */
-        if (vrtt < tp->vegas.baseRTT) 
-                tp->vegas.baseRTT = vrtt;
-
-        /* Find the min RTT during the last RTT to find
-         * the current prop. delay + queuing delay:
-         */
-        tp->vegas.minRTT = min(tp->vegas.minRTT, vrtt);
-        tp->vegas.cntRTT++;
-}
-
 /* Called to compute a smoothed rtt estimate. The data fed to this
  * routine either comes from timestamps, or from segments that were
  * known _not_ to have been retransmitted [see Karn/Partridge
@@ -606,13 +543,10 @@ static inline void vegas_rtt_calc(struct tcp_sock *tp, __u32 rtt)
  * To save cycles in the RFC 1323 implementation it was better to break
  * it up into three procedures. -- erics
  */
-static void tcp_rtt_estimator(struct tcp_sock *tp, __u32 mrtt)
+static void tcp_rtt_estimator(struct tcp_sock *tp, __u32 mrtt, u32 *usrtt)
 {
         long m = mrtt; /* RTT */
 
-        if (tcp_vegas_enabled(tp))
-                vegas_rtt_calc(tp, mrtt);
-
         /*      The following amusing code comes from Jacobson's
          *      article in SIGCOMM '88.  Note that rtt and mdev
          *      are scaled versions of rtt and mean deviation.
@@ -670,7 +604,8 @@ static void tcp_rtt_estimator(struct tcp_sock *tp, __u32 mrtt)
                 tp->rtt_seq = tp->snd_nxt;
         }
 
-        tcp_westwood_update_rtt(tp, tp->srtt >> 3);
+        if (tp->ca_ops->rtt_sample)
+                tp->ca_ops->rtt_sample(tp, *usrtt);
 }
 
 /* Calculate rto without backoff.  This is the second half of Van Jacobson's
@@ -805,10 +740,10 @@ __u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst)
         __u32 cwnd = (dst ? dst_metric(dst, RTAX_INITCWND) : 0);
 
         if (!cwnd) {
-                if (tp->mss_cache_std > 1460)
+                if (tp->mss_cache > 1460)
                         cwnd = 2;
                 else
-                        cwnd = (tp->mss_cache_std > 1095) ? 3 : 4;
+                        cwnd = (tp->mss_cache > 1095) ? 3 : 4;
         }
         return min_t(__u32, cwnd, tp->snd_cwnd_clamp);
 }
@@ -979,7 +914,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
         if (sk->sk_route_caps & NETIF_F_TSO) {
                 sk->sk_route_caps &= ~NETIF_F_TSO;
                 sock_set_flag(sk, SOCK_NO_LARGESEND);
-                tp->mss_cache = tp->mss_cache_std;
+                tp->mss_cache = tp->mss_cache;
         }
 
         if (!tp->sacked_out)
@@ -1142,7 +1077,7 @@ tcp_sacktag_write_queue(struct sock *sk, struct sk_buff *ack_skb, u32 prior_snd_
                             (IsFack(tp) ||
                              !before(lost_retrans,
                                      TCP_SKB_CB(skb)->ack_seq + tp->reordering *
-                                     tp->mss_cache_std))) {
+                                     tp->mss_cache))) {
                                 TCP_SKB_CB(skb)->sacked &= ~TCPCB_SACKED_RETRANS;
                                 tp->retrans_out -= tcp_skb_pcount(skb);
 
@@ -1185,8 +1120,8 @@ void tcp_enter_frto(struct sock *sk)
             tp->snd_una == tp->high_seq ||
             (tp->ca_state == TCP_CA_Loss && !tp->retransmits)) {
                 tp->prior_ssthresh = tcp_current_ssthresh(tp);
-                if (!tcp_westwood_ssthresh(tp))
-                        tp->snd_ssthresh = tcp_recalc_ssthresh(tp);
+                tp->snd_ssthresh = tp->ca_ops->ssthresh(tp);
+                tcp_ca_event(tp, CA_EVENT_FRTO);
         }
 
         /* Have to clear retransmission markers here to keep the bookkeeping
@@ -1252,8 +1187,6 @@ static void tcp_enter_frto_loss(struct sock *sk)
         tcp_set_ca_state(tp, TCP_CA_Loss);
         tp->high_seq = tp->frto_highmark;
         TCP_ECN_queue_cwr(tp);
-
-        init_bictcp(tp);
 }
 
 void tcp_clear_retrans(struct tcp_sock *tp)
@@ -1283,7 +1216,8 @@ void tcp_enter_loss(struct sock *sk, int how)
         if (tp->ca_state <= TCP_CA_Disorder || tp->snd_una == tp->high_seq ||
             (tp->ca_state == TCP_CA_Loss && !tp->retransmits)) {
                 tp->prior_ssthresh = tcp_current_ssthresh(tp);
-                tp->snd_ssthresh = tcp_recalc_ssthresh(tp);
+                tp->snd_ssthresh = tp->ca_ops->ssthresh(tp);
+                tcp_ca_event(tp, CA_EVENT_LOSS);
         }
         tp->snd_cwnd       = 1;
         tp->snd_cwnd_cnt   = 0;
@@ -1596,28 +1530,14 @@ static inline void tcp_moderate_cwnd(struct tcp_sock *tp)
 }
 
 /* Decrease cwnd each second ack. */
-
 static void tcp_cwnd_down(struct tcp_sock *tp)
 {
         int decr = tp->snd_cwnd_cnt + 1;
-        __u32 limit;
-
-        /*
-         * TCP Westwood
-         * Here limit is evaluated as BWestimation*RTTmin (for obtaining it
-         * in packets we use mss_cache). If sysctl_tcp_westwood is off
-         * tcp_westwood_bw_rttmin() returns 0. In such case snd_ssthresh is
-         * still used as usual. It prevents other strange cases in which
-         * BWE*RTTmin could assume value 0. It should not happen but...
-         */
-
-        if (!(limit = tcp_westwood_bw_rttmin(tp)))
-                limit = tp->snd_ssthresh/2;
 
         tp->snd_cwnd_cnt = decr&1;
         decr >>= 1;
 
-        if (decr && tp->snd_cwnd > limit)
+        if (decr && tp->snd_cwnd > tp->ca_ops->min_cwnd(tp))
                 tp->snd_cwnd -= decr;
 
         tp->snd_cwnd = min(tp->snd_cwnd, tcp_packets_in_flight(tp)+1);
@@ -1654,8 +1574,8 @@ static void DBGUNDO(struct sock *sk, struct tcp_sock *tp, const char *msg)
 static void tcp_undo_cwr(struct tcp_sock *tp, int undo)
 {
         if (tp->prior_ssthresh) {
-                if (tcp_is_bic(tp))
-                        tp->snd_cwnd = max(tp->snd_cwnd, tp->bictcp.last_max_cwnd);
+                if (tp->ca_ops->undo_cwnd)
+                        tp->snd_cwnd = tp->ca_ops->undo_cwnd(tp);
                 else
                         tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh<<1);
 
@@ -1767,11 +1687,9 @@ static int tcp_try_undo_loss(struct sock *sk, struct tcp_sock *tp)
 
 static inline void tcp_complete_cwr(struct tcp_sock *tp)
 {
-        if (tcp_westwood_cwnd(tp)) 
-                tp->snd_ssthresh = tp->snd_cwnd;
-        else
-                tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
+        tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
         tp->snd_cwnd_stamp = tcp_time_stamp;
+        tcp_ca_event(tp, CA_EVENT_COMPLETE_CWR);
 }
 
 static void tcp_try_to_open(struct sock *sk, struct tcp_sock *tp, int flag)
@@ -1946,7 +1864,7 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
                 if (tp->ca_state < TCP_CA_CWR) {
                         if (!(flag&FLAG_ECE))
                                 tp->prior_ssthresh = tcp_current_ssthresh(tp);
-                        tp->snd_ssthresh = tcp_recalc_ssthresh(tp);
+                        tp->snd_ssthresh = tp->ca_ops->ssthresh(tp);
                         TCP_ECN_queue_cwr(tp);
                 }
 
@@ -1963,7 +1881,7 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
 /* Read draft-ietf-tcplw-high-performance before mucking
  * with this code. (Superceeds RFC1323)
  */
-static void tcp_ack_saw_tstamp(struct tcp_sock *tp, int flag)
+static void tcp_ack_saw_tstamp(struct tcp_sock *tp, u32 *usrtt, int flag)
 {
         __u32 seq_rtt;
 
@@ -1983,13 +1901,13 @@ static void tcp_ack_saw_tstamp(struct tcp_sock *tp, int flag)
          * in window is lost... Voila.                          --ANK (010210)
          */
         seq_rtt = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
-        tcp_rtt_estimator(tp, seq_rtt);
+        tcp_rtt_estimator(tp, seq_rtt, usrtt);
         tcp_set_rto(tp);
         tp->backoff = 0;
         tcp_bound_rto(tp);
 }
 
-static void tcp_ack_no_tstamp(struct tcp_sock *tp, u32 seq_rtt, int flag)
+static void tcp_ack_no_tstamp(struct tcp_sock *tp, u32 seq_rtt, u32 *usrtt, int flag)
 {
         /* We don't have a timestamp. Can only use
          * packets that are not retransmitted to determine
@@ -2003,338 +1921,29 @@ static void tcp_ack_no_tstamp(struct tcp_sock *tp, u32 seq_rtt, int flag)
         if (flag & FLAG_RETRANS_DATA_ACKED)
                 return;
 
-        tcp_rtt_estimator(tp, seq_rtt);
+        tcp_rtt_estimator(tp, seq_rtt, usrtt);
         tcp_set_rto(tp);
         tp->backoff = 0;
         tcp_bound_rto(tp);
 }
 
 static inline void tcp_ack_update_rtt(struct tcp_sock *tp,
-                                      int flag, s32 seq_rtt)
+                                      int flag, s32 seq_rtt, u32 *usrtt)
 {
         /* Note that peer MAY send zero echo. In this case it is ignored. (rfc1323) */
         if (tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr)
-                tcp_ack_saw_tstamp(tp, flag);
+                tcp_ack_saw_tstamp(tp, usrtt, flag);
         else if (seq_rtt >= 0)
-                tcp_ack_no_tstamp(tp, seq_rtt, flag);
-}
-
-/*
- * Compute congestion window to use.
- *
- * This is from the implementation of BICTCP in
- * Lison-Xu, Kahaled Harfoush, and Injog Rhee.
- *  "Binary Increase Congestion Control for Fast, Long Distance
- *  Networks" in InfoComm 2004
- * Available from:
- *  http://www.csc.ncsu.edu/faculty/rhee/export/bitcp.pdf
- *
- * Unless BIC is enabled and congestion window is large
- * this behaves the same as the original Reno.
- */
-static inline __u32 bictcp_cwnd(struct tcp_sock *tp)
-{
-        /* orignal Reno behaviour */
-        if (!tcp_is_bic(tp))
-                return tp->snd_cwnd;
-
-        if (tp->bictcp.last_cwnd == tp->snd_cwnd &&
-           (s32)(tcp_time_stamp - tp->bictcp.last_stamp) <= (HZ>>5))
-                return tp->bictcp.cnt;
-
-        tp->bictcp.last_cwnd = tp->snd_cwnd;
-        tp->bictcp.last_stamp = tcp_time_stamp;
-      
-        /* start off normal */
-        if (tp->snd_cwnd <= sysctl_tcp_bic_low_window)
-                tp->bictcp.cnt = tp->snd_cwnd;
-
-        /* binary increase */
-        else if (tp->snd_cwnd < tp->bictcp.last_max_cwnd) {
-                __u32   dist = (tp->bictcp.last_max_cwnd - tp->snd_cwnd)
-                        / BICTCP_B;
-
-                if (dist > BICTCP_MAX_INCREMENT)
-                        /* linear increase */
-                        tp->bictcp.cnt = tp->snd_cwnd / BICTCP_MAX_INCREMENT;
-                else if (dist <= 1U)
-                        /* binary search increase */
-                        tp->bictcp.cnt = tp->snd_cwnd * BICTCP_FUNC_OF_MIN_INCR
-                                / BICTCP_B;
-                else
-                        /* binary search increase */
-                        tp->bictcp.cnt = tp->snd_cwnd / dist;
-        } else {
-                /* slow start amd linear increase */
-                if (tp->snd_cwnd < tp->bictcp.last_max_cwnd + BICTCP_B)
-                        /* slow start */
-                        tp->bictcp.cnt = tp->snd_cwnd * BICTCP_FUNC_OF_MIN_INCR
-                                / BICTCP_B;
-                else if (tp->snd_cwnd < tp->bictcp.last_max_cwnd
-                                        + BICTCP_MAX_INCREMENT*(BICTCP_B-1))
-                        /* slow start */
-                        tp->bictcp.cnt = tp->snd_cwnd * (BICTCP_B-1)
-                                / (tp->snd_cwnd-tp->bictcp.last_max_cwnd);
-                else
-                        /* linear increase */
-                        tp->bictcp.cnt = tp->snd_cwnd / BICTCP_MAX_INCREMENT;
-        }
-        return tp->bictcp.cnt;
+                tcp_ack_no_tstamp(tp, seq_rtt, usrtt, flag);
 }
 
-/* This is Jacobson's slow start and congestion avoidance. 
- * SIGCOMM '88, p. 328.
- */
-static inline void reno_cong_avoid(struct tcp_sock *tp)
+static inline void tcp_cong_avoid(struct tcp_sock *tp, u32 ack, u32 rtt,
+                                  u32 in_flight, int good)
 {
-        if (tp->snd_cwnd <= tp->snd_ssthresh) {
-                /* In "safe" area, increase. */
-                if (tp->snd_cwnd < tp->snd_cwnd_clamp)
-                        tp->snd_cwnd++;
-        } else {
-                /* In dangerous area, increase slowly.
-                 * In theory this is tp->snd_cwnd += 1 / tp->snd_cwnd
-                 */
-                if (tp->snd_cwnd_cnt >= bictcp_cwnd(tp)) {
-                        if (tp->snd_cwnd < tp->snd_cwnd_clamp)
-                                tp->snd_cwnd++;
-                        tp->snd_cwnd_cnt=0;
-                } else
-                        tp->snd_cwnd_cnt++;
-        }
+        tp->ca_ops->cong_avoid(tp, ack, rtt, in_flight, good);
         tp->snd_cwnd_stamp = tcp_time_stamp;
 }
 
-/* This is based on the congestion detection/avoidance scheme described in
- *    Lawrence S. Brakmo and Larry L. Peterson.
- *    "TCP Vegas: End to end congestion avoidance on a global internet."
- *    IEEE Journal on Selected Areas in Communication, 13(8):1465--1480,
- *    October 1995. Available from:
- *      ftp://ftp.cs.arizona.edu/xkernel/Papers/jsac.ps
- *
- * See http://www.cs.arizona.edu/xkernel/ for their implementation.
- * The main aspects that distinguish this implementation from the
- * Arizona Vegas implementation are:
- *   o We do not change the loss detection or recovery mechanisms of
- *     Linux in any way. Linux already recovers from losses quite well,
- *     using fine-grained timers, NewReno, and FACK.
- *   o To avoid the performance penalty imposed by increasing cwnd
- *     only every-other RTT during slow start, we increase during
- *     every RTT during slow start, just like Reno.
- *   o Largely to allow continuous cwnd growth during slow start,
- *     we use the rate at which ACKs come back as the "actual"
- *     rate, rather than the rate at which data is sent.
- *   o To speed convergence to the right rate, we set the cwnd
- *     to achieve the right ("actual") rate when we exit slow start.
- *   o To filter out the noise caused by delayed ACKs, we use the
- *     minimum RTT sample observed during the last RTT to calculate
- *     the actual rate.
- *   o When the sender re-starts from idle, it waits until it has
- *     received ACKs for an entire flight of new data before making
- *     a cwnd adjustment decision. The original Vegas implementation
- *     assumed senders never went idle.
- */
-static void vegas_cong_avoid(struct tcp_sock *tp, u32 ack, u32 seq_rtt)
-{
-        /* The key players are v_beg_snd_una and v_beg_snd_nxt.
-         *
-         * These are so named because they represent the approximate values
-         * of snd_una and snd_nxt at the beginning of the current RTT. More
-         * precisely, they represent the amount of data sent during the RTT.
-         * At the end of the RTT, when we receive an ACK for v_beg_snd_nxt,
-         * we will calculate that (v_beg_snd_nxt - v_beg_snd_una) outstanding
-         * bytes of data have been ACKed during the course of the RTT, giving
-         * an "actual" rate of:
-         *
-         *     (v_beg_snd_nxt - v_beg_snd_una) / (rtt duration)
-         *
-         * Unfortunately, v_beg_snd_una is not exactly equal to snd_una,
-         * because delayed ACKs can cover more than one segment, so they
-         * don't line up nicely with the boundaries of RTTs.
-         *
-         * Another unfortunate fact of life is that delayed ACKs delay the
-         * advance of the left edge of our send window, so that the number
-         * of bytes we send in an RTT is often less than our cwnd will allow.
-         * So we keep track of our cwnd separately, in v_beg_snd_cwnd.
-         */
-
-        if (after(ack, tp->vegas.beg_snd_nxt)) {
-                /* Do the Vegas once-per-RTT cwnd adjustment. */
-                u32 old_wnd, old_snd_cwnd;
-
-                
-                /* Here old_wnd is essentially the window of data that was
-                 * sent during the previous RTT, and has all
-                 * been acknowledged in the course of the RTT that ended
-                 * with the ACK we just received. Likewise, old_snd_cwnd
-                 * is the cwnd during the previous RTT.
-                 */
-                old_wnd = (tp->vegas.beg_snd_nxt - tp->vegas.beg_snd_una) /
-                        tp->mss_cache_std;
-                old_snd_cwnd = tp->vegas.beg_snd_cwnd;
-
-                /* Save the extent of the current window so we can use this
-                 * at the end of the next RTT.
-                 */
-                tp->vegas.beg_snd_una  = tp->vegas.beg_snd_nxt;
-                tp->vegas.beg_snd_nxt  = tp->snd_nxt;
-                tp->vegas.beg_snd_cwnd = tp->snd_cwnd;
-
-                /* Take into account the current RTT sample too, to
-                 * decrease the impact of delayed acks. This double counts
-                 * this sample since we count it for the next window as well,
-                 * but that's not too awful, since we're taking the min,
-                 * rather than averaging.
-                 */
-                vegas_rtt_calc(tp, seq_rtt);
-
-                /* We do the Vegas calculations only if we got enough RTT
-                 * samples that we can be reasonably sure that we got
-                 * at least one RTT sample that wasn't from a delayed ACK.
-                 * If we only had 2 samples total,
-                 * then that means we're getting only 1 ACK per RTT, which
-                 * means they're almost certainly delayed ACKs.
-                 * If  we have 3 samples, we should be OK.
-                 */
-
-                if (tp->vegas.cntRTT <= 2) {
-                        /* We don't have enough RTT samples to do the Vegas
-                         * calculation, so we'll behave like Reno.
-                         */
-                        if (tp->snd_cwnd > tp->snd_ssthresh)
-                                tp->snd_cwnd++;
-                } else {
-                        u32 rtt, target_cwnd, diff;
-
-                        /* We have enough RTT samples, so, using the Vegas
-                         * algorithm, we determine if we should increase or
-                         * decrease cwnd, and by how much.
-                         */
-
-                        /* Pluck out the RTT we are using for the Vegas
-                         * calculations. This is the min RTT seen during the
-                         * last RTT. Taking the min filters out the effects
-                         * of delayed ACKs, at the cost of noticing congestion
-                         * a bit later.
-                         */
-                        rtt = tp->vegas.minRTT;
-
-                        /* Calculate the cwnd we should have, if we weren't
-                         * going too fast.
-                         *
-                         * This is:
-                         *     (actual rate in segments) * baseRTT
-                         * We keep it as a fixed point number with
-                         * V_PARAM_SHIFT bits to the right of the binary point.
-                         */
-                        target_cwnd = ((old_wnd * tp->vegas.baseRTT)
-                                       << V_PARAM_SHIFT) / rtt;
-
-                        /* Calculate the difference between the window we had,
-                         * and the window we would like to have. This quantity
-                         * is the "Diff" from the Arizona Vegas papers.
-                         *
-                         * Again, this is a fixed point number with
-                         * V_PARAM_SHIFT bits to the right of the binary
-                         * point.
-                         */
-                        diff = (old_wnd << V_PARAM_SHIFT) - target_cwnd;
-
-                        if (tp->snd_cwnd < tp->snd_ssthresh) {
-                                /* Slow start.  */
-                                if (diff > sysctl_tcp_vegas_gamma) {
-                                        /* Going too fast. Time to slow down
-                                         * and switch to congestion avoidance.
-                                         */
-                                        tp->snd_ssthresh = 2;
-
-                                        /* Set cwnd to match the actual rate
-                                         * exactly:
-                                         *   cwnd = (actual rate) * baseRTT
-                                         * Then we add 1 because the integer
-                                         * truncation robs us of full link
-                                         * utilization.
-                                         */
-                                        tp->snd_cwnd = min(tp->snd_cwnd,
-                                                           (target_cwnd >>
-                                                            V_PARAM_SHIFT)+1);
-
-                                }
-                        } else {
-                                /* Congestion avoidance. */
-                                u32 next_snd_cwnd;
-
-                                /* Figure out where we would like cwnd
-                                 * to be.
-                                 */
-                                if (diff > sysctl_tcp_vegas_beta) {
-                                        /* The old window was too fast, so
-                                         * we slow down.
-                                         */
-                                        next_snd_cwnd = old_snd_cwnd - 1;
-                                } else if (diff < sysctl_tcp_vegas_alpha) {
-                                        /* We don't have enough extra packets
-                                         * in the network, so speed up.
-                                         */
-                                        next_snd_cwnd = old_snd_cwnd + 1;
-                                } else {
-                                        /* Sending just as fast as we
-                                         * should be.
-                                         */
-                                        next_snd_cwnd = old_snd_cwnd;
-                                }
-
-                                /* Adjust cwnd upward or downward, toward the
-                                 * desired value.
-                                 */
-                                if (next_snd_cwnd > tp->snd_cwnd)
-                                        tp->snd_cwnd++;
-                                else if (next_snd_cwnd < tp->snd_cwnd)
-                                        tp->snd_cwnd--;
-                        }
-                }
-
-                /* Wipe the slate clean for the next RTT. */
-                tp->vegas.cntRTT = 0;
-                tp->vegas.minRTT = 0x7fffffff;
-        }
-
-        /* The following code is executed for every ack we receive,
-         * except for conditions checked in should_advance_cwnd()
-         * before the call to tcp_cong_avoid(). Mainly this means that
-         * we only execute this code if the ack actually acked some
-         * data.
-         */
-
-        /* If we are in slow start, increase our cwnd in response to this ACK.
-         * (If we are not in slow start then we are in congestion avoidance,
-         * and adjust our congestion window only once per RTT. See the code
-         * above.)
-         */
-        if (tp->snd_cwnd <= tp->snd_ssthresh) 
-                tp->snd_cwnd++;
-
-        /* to keep cwnd from growing without bound */
-        tp->snd_cwnd = min_t(u32, tp->snd_cwnd, tp->snd_cwnd_clamp);
-
-        /* Make sure that we are never so timid as to reduce our cwnd below
-         * 2 MSS.
-         *
-         * Going below 2 MSS would risk huge delayed ACKs from our receiver.
-         */
-        tp->snd_cwnd = max(tp->snd_cwnd, 2U);
-
-        tp->snd_cwnd_stamp = tcp_time_stamp;
-}
-
-static inline void tcp_cong_avoid(struct tcp_sock *tp, u32 ack, u32 seq_rtt)
-{
-        if (tcp_vegas_enabled(tp))
-                vegas_cong_avoid(tp, ack, seq_rtt);
-        else
-                reno_cong_avoid(tp);
-}
-
 /* Restart timer after forward progress on connection.
  * RFC2988 recommends to restart timer to now+rto.
  */
@@ -2348,15 +1957,6 @@ static inline void tcp_ack_packets_out(struct sock *sk, struct tcp_sock *tp)
         }
 }
 
-/* There is one downside to this scheme.  Although we keep the
- * ACK clock ticking, adjusting packet counters and advancing
- * congestion window, we do not liberate socket send buffer
- * space.
- *
- * Mucking with skb->truesize and sk->sk_wmem_alloc et al.
- * then making a write space wakeup callback is a possible
- * future enhancement.  WARNING: it is not trivial to make.
- */
 static int tcp_tso_acked(struct sock *sk, struct sk_buff *skb,
                          __u32 now, __s32 *seq_rtt)
 {
@@ -2415,13 +2015,18 @@ static int tcp_tso_acked(struct sock *sk, struct sk_buff *skb,
 
 
 /* Remove acknowledged frames from the retransmission queue. */
-static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
+static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p, s32 *seq_usrtt)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
         __u32 now = tcp_time_stamp;
         int acked = 0;
         __s32 seq_rtt = -1;
+        struct timeval usnow;
+        u32 pkts_acked = 0;
+
+        if (seq_usrtt)
+                do_gettimeofday(&usnow);
 
         while ((skb = skb_peek(&sk->sk_write_queue)) &&
                skb != sk->sk_send_head) {
@@ -2433,7 +2038,8 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
                  * the other end.
                  */
                 if (after(scb->end_seq, tp->snd_una)) {
-                        if (tcp_skb_pcount(skb) > 1)
+                        if (tcp_skb_pcount(skb) > 1 &&
+                            after(tp->snd_una, scb->seq))
                                 acked |= tcp_tso_acked(sk, skb,
                                                        now, &seq_rtt);
                         break;
@@ -2448,6 +2054,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
                  */
                 if (!(scb->flags & TCPCB_FLAG_SYN)) {
                         acked |= FLAG_DATA_ACKED;
+                        ++pkts_acked;
                 } else {
                         acked |= FLAG_SYN_ACKED;
                         tp->retrans_stamp = 0;
@@ -2461,6 +2068,10 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
                                 seq_rtt = -1;
                         } else if (seq_rtt < 0)
                                 seq_rtt = now - scb->when;
+                        if (seq_usrtt)
+                                *seq_usrtt = (usnow.tv_sec - skb->stamp.tv_sec) * 1000000
+                                        + (usnow.tv_usec - skb->stamp.tv_usec);
+
                         if (sacked & TCPCB_SACKED_ACKED)
                                 tp->sacked_out -= tcp_skb_pcount(skb);
                         if (sacked & TCPCB_LOST)
@@ -2479,8 +2090,11 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
         }
 
         if (acked&FLAG_ACKED) {
-                tcp_ack_update_rtt(tp, acked, seq_rtt);
+                tcp_ack_update_rtt(tp, acked, seq_rtt, seq_usrtt);
                 tcp_ack_packets_out(sk, tp);
+
+                if (tp->ca_ops->pkts_acked)
+                        tp->ca_ops->pkts_acked(tp, pkts_acked);
         }
 
 #if FASTRETRANS_DEBUG > 0
@@ -2624,257 +2238,6 @@ static void tcp_process_frto(struct sock *sk, u32 prior_snd_una)
         tp->frto_counter = (tp->frto_counter + 1) % 3;
 }
 
-/*
- * TCP Westwood+
- */
-
-/*
- * @init_westwood
- * This function initializes fields used in TCP Westwood+. We can't
- * get no information about RTTmin at this time so we simply set it to
- * TCP_WESTWOOD_INIT_RTT. This value was chosen to be too conservative
- * since in this way we're sure it will be updated in a consistent
- * way as soon as possible. It will reasonably happen within the first
- * RTT period of the connection lifetime.
- */
-
-static void init_westwood(struct sock *sk)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        tp->westwood.bw_ns_est = 0;
-        tp->westwood.bw_est = 0;
-        tp->westwood.accounted = 0;
-        tp->westwood.cumul_ack = 0;
-        tp->westwood.rtt_win_sx = tcp_time_stamp;
-        tp->westwood.rtt = TCP_WESTWOOD_INIT_RTT;
-        tp->westwood.rtt_min = TCP_WESTWOOD_INIT_RTT;
-        tp->westwood.snd_una = tp->snd_una;
-}
-
-/*
- * @westwood_do_filter
- * Low-pass filter. Implemented using constant coeffients.
- */
-
-static inline __u32 westwood_do_filter(__u32 a, __u32 b)
-{
-        return (((7 * a) + b) >> 3);
-}
-
-static void westwood_filter(struct sock *sk, __u32 delta)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        tp->westwood.bw_ns_est =
-                westwood_do_filter(tp->westwood.bw_ns_est, 
-                                   tp->westwood.bk / delta);
-        tp->westwood.bw_est =
-                westwood_do_filter(tp->westwood.bw_est,
-                                   tp->westwood.bw_ns_est);
-}
-
-/* 
- * @westwood_update_rttmin
- * It is used to update RTTmin. In this case we MUST NOT use
- * WESTWOOD_RTT_MIN minimum bound since we could be on a LAN!
- */
-
-static inline __u32 westwood_update_rttmin(const struct sock *sk)
-{
-        const struct tcp_sock *tp = tcp_sk(sk);
-        __u32 rttmin = tp->westwood.rtt_min;
-
-        if (tp->westwood.rtt != 0 &&
-            (tp->westwood.rtt < tp->westwood.rtt_min || !rttmin))
-                rttmin = tp->westwood.rtt;
-
-        return rttmin;
-}
-
-/*
- * @westwood_acked
- * Evaluate increases for dk. 
- */
-
-static inline __u32 westwood_acked(const struct sock *sk)
-{
-        const struct tcp_sock *tp = tcp_sk(sk);
-
-        return tp->snd_una - tp->westwood.snd_una;
-}
-
-/*
- * @westwood_new_window
- * It evaluates if we are receiving data inside the same RTT window as
- * when we started.
- * Return value:
- * It returns 0 if we are still evaluating samples in the same RTT
- * window, 1 if the sample has to be considered in the next window.
- */
-
-static int westwood_new_window(const struct sock *sk)
-{
-        const struct tcp_sock *tp = tcp_sk(sk);
-        __u32 left_bound;
-        __u32 rtt;
-        int ret = 0;
-
-        left_bound = tp->westwood.rtt_win_sx;
-        rtt = max(tp->westwood.rtt, (u32) TCP_WESTWOOD_RTT_MIN);
-
-        /*
-         * A RTT-window has passed. Be careful since if RTT is less than
-         * 50ms we don't filter but we continue 'building the sample'.
-         * This minimum limit was choosen since an estimation on small
-         * time intervals is better to avoid...
-         * Obvioulsy on a LAN we reasonably will always have
-         * right_bound = left_bound + WESTWOOD_RTT_MIN
-         */
-
-        if ((left_bound + rtt) < tcp_time_stamp)
-                ret = 1;
-
-        return ret;
-}
-
-/*
- * @westwood_update_window
- * It updates RTT evaluation window if it is the right moment to do
- * it. If so it calls filter for evaluating bandwidth. 
- */
-
-static void __westwood_update_window(struct sock *sk, __u32 now)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-        __u32 delta = now - tp->westwood.rtt_win_sx;
-
-        if (delta) {
-                if (tp->westwood.rtt)
-                        westwood_filter(sk, delta);
-
-                tp->westwood.bk = 0;
-                tp->westwood.rtt_win_sx = tcp_time_stamp;
-        }
-}
-
-
-static void westwood_update_window(struct sock *sk, __u32 now)
-{
-        if (westwood_new_window(sk)) 
-                __westwood_update_window(sk, now);
-}
-
-/*
- * @__tcp_westwood_fast_bw
- * It is called when we are in fast path. In particular it is called when
- * header prediction is successfull. In such case infact update is
- * straight forward and doesn't need any particular care.
- */
-
-static void __tcp_westwood_fast_bw(struct sock *sk, struct sk_buff *skb)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        westwood_update_window(sk, tcp_time_stamp);
-
-        tp->westwood.bk += westwood_acked(sk);
-        tp->westwood.snd_una = tp->snd_una;
-        tp->westwood.rtt_min = westwood_update_rttmin(sk);
-}
-
-static inline void tcp_westwood_fast_bw(struct sock *sk, struct sk_buff *skb)
-{
-        if (tcp_is_westwood(tcp_sk(sk)))
-                __tcp_westwood_fast_bw(sk, skb);
-}
-
-
-/*
- * @westwood_dupack_update
- * It updates accounted and cumul_ack when receiving a dupack.
- */
-
-static void westwood_dupack_update(struct sock *sk)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        tp->westwood.accounted += tp->mss_cache_std;
-        tp->westwood.cumul_ack = tp->mss_cache_std;
-}
-
-static inline int westwood_may_change_cumul(struct tcp_sock *tp)
-{
-        return (tp->westwood.cumul_ack > tp->mss_cache_std);
-}
-
-static inline void westwood_partial_update(struct tcp_sock *tp)
-{
-        tp->westwood.accounted -= tp->westwood.cumul_ack;
-        tp->westwood.cumul_ack = tp->mss_cache_std;
-}
-
-static inline void westwood_complete_update(struct tcp_sock *tp)
-{
-        tp->westwood.cumul_ack -= tp->westwood.accounted;
-        tp->westwood.accounted = 0;
-}
-
-/*
- * @westwood_acked_count
- * This function evaluates cumul_ack for evaluating dk in case of
- * delayed or partial acks.
- */
-
-static inline __u32 westwood_acked_count(struct sock *sk)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        tp->westwood.cumul_ack = westwood_acked(sk);
-
-        /* If cumul_ack is 0 this is a dupack since it's not moving
-         * tp->snd_una.
-         */
-        if (!(tp->westwood.cumul_ack))
-                westwood_dupack_update(sk);
-
-        if (westwood_may_change_cumul(tp)) {
-                /* Partial or delayed ack */
-                if (tp->westwood.accounted >= tp->westwood.cumul_ack)
-                        westwood_partial_update(tp);
-                else
-                        westwood_complete_update(tp);
-        }
-
-        tp->westwood.snd_una = tp->snd_una;
-
-        return tp->westwood.cumul_ack;
-}
-
-
-/*
- * @__tcp_westwood_slow_bw
- * It is called when something is going wrong..even if there could
- * be no problems! Infact a simple delayed packet may trigger a
- * dupack. But we need to be careful in such case.
- */
-
-static void __tcp_westwood_slow_bw(struct sock *sk, struct sk_buff *skb)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        westwood_update_window(sk, tcp_time_stamp);
-
-        tp->westwood.bk += westwood_acked_count(sk);
-        tp->westwood.rtt_min = westwood_update_rttmin(sk);
-}
-
-static inline void tcp_westwood_slow_bw(struct sock *sk, struct sk_buff *skb)
-{
-        if (tcp_is_westwood(tcp_sk(sk)))
-                __tcp_westwood_slow_bw(sk, skb);
-}
-
 /* This routine deals with incoming acks, but not outgoing ones. */
 static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
 {
@@ -2884,6 +2247,7 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
         u32 ack = TCP_SKB_CB(skb)->ack_seq;
         u32 prior_in_flight;
         s32 seq_rtt;
+        s32 seq_usrtt = 0;
         int prior_packets;
 
         /* If the ack is newer than sent or older than previous acks
@@ -2902,9 +2266,10 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
                  */
                 tcp_update_wl(tp, ack, ack_seq);
                 tp->snd_una = ack;
-                tcp_westwood_fast_bw(sk, skb);
                 flag |= FLAG_WIN_UPDATE;
 
+                tcp_ca_event(tp, CA_EVENT_FAST_ACK);
+
                 NET_INC_STATS_BH(LINUX_MIB_TCPHPACKS);
         } else {
                 if (ack_seq != TCP_SKB_CB(skb)->end_seq)
@@ -2920,7 +2285,7 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
                 if (TCP_ECN_rcv_ecn_echo(tp, skb->h.th))
                         flag |= FLAG_ECE;
 
-                tcp_westwood_slow_bw(sk,skb);
+                tcp_ca_event(tp, CA_EVENT_SLOW_ACK);
         }
 
         /* We passed data and got it acked, remove any soft error
@@ -2935,22 +2300,20 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
         prior_in_flight = tcp_packets_in_flight(tp);
 
         /* See if we can take anything off of the retransmit queue. */
-        flag |= tcp_clean_rtx_queue(sk, &seq_rtt);
+        flag |= tcp_clean_rtx_queue(sk, &seq_rtt,
+                                    tp->ca_ops->rtt_sample ? &seq_usrtt : NULL);
 
         if (tp->frto_counter)
                 tcp_process_frto(sk, prior_snd_una);
 
         if (tcp_ack_is_dubious(tp, flag)) {
                 /* Advanve CWND, if state allows this. */
-                if ((flag & FLAG_DATA_ACKED) &&
-                    (tcp_vegas_enabled(tp) || prior_in_flight >= tp->snd_cwnd) &&
-                    tcp_may_raise_cwnd(tp, flag))
-                        tcp_cong_avoid(tp, ack, seq_rtt);
+                if ((flag & FLAG_DATA_ACKED) && tcp_may_raise_cwnd(tp, flag))
+                        tcp_cong_avoid(tp, ack,  seq_rtt, prior_in_flight, 0);
                 tcp_fastretrans_alert(sk, prior_snd_una, prior_packets, flag);
         } else {
-                if ((flag & FLAG_DATA_ACKED) && 
-                    (tcp_vegas_enabled(tp) || prior_in_flight >= tp->snd_cwnd))
-                        tcp_cong_avoid(tp, ack, seq_rtt);
+                if ((flag & FLAG_DATA_ACKED))
+                        tcp_cong_avoid(tp, ack, seq_rtt, prior_in_flight, 1);
         }
 
         if ((flag & FLAG_FORWARD_PROGRESS) || !(flag&FLAG_NOT_DUP))
@@ -3439,7 +2802,7 @@ static void tcp_sack_remove(struct tcp_sock *tp)
         int this_sack;
 
         /* Empty ofo queue, hence, all the SACKs are eaten. Clear. */
-        if (skb_queue_len(&tp->out_of_order_queue) == 0) {
+        if (skb_queue_empty(&tp->out_of_order_queue)) {
                 tp->rx_opt.num_sacks = 0;
                 tp->rx_opt.eff_sacks = tp->rx_opt.dsack;
                 return;
@@ -3572,13 +2935,13 @@ queue_and_out:
                 if(th->fin)
                         tcp_fin(skb, sk, th);
 
-                if (skb_queue_len(&tp->out_of_order_queue)) {
+                if (!skb_queue_empty(&tp->out_of_order_queue)) {
                         tcp_ofo_queue(sk);
 
                         /* RFC2581. 4.2. SHOULD send immediate ACK, when
                          * gap in queue is filled.
                          */
-                        if (!skb_queue_len(&tp->out_of_order_queue))
+                        if (skb_queue_empty(&tp->out_of_order_queue))
                                 tp->ack.pingpong = 0;
                 }
 
@@ -3886,9 +3249,8 @@ static int tcp_prune_queue(struct sock *sk)
          * This must not ever occur. */
 
         /* First, purge the out_of_order queue. */
-        if (skb_queue_len(&tp->out_of_order_queue)) {
-                NET_ADD_STATS_BH(LINUX_MIB_OFOPRUNED, 
-                                 skb_queue_len(&tp->out_of_order_queue));
+        if (!skb_queue_empty(&tp->out_of_order_queue)) {
+                NET_INC_STATS_BH(LINUX_MIB_OFOPRUNED);
                 __skb_queue_purge(&tp->out_of_order_queue);
 
                 /* Reset SACK state.  A conforming SACK implementation will
@@ -3937,6 +3299,28 @@ void tcp_cwnd_application_limited(struct sock *sk)
         tp->snd_cwnd_stamp = tcp_time_stamp;
 }
 
+static inline int tcp_should_expand_sndbuf(struct sock *sk, struct tcp_sock *tp)
+{
+        /* If the user specified a specific send buffer setting, do
+         * not modify it.
+         */
+        if (sk->sk_userlocks & SOCK_SNDBUF_LOCK)
+                return 0;
+
+        /* If we are under global TCP memory pressure, do not expand.  */
+        if (tcp_memory_pressure)
+                return 0;
+
+        /* If we are under soft global TCP memory pressure, do not expand.  */
+        if (atomic_read(&tcp_memory_allocated) >= sysctl_tcp_mem[0])
+                return 0;
+
+        /* If we filled the congestion window, do not expand.  */
+        if (tp->packets_out >= tp->snd_cwnd)
+                return 0;
+
+        return 1;
+}
 
 /* When incoming ACK allowed to free some skb from write_queue,
  * we remember this event in flag SOCK_QUEUE_SHRUNK and wake up socket
@@ -3948,11 +3332,8 @@ static void tcp_new_space(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
-        if (tp->packets_out < tp->snd_cwnd &&
-            !(sk->sk_userlocks & SOCK_SNDBUF_LOCK) &&
-            !tcp_memory_pressure &&
-            atomic_read(&tcp_memory_allocated) < sysctl_tcp_mem[0]) {
-                int sndmem = max_t(u32, tp->rx_opt.mss_clamp, tp->mss_cache_std) +
+        if (tcp_should_expand_sndbuf(sk, tp)) {
+                int sndmem = max_t(u32, tp->rx_opt.mss_clamp, tp->mss_cache) +
                         MAX_TCP_HEADER + 16 + sizeof(struct sk_buff),
                     demanded = max_t(unsigned int, tp->snd_cwnd,
                                                    tp->reordering + 1);
@@ -3975,22 +3356,9 @@ static inline void tcp_check_space(struct sock *sk)
         }
 }
 
-static void __tcp_data_snd_check(struct sock *sk, struct sk_buff *skb)
+static __inline__ void tcp_data_snd_check(struct sock *sk, struct tcp_sock *tp)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        if (after(TCP_SKB_CB(skb)->end_seq, tp->snd_una + tp->snd_wnd) ||
-            tcp_packets_in_flight(tp) >= tp->snd_cwnd ||
-            tcp_write_xmit(sk, tp->nonagle))
-                tcp_check_probe_timer(sk, tp);
-}
-
-static __inline__ void tcp_data_snd_check(struct sock *sk)
-{
-        struct sk_buff *skb = sk->sk_send_head;
-
-        if (skb != NULL)
-                __tcp_data_snd_check(sk, skb);
+        tcp_push_pending_frames(sk, tp);
         tcp_check_space(sk);
 }
 
@@ -4284,7 +3652,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                                  */
                                 tcp_ack(sk, skb, 0);
                                 __kfree_skb(skb); 
-                                tcp_data_snd_check(sk);
+                                tcp_data_snd_check(sk, tp);
                                 return 0;
                         } else { /* Header too small */
                                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
@@ -4350,7 +3718,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                         if (TCP_SKB_CB(skb)->ack_seq != tp->snd_una) {
                                 /* Well, only one small jumplet in fast path... */
                                 tcp_ack(sk, skb, FLAG_DATA);
-                                tcp_data_snd_check(sk);
+                                tcp_data_snd_check(sk, tp);
                                 if (!tcp_ack_scheduled(tp))
                                         goto no_ack;
                         }
@@ -4428,7 +3796,7 @@ step5:
         /* step 7: process the segment text */
         tcp_data_queue(sk, skb);
 
-        tcp_data_snd_check(sk);
+        tcp_data_snd_check(sk, tp);
         tcp_ack_snd_check(sk);
         return 0;
 
@@ -4552,6 +3920,8 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
 
                 tcp_init_metrics(sk);
 
+                tcp_init_congestion_control(tp);
+
                 /* Prevent spurious tcp_cwnd_restart() on first data
                  * packet.
                  */
@@ -4708,9 +4078,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                         if(tp->af_specific->conn_request(sk, skb) < 0)
                                 return 1;
 
-                        init_westwood(sk);
-                        init_bictcp(tp);
-
                         /* Now we have several options: In theory there is 
                          * nothing else in the frame. KA9Q has an option to 
                          * send data with the syn, BSD accepts data with the
@@ -4732,9 +4099,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 goto discard;
 
         case TCP_SYN_SENT:
-                init_westwood(sk);
-                init_bictcp(tp);
-
                 queued = tcp_rcv_synsent_state_process(sk, skb, th, len);
                 if (queued >= 0)
                         return queued;
@@ -4742,7 +4106,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 /* Do step6 onward by hand. */
                 tcp_urg(sk, skb, th);
                 __kfree_skb(skb);
-                tcp_data_snd_check(sk);
+                tcp_data_snd_check(sk, tp);
                 return 0;
         }
 
@@ -4816,7 +4180,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                                  */
                                 if (tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr &&
                                     !tp->srtt)
-                                        tcp_ack_saw_tstamp(tp, 0);
+                                        tcp_ack_saw_tstamp(tp, 0, 0);
 
                                 if (tp->rx_opt.tstamp_ok)
                                         tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
@@ -4828,6 +4192,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 
                                 tcp_init_metrics(sk);
 
+                                tcp_init_congestion_control(tp);
+
                                 /* Prevent spurious tcp_cwnd_restart() on
                                  * first data packet.
                                  */
@@ -4931,7 +4297,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 
         /* tcp_data could move socket to TIME-WAIT */
         if (sk->sk_state != TCP_CLOSE) {
-                tcp_data_snd_check(sk);
+                tcp_data_snd_check(sk, tp);
                 tcp_ack_snd_check(sk);
         }
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 2d41d5d6ad..67c670886c 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -242,9 +242,14 @@ static int tcp_v4_get_port(struct sock *sk, unsigned short snum)
                 tcp_port_rover = rover;
                 spin_unlock(&tcp_portalloc_lock);
 
-                /* Exhausted local port range during search? */
+                /* Exhausted local port range during search?  It is not
+                 * possible for us to be holding one of the bind hash
+                 * locks if this test triggers, because if 'remaining'
+                 * drops to zero, we broke out of the do/while loop at
+                 * the top level, not from the 'break;' statement.
+                 */
                 ret = 1;
-                if (remaining <= 0)
+                if (unlikely(remaining <= 0))
                         goto fail;
 
                 /* OK, here is the one we will use.  HEAD is
@@ -1494,12 +1499,11 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                          * to destinations, already remembered
                          * to the moment of synflood.
                          */
-                        NETDEBUG(if (net_ratelimit()) \
-                                        printk(KERN_DEBUG "TCP: drop open "
-                                                          "request from %u.%u."
-                                                          "%u.%u/%u\n", \
-                                               NIPQUAD(saddr),
-                                               ntohs(skb->h.th->source)));
+                        LIMIT_NETDEBUG(printk(KERN_DEBUG "TCP: drop open "
+                                              "request from %u.%u."
+                                              "%u.%u/%u\n",
+                                              NIPQUAD(saddr),
+                                              ntohs(skb->h.th->source)));
                         dst_release(dst);
                         goto drop_and_free;
                 }
@@ -1627,8 +1631,7 @@ static int tcp_v4_checksum_init(struct sk_buff *skb)
                                   skb->nh.iph->daddr, skb->csum))
                         return 0;
 
-                NETDEBUG(if (net_ratelimit())
-                                printk(KERN_DEBUG "hw tcp v4 csum failed\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "hw tcp v4 csum failed\n"));
                 skb->ip_summed = CHECKSUM_NONE;
         }
         if (skb->len <= 76) {
@@ -2045,9 +2048,10 @@ static int tcp_v4_init_sock(struct sock *sk)
          */
         tp->snd_ssthresh = 0x7fffffff;  /* Infinity */
         tp->snd_cwnd_clamp = ~0;
-        tp->mss_cache_std = tp->mss_cache = 536;
+        tp->mss_cache = 536;
 
         tp->reordering = sysctl_tcp_reordering;
+        tp->ca_ops = &tcp_init_congestion_ops;
 
         sk->sk_state = TCP_CLOSE;
 
@@ -2070,6 +2074,8 @@ int tcp_v4_destroy_sock(struct sock *sk)
 
         tcp_clear_xmit_timers(sk);
 
+        tcp_cleanup_congestion_control(tp);
+
         /* Cleanup up the write buffer. */
         sk_stream_writequeue_purge(sk);
 
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index b3943e7562..f42a284164 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -774,6 +774,8 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 newtp->frto_counter = 0;
                 newtp->frto_highmark = 0;
 
+                newtp->ca_ops = &tcp_reno;
+
                 tcp_set_ca_state(newtp, TCP_CA_Open);
                 tcp_init_xmit_timers(newsk);
                 skb_queue_head_init(&newtp->out_of_order_queue);
@@ -842,8 +844,6 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 if (newtp->ecn_flags&TCP_ECN_OK)
                         sock_set_flag(newsk, SOCK_NO_LARGESEND);
 
-                tcp_ca_init(newtp);
-
                 TCP_INC_STATS_BH(TCP_MIB_PASSIVEOPENS);
         }
         return newsk;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index f17c6577e3..dd30dd137b 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -49,7 +49,7 @@ int sysctl_tcp_retrans_collapse = 1;
  * will allow a single TSO frame to consume.  Building TSO frames
  * which are too large can cause TCP streams to be bursty.
  */
-int sysctl_tcp_tso_win_divisor = 8;
+int sysctl_tcp_tso_win_divisor = 3;
 
 static inline void update_send_head(struct sock *sk, struct tcp_sock *tp,
                                     struct sk_buff *skb)
@@ -111,8 +111,7 @@ static void tcp_cwnd_restart(struct tcp_sock *tp, struct dst_entry *dst)
         u32 restart_cwnd = tcp_init_cwnd(tp, dst);
         u32 cwnd = tp->snd_cwnd;
 
-        if (tcp_is_vegas(tp)) 
-                tcp_vegas_enable(tp);
+        tcp_ca_event(tp, CA_EVENT_CWND_RESTART);
 
         tp->snd_ssthresh = tcp_current_ssthresh(tp);
         restart_cwnd = min(restart_cwnd, cwnd);
@@ -141,11 +140,11 @@ static inline void tcp_event_data_sent(struct tcp_sock *tp,
                 tp->ack.pingpong = 1;
 }
 
-static __inline__ void tcp_event_ack_sent(struct sock *sk)
+static __inline__ void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
-        tcp_dec_quickack_mode(tp);
+        tcp_dec_quickack_mode(tp, pkts);
         tcp_clear_xmit_timer(sk, TCP_TIME_DACK);
 }
 
@@ -280,6 +279,10 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb)
 #define SYSCTL_FLAG_WSCALE      0x2
 #define SYSCTL_FLAG_SACK        0x4
 
+                /* If congestion control is doing timestamping */
+                if (tp->ca_ops->rtt_sample)
+                        do_gettimeofday(&skb->stamp);
+
                 sysctl_flags = 0;
                 if (tcb->flags & TCPCB_FLAG_SYN) {
                         tcp_header_size = sizeof(struct tcphdr) + TCPOLEN_MSS;
@@ -304,17 +307,8 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                                             (tp->rx_opt.eff_sacks * TCPOLEN_SACK_PERBLOCK));
                 }
                 
-                /*
-                 * If the connection is idle and we are restarting,
-                 * then we don't want to do any Vegas calculations
-                 * until we get fresh RTT samples.  So when we
-                 * restart, we reset our Vegas state to a clean
-                 * slate. After we get acks for this flight of
-                 * packets, _then_ we can make Vegas calculations
-                 * again.
-                 */
-                if (tcp_is_vegas(tp) && tcp_packets_in_flight(tp) == 0)
-                        tcp_vegas_enable(tp);
+                if (tcp_packets_in_flight(tp) == 0)
+                        tcp_ca_event(tp, CA_EVENT_TX_START);
 
                 th = (struct tcphdr *) skb_push(skb, tcp_header_size);
                 skb->h.th = th;
@@ -361,7 +355,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                 tp->af_specific->send_check(sk, th, skb->len, skb);
 
                 if (tcb->flags & TCPCB_FLAG_ACK)
-                        tcp_event_ack_sent(sk);
+                        tcp_event_ack_sent(sk, tcp_skb_pcount(skb));
 
                 if (skb->len != tcp_header_size)
                         tcp_event_data_sent(tp, skb, sk);
@@ -409,42 +403,9 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
                 sk->sk_send_head = skb;
 }
 
-static inline void tcp_tso_set_push(struct sk_buff *skb)
-{
-        /* Force push to be on for any TSO frames to workaround
-         * problems with busted implementations like Mac OS-X that
-         * hold off socket receive wakeups until push is seen.
-         */
-        if (tcp_skb_pcount(skb) > 1)
-                TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_PSH;
-}
-
-/* Send _single_ skb sitting at the send head. This function requires
- * true push pending frames to setup probe timer etc.
- */
-void tcp_push_one(struct sock *sk, unsigned cur_mss)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-        struct sk_buff *skb = sk->sk_send_head;
-
-        if (tcp_snd_test(sk, skb, cur_mss, TCP_NAGLE_PUSH)) {
-                /* Send it out now. */
-                TCP_SKB_CB(skb)->when = tcp_time_stamp;
-                tcp_tso_set_push(skb);
-                if (!tcp_transmit_skb(sk, skb_clone(skb, sk->sk_allocation))) {
-                        sk->sk_send_head = NULL;
-                        tp->snd_nxt = TCP_SKB_CB(skb)->end_seq;
-                        tcp_packets_out_inc(sk, tp, skb);
-                        return;
-                }
-        }
-}
-
-void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb)
+static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb, unsigned int mss_now)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        if (skb->len <= tp->mss_cache_std ||
+        if (skb->len <= mss_now ||
             !(sk->sk_route_caps & NETIF_F_TSO)) {
                 /* Avoid the costly divide in the normal
                  * non-TSO case.
@@ -454,10 +415,10 @@ void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb)
         } else {
                 unsigned int factor;
 
-                factor = skb->len + (tp->mss_cache_std - 1);
-                factor /= tp->mss_cache_std;
+                factor = skb->len + (mss_now - 1);
+                factor /= mss_now;
                 skb_shinfo(skb)->tso_segs = factor;
-                skb_shinfo(skb)->tso_size = tp->mss_cache_std;
+                skb_shinfo(skb)->tso_size = mss_now;
         }
 }
 
@@ -466,7 +427,7 @@ void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb)
  * packet to the list.  This won't be called frequently, I hope. 
  * Remember, these are still headerless SKBs at this point.
  */
-static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len)
+static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss_now)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *buff;
@@ -521,6 +482,7 @@ static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len)
          * skbs, which it never sent before. --ANK
          */
         TCP_SKB_CB(buff)->when = TCP_SKB_CB(skb)->when;
+        buff->stamp = skb->stamp;
 
         if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST) {
                 tp->lost_out -= tcp_skb_pcount(skb);
@@ -528,8 +490,8 @@ static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len)
         }
 
         /* Fix up tso_factor for both original and new SKB.  */
-        tcp_set_skb_tso_segs(sk, skb);
-        tcp_set_skb_tso_segs(sk, buff);
+        tcp_set_skb_tso_segs(sk, skb, mss_now);
+        tcp_set_skb_tso_segs(sk, buff, mss_now);
 
         if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST) {
                 tp->lost_out += tcp_skb_pcount(skb);
@@ -542,6 +504,7 @@ static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len)
         }
 
         /* Link BUFF into the send queue. */
+        skb_header_release(buff);
         __skb_append(skb, buff);
 
         return 0;
@@ -604,7 +567,7 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
          * factor and mss.
          */
         if (tcp_skb_pcount(skb) > 1)
-                tcp_set_skb_tso_segs(sk, skb);
+                tcp_set_skb_tso_segs(sk, skb, tcp_current_mss(sk, 1));
 
         return 0;
 }
@@ -662,7 +625,7 @@ unsigned int tcp_sync_mss(struct sock *sk, u32 pmtu)
 
         /* And store cached results */
         tp->pmtu_cookie = pmtu;
-        tp->mss_cache = tp->mss_cache_std = mss_now;
+        tp->mss_cache = mss_now;
 
         return mss_now;
 }
@@ -674,57 +637,315 @@ unsigned int tcp_sync_mss(struct sock *sk, u32 pmtu)
  * cannot be large. However, taking into account rare use of URG, this
  * is not a big flaw.
  */
-
-unsigned int tcp_current_mss(struct sock *sk, int large)
+unsigned int tcp_current_mss(struct sock *sk, int large_allowed)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct dst_entry *dst = __sk_dst_get(sk);
-        unsigned int do_large, mss_now;
+        u32 mss_now;
+        u16 xmit_size_goal;
+        int doing_tso = 0;
+
+        mss_now = tp->mss_cache;
+
+        if (large_allowed &&
+            (sk->sk_route_caps & NETIF_F_TSO) &&
+            !tp->urg_mode)
+                doing_tso = 1;
 
-        mss_now = tp->mss_cache_std;
         if (dst) {
                 u32 mtu = dst_mtu(dst);
                 if (mtu != tp->pmtu_cookie)
                         mss_now = tcp_sync_mss(sk, mtu);
         }
 
-        do_large = (large &&
-                    (sk->sk_route_caps & NETIF_F_TSO) &&
-                    !tp->urg_mode);
+        if (tp->rx_opt.eff_sacks)
+                mss_now -= (TCPOLEN_SACK_BASE_ALIGNED +
+                            (tp->rx_opt.eff_sacks * TCPOLEN_SACK_PERBLOCK));
 
-        if (do_large) {
-                unsigned int large_mss, factor, limit;
+        xmit_size_goal = mss_now;
 
-                large_mss = 65535 - tp->af_specific->net_header_len -
+        if (doing_tso) {
+                xmit_size_goal = 65535 -
+                        tp->af_specific->net_header_len -
                         tp->ext_header_len - tp->tcp_header_len;
 
-                if (tp->max_window && large_mss > (tp->max_window>>1))
-                        large_mss = max((tp->max_window>>1),
-                                        68U - tp->tcp_header_len);
+                if (tp->max_window &&
+                    (xmit_size_goal > (tp->max_window >> 1)))
+                        xmit_size_goal = max((tp->max_window >> 1),
+                                             68U - tp->tcp_header_len);
 
-                factor = large_mss / mss_now;
+                xmit_size_goal -= (xmit_size_goal % mss_now);
+        }
+        tp->xmit_size_goal = xmit_size_goal;
 
-                /* Always keep large mss multiple of real mss, but
-                 * do not exceed 1/tso_win_divisor of the congestion window
-                 * so we can keep the ACK clock ticking and minimize
-                 * bursting.
-                 */
-                limit = tp->snd_cwnd;
-                if (sysctl_tcp_tso_win_divisor)
-                        limit /= sysctl_tcp_tso_win_divisor;
-                limit = max(1U, limit);
-                if (factor > limit)
-                        factor = limit;
+        return mss_now;
+}
+
+/* Congestion window validation. (RFC2861) */
 
-                tp->mss_cache = mss_now * factor;
+static inline void tcp_cwnd_validate(struct sock *sk, struct tcp_sock *tp)
+{
+        __u32 packets_out = tp->packets_out;
+
+        if (packets_out >= tp->snd_cwnd) {
+                /* Network is feed fully. */
+                tp->snd_cwnd_used = 0;
+                tp->snd_cwnd_stamp = tcp_time_stamp;
+        } else {
+                /* Network starves. */
+                if (tp->packets_out > tp->snd_cwnd_used)
+                        tp->snd_cwnd_used = tp->packets_out;
 
-                mss_now = tp->mss_cache;
+                if ((s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= tp->rto)
+                        tcp_cwnd_application_limited(sk);
         }
+}
 
-        if (tp->rx_opt.eff_sacks)
-                mss_now -= (TCPOLEN_SACK_BASE_ALIGNED +
-                            (tp->rx_opt.eff_sacks * TCPOLEN_SACK_PERBLOCK));
-        return mss_now;
+static unsigned int tcp_window_allows(struct tcp_sock *tp, struct sk_buff *skb, unsigned int mss_now, unsigned int cwnd)
+{
+        u32 window, cwnd_len;
+
+        window = (tp->snd_una + tp->snd_wnd - TCP_SKB_CB(skb)->seq);
+        cwnd_len = mss_now * cwnd;
+        return min(window, cwnd_len);
+}
+
+/* Can at least one segment of SKB be sent right now, according to the
+ * congestion window rules?  If so, return how many segments are allowed.
+ */
+static inline unsigned int tcp_cwnd_test(struct tcp_sock *tp, struct sk_buff *skb)
+{
+        u32 in_flight, cwnd;
+
+        /* Don't be strict about the congestion window for the final FIN.  */
+        if (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN)
+                return 1;
+
+        in_flight = tcp_packets_in_flight(tp);
+        cwnd = tp->snd_cwnd;
+        if (in_flight < cwnd)
+                return (cwnd - in_flight);
+
+        return 0;
+}
+
+/* This must be invoked the first time we consider transmitting
+ * SKB onto the wire.
+ */
+static inline int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb, unsigned int mss_now)
+{
+        int tso_segs = tcp_skb_pcount(skb);
+
+        if (!tso_segs ||
+            (tso_segs > 1 &&
+             skb_shinfo(skb)->tso_size != mss_now)) {
+                tcp_set_skb_tso_segs(sk, skb, mss_now);
+                tso_segs = tcp_skb_pcount(skb);
+        }
+        return tso_segs;
+}
+
+static inline int tcp_minshall_check(const struct tcp_sock *tp)
+{
+        return after(tp->snd_sml,tp->snd_una) &&
+                !after(tp->snd_sml, tp->snd_nxt);
+}
+
+/* Return 0, if packet can be sent now without violation Nagle's rules:
+ * 1. It is full sized.
+ * 2. Or it contains FIN. (already checked by caller)
+ * 3. Or TCP_NODELAY was set.
+ * 4. Or TCP_CORK is not set, and all sent packets are ACKed.
+ *    With Minshall's modification: all sent small packets are ACKed.
+ */
+
+static inline int tcp_nagle_check(const struct tcp_sock *tp,
+                                  const struct sk_buff *skb, 
+                                  unsigned mss_now, int nonagle)
+{
+        return (skb->len < mss_now &&
+                ((nonagle&TCP_NAGLE_CORK) ||
+                 (!nonagle &&
+                  tp->packets_out &&
+                  tcp_minshall_check(tp))));
+}
+
+/* Return non-zero if the Nagle test allows this packet to be
+ * sent now.
+ */
+static inline int tcp_nagle_test(struct tcp_sock *tp, struct sk_buff *skb,
+                                 unsigned int cur_mss, int nonagle)
+{
+        /* Nagle rule does not apply to frames, which sit in the middle of the
+         * write_queue (they have no chances to get new data).
+         *
+         * This is implemented in the callers, where they modify the 'nonagle'
+         * argument based upon the location of SKB in the send queue.
+         */
+        if (nonagle & TCP_NAGLE_PUSH)
+                return 1;
+
+        /* Don't use the nagle rule for urgent data (or for the final FIN).  */
+        if (tp->urg_mode ||
+            (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN))
+                return 1;
+
+        if (!tcp_nagle_check(tp, skb, cur_mss, nonagle))
+                return 1;
+
+        return 0;
+}
+
+/* Does at least the first segment of SKB fit into the send window? */
+static inline int tcp_snd_wnd_test(struct tcp_sock *tp, struct sk_buff *skb, unsigned int cur_mss)
+{
+        u32 end_seq = TCP_SKB_CB(skb)->end_seq;
+
+        if (skb->len > cur_mss)
+                end_seq = TCP_SKB_CB(skb)->seq + cur_mss;
+
+        return !after(end_seq, tp->snd_una + tp->snd_wnd);
+}
+
+/* This checks if the data bearing packet SKB (usually sk->sk_send_head)
+ * should be put on the wire right now.  If so, it returns the number of
+ * packets allowed by the congestion window.
+ */
+static unsigned int tcp_snd_test(struct sock *sk, struct sk_buff *skb,
+                                 unsigned int cur_mss, int nonagle)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        unsigned int cwnd_quota;
+
+        tcp_init_tso_segs(sk, skb, cur_mss);
+
+        if (!tcp_nagle_test(tp, skb, cur_mss, nonagle))
+                return 0;
+
+        cwnd_quota = tcp_cwnd_test(tp, skb);
+        if (cwnd_quota &&
+            !tcp_snd_wnd_test(tp, skb, cur_mss))
+                cwnd_quota = 0;
+
+        return cwnd_quota;
+}
+
+static inline int tcp_skb_is_last(const struct sock *sk, 
+                                  const struct sk_buff *skb)
+{
+        return skb->next == (struct sk_buff *)&sk->sk_write_queue;
+}
+
+int tcp_may_send_now(struct sock *sk, struct tcp_sock *tp)
+{
+        struct sk_buff *skb = sk->sk_send_head;
+
+        return (skb &&
+                tcp_snd_test(sk, skb, tcp_current_mss(sk, 1),
+                             (tcp_skb_is_last(sk, skb) ?
+                              TCP_NAGLE_PUSH :
+                              tp->nonagle)));
+}
+
+/* Trim TSO SKB to LEN bytes, put the remaining data into a new packet
+ * which is put after SKB on the list.  It is very much like
+ * tcp_fragment() except that it may make several kinds of assumptions
+ * in order to speed up the splitting operation.  In particular, we
+ * know that all the data is in scatter-gather pages, and that the
+ * packet has never been sent out before (and thus is not cloned).
+ */
+static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len, unsigned int mss_now)
+{
+        struct sk_buff *buff;
+        int nlen = skb->len - len;
+        u16 flags;
+
+        /* All of a TSO frame must be composed of paged data.  */
+        if (skb->len != skb->data_len)
+                return tcp_fragment(sk, skb, len, mss_now);
+
+        buff = sk_stream_alloc_pskb(sk, 0, 0, GFP_ATOMIC);
+        if (unlikely(buff == NULL))
+                return -ENOMEM;
+
+        buff->truesize = nlen;
+        skb->truesize -= nlen;
+
+        /* Correct the sequence numbers. */
+        TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
+        TCP_SKB_CB(buff)->end_seq = TCP_SKB_CB(skb)->end_seq;
+        TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(buff)->seq;
+
+        /* PSH and FIN should only be set in the second packet. */
+        flags = TCP_SKB_CB(skb)->flags;
+        TCP_SKB_CB(skb)->flags = flags & ~(TCPCB_FLAG_FIN|TCPCB_FLAG_PSH);
+        TCP_SKB_CB(buff)->flags = flags;
+
+        /* This packet was never sent out yet, so no SACK bits. */
+        TCP_SKB_CB(buff)->sacked = 0;
+
+        buff->ip_summed = skb->ip_summed = CHECKSUM_HW;
+        skb_split(skb, buff, len);
+
+        /* Fix up tso_factor for both original and new SKB.  */
+        tcp_set_skb_tso_segs(sk, skb, mss_now);
+        tcp_set_skb_tso_segs(sk, buff, mss_now);
+
+        /* Link BUFF into the send queue. */
+        skb_header_release(buff);
+        __skb_append(skb, buff);
+
+        return 0;
+}
+
+/* Try to defer sending, if possible, in order to minimize the amount
+ * of TSO splitting we do.  View it as a kind of TSO Nagle test.
+ *
+ * This algorithm is from John Heffner.
+ */
+static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_buff *skb)
+{
+        u32 send_win, cong_win, limit, in_flight;
+
+        if (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN)
+                return 0;
+
+        if (tp->ca_state != TCP_CA_Open)
+                return 0;
+
+        in_flight = tcp_packets_in_flight(tp);
+
+        BUG_ON(tcp_skb_pcount(skb) <= 1 ||
+               (tp->snd_cwnd <= in_flight));
+
+        send_win = (tp->snd_una + tp->snd_wnd) - TCP_SKB_CB(skb)->seq;
+
+        /* From in_flight test above, we know that cwnd > in_flight.  */
+        cong_win = (tp->snd_cwnd - in_flight) * tp->mss_cache;
+
+        limit = min(send_win, cong_win);
+
+        if (sysctl_tcp_tso_win_divisor) {
+                u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
+
+                /* If at least some fraction of a window is available,
+                 * just use it.
+                 */
+                chunk /= sysctl_tcp_tso_win_divisor;
+                if (limit >= chunk)
+                        return 0;
+        } else {
+                /* Different approach, try not to defer past a single
+                 * ACK.  Receiver should ACK every other full sized
+                 * frame, so if we have space for more than 3 frames
+                 * then send now.
+                 */
+                if (limit > tcp_max_burst(tp) * tp->mss_cache)
+                        return 0;
+        }
+
+        /* Ok, it looks like it is advisable to defer.  */
+        return 1;
 }
 
 /* This routine writes packets to the network.  It advances the
@@ -734,57 +955,142 @@ unsigned int tcp_current_mss(struct sock *sk, int large)
  * Returns 1, if no segments are in flight and we have queued segments, but
  * cannot send anything now because of SWS or another problem.
  */
-int tcp_write_xmit(struct sock *sk, int nonagle)
+static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        unsigned int mss_now;
+        struct sk_buff *skb;
+        unsigned int tso_segs, sent_pkts;
+        int cwnd_quota;
 
         /* If we are closed, the bytes will have to remain here.
          * In time closedown will finish, we empty the write queue and all
          * will be happy.
          */
-        if (sk->sk_state != TCP_CLOSE) {
-                struct sk_buff *skb;
-                int sent_pkts = 0;
+        if (unlikely(sk->sk_state == TCP_CLOSE))
+                return 0;
 
-                /* Account for SACKS, we may need to fragment due to this.
-                 * It is just like the real MSS changing on us midstream.
-                 * We also handle things correctly when the user adds some
-                 * IP options mid-stream.  Silly to do, but cover it.
-                 */
-                mss_now = tcp_current_mss(sk, 1);
-
-                while ((skb = sk->sk_send_head) &&
-                       tcp_snd_test(sk, skb, mss_now,
-                                    tcp_skb_is_last(sk, skb) ? nonagle :
-                                                               TCP_NAGLE_PUSH)) {
-                        if (skb->len > mss_now) {
-                                if (tcp_fragment(sk, skb, mss_now))
-                                        break;
-                        }
+        sent_pkts = 0;
+        while ((skb = sk->sk_send_head)) {
+                unsigned int limit;
 
-                        TCP_SKB_CB(skb)->when = tcp_time_stamp;
-                        tcp_tso_set_push(skb);
-                        if (tcp_transmit_skb(sk, skb_clone(skb, GFP_ATOMIC)))
+                tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
+                BUG_ON(!tso_segs);
+
+                cwnd_quota = tcp_cwnd_test(tp, skb);
+                if (!cwnd_quota)
+                        break;
+
+                if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now)))
+                        break;
+
+                if (tso_segs == 1) {
+                        if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
+                                                     (tcp_skb_is_last(sk, skb) ?
+                                                      nonagle : TCP_NAGLE_PUSH))))
                                 break;
+                } else {
+                        if (tcp_tso_should_defer(sk, tp, skb))
+                                break;
+                }
 
-                        /* Advance the send_head.  This one is sent out.
-                         * This call will increment packets_out.
-                         */
-                        update_send_head(sk, tp, skb);
+                limit = mss_now;
+                if (tso_segs > 1) {
+                        limit = tcp_window_allows(tp, skb,
+                                                  mss_now, cwnd_quota);
+
+                        if (skb->len < limit) {
+                                unsigned int trim = skb->len % mss_now;
 
-                        tcp_minshall_update(tp, mss_now, skb);
-                        sent_pkts = 1;
+                                if (trim)
+                                        limit = skb->len - trim;
+                        }
                 }
 
-                if (sent_pkts) {
-                        tcp_cwnd_validate(sk, tp);
-                        return 0;
+                if (skb->len > limit &&
+                    unlikely(tso_fragment(sk, skb, limit, mss_now)))
+                        break;
+
+                TCP_SKB_CB(skb)->when = tcp_time_stamp;
+
+                if (unlikely(tcp_transmit_skb(sk, skb_clone(skb, GFP_ATOMIC))))
+                        break;
+
+                /* Advance the send_head.  This one is sent out.
+                 * This call will increment packets_out.
+                 */
+                update_send_head(sk, tp, skb);
+
+                tcp_minshall_update(tp, mss_now, skb);
+                sent_pkts++;
+        }
+
+        if (likely(sent_pkts)) {
+                tcp_cwnd_validate(sk, tp);
+                return 0;
+        }
+        return !tp->packets_out && sk->sk_send_head;
+}
+
+/* Push out any pending frames which were held back due to
+ * TCP_CORK or attempt at coalescing tiny packets.
+ * The socket must be locked by the caller.
+ */
+void __tcp_push_pending_frames(struct sock *sk, struct tcp_sock *tp,
+                               unsigned int cur_mss, int nonagle)
+{
+        struct sk_buff *skb = sk->sk_send_head;
+
+        if (skb) {
+                if (tcp_write_xmit(sk, cur_mss, nonagle))
+                        tcp_check_probe_timer(sk, tp);
+        }
+}
+
+/* Send _single_ skb sitting at the send head. This function requires
+ * true push pending frames to setup probe timer etc.
+ */
+void tcp_push_one(struct sock *sk, unsigned int mss_now)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct sk_buff *skb = sk->sk_send_head;
+        unsigned int tso_segs, cwnd_quota;
+
+        BUG_ON(!skb || skb->len < mss_now);
+
+        tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
+        cwnd_quota = tcp_snd_test(sk, skb, mss_now, TCP_NAGLE_PUSH);
+
+        if (likely(cwnd_quota)) {
+                unsigned int limit;
+
+                BUG_ON(!tso_segs);
+
+                limit = mss_now;
+                if (tso_segs > 1) {
+                        limit = tcp_window_allows(tp, skb,
+                                                  mss_now, cwnd_quota);
+
+                        if (skb->len < limit) {
+                                unsigned int trim = skb->len % mss_now;
+
+                                if (trim)
+                                        limit = skb->len - trim;
+                        }
                 }
 
-                return !tp->packets_out && sk->sk_send_head;
+                if (skb->len > limit &&
+                    unlikely(tso_fragment(sk, skb, limit, mss_now)))
+                        return;
+
+                /* Send it out now. */
+                TCP_SKB_CB(skb)->when = tcp_time_stamp;
+
+                if (likely(!tcp_transmit_skb(sk, skb_clone(skb, sk->sk_allocation)))) {
+                        update_send_head(sk, tp, skb);
+                        tcp_cwnd_validate(sk, tp);
+                        return;
+                }
         }
-        return 0;
 }
 
 /* This function returns the amount that we can raise the
@@ -1044,7 +1350,6 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
                 if (sk->sk_route_caps & NETIF_F_TSO) {
                         sk->sk_route_caps &= ~NETIF_F_TSO;
                         sock_set_flag(sk, SOCK_NO_LARGESEND);
-                        tp->mss_cache = tp->mss_cache_std;
                 }
 
                 if (tcp_trim_head(sk, skb, tp->snd_una - TCP_SKB_CB(skb)->seq))
@@ -1062,15 +1367,21 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
 
         if (skb->len > cur_mss) {
                 int old_factor = tcp_skb_pcount(skb);
-                int new_factor;
+                int diff;
 
-                if (tcp_fragment(sk, skb, cur_mss))
+                if (tcp_fragment(sk, skb, cur_mss, cur_mss))
                         return -ENOMEM; /* We'll try again later. */
 
                 /* New SKB created, account for it. */
-                new_factor = tcp_skb_pcount(skb);
-                tp->packets_out -= old_factor - new_factor;
-                tp->packets_out += tcp_skb_pcount(skb->next);
+                diff = old_factor - tcp_skb_pcount(skb) -
+                       tcp_skb_pcount(skb->next);
+                tp->packets_out -= diff;
+
+                if (diff > 0) {
+                        tp->fackets_out -= diff;
+                        if ((int)tp->fackets_out < 0)
+                                tp->fackets_out = 0;
+                }
         }
 
         /* Collapse two adjacent packets if worthwhile and we can. */
@@ -1106,7 +1417,6 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
          * is still in somebody's hands, else make a clone.
          */
         TCP_SKB_CB(skb)->when = tcp_time_stamp;
-        tcp_tso_set_push(skb);
 
         err = tcp_transmit_skb(sk, (skb_cloned(skb) ?
                                     pskb_copy(skb, GFP_ATOMIC):
@@ -1290,7 +1600,7 @@ void tcp_send_fin(struct sock *sk)
  * was unread data in the receive queue.  This behavior is recommended
  * by draft-ietf-tcpimpl-prob-03.txt section 3.10.  -DaveM
  */
-void tcp_send_active_reset(struct sock *sk, int priority)
+void tcp_send_active_reset(struct sock *sk, unsigned int __nocast priority)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
@@ -1449,7 +1759,6 @@ static inline void tcp_connect_init(struct sock *sk)
                 tp->window_clamp = dst_metric(dst, RTAX_WINDOW);
         tp->advmss = dst_metric(dst, RTAX_ADVMSS);
         tcp_initialize_rcv_mss(sk);
-        tcp_ca_init(tp);
 
         tcp_select_initial_window(tcp_full_space(sk),
                                   tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
@@ -1503,7 +1812,6 @@ int tcp_connect(struct sock *sk)
         TCP_SKB_CB(buff)->end_seq = tp->write_seq;
         tp->snd_nxt = tp->write_seq;
         tp->pushed_seq = tp->write_seq;
-        tcp_ca_init(tp);
 
         /* Send it off. */
         TCP_SKB_CB(buff)->when = tcp_time_stamp;
@@ -1670,21 +1978,19 @@ int tcp_write_wakeup(struct sock *sk)
                             skb->len > mss) {
                                 seg_size = min(seg_size, mss);
                                 TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_PSH;
-                                if (tcp_fragment(sk, skb, seg_size))
+                                if (tcp_fragment(sk, skb, seg_size, mss))
                                         return -1;
                                 /* SWS override triggered forced fragmentation.
                                  * Disable TSO, the connection is too sick. */
                                 if (sk->sk_route_caps & NETIF_F_TSO) {
                                         sock_set_flag(sk, SOCK_NO_LARGESEND);
                                         sk->sk_route_caps &= ~NETIF_F_TSO;
-                                        tp->mss_cache = tp->mss_cache_std;
                                 }
                         } else if (!tcp_skb_pcount(skb))
-                                tcp_set_skb_tso_segs(sk, skb);
+                                tcp_set_skb_tso_segs(sk, skb, mss);
 
                         TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_PSH;
                         TCP_SKB_CB(skb)->when = tcp_time_stamp;
-                        tcp_tso_set_push(skb);
                         err = tcp_transmit_skb(sk, skb_clone(skb, GFP_ATOMIC));
                         if (!err) {
                                 update_send_head(sk, tp, skb);
diff --git a/net/ipv4/tcp_scalable.c b/net/ipv4/tcp_scalable.c
new file mode 100644
index 0000000000..70e108e15c
--- /dev/null
+++ b/net/ipv4/tcp_scalable.c
@@ -0,0 +1,68 @@
+/* Tom Kelly's Scalable TCP
+ *
+ * See htt://www-lce.eng.cam.ac.uk/~ctk21/scalable/
+ *
+ * John Heffner <jheffner@sc.edu>
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <net/tcp.h>
+
+/* These factors derived from the recommended values in the aer:
+ * .01 and and 7/8. We use 50 instead of 100 to account for
+ * delayed ack.
+ */
+#define TCP_SCALABLE_AI_CNT     50U
+#define TCP_SCALABLE_MD_SCALE   3
+
+static void tcp_scalable_cong_avoid(struct tcp_sock *tp, u32 ack, u32 rtt,
+                                    u32 in_flight, int flag)
+{
+        if (in_flight < tp->snd_cwnd)
+                return;
+
+        if (tp->snd_cwnd <= tp->snd_ssthresh) {
+                tp->snd_cwnd++;
+        } else {
+                tp->snd_cwnd_cnt++;
+                if (tp->snd_cwnd_cnt > min(tp->snd_cwnd, TCP_SCALABLE_AI_CNT)){
+                        tp->snd_cwnd++;
+                        tp->snd_cwnd_cnt = 0;
+                }
+        }
+        tp->snd_cwnd = min_t(u32, tp->snd_cwnd, tp->snd_cwnd_clamp);
+        tp->snd_cwnd_stamp = tcp_time_stamp;
+}
+
+static u32 tcp_scalable_ssthresh(struct tcp_sock *tp)
+{
+        return max(tp->snd_cwnd - (tp->snd_cwnd>>TCP_SCALABLE_MD_SCALE), 2U);
+}
+
+
+static struct tcp_congestion_ops tcp_scalable = {
+        .ssthresh       = tcp_scalable_ssthresh,
+        .cong_avoid     = tcp_scalable_cong_avoid,
+        .min_cwnd       = tcp_reno_min_cwnd,
+
+        .owner          = THIS_MODULE,
+        .name           = "scalable",
+};
+
+static int __init tcp_scalable_register(void)
+{
+        return tcp_register_congestion_control(&tcp_scalable);
+}
+
+static void __exit tcp_scalable_unregister(void)
+{
+        tcp_unregister_congestion_control(&tcp_scalable);
+}
+
+module_init(tcp_scalable_register);
+module_exit(tcp_scalable_unregister);
+
+MODULE_AUTHOR("John Heffner");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Scalable TCP");
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index b127b44985..0084227438 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -231,11 +231,10 @@ static void tcp_delack_timer(unsigned long data)
         }
         tp->ack.pending &= ~TCP_ACK_TIMER;
 
-        if (skb_queue_len(&tp->ucopy.prequeue)) {
+        if (!skb_queue_empty(&tp->ucopy.prequeue)) {
                 struct sk_buff *skb;
 
-                NET_ADD_STATS_BH(LINUX_MIB_TCPSCHEDULERFAILED, 
-                                 skb_queue_len(&tp->ucopy.prequeue));
+                NET_INC_STATS_BH(LINUX_MIB_TCPSCHEDULERFAILED);
 
                 while ((skb = __skb_dequeue(&tp->ucopy.prequeue)) != NULL)
                         sk->sk_backlog_rcv(sk, skb);
diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
new file mode 100644
index 0000000000..9bd443db51
--- /dev/null
+++ b/net/ipv4/tcp_vegas.c
@@ -0,0 +1,411 @@
+/*
+ * TCP Vegas congestion control
+ *
+ * This is based on the congestion detection/avoidance scheme described in
+ *    Lawrence S. Brakmo and Larry L. Peterson.
+ *    "TCP Vegas: End to end congestion avoidance on a global internet."
+ *    IEEE Journal on Selected Areas in Communication, 13(8):1465--1480,
+ *    October 1995. Available from:
+ *      ftp://ftp.cs.arizona.edu/xkernel/Papers/jsac.ps
+ *
+ * See http://www.cs.arizona.edu/xkernel/ for their implementation.
+ * The main aspects that distinguish this implementation from the
+ * Arizona Vegas implementation are:
+ *   o We do not change the loss detection or recovery mechanisms of
+ *     Linux in any way. Linux already recovers from losses quite well,
+ *     using fine-grained timers, NewReno, and FACK.
+ *   o To avoid the performance penalty imposed by increasing cwnd
+ *     only every-other RTT during slow start, we increase during
+ *     every RTT during slow start, just like Reno.
+ *   o Largely to allow continuous cwnd growth during slow start,
+ *     we use the rate at which ACKs come back as the "actual"
+ *     rate, rather than the rate at which data is sent.
+ *   o To speed convergence to the right rate, we set the cwnd
+ *     to achieve the right ("actual") rate when we exit slow start.
+ *   o To filter out the noise caused by delayed ACKs, we use the
+ *     minimum RTT sample observed during the last RTT to calculate
+ *     the actual rate.
+ *   o When the sender re-starts from idle, it waits until it has
+ *     received ACKs for an entire flight of new data before making
+ *     a cwnd adjustment decision. The original Vegas implementation
+ *     assumed senders never went idle.
+ */
+
+#include <linux/config.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/tcp_diag.h>
+
+#include <net/tcp.h>
+
+/* Default values of the Vegas variables, in fixed-point representation
+ * with V_PARAM_SHIFT bits to the right of the binary point.
+ */
+#define V_PARAM_SHIFT 1
+static int alpha = 1<<V_PARAM_SHIFT;
+static int beta  = 3<<V_PARAM_SHIFT;
+static int gamma = 1<<V_PARAM_SHIFT;
+
+module_param(alpha, int, 0644);
+MODULE_PARM_DESC(alpha, "lower bound of packets in network (scale by 2)");
+module_param(beta, int, 0644);
+MODULE_PARM_DESC(beta, "upper bound of packets in network (scale by 2)");
+module_param(gamma, int, 0644);
+MODULE_PARM_DESC(gamma, "limit on increase (scale by 2)");
+
+
+/* Vegas variables */
+struct vegas {
+        u32     beg_snd_nxt;    /* right edge during last RTT */
+        u32     beg_snd_una;    /* left edge  during last RTT */
+        u32     beg_snd_cwnd;   /* saves the size of the cwnd */
+        u8      doing_vegas_now;/* if true, do vegas for this RTT */
+        u16     cntRTT;         /* # of RTTs measured within last RTT */
+        u32     minRTT;         /* min of RTTs measured within last RTT (in usec) */
+        u32     baseRTT;        /* the min of all Vegas RTT measurements seen (in usec) */
+};
+
+/* There are several situations when we must "re-start" Vegas:
+ *
+ *  o when a connection is established
+ *  o after an RTO
+ *  o after fast recovery
+ *  o when we send a packet and there is no outstanding
+ *    unacknowledged data (restarting an idle connection)
+ *
+ * In these circumstances we cannot do a Vegas calculation at the
+ * end of the first RTT, because any calculation we do is using
+ * stale info -- both the saved cwnd and congestion feedback are
+ * stale.
+ *
+ * Instead we must wait until the completion of an RTT during
+ * which we actually receive ACKs.
+ */
+static inline void vegas_enable(struct tcp_sock *tp)
+{
+        struct vegas *vegas = tcp_ca(tp);
+
+        /* Begin taking Vegas samples next time we send something. */
+        vegas->doing_vegas_now = 1;
+
+        /* Set the beginning of the next send window. */
+        vegas->beg_snd_nxt = tp->snd_nxt;
+
+        vegas->cntRTT = 0;
+        vegas->minRTT = 0x7fffffff;
+}
+
+/* Stop taking Vegas samples for now. */
+static inline void vegas_disable(struct tcp_sock *tp)
+{
+        struct vegas *vegas = tcp_ca(tp);
+
+        vegas->doing_vegas_now = 0;
+}
+
+static void tcp_vegas_init(struct tcp_sock *tp)
+{
+        struct vegas *vegas = tcp_ca(tp);
+
+        vegas->baseRTT = 0x7fffffff;
+        vegas_enable(tp);
+}
+
+/* Do RTT sampling needed for Vegas.
+ * Basically we:
+ *   o min-filter RTT samples from within an RTT to get the current
+ *     propagation delay + queuing delay (we are min-filtering to try to
+ *     avoid the effects of delayed ACKs)
+ *   o min-filter RTT samples from a much longer window (forever for now)
+ *     to find the propagation delay (baseRTT)
+ */
+static void tcp_vegas_rtt_calc(struct tcp_sock *tp, u32 usrtt)
+{
+        struct vegas *vegas = tcp_ca(tp);
+        u32 vrtt = usrtt + 1; /* Never allow zero rtt or baseRTT */
+
+        /* Filter to find propagation delay: */
+        if (vrtt < vegas->baseRTT)
+                vegas->baseRTT = vrtt;
+
+        /* Find the min RTT during the last RTT to find
+         * the current prop. delay + queuing delay:
+         */
+        vegas->minRTT = min(vegas->minRTT, vrtt);
+        vegas->cntRTT++;
+}
+
+static void tcp_vegas_state(struct tcp_sock *tp, u8 ca_state)
+{
+
+        if (ca_state == TCP_CA_Open)
+                vegas_enable(tp);
+        else
+                vegas_disable(tp);
+}
+
+/*
+ * If the connection is idle and we are restarting,
+ * then we don't want to do any Vegas calculations
+ * until we get fresh RTT samples.  So when we
+ * restart, we reset our Vegas state to a clean
+ * slate. After we get acks for this flight of
+ * packets, _then_ we can make Vegas calculations
+ * again.
+ */
+static void tcp_vegas_cwnd_event(struct tcp_sock *tp, enum tcp_ca_event event)
+{
+        if (event == CA_EVENT_CWND_RESTART ||
+            event == CA_EVENT_TX_START)
+                tcp_vegas_init(tp);
+}
+
+static void tcp_vegas_cong_avoid(struct tcp_sock *tp, u32 ack,
+                                 u32 seq_rtt, u32 in_flight, int flag)
+{
+        struct vegas *vegas = tcp_ca(tp);
+
+        if (!vegas->doing_vegas_now)
+                return tcp_reno_cong_avoid(tp, ack, seq_rtt, in_flight, flag);
+
+        /* The key players are v_beg_snd_una and v_beg_snd_nxt.
+         *
+         * These are so named because they represent the approximate values
+         * of snd_una and snd_nxt at the beginning of the current RTT. More
+         * precisely, they represent the amount of data sent during the RTT.
+         * At the end of the RTT, when we receive an ACK for v_beg_snd_nxt,
+         * we will calculate that (v_beg_snd_nxt - v_beg_snd_una) outstanding
+         * bytes of data have been ACKed during the course of the RTT, giving
+         * an "actual" rate of:
+         *
+         *     (v_beg_snd_nxt - v_beg_snd_una) / (rtt duration)
+         *
+         * Unfortunately, v_beg_snd_una is not exactly equal to snd_una,
+         * because delayed ACKs can cover more than one segment, so they
+         * don't line up nicely with the boundaries of RTTs.
+         *
+         * Another unfortunate fact of life is that delayed ACKs delay the
+         * advance of the left edge of our send window, so that the number
+         * of bytes we send in an RTT is often less than our cwnd will allow.
+         * So we keep track of our cwnd separately, in v_beg_snd_cwnd.
+         */
+
+        if (after(ack, vegas->beg_snd_nxt)) {
+                /* Do the Vegas once-per-RTT cwnd adjustment. */
+                u32 old_wnd, old_snd_cwnd;
+
+
+                /* Here old_wnd is essentially the window of data that was
+                 * sent during the previous RTT, and has all
+                 * been acknowledged in the course of the RTT that ended
+                 * with the ACK we just received. Likewise, old_snd_cwnd
+                 * is the cwnd during the previous RTT.
+                 */
+                old_wnd = (vegas->beg_snd_nxt - vegas->beg_snd_una) /
+                        tp->mss_cache;
+                old_snd_cwnd = vegas->beg_snd_cwnd;
+
+                /* Save the extent of the current window so we can use this
+                 * at the end of the next RTT.
+                 */
+                vegas->beg_snd_una  = vegas->beg_snd_nxt;
+                vegas->beg_snd_nxt  = tp->snd_nxt;
+                vegas->beg_snd_cwnd = tp->snd_cwnd;
+
+                /* Take into account the current RTT sample too, to
+                 * decrease the impact of delayed acks. This double counts
+                 * this sample since we count it for the next window as well,
+                 * but that's not too awful, since we're taking the min,
+                 * rather than averaging.
+                 */
+                tcp_vegas_rtt_calc(tp, seq_rtt*1000);
+
+                /* We do the Vegas calculations only if we got enough RTT
+                 * samples that we can be reasonably sure that we got
+                 * at least one RTT sample that wasn't from a delayed ACK.
+                 * If we only had 2 samples total,
+                 * then that means we're getting only 1 ACK per RTT, which
+                 * means they're almost certainly delayed ACKs.
+                 * If  we have 3 samples, we should be OK.
+                 */
+
+                if (vegas->cntRTT <= 2) {
+                        /* We don't have enough RTT samples to do the Vegas
+                         * calculation, so we'll behave like Reno.
+                         */
+                        if (tp->snd_cwnd > tp->snd_ssthresh)
+                                tp->snd_cwnd++;
+                } else {
+                        u32 rtt, target_cwnd, diff;
+
+                        /* We have enough RTT samples, so, using the Vegas
+                         * algorithm, we determine if we should increase or
+                         * decrease cwnd, and by how much.
+                         */
+
+                        /* Pluck out the RTT we are using for the Vegas
+                         * calculations. This is the min RTT seen during the
+                         * last RTT. Taking the min filters out the effects
+                         * of delayed ACKs, at the cost of noticing congestion
+                         * a bit later.
+                         */
+                        rtt = vegas->minRTT;
+
+                        /* Calculate the cwnd we should have, if we weren't
+                         * going too fast.
+                         *
+                         * This is:
+                         *     (actual rate in segments) * baseRTT
+                         * We keep it as a fixed point number with
+                         * V_PARAM_SHIFT bits to the right of the binary point.
+                         */
+                        target_cwnd = ((old_wnd * vegas->baseRTT)
+                                       << V_PARAM_SHIFT) / rtt;
+
+                        /* Calculate the difference between the window we had,
+                         * and the window we would like to have. This quantity
+                         * is the "Diff" from the Arizona Vegas papers.
+                         *
+                         * Again, this is a fixed point number with
+                         * V_PARAM_SHIFT bits to the right of the binary
+                         * point.
+                         */
+                        diff = (old_wnd << V_PARAM_SHIFT) - target_cwnd;
+
+                        if (tp->snd_cwnd < tp->snd_ssthresh) {
+                                /* Slow start.  */
+                                if (diff > gamma) {
+                                        /* Going too fast. Time to slow down
+                                         * and switch to congestion avoidance.
+                                         */
+                                        tp->snd_ssthresh = 2;
+
+                                        /* Set cwnd to match the actual rate
+                                         * exactly:
+                                         *   cwnd = (actual rate) * baseRTT
+                                         * Then we add 1 because the integer
+                                         * truncation robs us of full link
+                                         * utilization.
+                                         */
+                                        tp->snd_cwnd = min(tp->snd_cwnd,
+                                                           (target_cwnd >>
+                                                            V_PARAM_SHIFT)+1);
+
+                                }
+                        } else {
+                                /* Congestion avoidance. */
+                                u32 next_snd_cwnd;
+
+                                /* Figure out where we would like cwnd
+                                 * to be.
+                                 */
+                                if (diff > beta) {
+                                        /* The old window was too fast, so
+                                         * we slow down.
+                                         */
+                                        next_snd_cwnd = old_snd_cwnd - 1;
+                                } else if (diff < alpha) {
+                                        /* We don't have enough extra packets
+                                         * in the network, so speed up.
+                                         */
+                                        next_snd_cwnd = old_snd_cwnd + 1;
+                                } else {
+                                        /* Sending just as fast as we
+                                         * should be.
+                                         */
+                                        next_snd_cwnd = old_snd_cwnd;
+                                }
+
+                                /* Adjust cwnd upward or downward, toward the
+                                 * desired value.
+                                 */
+                                if (next_snd_cwnd > tp->snd_cwnd)
+                                        tp->snd_cwnd++;
+                                else if (next_snd_cwnd < tp->snd_cwnd)
+                                        tp->snd_cwnd--;
+                        }
+                }
+
+                /* Wipe the slate clean for the next RTT. */
+                vegas->cntRTT = 0;
+                vegas->minRTT = 0x7fffffff;
+        }
+
+        /* The following code is executed for every ack we receive,
+         * except for conditions checked in should_advance_cwnd()
+         * before the call to tcp_cong_avoid(). Mainly this means that
+         * we only execute this code if the ack actually acked some
+         * data.
+         */
+
+        /* If we are in slow start, increase our cwnd in response to this ACK.
+         * (If we are not in slow start then we are in congestion avoidance,
+         * and adjust our congestion window only once per RTT. See the code
+         * above.)
+         */
+        if (tp->snd_cwnd <= tp->snd_ssthresh)
+                tp->snd_cwnd++;
+
+        /* to keep cwnd from growing without bound */
+        tp->snd_cwnd = min_t(u32, tp->snd_cwnd, tp->snd_cwnd_clamp);
+
+        /* Make sure that we are never so timid as to reduce our cwnd below
+         * 2 MSS.
+         *
+         * Going below 2 MSS would risk huge delayed ACKs from our receiver.
+         */
+        tp->snd_cwnd = max(tp->snd_cwnd, 2U);
+}
+
+/* Extract info for Tcp socket info provided via netlink. */
+static void tcp_vegas_get_info(struct tcp_sock *tp, u32 ext,
+                               struct sk_buff *skb)
+{
+        const struct vegas *ca = tcp_ca(tp);
+        if (ext & (1<<(TCPDIAG_VEGASINFO-1))) {
+                struct tcpvegas_info *info;
+
+                info = RTA_DATA(__RTA_PUT(skb, TCPDIAG_VEGASINFO,
+                                          sizeof(*info)));
+
+                info->tcpv_enabled = ca->doing_vegas_now;
+                info->tcpv_rttcnt = ca->cntRTT;
+                info->tcpv_rtt = ca->baseRTT;
+                info->tcpv_minrtt = ca->minRTT;
+        rtattr_failure: ;
+        }
+}
+
+static struct tcp_congestion_ops tcp_vegas = {
+        .init           = tcp_vegas_init,
+        .ssthresh       = tcp_reno_ssthresh,
+        .cong_avoid     = tcp_vegas_cong_avoid,
+        .min_cwnd       = tcp_reno_min_cwnd,
+        .rtt_sample     = tcp_vegas_rtt_calc,
+        .set_state      = tcp_vegas_state,
+        .cwnd_event     = tcp_vegas_cwnd_event,
+        .get_info       = tcp_vegas_get_info,
+
+        .owner          = THIS_MODULE,
+        .name           = "vegas",
+};
+
+static int __init tcp_vegas_register(void)
+{
+        BUG_ON(sizeof(struct vegas) > TCP_CA_PRIV_SIZE);
+        tcp_register_congestion_control(&tcp_vegas);
+        return 0;
+}
+
+static void __exit tcp_vegas_unregister(void)
+{
+        tcp_unregister_congestion_control(&tcp_vegas);
+}
+
+module_init(tcp_vegas_register);
+module_exit(tcp_vegas_unregister);
+
+MODULE_AUTHOR("Stephen Hemminger");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("TCP Vegas");
diff --git a/net/ipv4/tcp_westwood.c b/net/ipv4/tcp_westwood.c
new file mode 100644
index 0000000000..ef827242c9
--- /dev/null
+++ b/net/ipv4/tcp_westwood.c
@@ -0,0 +1,259 @@
+/*
+ * TCP Westwood+
+ *
+ *      Angelo Dell'Aera:       TCP Westwood+ support
+ */
+
+#include <linux/config.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/tcp_diag.h>
+#include <net/tcp.h>
+
+/* TCP Westwood structure */
+struct westwood {
+        u32    bw_ns_est;        /* first bandwidth estimation..not too smoothed 8) */
+        u32    bw_est;           /* bandwidth estimate */
+        u32    rtt_win_sx;       /* here starts a new evaluation... */
+        u32    bk;
+        u32    snd_una;          /* used for evaluating the number of acked bytes */
+        u32    cumul_ack;
+        u32    accounted;
+        u32    rtt;
+        u32    rtt_min;          /* minimum observed RTT */
+};
+
+
+/* TCP Westwood functions and constants */
+#define TCP_WESTWOOD_RTT_MIN   (HZ/20)  /* 50ms */
+#define TCP_WESTWOOD_INIT_RTT  (20*HZ)  /* maybe too conservative?! */
+
+/*
+ * @tcp_westwood_create
+ * This function initializes fields used in TCP Westwood+,
+ * it is called after the initial SYN, so the sequence numbers
+ * are correct but new passive connections we have no
+ * information about RTTmin at this time so we simply set it to
+ * TCP_WESTWOOD_INIT_RTT. This value was chosen to be too conservative
+ * since in this way we're sure it will be updated in a consistent
+ * way as soon as possible. It will reasonably happen within the first
+ * RTT period of the connection lifetime.
+ */
+static void tcp_westwood_init(struct tcp_sock *tp)
+{
+        struct westwood *w = tcp_ca(tp);
+
+        w->bk = 0;
+        w->bw_ns_est = 0;
+        w->bw_est = 0;
+        w->accounted = 0;
+        w->cumul_ack = 0;
+        w->rtt_min = w->rtt = TCP_WESTWOOD_INIT_RTT;
+        w->rtt_win_sx = tcp_time_stamp;
+        w->snd_una = tp->snd_una;
+}
+
+/*
+ * @westwood_do_filter
+ * Low-pass filter. Implemented using constant coefficients.
+ */
+static inline u32 westwood_do_filter(u32 a, u32 b)
+{
+        return (((7 * a) + b) >> 3);
+}
+
+static inline void westwood_filter(struct westwood *w, u32 delta)
+{
+        w->bw_ns_est = westwood_do_filter(w->bw_ns_est, w->bk / delta);
+        w->bw_est = westwood_do_filter(w->bw_est, w->bw_ns_est);
+}
+
+/*
+ * @westwood_pkts_acked
+ * Called after processing group of packets.
+ * but all westwood needs is the last sample of srtt.
+ */
+static void tcp_westwood_pkts_acked(struct tcp_sock *tp, u32 cnt)
+{
+        struct westwood *w = tcp_ca(tp);
+        if (cnt > 0)
+                w->rtt = tp->srtt >> 3;
+}
+
+/*
+ * @westwood_update_window
+ * It updates RTT evaluation window if it is the right moment to do
+ * it. If so it calls filter for evaluating bandwidth.
+ */
+static void westwood_update_window(struct tcp_sock *tp)
+{
+        struct westwood *w = tcp_ca(tp);
+        s32 delta = tcp_time_stamp - w->rtt_win_sx;
+
+        /*
+         * See if a RTT-window has passed.
+         * Be careful since if RTT is less than
+         * 50ms we don't filter but we continue 'building the sample'.
+         * This minimum limit was chosen since an estimation on small
+         * time intervals is better to avoid...
+         * Obviously on a LAN we reasonably will always have
+         * right_bound = left_bound + WESTWOOD_RTT_MIN
+         */
+        if (w->rtt && delta > max_t(u32, w->rtt, TCP_WESTWOOD_RTT_MIN)) {
+                westwood_filter(w, delta);
+
+                w->bk = 0;
+                w->rtt_win_sx = tcp_time_stamp;
+        }
+}
+
+/*
+ * @westwood_fast_bw
+ * It is called when we are in fast path. In particular it is called when
+ * header prediction is successful. In such case in fact update is
+ * straight forward and doesn't need any particular care.
+ */
+static inline void westwood_fast_bw(struct tcp_sock *tp)
+{
+        struct westwood *w = tcp_ca(tp);
+
+        westwood_update_window(tp);
+
+        w->bk += tp->snd_una - w->snd_una;
+        w->snd_una = tp->snd_una;
+        w->rtt_min = min(w->rtt, w->rtt_min);
+}
+
+/*
+ * @westwood_acked_count
+ * This function evaluates cumul_ack for evaluating bk in case of
+ * delayed or partial acks.
+ */
+static inline u32 westwood_acked_count(struct tcp_sock *tp)
+{
+        struct westwood *w = tcp_ca(tp);
+
+        w->cumul_ack = tp->snd_una - w->snd_una;
+
+        /* If cumul_ack is 0 this is a dupack since it's not moving
+         * tp->snd_una.
+         */
+        if (!w->cumul_ack) {
+                w->accounted += tp->mss_cache;
+                w->cumul_ack = tp->mss_cache;
+        }
+
+        if (w->cumul_ack > tp->mss_cache) {
+                /* Partial or delayed ack */
+                if (w->accounted >= w->cumul_ack) {
+                        w->accounted -= w->cumul_ack;
+                        w->cumul_ack = tp->mss_cache;
+                } else {
+                        w->cumul_ack -= w->accounted;
+                        w->accounted = 0;
+                }
+        }
+
+        w->snd_una = tp->snd_una;
+
+        return w->cumul_ack;
+}
+
+static inline u32 westwood_bw_rttmin(const struct tcp_sock *tp)
+{
+        struct westwood *w = tcp_ca(tp);
+        return max_t(u32, (w->bw_est * w->rtt_min) / tp->mss_cache, 2);
+}
+
+/*
+ * TCP Westwood
+ * Here limit is evaluated as Bw estimation*RTTmin (for obtaining it
+ * in packets we use mss_cache). Rttmin is guaranteed to be >= 2
+ * so avoids ever returning 0.
+ */
+static u32 tcp_westwood_cwnd_min(struct tcp_sock *tp)
+{
+        return westwood_bw_rttmin(tp);
+}
+
+static void tcp_westwood_event(struct tcp_sock *tp, enum tcp_ca_event event)
+{
+        struct westwood *w = tcp_ca(tp);
+
+        switch(event) {
+        case CA_EVENT_FAST_ACK:
+                westwood_fast_bw(tp);
+                break;
+
+        case CA_EVENT_COMPLETE_CWR:
+                tp->snd_cwnd = tp->snd_ssthresh = westwood_bw_rttmin(tp);
+                break;
+
+        case CA_EVENT_FRTO:
+                tp->snd_ssthresh = westwood_bw_rttmin(tp);
+                break;
+
+        case CA_EVENT_SLOW_ACK:
+                westwood_update_window(tp);
+                w->bk += westwood_acked_count(tp);
+                w->rtt_min = min(w->rtt, w->rtt_min);
+                break;
+
+        default:
+                /* don't care */
+                break;
+        }
+}
+
+
+/* Extract info for Tcp socket info provided via netlink. */
+static void tcp_westwood_info(struct tcp_sock *tp, u32 ext,
+                              struct sk_buff *skb)
+{
+        const struct westwood *ca = tcp_ca(tp);
+        if (ext & (1<<(TCPDIAG_VEGASINFO-1))) {
+                struct rtattr *rta;
+                struct tcpvegas_info *info;
+
+                rta = __RTA_PUT(skb, TCPDIAG_VEGASINFO, sizeof(*info));
+                info = RTA_DATA(rta);
+                info->tcpv_enabled = 1;
+                info->tcpv_rttcnt = 0;
+                info->tcpv_rtt = jiffies_to_usecs(ca->rtt);
+                info->tcpv_minrtt = jiffies_to_usecs(ca->rtt_min);
+        rtattr_failure: ;
+        }
+}
+
+
+static struct tcp_congestion_ops tcp_westwood = {
+        .init           = tcp_westwood_init,
+        .ssthresh       = tcp_reno_ssthresh,
+        .cong_avoid     = tcp_reno_cong_avoid,
+        .min_cwnd       = tcp_westwood_cwnd_min,
+        .cwnd_event     = tcp_westwood_event,
+        .get_info       = tcp_westwood_info,
+        .pkts_acked     = tcp_westwood_pkts_acked,
+
+        .owner          = THIS_MODULE,
+        .name           = "westwood"
+};
+
+static int __init tcp_westwood_register(void)
+{
+        BUG_ON(sizeof(struct westwood) > TCP_CA_PRIV_SIZE);
+        return tcp_register_congestion_control(&tcp_westwood);
+}
+
+static void __exit tcp_westwood_unregister(void)
+{
+        tcp_unregister_congestion_control(&tcp_westwood);
+}
+
+module_init(tcp_westwood_register);
+module_exit(tcp_westwood_unregister);
+
+MODULE_AUTHOR("Stephen Hemminger, Angelo Dell'Aera");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("TCP Westwood+");
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 7c24e64b44..dc4d07357e 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -628,7 +628,7 @@ back_from_confirm:
                 /* ... which is an evident application bug. --ANK */
                 release_sock(sk);
 
-                NETDEBUG(if (net_ratelimit()) printk(KERN_DEBUG "udp cork app bug 2\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "udp cork app bug 2\n"));
                 err = -EINVAL;
                 goto out;
         }
@@ -693,7 +693,7 @@ static int udp_sendpage(struct sock *sk, struct page *page, int offset,
         if (unlikely(!up->pending)) {
                 release_sock(sk);
 
-                NETDEBUG(if (net_ratelimit()) printk(KERN_DEBUG "udp cork app bug 3\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "udp cork app bug 3\n"));
                 return -EINVAL;
         }
 
@@ -1102,7 +1102,7 @@ static int udp_checksum_init(struct sk_buff *skb, struct udphdr *uh,
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
                 if (!udp_check(uh, ulen, saddr, daddr, skb->csum))
                         return 0;
-                NETDEBUG(if (net_ratelimit()) printk(KERN_DEBUG "udp v4 hw csum failure.\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "udp v4 hw csum failure.\n"));
                 skb->ip_summed = CHECKSUM_NONE;
         }
         if (skb->ip_summed != CHECKSUM_UNNECESSARY)
@@ -1181,14 +1181,13 @@ int udp_rcv(struct sk_buff *skb)
         return(0);
 
 short_packet:
-        NETDEBUG(if (net_ratelimit())
-                printk(KERN_DEBUG "UDP: short packet: From %u.%u.%u.%u:%u %d/%d to %u.%u.%u.%u:%u\n",
-                        NIPQUAD(saddr),
-                        ntohs(uh->source),
-                        ulen,
-                        len,
-                        NIPQUAD(daddr),
-                        ntohs(uh->dest)));
+        LIMIT_NETDEBUG(printk(KERN_DEBUG "UDP: short packet: From %u.%u.%u.%u:%u %d/%d to %u.%u.%u.%u:%u\n",
+                              NIPQUAD(saddr),
+                              ntohs(uh->source),
+                              ulen,
+                              len,
+                              NIPQUAD(daddr),
+                              ntohs(uh->dest)));
 no_header:
         UDP_INC_STATS_BH(UDP_MIB_INERRORS);
         kfree_skb(skb);
@@ -1199,13 +1198,12 @@ csum_error:
          * RFC1122: OK.  Discards the bad packet silently (as far as 
          * the network is concerned, anyway) as per 4.1.3.4 (MUST). 
          */
-        NETDEBUG(if (net_ratelimit())
-                 printk(KERN_DEBUG "UDP: bad checksum. From %d.%d.%d.%d:%d to %d.%d.%d.%d:%d ulen %d\n",
-                        NIPQUAD(saddr),
-                        ntohs(uh->source),
-                        NIPQUAD(daddr),
-                        ntohs(uh->dest),
-                        ulen));
+        LIMIT_NETDEBUG(printk(KERN_DEBUG "UDP: bad checksum. From %d.%d.%d.%d:%d to %d.%d.%d.%d:%d ulen %d\n",
+                              NIPQUAD(saddr),
+                              ntohs(uh->source),
+                              NIPQUAD(daddr),
+                              ntohs(uh->dest),
+                              ulen));
 drop:
         UDP_INC_STATS_BH(UDP_MIB_INERRORS);
         kfree_skb(skb);
diff --git a/net/ipv4/utils.c b/net/ipv4/utils.c
deleted file mode 100644
index 6aecd7a435..0000000000
--- a/net/ipv4/utils.c
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * INET         An implementation of the TCP/IP protocol suite for the LINUX
- *              operating system.  INET is implemented using the  BSD Socket
- *              interface as the means of communication with the user level.
- *
- *              Various kernel-resident INET utility functions; mainly
- *              for format conversion and debugging output.
- *
- * Version:     $Id: utils.c,v 1.8 2000/10/03 07:29:01 anton Exp $
- *
- * Author:      Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
- *
- * Fixes:
- *              Alan Cox        :       verify_area check.
- *              Alan Cox        :       removed old debugging.
- *              Andi Kleen      :       add net_ratelimit()  
- *
- *              This program is free software; you can redistribute it and/or
- *              modify it under the terms of the GNU General Public License
- *              as published by the Free Software Foundation; either version
- *              2 of the License, or (at your option) any later version.
- */
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <asm/byteorder.h>
-
-/*
- *      Convert an ASCII string to binary IP. 
- */
- 
-__u32 in_aton(const char *str)
-{
-        unsigned long l;
-        unsigned int val;
-        int i;
-
-        l = 0;
-        for (i = 0; i < 4; i++) 
-        {
-                l <<= 8;
-                if (*str != '\0') 
-                {
-                        val = 0;
-                        while (*str != '\0' && *str != '.') 
-                        {
-                                val *= 10;
-                                val += *str - '0';
-                                str++;
-                        }
-                        l |= val;
-                        if (*str != '\0') 
-                                str++;
-                }
-        }
-        return(htonl(l));
-}
-
-EXPORT_SYMBOL(in_aton);
diff --git a/net/ipv4/xfrm4_tunnel.c b/net/ipv4/xfrm4_tunnel.c
index e1fe360ed2..afbb0d4cc3 100644
--- a/net/ipv4/xfrm4_tunnel.c
+++ b/net/ipv4/xfrm4_tunnel.c
@@ -78,10 +78,9 @@ static int ipip_rcv(struct sk_buff *skb)
 static void ipip_err(struct sk_buff *skb, u32 info)
 {
         struct xfrm_tunnel *handler = ipip_handler;
-        u32 arg = info;
 
         if (handler)
-                handler->err_handler(skb, &arg);
+                handler->err_handler(skb, info);
 }
 
 static int ipip_init_state(struct xfrm_state *x)