## Automatically generated incremental diff
## From:   linux-2.5.69-bk4
## To:     linux-2.5.69-bk5
## Robot:  $Id: make-incremental-diff,v 1.11 2002/02/20 02:59:33 hpa Exp $

diff -urN linux-2.5.69-bk4/CREDITS linux-2.5.69-bk5/CREDITS
--- linux-2.5.69-bk4/CREDITS	2003-05-10 04:36:21.000000000 -0700
+++ linux-2.5.69-bk5/CREDITS	2003-05-10 04:36:24.000000000 -0700
@@ -1549,6 +1549,18 @@
 S: 8103 Rein
 S: Austria
 
+N: Mitsuru Kanda
+E: mk@linux-ipv6.org
+E: mk@isl.rdc.toshiba.co.jp
+E: mk@karaba.org
+W: http://www.karaba.org/~mk/
+P: 1024D/2EC7E30D 9A35 D378 F084 9EA4 EFBA  925B 1C93 B376 F0EF BE59
+D: IPsec, IPv6
+D: USAGI/WIDE Project, TOSHIBA CORPORATION
+S: 2-47-8, Takinogawa,
+S: Kita, Tokyo 114-0023
+S: Japan
+
 N: Jan Kara
 E: jack@atrey.karlin.mff.cuni.cz
 E: jack@suse.cz
@@ -2200,6 +2212,17 @@
 S: Garland, Texas 75044
 S: USA
 
+N: Kazunori Miyazawa
+E: miyazawa@linux-ipv6.org
+E: Kazunori.Miyazawa@jp.yokogawa.com
+E: kazunori@miyazawa.org
+W: http://www.miyazawa.org/~kazunori/
+D: IPsec, IPv6
+D: USAGI/WIDE Project, Yokogawa Electric Corporation
+S: 2-20-4-203, Nakacho,
+S: Musashino, Tokyo 180-0006
+S: Japan
+
 N: Patrick Mochel
 E: mochel@osdl.org
 E: mochelp@infinity.powertie.org
@@ -3442,6 +3465,17 @@
 D: Workbit NinjaSCSI-32Bi/UDE driver
 S: Japan
 
+N: Hideaki YOSHIFUJI
+E: hideaki@yoshifuji.org
+E: yoshfuji@linux-ipv6.org
+W: http://www.yoshifuji.org/~hideaki/
+P: 1024D/E0620EEA 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA
+D: IPv6 and other networking related stuff
+D: USAGI/WIDE Project, The University of Tokyo
+S: Green House #102, 1-15-5, Nishikata, 
+S: Bunkyo, Tokyo 113-0024
+S: Japan
+
 N: Eric Youngdale
 E: eric@andante.org
 W: http://www.andante.org
diff -urN linux-2.5.69-bk4/MAINTAINERS linux-2.5.69-bk5/MAINTAINERS
--- linux-2.5.69-bk4/MAINTAINERS	2003-05-10 04:36:21.000000000 -0700
+++ linux-2.5.69-bk5/MAINTAINERS	2003-05-10 04:36:24.000000000 -0700
@@ -1278,6 +1278,8 @@
 M:	pekkas@netcore.fi
 P:	James Morris
 M:	jmorris@intercode.com.au
+P:	Hideaki YOSHIFUJI
+M:	yoshfuji@linux-ipv6.org
 L:	netdev@oss.sgi.com
 S:	Maintained
 
diff -urN linux-2.5.69-bk4/Makefile linux-2.5.69-bk5/Makefile
--- linux-2.5.69-bk4/Makefile	2003-05-10 04:36:21.000000000 -0700
+++ linux-2.5.69-bk5/Makefile	2003-05-10 04:36:24.000000000 -0700
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 5
 SUBLEVEL = 69
-EXTRAVERSION = -bk4
+EXTRAVERSION = -bk5
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff -urN linux-2.5.69-bk4/arch/i386/kernel/ldt.c linux-2.5.69-bk5/arch/i386/kernel/ldt.c
--- linux-2.5.69-bk4/arch/i386/kernel/ldt.c	2003-05-04 16:53:35.000000000 -0700
+++ linux-2.5.69-bk5/arch/i386/kernel/ldt.c	2003-05-10 04:36:24.000000000 -0700
@@ -119,7 +119,7 @@
 	}
 }
 
-static int read_ldt(void * ptr, unsigned long bytecount)
+static int read_ldt(void __user * ptr, unsigned long bytecount)
 {
 	int err;
 	unsigned long size;
@@ -148,7 +148,7 @@
 	return bytecount;
 }
 
-static int read_default_ldt(void * ptr, unsigned long bytecount)
+static int read_default_ldt(void __user * ptr, unsigned long bytecount)
 {
 	int err;
 	unsigned long size;
@@ -167,7 +167,7 @@
 	return err;
 }
 
-static int write_ldt(void * ptr, unsigned long bytecount, int oldmode)
+static int write_ldt(void __user * ptr, unsigned long bytecount, int oldmode)
 {
 	struct mm_struct * mm = current->mm;
 	__u32 entry_1, entry_2, *lp;
@@ -226,7 +226,7 @@
 	return error;
 }
 
-asmlinkage int sys_modify_ldt(int func, void *ptr, unsigned long bytecount)
+asmlinkage int sys_modify_ldt(int func, void __user *ptr, unsigned long bytecount)
 {
 	int ret = -ENOSYS;
 
diff -urN linux-2.5.69-bk4/arch/i386/kernel/sys_i386.c linux-2.5.69-bk5/arch/i386/kernel/sys_i386.c
--- linux-2.5.69-bk4/arch/i386/kernel/sys_i386.c	2003-05-04 16:53:42.000000000 -0700
+++ linux-2.5.69-bk5/arch/i386/kernel/sys_i386.c	2003-05-10 04:36:24.000000000 -0700
@@ -26,7 +26,7 @@
  * sys_pipe() is the normal C calling standard for creating
  * a pipe. It's not the way Unix traditionally does this, though.
  */
-asmlinkage int sys_pipe(unsigned long * fildes)
+asmlinkage int sys_pipe(unsigned long __user * fildes)
 {
 	int fd[2];
 	int error;
@@ -88,7 +88,7 @@
 	unsigned long offset;
 };
 
-asmlinkage int old_mmap(struct mmap_arg_struct *arg)
+asmlinkage int old_mmap(struct mmap_arg_struct __user *arg)
 {
 	struct mmap_arg_struct a;
 	int err = -EFAULT;
@@ -106,15 +106,15 @@
 }
 
 
-extern asmlinkage int sys_select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
+extern asmlinkage int sys_select(int, fd_set __user *, fd_set __user *, fd_set __user *, struct timeval __user *);
 
 struct sel_arg_struct {
 	unsigned long n;
-	fd_set *inp, *outp, *exp;
-	struct timeval *tvp;
+	fd_set __user *inp, *outp, *exp;
+	struct timeval __user *tvp;
 };
 
-asmlinkage int old_select(struct sel_arg_struct *arg)
+asmlinkage int old_select(struct sel_arg_struct __user *arg)
 {
 	struct sel_arg_struct a;
 
@@ -130,7 +130,7 @@
  * This is really horribly ugly.
  */
 asmlinkage int sys_ipc (uint call, int first, int second,
-			int third, void *ptr, long fifth)
+			int third, void __user *ptr, long fifth)
 {
 	int version, ret;
 
@@ -139,10 +139,10 @@
 
 	switch (call) {
 	case SEMOP:
-		return sys_semtimedop (first, (struct sembuf *)ptr, second, NULL);
+		return sys_semtimedop (first, (struct sembuf __user *)ptr, second, NULL);
 	case SEMTIMEDOP:
-		return sys_semtimedop(first, (struct sembuf *)ptr, second,
-					(const struct timespec *)fifth);
+		return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
+					(const struct timespec __user *)fifth);
 
 	case SEMGET:
 		return sys_semget (first, second, third);
@@ -150,13 +150,13 @@
 		union semun fourth;
 		if (!ptr)
 			return -EINVAL;
-		if (get_user(fourth.__pad, (void **) ptr))
+		if (get_user(fourth.__pad, (void * __user *) ptr))
 			return -EFAULT;
 		return sys_semctl (first, second, third, fourth);
 	}
 
 	case MSGSND:
-		return sys_msgsnd (first, (struct msgbuf *) ptr, 
+		return sys_msgsnd (first, (struct msgbuf __user *) ptr, 
 				   second, third);
 	case MSGRCV:
 		switch (version) {
@@ -166,7 +166,7 @@
 				return -EINVAL;
 			
 			if (copy_from_user(&tmp,
-					   (struct ipc_kludge *) ptr, 
+					   (struct ipc_kludge __user *) ptr, 
 					   sizeof (tmp)))
 				return -EFAULT;
 			return sys_msgrcv (first, tmp.msgp, second,
@@ -174,35 +174,36 @@
 		}
 		default:
 			return sys_msgrcv (first,
-					   (struct msgbuf *) ptr,
+					   (struct msgbuf __user *) ptr,
 					   second, fifth, third);
 		}
 	case MSGGET:
 		return sys_msgget ((key_t) first, second);
 	case MSGCTL:
-		return sys_msgctl (first, second, (struct msqid_ds *) ptr);
+		return sys_msgctl (first, second, (struct msqid_ds __user *) ptr);
 
 	case SHMAT:
 		switch (version) {
 		default: {
 			ulong raddr;
-			ret = sys_shmat (first, (char *) ptr, second, &raddr);
+			ret = sys_shmat (first, (char __user *) ptr, second, &raddr);
 			if (ret)
 				return ret;
-			return put_user (raddr, (ulong *) third);
+			return put_user (raddr, (ulong __user *) third);
 		}
 		case 1:	/* iBCS2 emulator entry point */
 			if (!segment_eq(get_fs(), get_ds()))
 				return -EINVAL;
-			return sys_shmat (first, (char *) ptr, second, (ulong *) third);
+			/* The "(ulong *) third" is valid _only_ because of the kernel segment thing */
+			return sys_shmat (first, (char __user *) ptr, second, (ulong *) third);
 		}
 	case SHMDT: 
-		return sys_shmdt ((char *)ptr);
+		return sys_shmdt ((char __user *)ptr);
 	case SHMGET:
 		return sys_shmget (first, second, third);
 	case SHMCTL:
 		return sys_shmctl (first, second,
-				   (struct shmid_ds *) ptr);
+				   (struct shmid_ds __user *) ptr);
 	default:
 		return -ENOSYS;
 	}
@@ -211,7 +212,7 @@
 /*
  * Old cruft
  */
-asmlinkage int sys_uname(struct old_utsname * name)
+asmlinkage int sys_uname(struct old_utsname __user * name)
 {
 	int err;
 	if (!name)
@@ -222,7 +223,7 @@
 	return err?-EFAULT:0;
 }
 
-asmlinkage int sys_olduname(struct oldold_utsname * name)
+asmlinkage int sys_olduname(struct oldold_utsname __user * name)
 {
 	int error;
 
diff -urN linux-2.5.69-bk4/arch/i386/kernel/vm86.c linux-2.5.69-bk5/arch/i386/kernel/vm86.c
--- linux-2.5.69-bk4/arch/i386/kernel/vm86.c	2003-05-04 16:53:02.000000000 -0700
+++ linux-2.5.69-bk5/arch/i386/kernel/vm86.c	2003-05-10 04:36:24.000000000 -0700
@@ -170,7 +170,7 @@
 static int do_vm86_irq_handling(int subfunction, int irqnumber);
 static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk);
 
-asmlinkage int sys_vm86old(struct vm86_struct * v86)
+asmlinkage int sys_vm86old(struct vm86_struct __user * v86)
 {
 	struct kernel_vm86_struct info; /* declare this _on top_,
 					 * this avoids wasting of stack space.
@@ -199,7 +199,7 @@
 }
 
 
-asmlinkage int sys_vm86(unsigned long subfunction, struct vm86plus_struct * v86)
+asmlinkage int sys_vm86(unsigned long subfunction, struct vm86plus_struct __user * v86)
 {
 	struct kernel_vm86_struct info; /* declare this _on top_,
 					 * this avoids wasting of stack space.
@@ -239,7 +239,7 @@
 		goto out;
 	info.regs32 = (struct pt_regs *) &subfunction;
 	info.vm86plus.is_vm86pus = 1;
-	tsk->thread.vm86_info = (struct vm86_struct *)v86;
+	tsk->thread.vm86_info = (struct vm86_struct __user *)v86;
 	do_sys_vm86(&info, tsk);
 	ret = 0;	/* we never return here */
 out:
diff -urN linux-2.5.69-bk4/drivers/atm/he.c linux-2.5.69-bk5/drivers/atm/he.c
--- linux-2.5.69-bk4/drivers/atm/he.c	2003-05-10 04:36:21.000000000 -0700
+++ linux-2.5.69-bk5/drivers/atm/he.c	2003-05-10 04:36:24.000000000 -0700
@@ -96,16 +96,30 @@
 #define USE_TPD_POOL
 /* #undef CONFIG_ATM_HE_USE_SUNI */
 
-/* 2.2 kernel support */
+/* compatibility */
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,43)
-#define dev_kfree_skb_irq(skb)		dev_kfree_skb(skb)
-#define dev_kfree_skb_any(skb)		dev_kfree_skb(skb)
-#undef USE_TASKLET
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,69)
+typedef void irqreturn_t;
+#define IRQ_NONE
+#define IRQ_HANDLED
+#define IRQ_RETVAL(x)
 #endif
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,2,18)
-#define set_current_state(x)		current->state = (x);
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,4,9)
+#define __devexit_p(func)		func
+#endif
+
+#ifndef MODULE_LICENSE
+#define MODULE_LICENSE(x)
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,4,3)
+#define pci_set_drvdata(pci_dev, data)	(pci_dev)->driver_data = (data)
+#define pci_get_drvdata(pci_dev)	(pci_dev)->driver_data
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,44)
+#define pci_pool_create(a, b, c, d, e)	pci_pool_create(a, b, c, d, e, SLAB_KERNEL)
 #endif
 
 #include "he.h"
@@ -135,11 +149,7 @@
 static int he_send(struct atm_vcc *vcc, struct sk_buff *skb);
 static int he_sg_send(struct atm_vcc *vcc, unsigned long start, unsigned long size);
 static int he_ioctl(struct atm_dev *dev, unsigned int cmd, void *arg);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,69)
 static irqreturn_t he_irq_handler(int irq, void *dev_id, struct pt_regs *regs);
-#else
-static void he_irq_handler(int irq, void *dev_id, struct pt_regs *regs);
-#endif
 static void he_tasklet(unsigned long data);
 static int he_proc_read(struct atm_dev *dev,loff_t *pos,char *page);
 static int he_start(struct atm_dev *dev);
@@ -357,9 +367,7 @@
 
 	printk(KERN_INFO "he: %s\n", version);
 
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,3,43)
 	if (pci_enable_device(pci_dev)) return -EIO;
-#endif
 	if (pci_set_dma_mask(pci_dev, HE_DMA_MASK) != 0)
 	{
 		printk(KERN_WARNING "he: no suitable dma available\n");
@@ -368,11 +376,7 @@
 
 	atm_dev = atm_dev_register(DEV_LABEL, &he_ops, -1, 0);
 	if (!atm_dev) return -ENODEV;
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,4,3)
 	pci_set_drvdata(pci_dev, atm_dev);
-#else
-	pci_dev->driver_data = atm_dev;
-#endif
 
 	he_dev = (struct he_dev *) kmalloc(sizeof(struct he_dev),
 							GFP_KERNEL);
@@ -403,11 +407,7 @@
 	struct atm_dev *atm_dev;
 	struct he_dev *he_dev;
 
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,4,3)
 	atm_dev = pci_get_drvdata(pci_dev);
-#else
-	atm_dev = pci_dev->driver_data;
-#endif
 	he_dev = HE_DEV(atm_dev);
 
 	/* need to remove from he_devs */
@@ -416,11 +416,7 @@
 	atm_dev_deregister(atm_dev);
 	kfree(he_dev);
 
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,4,3)
 	pci_set_drvdata(pci_dev, NULL);
-#else
-	pci_dev->driver_data = NULL;
-#endif
 }
 
 
@@ -783,13 +779,8 @@
 #ifdef USE_RBPS
 	/* small buffer pool */
 #ifdef USE_RBPS_POOL
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,44)
-	he_dev->rbps_pool = pci_pool_create("rbps", he_dev->pci_dev,
-			CONFIG_RBPS_BUFSIZE, 8, 0, SLAB_KERNEL);
-#else
 	he_dev->rbps_pool = pci_pool_create("rbps", he_dev->pci_dev,
 			CONFIG_RBPS_BUFSIZE, 8, 0);
-#endif
 	if (he_dev->rbps_pool == NULL)
 	{
 		hprintk("unable to create rbps pages\n");
@@ -855,13 +846,8 @@
 
 	/* large buffer pool */
 #ifdef USE_RBPL_POOL
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,44)
-	he_dev->rbpl_pool = pci_pool_create("rbpl", he_dev->pci_dev,
-			CONFIG_RBPL_BUFSIZE, 8, 0, SLAB_KERNEL);
-#else
 	he_dev->rbpl_pool = pci_pool_create("rbpl", he_dev->pci_dev,
 			CONFIG_RBPL_BUFSIZE, 8, 0);
-#endif
 	if (he_dev->rbpl_pool == NULL)
 	{
 		hprintk("unable to create rbpl pool\n");
@@ -1053,11 +1039,7 @@
         he_dev = HE_DEV(dev);
         pci_dev = he_dev->pci_dev;
 
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,3,3)
 	he_dev->membase = pci_dev->resource[0].start;
-#else
-	he_dev->membase = pci_dev->base_address[0] & PCI_BASE_ADDRESS_MEM_MASK;
-#endif
 	HPRINTK("membase = 0x%lx  irq = %d.\n", he_dev->membase, pci_dev->irq);
 
 	/*
@@ -1519,13 +1501,8 @@
 	he_init_tpdrq(he_dev);
 
 #ifdef USE_TPD_POOL
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,44)
-	he_dev->tpd_pool = pci_pool_create("tpd", he_dev->pci_dev,
-		sizeof(struct he_tpd), TPD_ALIGNMENT, 0, SLAB_KERNEL);
-#else
 	he_dev->tpd_pool = pci_pool_create("tpd", he_dev->pci_dev,
 		sizeof(struct he_tpd), TPD_ALIGNMENT, 0);
-#endif
 	if (he_dev->tpd_pool == NULL)
 	{
 		hprintk("unable to create tpd pci_pool\n");
@@ -1919,11 +1896,7 @@
 		if (RBRQ_HBUF_ERR(he_dev->rbrq_head))
 		{
 			hprintk("HBUF_ERR!  (cid 0x%x)\n", cid);
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,99)
-				++vcc->stats->rx_drop;
-#else
 				atomic_inc(&vcc->stats->rx_drop);
-#endif
 			goto return_host_buffers;
 		}
 
@@ -1958,27 +1931,12 @@
 				RBRQ_LEN_ERR(he_dev->rbrq_head)
 							? "LEN_ERR" : "",
 							vcc->vpi, vcc->vci);
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,99)
-			++vcc->stats->rx_err;
-#else
 			atomic_inc(&vcc->stats->rx_err);
-#endif
 			goto return_host_buffers;
 		}
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,3,15)
 		skb = atm_alloc_charge(vcc, he_vcc->pdu_len + rx_skb_reserve,
 							GFP_ATOMIC);
-#else
-		if (!atm_charge(vcc, atm_pdu2truesize(he_vcc->pdu_len + rx_skb_reserve)))
-			skb = NULL;
-		else
-		{
-			skb = alloc_skb(he_vcc->pdu_len + rx_skb_reserve, GFP_ATOMIC);
-			if (!skb) atm_return(vcc,
-				atm_pdu2truesize(he_vcc->pdu_len + rx_skb_reserve));
-		}
-#endif
 		if (!skb)
 		{
 			HPRINTK("charge failed (%d.%d)\n", vcc->vpi, vcc->vci);
@@ -2035,11 +1993,7 @@
 #endif
 		vcc->push(vcc, skb);
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,99)
-		++vcc->stats->rx;
-#else
 		atomic_inc(&vcc->stats->rx);
-#endif
 
 return_host_buffers:
 		++pdus_assembled;
@@ -2355,11 +2309,7 @@
 #endif
 }
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,69)
 static irqreturn_t
-#else
-static void
-#endif
 he_irq_handler(int irq, void *dev_id, struct pt_regs *regs)
 {
 	unsigned long flags;
@@ -2367,11 +2317,7 @@
 	int handled = 0;
 
 	if (he_dev == NULL)
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,69)
 		return IRQ_NONE;
-#else
-		return;
-#endif
 
 	HE_SPIN_LOCK(he_dev, flags);
 
@@ -2406,11 +2352,7 @@
 #endif
 	}
 	HE_SPIN_UNLOCK(he_dev, flags);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,69)
 	return IRQ_RETVAL(handled);
-#else
-	return;
-#endif
 
 }
 
@@ -2454,11 +2396,7 @@
 					tpd->vcc->pop(tpd->vcc, tpd->skb);
 				else
 					dev_kfree_skb_any(tpd->skb);
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,99)
-				++tpd->vcc->stats->tx_err;
-#else
 				atomic_inc(&tpd->vcc->stats->tx_err);
-#endif
 			}
 #ifdef USE_TPD_POOL
 			pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
@@ -2509,11 +2447,7 @@
 
 	HPRINTK("open vcc %p %d.%d\n", vcc, vpi, vci);
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,1)
-	vcc->flags |= ATM_VF_ADDR;
-#else
 	set_bit(ATM_VF_ADDR, &vcc->flags);
-#endif
 
 	cid = he_mkcid(he_dev, vpi, vci);
 
@@ -2528,13 +2462,8 @@
 	he_vcc->pdu_len = 0;
 	he_vcc->rc_index = -1;
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,1)
-	init_waitqueue(&he_vcc->rx_waitq);
-	init_waitqueue(&he_vcc->tx_waitq);
-#else
 	init_waitqueue_head(&he_vcc->rx_waitq);
 	init_waitqueue_head(&he_vcc->tx_waitq);
-#endif
 
 	HE_VCC(vcc) = he_vcc;
 
@@ -2729,20 +2658,10 @@
 	if (err)
 	{
 		if (he_vcc) kfree(he_vcc);
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,1)
-		vcc->flags &= ~ATM_VF_ADDR;
-#else
 		clear_bit(ATM_VF_ADDR, &vcc->flags);
-#endif
 	}
 	else
-	{
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,1)
-		vcc->flags |= ATM_VF_READY;
-#else
 		set_bit(ATM_VF_READY, &vcc->flags);
-#endif
-	}
 
 	return err;
 }
@@ -2751,11 +2670,7 @@
 he_close(struct atm_vcc *vcc)
 {
 	unsigned long flags;
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,3,1)
 	DECLARE_WAITQUEUE(wait, current);
-#else
-	struct wait_queue wait = { current, NULL };
-#endif
 	struct he_dev *he_dev = HE_DEV(vcc->dev);
 	struct he_tpd *tpd;
 	unsigned cid;
@@ -2765,11 +2680,7 @@
 
 	HPRINTK("close vcc %p %d.%d\n", vcc, vcc->vpi, vcc->vci);
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,1)
-	vcc->flags &= ~ATM_VF_READY;
-#else
 	clear_bit(ATM_VF_READY, &vcc->flags);
-#endif
 	cid = he_mkcid(he_dev, vcc->vpi, vcc->vci);
 
 	if (vcc->qos.rxtp.traffic_class != ATM_NONE)
@@ -2929,11 +2840,7 @@
 
 	kfree(he_vcc);
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,1)
-	vcc->flags &= ~ATM_VF_ADDR;
-#else
 	clear_bit(ATM_VF_ADDR, &vcc->flags);
-#endif
 }
 
 static int
@@ -2969,11 +2876,7 @@
 			vcc->pop(vcc, skb);
 		else
 			dev_kfree_skb_any(skb);
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,99)
-		++vcc->stats->tx_err;
-#else
 		atomic_inc(&vcc->stats->tx_err);
-#endif
 		return -EINVAL;
 	}
 
@@ -2985,11 +2888,7 @@
 			vcc->pop(vcc, skb);
 		else
 			dev_kfree_skb_any(skb);
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,99)
-		++vcc->stats->tx_err;
-#else
 		atomic_inc(&vcc->stats->tx_err);
-#endif
 		return -EINVAL;
 	}
 #endif
@@ -3002,11 +2901,7 @@
 			vcc->pop(vcc, skb);
 		else
 			dev_kfree_skb_any(skb);
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,99)
-		++vcc->stats->tx_err;
-#else
 		atomic_inc(&vcc->stats->tx_err);
-#endif
 		HE_SPIN_UNLOCK(he_dev, flags);
 		return -ENOMEM;
 	}
@@ -3051,12 +2946,8 @@
 					vcc->pop(vcc, skb);
 				else
 					dev_kfree_skb_any(skb);
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,99)
-				++vcc->stats->tx_err;
-#else
 				atomic_inc(&vcc->stats->tx_err);
 				HE_SPIN_UNLOCK(he_dev, flags);
-#endif
 				return -ENOMEM;
 			}
 			tpd->status |= TPD_USERCELL;
@@ -3086,11 +2977,7 @@
 	__enqueue_tpd(he_dev, tpd, cid);
 	HE_SPIN_UNLOCK(he_dev, flags);
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,99)
-	++vcc->stats->tx;
-#else
 	atomic_inc(&vcc->stats->tx);
-#endif
 
 	return 0;
 }
@@ -3316,6 +3203,7 @@
         return (byte_read);
 }
 
+MODULE_LICENSE("GPL");
 MODULE_AUTHOR("chas williams <chas@cmf.nrl.navy.mil>");
 MODULE_DESCRIPTION("ForeRunnerHE ATM Adapter driver");
 MODULE_PARM(disable64, "h");
@@ -3331,7 +3219,6 @@
 MODULE_PARM(sdh, "i");
 MODULE_PARM_DESC(sdh, "use SDH framing (default 0)");
 
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,3,1)
 static struct pci_device_id he_pci_tbl[] __devinitdata = {
 	{ PCI_VENDOR_ID_FORE, PCI_DEVICE_ID_FORE_HE, PCI_ANY_ID, PCI_ANY_ID,
 	  0, 0, 0 },
@@ -3341,11 +3228,7 @@
 static struct pci_driver he_driver = {
 	.name =		"he",
 	.probe =	he_init_one,
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,4,9)
 	.remove =	__devexit_p(he_remove_one),
-#else
-	.remove =	he_remove_one,
-#endif
 	.id_table =	he_pci_tbl,
 };
 
@@ -3361,52 +3244,3 @@
 
 module_init(he_init);
 module_exit(he_cleanup);
-#else
-static int __init
-he_init()
-{
-	if (!pci_present())
-		return -EIO;
-
-#ifdef CONFIG_ATM_HE_USE_SUNI_MODULE
-	/* request_module("suni"); */
-#endif
-
-	pci_dev = NULL;
-	while ((pci_dev = pci_find_device(PCI_VENDOR_ID_FORE,
-					PCI_DEVICE_ID_FORE_HE, pci_dev)) != NULL)
-		if (he_init_one(pci_dev, NULL) == 0)
-			++ndevs;
-
-	return (ndevs ? 0 : -ENODEV);
-}
-
-static void __devexit
-he_cleanup(void)
-{
-	while (he_devs)
-	{
-		struct he_dev *next = he_devs->next;
-		he_stop(he_devs);
-		atm_dev_deregister(he_devs->atm_dev);
-		kfree(he_devs);
-
-		he_devs = next;
-	}
-
-}
-
-int init_module(void)
-{
-	return he_init();
-}
-
-void cleanup_module(void)
-{
-	he_cleanup();
-}
-#endif
-
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,4,7)
-MODULE_LICENSE("GPL");
-#endif
diff -urN linux-2.5.69-bk4/drivers/atm/he.h linux-2.5.69-bk5/drivers/atm/he.h
--- linux-2.5.69-bk4/drivers/atm/he.h	2003-05-10 04:36:21.000000000 -0700
+++ linux-2.5.69-bk5/drivers/atm/he.h	2003-05-10 04:36:24.000000000 -0700
@@ -371,13 +371,8 @@
 
 	int rc_index;
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2,3,1)
-	struct wait_queue *rx_waitq;
-	atruct wait_queue *tx_waitq;
-#else
 	wait_queue_head_t rx_waitq;
 	wait_queue_head_t tx_waitq;
-#endif
 };
 
 #define HE_VCC(vcc)	((struct he_vcc *)(vcc->dev_data))
diff -urN linux-2.5.69-bk4/drivers/net/ppp_generic.c linux-2.5.69-bk5/drivers/net/ppp_generic.c
--- linux-2.5.69-bk4/drivers/net/ppp_generic.c	2003-05-10 04:36:21.000000000 -0700
+++ linux-2.5.69-bk5/drivers/net/ppp_generic.c	2003-05-10 04:36:25.000000000 -0700
@@ -57,7 +57,9 @@
 #define NP_IPV6	1		/* Internet Protocol V6 */
 #define NP_IPX	2		/* IPX protocol */
 #define NP_AT	3		/* Appletalk protocol */
-#define NUM_NP	4		/* Number of NPs. */
+#define NP_MPLS_UC 4		/* MPLS unicast */
+#define NP_MPLS_MC 5		/* MPLS multicast */
+#define NUM_NP	6		/* Number of NPs. */
 
 #define MPHDRLEN	6	/* multilink protocol header length */
 #define MPHDRLEN_SSN	4	/* ditto with short sequence numbers */
@@ -281,6 +283,10 @@
 		return NP_IPX;
 	case PPP_AT:
 		return NP_AT;
+	case PPP_MPLS_UC:
+		return NP_MPLS_UC;
+	case PPP_MPLS_MC:
+		return NP_MPLS_MC;
 	}
 	return -EINVAL;
 }
@@ -291,6 +297,8 @@
 	PPP_IPV6,
 	PPP_IPX,
 	PPP_AT,
+	PPP_MPLS_UC,
+	PPP_MPLS_MC,
 };
 	
 /* Translates an ethertype into an NP index */
@@ -306,6 +314,10 @@
 	case ETH_P_PPPTALK:
 	case ETH_P_ATALK:
 		return NP_AT;
+	case ETH_P_MPLS_UC:
+		return NP_MPLS_UC;
+	case ETH_P_MPLS_MC:
+		return NP_MPLS_MC;
 	}
 	return -1;
 }
@@ -316,6 +328,8 @@
 	ETH_P_IPV6,
 	ETH_P_IPX,
 	ETH_P_PPPTALK,
+	ETH_P_MPLS_UC,
+	ETH_P_MPLS_MC,
 };
 
 /*
diff -urN linux-2.5.69-bk4/drivers/net/setup.c linux-2.5.69-bk5/drivers/net/setup.c
--- linux-2.5.69-bk4/drivers/net/setup.c	2003-05-10 04:36:21.000000000 -0700
+++ linux-2.5.69-bk5/drivers/net/setup.c	2003-05-10 04:36:25.000000000 -0700
@@ -9,14 +9,11 @@
 #include <linux/init.h>
 #include <linux/netlink.h>
 
-extern int x25_asy_init_ctrl_dev(void);
-  
 extern int dmascc_init(void);
 
 extern int arcnet_init(void); 
 extern int scc_enet_init(void); 
 extern int fec_enet_init(void); 
-extern int dlci_setup(void); 
 extern int sdla_setup(void); 
 extern int sdla_c_setup(void); 
 extern int comx_init(void);
@@ -51,9 +48,6 @@
 #if defined(CONFIG_DMASCC)
 	{dmascc_init, 0},
 #endif	
-#if defined(CONFIG_DLCI)
-	{dlci_setup, 0},
-#endif
 #if defined(CONFIG_SDLA)
 	{sdla_c_setup, 0},
 #endif
@@ -101,19 +95,6 @@
 	}
 }
 
-
-/*
- *	Initialise the line discipline drivers
- */
- 
-static void __init network_ldisc_init(void)
-{
-#if defined(CONFIG_X25_ASY)
-	x25_asy_init_ctrl_dev();
-#endif
-}
-
-
 static void __init special_device_init(void)
 {
 #ifdef CONFIG_NET_SB1000
@@ -133,11 +114,8 @@
  
 void __init net_device_init(void)
 {
-	/* Devices supporting the new probing API */
+	/* Devices supporting the new^H^H^Hold probing API */
 	network_probe();
-	/* Line disciplines */
-	network_ldisc_init();
 	/* Special devices */
 	special_device_init();
-	/* That kicks off the legacy init functions */
 }
diff -urN linux-2.5.69-bk4/drivers/net/skfp/skfddi.c linux-2.5.69-bk5/drivers/net/skfp/skfddi.c
--- linux-2.5.69-bk4/drivers/net/skfp/skfddi.c	2003-05-04 16:53:00.000000000 -0700
+++ linux-2.5.69-bk5/drivers/net/skfp/skfddi.c	2003-05-10 04:36:25.000000000 -0700
@@ -539,6 +539,8 @@
 	dev->header_cache_update = NULL;	/* not supported */
 	dev->change_mtu = NULL;	/* set in fddi_setup() */
 
+	SET_MODULE_OWNER(dev);
+
 	/* Initialize remaining device structure information */
 	fddi_setup(dev);
 }				// init_device
@@ -791,8 +793,6 @@
 	smt_online(smc, 1);
 	STI_FBI();
 
-	MOD_INC_USE_COUNT;
-
 	/* Clear local multicast address tables */
 	mac_clear_multicast(smc);
 
@@ -854,8 +854,6 @@
 		dev_kfree_skb(skb);
 	}
 
-	MOD_DEC_USE_COUNT;
-
 	return (0);
 }				// skfp_close
 
diff -urN linux-2.5.69-bk4/drivers/net/wan/dlci.c linux-2.5.69-bk5/drivers/net/wan/dlci.c
--- linux-2.5.69-bk4/drivers/net/wan/dlci.c	2003-05-04 16:53:28.000000000 -0700
+++ linux-2.5.69-bk5/drivers/net/wan/dlci.c	2003-05-10 04:36:25.000000000 -0700
@@ -37,6 +37,7 @@
 #include <linux/ptrace.h>
 #include <linux/ioport.h>
 #include <linux/in.h>
+#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/init.h>
@@ -577,9 +578,10 @@
 	return(0);
 }
 
-int __init dlci_setup(void)
+int __init init_dlci(void)
 {
 	int i;
+	dlci_ioctl_set(dlci_ioctl);
 
 	printk("%s.\n", version);
 	
@@ -589,25 +591,16 @@
 	for(i=0;i<sizeof(basename) / sizeof(char *);i++)
 		basename[i] = NULL;
 
-	return(0);
+	return 0;
 }
 
-#ifdef MODULE
-
-extern int (*dlci_ioctl_hook)(unsigned int, void *);
-
-int init_module(void)
+void __exit dlci_exit(void)
 {
-	dlci_ioctl_hook = dlci_ioctl;
-
-	return(dlci_setup());
+	dlci_ioctl_set(NULL);
 }
 
-void cleanup_module(void)
-{
-	dlci_ioctl_hook = NULL;
-}
-#endif /* MODULE */
+module_init(init_dlci);
+module_exit(dlci_exit);
 
 MODULE_AUTHOR("Mike McLagan");
 MODULE_DESCRIPTION("Frame Relay DLCI layer");
diff -urN linux-2.5.69-bk4/drivers/net/wan/x25_asy.c linux-2.5.69-bk5/drivers/net/wan/x25_asy.c
--- linux-2.5.69-bk4/drivers/net/wan/x25_asy.c	2003-05-04 16:53:07.000000000 -0700
+++ linux-2.5.69-bk5/drivers/net/wan/x25_asy.c	2003-05-10 04:36:25.000000000 -0700
@@ -46,8 +46,6 @@
 MODULE_PARM(x25_asy_maxdev, "i");
 MODULE_LICENSE("GPL");
 
-static struct tty_ldisc	x25_ldisc;
-
 static int x25_asy_esc(unsigned char *p, unsigned char *d, int len);
 static void x25_asy_unesc(struct x25_asy *sl, unsigned char c);
 
@@ -634,8 +632,6 @@
 	if ((err = x25_asy_open(sl->dev)))
 		return err;
 
-	MOD_INC_USE_COUNT;
-
 	/* Done.  We have linked the TTY line to a channel. */
 	return sl->dev->base_addr;
 }
@@ -664,7 +660,6 @@
 	sl->tty = NULL;
 	x25_asy_free(sl);
 	unregister_netdev(sl->dev);
-	MOD_DEC_USE_COUNT;
 }
 
 
@@ -769,32 +764,29 @@
 
 
 /* Perform I/O control on an active X.25 channel. */
-static int x25_asy_ioctl(struct tty_struct *tty, void *file, int cmd, void *arg)
+static int x25_asy_ioctl(struct tty_struct *tty, struct file *file,
+			 unsigned int cmd,  unsigned long arg)
 {
 	struct x25_asy *sl = (struct x25_asy *) tty->disc_data;
 
 	/* First make sure we're connected. */
-	if (!sl || sl->magic != X25_ASY_MAGIC) {
+	if (!sl || sl->magic != X25_ASY_MAGIC)
 		return -EINVAL;
-	}
 
-	switch(cmd) 
-	{
-		case SIOCGIFNAME:
-			if(copy_to_user(arg, sl->dev->name, strlen(sl->dev->name) + 1))
-				return -EFAULT;
-			return 0;
-
-		case SIOCSIFHWADDR:
-			return -EINVAL;
-
-		/* Allow stty to read, but not set, the serial port */
-		case TCGETS:
-		case TCGETA:
-			return n_tty_ioctl(tty, (struct file *) file, cmd, (unsigned long) arg);
-
-		default:
-			return -ENOIOCTLCMD;
+	switch(cmd) {
+	case SIOCGIFNAME:
+		if (copy_to_user((void *)arg, sl->dev->name,
+					strlen(sl->dev->name) + 1))
+			return -EFAULT;
+		return 0;
+	case SIOCSIFHWADDR:
+		return -EINVAL;
+	/* Allow stty to read, but not set, the serial port */
+	case TCGETS:
+	case TCGETA:
+		return n_tty_ioctl(tty, file, cmd, arg);
+	default:
+		return -ENOIOCTLCMD;
 	}
 }
 
@@ -806,51 +798,7 @@
 	return 0;
 }
 
-/* Initialize X.25 control device -- register X.25 line discipline */
-
-int __init x25_asy_init_ctrl_dev(void)
-{
-	int status;
-
-	if (x25_asy_maxdev < 4) x25_asy_maxdev = 4; /* Sanity */
-
-	printk(KERN_INFO "X.25 async: version 0.00 ALPHA (dynamic channels, max=%d).\n",
-		x25_asy_maxdev );
-	x25_asy_ctrls = (x25_asy_ctrl_t **) kmalloc(sizeof(void*)*x25_asy_maxdev, GFP_KERNEL);
-	if (x25_asy_ctrls == NULL)
-	{
-		printk("X25 async: Can't allocate x25_asy_ctrls[] array!  Uaargh! (-> No X.25 available)\n");
-		return -ENOMEM;
-	}
-
-	/* Clear the pointer array, we allocate devices when we need them */
-	memset(x25_asy_ctrls, 0, sizeof(void*)*x25_asy_maxdev); /* Pointers */
-
-	/* Fill in our line protocol discipline, and register it */
-	memset(&x25_ldisc, 0, sizeof(x25_ldisc));
-	x25_ldisc.magic  = TTY_LDISC_MAGIC;
-	x25_ldisc.name   = "X.25";
-	x25_ldisc.flags  = 0;
-	x25_ldisc.open   = x25_asy_open_tty;
-	x25_ldisc.close  = x25_asy_close_tty;
-	x25_ldisc.read   = NULL;
-	x25_ldisc.write  = NULL;
-	x25_ldisc.ioctl  = (int (*)(struct tty_struct *, struct file *,
-				   unsigned int, unsigned long)) x25_asy_ioctl;
-	x25_ldisc.poll   = NULL;
-	x25_ldisc.receive_buf = x25_asy_receive_buf;
-	x25_ldisc.receive_room = x25_asy_receive_room;
-	x25_ldisc.write_wakeup = x25_asy_write_wakeup;
-	if ((status = tty_register_ldisc(N_X25, &x25_ldisc)) != 0)  {
-		printk("X.25 async: can't register line discipline (err = %d)\n", status);
-	}
-
-	return status;
-}
-
-
 /* Initialise the X.25 driver.  Called by the device init code */
-
 int x25_asy_init(struct net_device *dev)
 {
 	struct x25_asy *sl = (struct x25_asy*)(dev->priv);
@@ -885,43 +833,58 @@
 
 	return 0;
 }
-#ifdef MODULE
 
-int
-init_module(void)
-{
-	return x25_asy_init_ctrl_dev();
+static struct tty_ldisc x25_ldisc = {
+	.owner		= THIS_MODULE,
+	.magic		= TTY_LDISC_MAGIC,
+	.name		= "X.25",
+	.open		= x25_asy_open_tty,
+	.close		= x25_asy_close_tty,
+	.ioctl		= x25_asy_ioctl,
+	.receive_buf	= x25_asy_receive_buf,
+	.receive_room	= x25_asy_receive_room,
+	.write_wakeup	= x25_asy_write_wakeup,
+};
+
+static int __init init_x25_asy(void)
+{
+	if (x25_asy_maxdev < 4)
+		x25_asy_maxdev = 4; /* Sanity */
+
+	printk(KERN_INFO "X.25 async: version 0.00 ALPHA "
+			"(dynamic channels, max=%d).\n", x25_asy_maxdev );
+	x25_asy_ctrls = kmalloc(sizeof(void*)*x25_asy_maxdev, GFP_KERNEL);
+	if (!x25_asy_ctrls) {
+		printk(KERN_WARNING "X25 async: Can't allocate x25_asy_ctrls[] "
+				"array! Uaargh! (-> No X.25 available)\n");
+		return -ENOMEM;
+	}
+	memset(x25_asy_ctrls, 0, sizeof(void*)*x25_asy_maxdev); /* Pointers */
+
+	return tty_register_ldisc(N_X25, &x25_ldisc);
 }
 
-void
-cleanup_module(void)
+
+static void __exit exit_x25_asy(void)
 {
 	int i;
 
-	if (x25_asy_ctrls != NULL)
-	{
-		for (i = 0; i < x25_asy_maxdev; i++)
-		{
-			if (x25_asy_ctrls[i])
-			{
-				/*
-				 * VSV = if dev->start==0, then device
-				 * unregistered while close proc.
-				 */
-				if (netif_running(&(x25_asy_ctrls[i]->dev)))
-					unregister_netdev(&(x25_asy_ctrls[i]->dev));
+	for (i = 0; i < x25_asy_maxdev; i++) {
+		if (x25_asy_ctrls[i]) {
+			/*
+			 * VSV = if dev->start==0, then device
+			 * unregistered while close proc.
+			 */
+			if (netif_running(&(x25_asy_ctrls[i]->dev)))
+				unregister_netdev(&(x25_asy_ctrls[i]->dev));
 
-				kfree(x25_asy_ctrls[i]);
-				x25_asy_ctrls[i] = NULL;
-			}
+			kfree(x25_asy_ctrls[i]);
 		}
-		kfree(x25_asy_ctrls);
-		x25_asy_ctrls = NULL;
-	}
-	if ((i = tty_register_ldisc(N_X25, NULL)))
-	{
-		printk("X.25 async: can't unregister line discipline (err = %d)\n", i);
 	}
+
+	kfree(x25_asy_ctrls);
+	tty_register_ldisc(N_X25, NULL);
 }
-#endif /* MODULE */
 
+module_init(init_x25_asy);
+module_exit(exit_x25_asy);
diff -urN linux-2.5.69-bk4/drivers/scsi/aic7xxx/aic7xxx_osm.h linux-2.5.69-bk5/drivers/scsi/aic7xxx/aic7xxx_osm.h
--- linux-2.5.69-bk4/drivers/scsi/aic7xxx/aic7xxx_osm.h	2003-05-04 16:53:12.000000000 -0700
+++ linux-2.5.69-bk5/drivers/scsi/aic7xxx/aic7xxx_osm.h	2003-05-10 04:36:26.000000000 -0700
@@ -768,7 +768,7 @@
 }
 
 static __inline void
-ahc_list_lockinit()
+ahc_list_lockinit(void)
 {
 	spin_lock_init(&ahc_list_spinlock);
 }
diff -urN linux-2.5.69-bk4/drivers/scsi/aic7xxx/aic7xxx_pci.c linux-2.5.69-bk5/drivers/scsi/aic7xxx/aic7xxx_pci.c
--- linux-2.5.69-bk4/drivers/scsi/aic7xxx/aic7xxx_pci.c	2003-05-04 16:53:01.000000000 -0700
+++ linux-2.5.69-bk5/drivers/scsi/aic7xxx/aic7xxx_pci.c	2003-05-10 04:36:26.000000000 -0700
@@ -1958,8 +1958,7 @@
 }
 
 static uint8_t
-read_brdctl(ahc)
-	struct 	ahc_softc *ahc;
+read_brdctl(struct ahc_softc *ahc)
 {
 	uint8_t brdctl;
 	uint8_t value;
diff -urN linux-2.5.69-bk4/include/asm-i386/i387.h linux-2.5.69-bk5/include/asm-i386/i387.h
--- linux-2.5.69-bk4/include/asm-i386/i387.h	2003-05-04 16:53:36.000000000 -0700
+++ linux-2.5.69-bk5/include/asm-i386/i387.h	2003-05-10 04:36:26.000000000 -0700
@@ -87,15 +87,15 @@
 /*
  * ptrace request handers...
  */
-extern int get_fpregs( struct user_i387_struct *buf,
+extern int get_fpregs( struct user_i387_struct __user *buf,
 		       struct task_struct *tsk );
 extern int set_fpregs( struct task_struct *tsk,
-		       struct user_i387_struct *buf );
+		       struct user_i387_struct __user *buf );
 
-extern int get_fpxregs( struct user_fxsr_struct *buf,
+extern int get_fpxregs( struct user_fxsr_struct __user *buf,
 			struct task_struct *tsk );
 extern int set_fpxregs( struct task_struct *tsk,
-			struct user_fxsr_struct *buf );
+			struct user_fxsr_struct __user *buf );
 
 /*
  * FPU state for core dumps...
diff -urN linux-2.5.69-bk4/include/asm-i386/ipc.h linux-2.5.69-bk5/include/asm-i386/ipc.h
--- linux-2.5.69-bk4/include/asm-i386/ipc.h	2003-05-04 16:53:40.000000000 -0700
+++ linux-2.5.69-bk5/include/asm-i386/ipc.h	2003-05-10 04:36:26.000000000 -0700
@@ -7,7 +7,7 @@
  * See arch/i386/kernel/sys_i386.c for ugly details..
  */
 struct ipc_kludge {
-	struct msgbuf *msgp;
+	struct msgbuf __user *msgp;
 	long msgtyp;
 };
 
diff -urN linux-2.5.69-bk4/include/asm-i386/processor.h linux-2.5.69-bk5/include/asm-i386/processor.h
--- linux-2.5.69-bk4/include/asm-i386/processor.h	2003-05-10 04:36:21.000000000 -0700
+++ linux-2.5.69-bk5/include/asm-i386/processor.h	2003-05-10 04:36:26.000000000 -0700
@@ -400,7 +400,7 @@
 /* floating point info */
 	union i387_union	i387;
 /* virtual 86 mode info */
-	struct vm86_struct	* vm86_info;
+	struct vm86_struct __user * vm86_info;
 	unsigned long		screen_bitmap;
 	unsigned long		v86flags, v86mask, saved_esp0;
 	unsigned int		saved_fs, saved_gs;
diff -urN linux-2.5.69-bk4/include/linux/if_ether.h linux-2.5.69-bk5/include/linux/if_ether.h
--- linux-2.5.69-bk4/include/linux/if_ether.h	2003-05-04 16:53:32.000000000 -0700
+++ linux-2.5.69-bk5/include/linux/if_ether.h	2003-05-10 04:36:26.000000000 -0700
@@ -61,6 +61,8 @@
 #define ETH_P_IPV6	0x86DD		/* IPv6 over bluebook		*/
 #define ETH_P_PPP_DISC	0x8863		/* PPPoE discovery messages     */
 #define ETH_P_PPP_SES	0x8864		/* PPPoE session messages	*/
+#define ETH_P_MPLS_UC	0x8847		/* MPLS Unicast traffic		*/
+#define ETH_P_MPLS_MC	0x8848		/* MPLS Multicast traffic	*/
 #define ETH_P_ATMMPOA	0x884c		/* MultiProtocol Over ATM	*/
 #define ETH_P_ATMFATE	0x8884		/* Frame-based ATM Transport
 					 * over Ethernet
diff -urN linux-2.5.69-bk4/include/linux/if_frad.h linux-2.5.69-bk5/include/linux/if_frad.h
--- linux-2.5.69-bk4/include/linux/if_frad.h	2003-05-04 16:52:49.000000000 -0700
+++ linux-2.5.69-bk5/include/linux/if_frad.h	2003-05-10 04:36:26.000000000 -0700
@@ -192,7 +192,7 @@
 int register_frad(const char *name);
 int unregister_frad(const char *name);
 
-extern int (*dlci_ioctl_hook)(unsigned int, void *);
+extern void dlci_ioctl_set(int (*hook)(unsigned int, void *));
 
 #endif /* __KERNEL__ */
 
diff -urN linux-2.5.69-bk4/include/linux/msg.h linux-2.5.69-bk5/include/linux/msg.h
--- linux-2.5.69-bk4/include/linux/msg.h	2003-05-04 16:53:31.000000000 -0700
+++ linux-2.5.69-bk5/include/linux/msg.h	2003-05-10 04:36:26.000000000 -0700
@@ -94,9 +94,9 @@
 };
 
 asmlinkage long sys_msgget (key_t key, int msgflg);
-asmlinkage long sys_msgsnd (int msqid, struct msgbuf *msgp, size_t msgsz, int msgflg);
-asmlinkage long sys_msgrcv (int msqid, struct msgbuf *msgp, size_t msgsz, long msgtyp, int msgflg);
-asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds *buf);
+asmlinkage long sys_msgsnd (int msqid, struct msgbuf __user *msgp, size_t msgsz, int msgflg);
+asmlinkage long sys_msgrcv (int msqid, struct msgbuf __user *msgp, size_t msgsz, long msgtyp, int msgflg);
+asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds __user *buf);
 
 #endif /* __KERNEL__ */
 
diff -urN linux-2.5.69-bk4/include/linux/ppp_defs.h linux-2.5.69-bk5/include/linux/ppp_defs.h
--- linux-2.5.69-bk4/include/linux/ppp_defs.h	2003-05-04 16:53:09.000000000 -0700
+++ linux-2.5.69-bk5/include/linux/ppp_defs.h	2003-05-10 04:36:26.000000000 -0700
@@ -74,12 +74,15 @@
 #define PPP_IPV6	0x57	/* Internet Protocol Version 6 */
 #define PPP_COMPFRAG	0xfb	/* fragment compressed below bundle */
 #define PPP_COMP	0xfd	/* compressed packet */
+#define PPP_MPLS_UC	0x0281	/* Multi Protocol Label Switching - Unicast */
+#define PPP_MPLS_MC	0x0283	/* Multi Protocol Label Switching - Multicast */
 #define PPP_IPCP	0x8021	/* IP Control Protocol */
 #define PPP_ATCP	0x8029	/* AppleTalk Control Protocol */
 #define PPP_IPXCP	0x802b	/* IPX Control Protocol */
 #define PPP_IPV6CP	0x8057	/* IPv6 Control Protocol */
 #define PPP_CCPFRAG	0x80fb	/* CCP at link level (below MP bundle) */
 #define PPP_CCP		0x80fd	/* Compression Control Protocol */
+#define PPP_MPLSCP	0x80fd	/* MPLS Control Protocol */
 #define PPP_LCP		0xc021	/* Link Control Protocol */
 #define PPP_PAP		0xc023	/* Password Authentication Protocol */
 #define PPP_LQR		0xc025	/* Link Quality Report protocol */
diff -urN linux-2.5.69-bk4/include/linux/rtnetlink.h linux-2.5.69-bk5/include/linux/rtnetlink.h
--- linux-2.5.69-bk4/include/linux/rtnetlink.h	2003-05-10 04:36:21.000000000 -0700
+++ linux-2.5.69-bk5/include/linux/rtnetlink.h	2003-05-10 04:36:26.000000000 -0700
@@ -201,9 +201,10 @@
 	RTA_FLOW,
 	RTA_CACHEINFO,
 	RTA_SESSION,
+	RTA_HOPLIMIT,
 };
 
-#define RTA_MAX RTA_SESSION
+#define RTA_MAX RTA_HOPLIMIT
 
 #define RTM_RTA(r)  ((struct rtattr*)(((char*)(r)) + NLMSG_ALIGN(sizeof(struct rtmsg))))
 #define RTM_PAYLOAD(n) NLMSG_PAYLOAD(n,sizeof(struct rtmsg))
diff -urN linux-2.5.69-bk4/include/linux/security.h linux-2.5.69-bk5/include/linux/security.h
--- linux-2.5.69-bk4/include/linux/security.h	2003-05-10 04:36:21.000000000 -0700
+++ linux-2.5.69-bk5/include/linux/security.h	2003-05-10 04:36:26.000000000 -0700
@@ -1729,7 +1729,7 @@
 }
 
 static inline int security_shm_shmat (struct shmid_kernel * shp, 
-				      char *shmaddr, int shmflg)
+				      char __user *shmaddr, int shmflg)
 {
 	return security_ops->shm_shmat(shp, shmaddr, shmflg);
 }
@@ -2322,7 +2322,7 @@
 }
 
 static inline int security_shm_shmat (struct shmid_kernel * shp, 
-				      char *shmaddr, int shmflg)
+				      char __user *shmaddr, int shmflg)
 {
 	return 0;
 }
diff -urN linux-2.5.69-bk4/include/linux/sem.h linux-2.5.69-bk5/include/linux/sem.h
--- linux-2.5.69-bk4/include/linux/sem.h	2003-05-04 16:53:13.000000000 -0700
+++ linux-2.5.69-bk5/include/linux/sem.h	2003-05-10 04:36:26.000000000 -0700
@@ -138,10 +138,10 @@
 };
 
 asmlinkage long sys_semget (key_t key, int nsems, int semflg);
-asmlinkage long sys_semop (int semid, struct sembuf *sops, unsigned nsops);
+asmlinkage long sys_semop (int semid, struct sembuf __user *sops, unsigned nsops);
 asmlinkage long sys_semctl (int semid, int semnum, int cmd, union semun arg);
-asmlinkage long sys_semtimedop(int semid, struct sembuf *sops,
-			unsigned nsops, const struct timespec *timeout);
+asmlinkage long sys_semtimedop(int semid, struct sembuf __user *sops,
+			unsigned nsops, const struct timespec __user *timeout);
 
 #endif /* __KERNEL__ */
 
diff -urN linux-2.5.69-bk4/include/linux/shm.h linux-2.5.69-bk5/include/linux/shm.h
--- linux-2.5.69-bk4/include/linux/shm.h	2003-05-04 16:53:36.000000000 -0700
+++ linux-2.5.69-bk5/include/linux/shm.h	2003-05-10 04:36:26.000000000 -0700
@@ -90,10 +90,10 @@
 #define SHM_LOCKED      02000   /* segment will not be swapped */
 #define SHM_HUGETLB     04000   /* segment will use huge TLB pages */
 
+long sys_shmat (int shmid, char __user *shmaddr, int shmflg, unsigned long *addr);
 asmlinkage long sys_shmget (key_t key, size_t size, int flag);
-asmlinkage long sys_shmat (int shmid, char *shmaddr, int shmflg, unsigned long *addr);
-asmlinkage long sys_shmdt (char *shmaddr);
-asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds *buf);
+asmlinkage long sys_shmdt (char __user *shmaddr);
+asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf);
 
 #endif /* __KERNEL__ */
 
diff -urN linux-2.5.69-bk4/include/net/dn_fib.h linux-2.5.69-bk5/include/net/dn_fib.h
--- linux-2.5.69-bk4/include/net/dn_fib.h	2003-05-10 04:36:21.000000000 -0700
+++ linux-2.5.69-bk5/include/net/dn_fib.h	2003-05-10 04:36:26.000000000 -0700
@@ -1,6 +1,9 @@
 #ifndef _NET_DN_FIB_H
 #define _NET_DN_FIB_H
 
+/* WARNING: The ordering of these elements must match ordering
+ *          of RTA_* rtnetlink attribute numbers.
+ */
 struct dn_kern_rta
 {
         void            *rta_dst;
@@ -13,8 +16,10 @@
         struct rtattr   *rta_mx;
         struct rtattr   *rta_mp;
         unsigned char   *rta_protoinfo;
-        unsigned char   *rta_flow;
+        u32             *rta_flow;
         struct rta_cacheinfo *rta_ci;
+	struct rta_session *rta_sess;
+	u8		*rta_hoplimit;
 };
 
 struct dn_fib_res {
diff -urN linux-2.5.69-bk4/include/net/ip6_fib.h linux-2.5.69-bk5/include/net/ip6_fib.h
--- linux-2.5.69-bk4/include/net/ip6_fib.h	2003-05-04 16:53:36.000000000 -0700
+++ linux-2.5.69-bk5/include/net/ip6_fib.h	2003-05-10 04:36:26.000000000 -0700
@@ -163,10 +163,12 @@
 
 extern int			fib6_add(struct fib6_node *root,
 					 struct rt6_info *rt,
-					 struct nlmsghdr *nlh);
+					 struct nlmsghdr *nlh,
+					 void *rtattr);
 
 extern int			fib6_del(struct rt6_info *rt,
-					 struct nlmsghdr *nlh);
+					 struct nlmsghdr *nlh,
+					 void *rtattr);
 
 extern void			inet6_rt_notify(int event, struct rt6_info *rt,
 						struct nlmsghdr *nlh);
diff -urN linux-2.5.69-bk4/include/net/ip6_route.h linux-2.5.69-bk5/include/net/ip6_route.h
--- linux-2.5.69-bk4/include/net/ip6_route.h	2003-05-04 16:53:08.000000000 -0700
+++ linux-2.5.69-bk5/include/net/ip6_route.h	2003-05-10 04:36:26.000000000 -0700
@@ -38,9 +38,11 @@
 extern int			ipv6_route_ioctl(unsigned int cmd, void *arg);
 
 extern int			ip6_route_add(struct in6_rtmsg *rtmsg,
-					      struct nlmsghdr *);
+					      struct nlmsghdr *,
+					      void *rtattr);
 extern int			ip6_del_rt(struct rt6_info *,
-					   struct nlmsghdr *);
+					   struct nlmsghdr *,
+					   void *rtattr);
 
 extern int			ip6_rt_addr_add(struct in6_addr *addr,
 						struct net_device *dev);
diff -urN linux-2.5.69-bk4/include/net/ip_fib.h linux-2.5.69-bk5/include/net/ip_fib.h
--- linux-2.5.69-bk4/include/net/ip_fib.h	2003-05-04 16:53:41.000000000 -0700
+++ linux-2.5.69-bk5/include/net/ip_fib.h	2003-05-10 04:36:26.000000000 -0700
@@ -20,6 +20,9 @@
 #include <net/flow.h>
 #include <linux/seq_file.h>
 
+/* WARNING: The ordering of these elements must match ordering
+ *          of RTA_* rtnetlink attribute numbers.
+ */
 struct kern_rta
 {
 	void		*rta_dst;
@@ -32,8 +35,10 @@
 	struct rtattr	*rta_mx;
 	struct rtattr	*rta_mp;
 	unsigned char	*rta_protoinfo;
-	unsigned char	*rta_flow;
+	u32		*rta_flow;
 	struct rta_cacheinfo *rta_ci;
+	struct rta_session *rta_sess;
+	u8		*rta_hoplimit;
 };
 
 struct fib_nh
diff -urN linux-2.5.69-bk4/include/net/xfrm.h linux-2.5.69-bk5/include/net/xfrm.h
--- linux-2.5.69-bk4/include/net/xfrm.h	2003-05-04 16:53:37.000000000 -0700
+++ linux-2.5.69-bk5/include/net/xfrm.h	2003-05-10 04:36:26.000000000 -0700
@@ -336,7 +336,7 @@
 
 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
 {
-	if (policy)
+	if (likely(policy != NULL))
 		atomic_inc(&policy->refcnt);
 }
 
diff -urN linux-2.5.69-bk4/ipc/shm.c linux-2.5.69-bk5/ipc/shm.c
--- linux-2.5.69-bk4/ipc/shm.c	2003-05-10 04:36:21.000000000 -0700
+++ linux-2.5.69-bk5/ipc/shm.c	2003-05-10 04:36:26.000000000 -0700
@@ -270,7 +270,7 @@
 	return err;
 }
 
-static inline unsigned long copy_shmid_to_user(void *buf, struct shmid64_ds *in, int version)
+static inline unsigned long copy_shmid_to_user(void __user *buf, struct shmid64_ds *in, int version)
 {
 	switch(version) {
 	case IPC_64:
@@ -301,7 +301,7 @@
 	mode_t	mode;
 };	
 
-static inline unsigned long copy_shmid_from_user(struct shm_setbuf *out, void *buf, int version)
+static inline unsigned long copy_shmid_from_user(struct shm_setbuf *out, void __user *buf, int version)
 {
 	switch(version) {
 	case IPC_64:
@@ -335,7 +335,7 @@
 	}
 }
 
-static inline unsigned long copy_shminfo_to_user(void *buf, struct shminfo64 *in, int version)
+static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminfo64 *in, int version)
 {
 	switch(version) {
 	case IPC_64:
@@ -393,7 +393,7 @@
 	}
 }
 
-asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds *buf)
+asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf)
 {
 	struct shm_setbuf setbuf;
 	struct shmid_kernel *shp;
@@ -580,7 +580,7 @@
 
 	case IPC_SET:
 	{
-		if(copy_shmid_from_user (&setbuf, buf, version)) {
+		if (copy_shmid_from_user (&setbuf, buf, version)) {
 			err = -EFAULT;
 			goto out;
 		}
@@ -630,8 +630,12 @@
 
 /*
  * Fix shmaddr, allocate descriptor, map shm, add attach descriptor to lists.
+ *
+ * NOTE! Despite the name, this is NOT a direct system call entrypoint. The
+ * "raddr" thing points to kernel space, and there has to be a wrapper around
+ * this.
  */
-asmlinkage long sys_shmat (int shmid, char *shmaddr, int shmflg, ulong *raddr)
+long sys_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
 {
 	struct shmid_kernel *shp;
 	unsigned long addr;
@@ -745,7 +749,7 @@
  * detach and kill segment if marked destroyed.
  * The work is done in shm_close.
  */
-asmlinkage long sys_shmdt(char *shmaddr)
+asmlinkage long sys_shmdt(char __user *shmaddr)
 {
 	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma, *next;
diff -urN linux-2.5.69-bk4/kernel/signal.c linux-2.5.69-bk5/kernel/signal.c
--- linux-2.5.69-bk4/kernel/signal.c	2003-05-04 16:53:13.000000000 -0700
+++ linux-2.5.69-bk5/kernel/signal.c	2003-05-10 04:36:26.000000000 -0700
@@ -1146,6 +1146,7 @@
 send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
 {
 	int ret;
+	unsigned long flags;
 
 	/*
 	 * We need the tasklist lock even for the specific
@@ -1154,9 +1155,9 @@
 	 * going away or changing from under us.
 	 */
 	read_lock(&tasklist_lock);  
-	spin_lock_irq(&p->sighand->siglock);
+	spin_lock_irqsave(&p->sighand->siglock, flags);
 	ret = specific_send_sig_info(sig, info, p);
-	spin_unlock_irq(&p->sighand->siglock);
+	spin_unlock_irqrestore(&p->sighand->siglock, flags);
 	read_unlock(&tasklist_lock);
 	return ret;
 }
diff -urN linux-2.5.69-bk4/net/compat.c linux-2.5.69-bk5/net/compat.c
--- linux-2.5.69-bk4/net/compat.c	2003-05-04 16:53:32.000000000 -0700
+++ linux-2.5.69-bk5/net/compat.c	2003-05-10 04:36:26.000000000 -0700
@@ -27,8 +27,6 @@
 #include <asm/uaccess.h>
 #include <net/compat.h>
 
-#define AA(__x)		((unsigned long)(__x))
-
 static inline int iov_from_user_compat_to_kern(struct iovec *kiov,
 					  struct compat_iovec *uiov32,
 					  int niov)
@@ -393,31 +391,27 @@
 	struct compat_sock_fprog *fprog32 = (struct compat_sock_fprog *)optval;
 	struct sock_fprog kfprog;
 	mm_segment_t old_fs;
-	compat_uptr_t uptr;
-	unsigned int fsize;
 	int ret;
+	compat_uptr_t ptr;
 
 	if (!access_ok(VERIFY_READ, fprog32, sizeof(*fprog32)) ||
 	    __get_user(kfprog.len, &fprog32->len) ||
-	    __get_user(uptr, &fprog32->filter))
+	    __get_user(ptr, &fprog32->filter))
 		return -EFAULT;
+	kfprog.filter = compat_ptr(ptr);	
 
-	fsize = kfprog.len * sizeof(struct sock_filter);
-	kfprog.filter = (struct sock_filter *)kmalloc(fsize, GFP_KERNEL);
-	if (kfprog.filter == NULL)
-		return -ENOMEM;
-	if (copy_from_user(kfprog.filter, compat_ptr(uptr), fsize)) {
-		kfree(kfprog.filter);
+	if (kfprog.len * sizeof(struct sock_filter) < kfprog.len) 
+		return -EINVAL;
+
+	if (verify_area(VERIFY_READ, kfprog.filter, 
+				    kfprog.len * sizeof(struct sock_filter)))
 		return -EFAULT;
-	}
 
 	old_fs = get_fs();
 	set_fs(KERNEL_DS);
 	ret = sys_setsockopt(fd, level, optname,
 			     (char *)&kfprog, sizeof(kfprog));
 	set_fs(old_fs);
-
-	kfree(kfprog.filter);
 	return ret;
 }
 
diff -urN linux-2.5.69-bk4/net/ipv4/netfilter/ip_fw_compat.c linux-2.5.69-bk5/net/ipv4/netfilter/ip_fw_compat.c
--- linux-2.5.69-bk4/net/ipv4/netfilter/ip_fw_compat.c	2003-05-04 16:53:13.000000000 -0700
+++ linux-2.5.69-bk5/net/ipv4/netfilter/ip_fw_compat.c	2003-05-10 04:36:26.000000000 -0700
@@ -35,7 +35,7 @@
 do_masquerade(struct sk_buff **pskb, const struct net_device *dev);
 
 extern unsigned int
-check_for_masq_error(struct sk_buff *pskb);
+check_for_masq_error(struct sk_buff **pskb);
 
 extern unsigned int
 check_for_demasq(struct sk_buff **pskb);
@@ -167,7 +167,7 @@
 			/* Handle ICMP errors from client here */
 			if ((*pskb)->nh.iph->protocol == IPPROTO_ICMP
 			    && (*pskb)->nfct)
-				check_for_masq_error(*pskb);
+				check_for_masq_error(pskb);
 		}
 		return NF_ACCEPT;
 
diff -urN linux-2.5.69-bk4/net/ipv4/netfilter/ip_fw_compat_masq.c linux-2.5.69-bk5/net/ipv4/netfilter/ip_fw_compat_masq.c
--- linux-2.5.69-bk4/net/ipv4/netfilter/ip_fw_compat_masq.c	2003-05-04 16:53:37.000000000 -0700
+++ linux-2.5.69-bk5/net/ipv4/netfilter/ip_fw_compat_masq.c	2003-05-10 04:36:26.000000000 -0700
@@ -103,19 +103,19 @@
 }
 
 void
-check_for_masq_error(struct sk_buff *skb)
+check_for_masq_error(struct sk_buff **pskb)
 {
 	enum ip_conntrack_info ctinfo;
 	struct ip_conntrack *ct;
 
-	ct = ip_conntrack_get(skb, &ctinfo);
+	ct = ip_conntrack_get(*pskb, &ctinfo);
 	/* Wouldn't be here if not tracked already => masq'ed ICMP
            ping or error related to masq'd connection */
 	IP_NF_ASSERT(ct);
 	if (ctinfo == IP_CT_RELATED) {
-		icmp_reply_translation(skb, ct, NF_IP_PRE_ROUTING,
+		icmp_reply_translation(pskb, ct, NF_IP_PRE_ROUTING,
 				       CTINFO2DIR(ctinfo));
-		icmp_reply_translation(skb, ct, NF_IP_POST_ROUTING,
+		icmp_reply_translation(pskb, ct, NF_IP_POST_ROUTING,
 				       CTINFO2DIR(ctinfo));
 	}
 }
@@ -152,10 +152,10 @@
 				    && skb_linearize(*pskb, GFP_ATOMIC) != 0)
 					return NF_DROP;
 
-				icmp_reply_translation(*pskb, ct,
+				icmp_reply_translation(pskb, ct,
 						       NF_IP_PRE_ROUTING,
 						       CTINFO2DIR(ctinfo));
-				icmp_reply_translation(*pskb, ct,
+				icmp_reply_translation(pskb, ct,
 						       NF_IP_POST_ROUTING,
 						       CTINFO2DIR(ctinfo));
 			}
diff -urN linux-2.5.69-bk4/net/ipv4/netfilter/ip_nat_core.c linux-2.5.69-bk5/net/ipv4/netfilter/ip_nat_core.c
--- linux-2.5.69-bk4/net/ipv4/netfilter/ip_nat_core.c	2003-05-10 04:36:21.000000000 -0700
+++ linux-2.5.69-bk5/net/ipv4/netfilter/ip_nat_core.c	2003-05-10 04:36:26.000000000 -0700
@@ -773,9 +773,9 @@
 			       ? "SRC" : "DST",
 			       NIPQUAD(info->manips[i].manip.ip),
 			       htons(info->manips[i].manip.u.all));
-			if (manip_pkt(proto, pskb, 0,
-				      &info->manips[i].manip,
-				      info->manips[i].maniptype) < 0) {
+			if (!manip_pkt(proto, pskb, 0,
+				       &info->manips[i].manip,
+				       info->manips[i].maniptype)) {
 				READ_UNLOCK(&ip_nat_lock);
 				return NF_DROP;
 			}
@@ -927,11 +927,11 @@
 			       ? "DST" : "SRC",
 			       NIPQUAD(info->manips[i].manip.ip),
 			       ntohs(info->manips[i].manip.u.udp.port));
-			if (manip_pkt(inside->ip.protocol, pskb,
-				      (*pskb)->nh.iph->ihl*4
-				      + sizeof(inside->icmp),
-				      &info->manips[i].manip,
-				      !info->manips[i].maniptype) < 0)
+			if (!manip_pkt(inside->ip.protocol, pskb,
+				       (*pskb)->nh.iph->ihl*4
+				       + sizeof(inside->icmp),
+				       &info->manips[i].manip,
+				       !info->manips[i].maniptype))
 				goto unlock_fail;
 
 			/* Outer packet needs to have IP header NATed like
@@ -943,9 +943,9 @@
 			       info->manips[i].maniptype == IP_NAT_MANIP_SRC
 			       ? "SRC" : "DST",
 			       NIPQUAD(info->manips[i].manip.ip));
-			if (manip_pkt(0, pskb, 0,
-				      &info->manips[i].manip,
-				      info->manips[i].maniptype) < 0)
+			if (!manip_pkt(0, pskb, 0,
+				       &info->manips[i].manip,
+				       info->manips[i].maniptype))
 				goto unlock_fail;
 		}
 	}
diff -urN linux-2.5.69-bk4/net/ipv4/xfrm4_state.c linux-2.5.69-bk5/net/ipv4/xfrm4_state.c
--- linux-2.5.69-bk4/net/ipv4/xfrm4_state.c	2003-05-04 16:52:59.000000000 -0700
+++ linux-2.5.69-bk5/net/ipv4/xfrm4_state.c	2003-05-10 04:36:26.000000000 -0700
@@ -50,7 +50,7 @@
 		    spi == x->id.spi &&
 		    daddr->a4 == x->id.daddr.a4 &&
 		    proto == x->id.proto) {
-			atomic_inc(&x->refcnt);
+			xfrm_state_hold(x);
 			return x;
 		}
 	}
@@ -84,7 +84,7 @@
 		    }
 	}
 	if (x0) {
-		atomic_inc(&x0->refcnt);
+		xfrm_state_hold(x0);
 	} else if (create && (x0 = xfrm_state_alloc()) != NULL) {
 		x0->sel.daddr.a4 = daddr->a4;
 		x0->sel.saddr.a4 = saddr->a4;
@@ -99,9 +99,9 @@
 		x0->props.reqid = reqid;
 		x0->props.family = AF_INET;
 		x0->lft.hard_add_expires_seconds = XFRM_ACQ_EXPIRES;
-		atomic_inc(&x0->refcnt);
+		xfrm_state_hold(x0);
 		mod_timer(&x0->timer, jiffies + XFRM_ACQ_EXPIRES*HZ);
-		atomic_inc(&x0->refcnt);
+		xfrm_state_hold(0);
 		list_add_tail(&x0->bydst, xfrm4_state_afinfo.state_bydst+h);
 		wake_up(&km_waitq);
 	}
diff -urN linux-2.5.69-bk4/net/ipv6/addrconf.c linux-2.5.69-bk5/net/ipv6/addrconf.c
--- linux-2.5.69-bk4/net/ipv6/addrconf.c	2003-05-04 16:53:41.000000000 -0700
+++ linux-2.5.69-bk5/net/ipv6/addrconf.c	2003-05-10 04:36:26.000000000 -0700
@@ -1210,7 +1210,7 @@
 	if (dev->type == ARPHRD_SIT && (dev->flags&IFF_POINTOPOINT))
 		rtmsg.rtmsg_flags |= RTF_NONEXTHOP;
 
-	ip6_route_add(&rtmsg, NULL);
+	ip6_route_add(&rtmsg, NULL, NULL);
 }
 
 /* Create "default" multicast route to the interface */
@@ -1227,7 +1227,7 @@
 	rtmsg.rtmsg_ifindex = dev->ifindex;
 	rtmsg.rtmsg_flags = RTF_UP|RTF_ADDRCONF;
 	rtmsg.rtmsg_type = RTMSG_NEWROUTE;
-	ip6_route_add(&rtmsg, NULL);
+	ip6_route_add(&rtmsg, NULL, NULL);
 }
 
 static void sit_route_add(struct net_device *dev)
@@ -1244,7 +1244,7 @@
 	rtmsg.rtmsg_flags	= RTF_UP|RTF_NONEXTHOP;
 	rtmsg.rtmsg_ifindex	= dev->ifindex;
 
-	ip6_route_add(&rtmsg, NULL);
+	ip6_route_add(&rtmsg, NULL, NULL);
 }
 
 static void addrconf_add_lroute(struct net_device *dev)
@@ -1336,7 +1336,7 @@
 	if (rt && ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
 		if (rt->rt6i_flags&RTF_EXPIRES) {
 			if (pinfo->onlink == 0 || valid_lft == 0) {
-				ip6_del_rt(rt, NULL);
+				ip6_del_rt(rt, NULL, NULL);
 				rt = NULL;
 			} else {
 				rt->rt6i_expires = rt_expires;
@@ -1960,7 +1960,7 @@
 
 		rtmsg.rtmsg_ifindex = ifp->idev->dev->ifindex;
 
-		ip6_route_add(&rtmsg, NULL);
+		ip6_route_add(&rtmsg, NULL, NULL);
 	}
 
 out:
diff -urN linux-2.5.69-bk4/net/ipv6/ip6_fib.c linux-2.5.69-bk5/net/ipv6/ip6_fib.c
--- linux-2.5.69-bk4/net/ipv6/ip6_fib.c	2003-05-10 04:36:21.000000000 -0700
+++ linux-2.5.69-bk5/net/ipv6/ip6_fib.c	2003-05-10 04:36:26.000000000 -0700
@@ -502,7 +502,7 @@
  *	with source addr info in sub-trees
  */
 
-int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nlmsghdr *nlh)
+int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr)
 {
 	struct fib6_node *fn;
 	int err = -ENOMEM;
@@ -884,7 +884,7 @@
 }
 
 static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
-    struct nlmsghdr *nlh)
+    struct nlmsghdr *nlh, void *_rtattr)
 {
 	struct fib6_walker_t *w;
 	struct rt6_info *rt = *rtp;
@@ -943,7 +943,7 @@
 	rt6_release(rt);
 }
 
-int fib6_del(struct rt6_info *rt, struct nlmsghdr *nlh)
+int fib6_del(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr)
 {
 	struct fib6_node *fn = rt->rt6i_node;
 	struct rt6_info **rtp;
@@ -968,7 +968,7 @@
 
 	for (rtp = &fn->leaf; *rtp; rtp = &(*rtp)->u.next) {
 		if (*rtp == rt) {
-			fib6_del_route(fn, rtp, nlh);
+			fib6_del_route(fn, rtp, nlh, _rtattr);
 			return 0;
 		}
 	}
@@ -1097,7 +1097,7 @@
 		res = c->func(rt, c->arg);
 		if (res < 0) {
 			w->leaf = rt;
-			res = fib6_del(rt, NULL);
+			res = fib6_del(rt, NULL, NULL);
 			if (res) {
 #if RT6_DEBUG >= 2
 				printk(KERN_DEBUG "fib6_clean_node: del failed: rt=%p@%p err=%d\n", rt, rt->rt6i_node, res);
diff -urN linux-2.5.69-bk4/net/ipv6/ndisc.c linux-2.5.69-bk5/net/ipv6/ndisc.c
--- linux-2.5.69-bk4/net/ipv6/ndisc.c	2003-05-04 16:53:32.000000000 -0700
+++ linux-2.5.69-bk5/net/ipv6/ndisc.c	2003-05-10 04:36:26.000000000 -0700
@@ -976,7 +976,7 @@
 				struct rt6_info *rt;
 				rt = rt6_get_dflt_router(saddr, dev);
 				if (rt)
-					ip6_del_rt(rt, NULL);
+					ip6_del_rt(rt, NULL, NULL);
 			}
 		} else {
 			if (msg->icmph.icmp6_router)
@@ -1050,7 +1050,7 @@
 	rt = rt6_get_dflt_router(&skb->nh.ipv6h->saddr, skb->dev);
 
 	if (rt && lifetime == 0) {
-		ip6_del_rt(rt, NULL);
+		ip6_del_rt(rt, NULL, NULL);
 		rt = NULL;
 	}
 
diff -urN linux-2.5.69-bk4/net/ipv6/route.c linux-2.5.69-bk5/net/ipv6/route.c
--- linux-2.5.69-bk4/net/ipv6/route.c	2003-05-10 04:36:21.000000000 -0700
+++ linux-2.5.69-bk5/net/ipv6/route.c	2003-05-10 04:36:26.000000000 -0700
@@ -324,12 +324,12 @@
    be destroyed.
  */
 
-static int rt6_ins(struct rt6_info *rt, struct nlmsghdr *nlh)
+static int rt6_ins(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr)
 {
 	int err;
 
 	write_lock_bh(&rt6_lock);
-	err = fib6_add(&ip6_routing_table, rt, nlh);
+	err = fib6_add(&ip6_routing_table, rt, nlh, _rtattr);
 	write_unlock_bh(&rt6_lock);
 
 	return err;
@@ -372,7 +372,7 @@
 
 		dst_hold(&rt->u.dst);
 
-		err = rt6_ins(rt, NULL);
+		err = rt6_ins(rt, NULL, NULL);
 		if (err == 0)
 			return rt;
 
@@ -526,7 +526,7 @@
 
 	if (rt) {
 		if (rt->rt6i_flags & RTF_CACHE)
-			ip6_del_rt(rt, NULL);
+			ip6_del_rt(rt, NULL, NULL);
 		else
 			dst_release(dst);
 	}
@@ -629,14 +629,17 @@
  *
  */
 
-int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh)
+int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh, void *_rtattr)
 {
 	int err;
 	struct rtmsg *r;
+	struct rtattr **rta;
 	struct rt6_info *rt;
 	struct net_device *dev = NULL;
 	int addr_type;
 
+	rta = (struct rtattr **) _rtattr;
+
 	if (rtmsg->rtmsg_dst_len > 128 || rtmsg->rtmsg_src_len > 128)
 		return -EINVAL;
 #ifndef CONFIG_IPV6_SUBTREES
@@ -768,13 +771,38 @@
 
 	if (ipv6_addr_is_multicast(&rt->rt6i_dst.addr))
 		rt->rt6i_hoplimit = IPV6_DEFAULT_MCASTHOPS;
+	else if (rta && rta[RTA_HOPLIMIT-1])
+		memcpy(&rt->rt6i_hoplimit, RTA_DATA(rta[RTA_HOPLIMIT-1]), 1);
 	else
 		rt->rt6i_hoplimit = ipv6_get_hoplimit(dev);
+
 	rt->rt6i_flags = rtmsg->rtmsg_flags;
 
 install_route:
-	rt->u.dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(dev);
-	rt->u.dst.metrics[RTAX_ADVMSS-1] = max_t(unsigned int, dst_pmtu(&rt->u.dst) - 60, ip6_rt_min_advmss);
+	if (rta && rta[RTA_METRICS-1]) {
+		int attrlen = RTA_PAYLOAD(rta[RTA_METRICS-1]);
+		struct rtattr *attr = RTA_DATA(rta[RTA_METRICS-1]);
+
+		while (RTA_OK(attr, attrlen)) {
+			unsigned flavor = attr->rta_type;
+			if (flavor) {
+				if (flavor > RTAX_MAX) {
+					err = -EINVAL;
+					goto out;
+				}
+				rt->u.dst.metrics[flavor-1] =
+					*(u32 *)RTA_DATA(attr);
+			}
+			attr = RTA_NEXT(attr, attrlen);
+		}
+	}
+	if (!rt->u.dst.metrics[RTAX_MTU-1])
+		rt->u.dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(dev);
+	if (!rt->u.dst.metrics[RTAX_ADVMSS-1])
+		rt->u.dst.metrics[RTAX_ADVMSS-1] =
+			max_t(unsigned int, dst_pmtu(&rt->u.dst) - 60,
+			      ip6_rt_min_advmss);
+
 	/* Maximal non-jumbo IPv6 payload is 65535 and corresponding
 	   MSS is 65535 - tcp_header_size. 65535 is also valid and
 	   means: "any MSS, rely only on pmtu discovery"
@@ -782,7 +810,7 @@
 	if (dst_metric(&rt->u.dst, RTAX_ADVMSS) > 65535-20)
 		rt->u.dst.metrics[RTAX_ADVMSS-1] = 65535;
 	rt->u.dst.dev = dev;
-	return rt6_ins(rt, nlh);
+	return rt6_ins(rt, nlh, _rtattr);
 
 out:
 	if (dev)
@@ -791,7 +819,7 @@
 	return err;
 }
 
-int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh)
+int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr)
 {
 	int err;
 
@@ -803,13 +831,13 @@
 
 	dst_release(&rt->u.dst);
 
-	err = fib6_del(rt, nlh);
+	err = fib6_del(rt, nlh, _rtattr);
 	write_unlock_bh(&rt6_lock);
 
 	return err;
 }
 
-static int ip6_route_del(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh)
+static int ip6_route_del(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh, void *_rtattr)
 {
 	struct fib6_node *fn;
 	struct rt6_info *rt;
@@ -836,7 +864,7 @@
 			dst_hold(&rt->u.dst);
 			read_unlock_bh(&rt6_lock);
 
-			return ip6_del_rt(rt, nlh);
+			return ip6_del_rt(rt, nlh, _rtattr);
 		}
 	}
 	read_unlock_bh(&rt6_lock);
@@ -938,11 +966,11 @@
 		nrt->u.dst.metrics[RTAX_ADVMSS-1] = 65535;
 	nrt->rt6i_hoplimit = ipv6_get_hoplimit(neigh->dev);
 
-	if (rt6_ins(nrt, NULL))
+	if (rt6_ins(nrt, NULL, NULL))
 		goto out;
 
 	if (rt->rt6i_flags&RTF_CACHE) {
-		ip6_del_rt(rt, NULL);
+		ip6_del_rt(rt, NULL, NULL);
 		return;
 	}
 
@@ -1028,7 +1056,7 @@
 		dst_set_expires(&nrt->u.dst, ip6_rt_mtu_expires);
 		nrt->rt6i_flags |= RTF_DYNAMIC|RTF_CACHE|RTF_EXPIRES;
 		nrt->u.dst.metrics[RTAX_MTU-1] = pmtu;
-		rt6_ins(nrt, NULL);
+		rt6_ins(nrt, NULL, NULL);
 	}
 
 out:
@@ -1099,7 +1127,7 @@
 
 	rtmsg.rtmsg_ifindex = dev->ifindex;
 
-	ip6_route_add(&rtmsg, NULL);
+	ip6_route_add(&rtmsg, NULL, NULL);
 	return rt6_get_dflt_router(gwaddr, dev);
 }
 
@@ -1125,7 +1153,7 @@
 
 			read_unlock_bh(&rt6_lock);
 
-			ip6_del_rt(rt, NULL);
+			ip6_del_rt(rt, NULL, NULL);
 
 			goto restart;
 		}
@@ -1151,10 +1179,10 @@
 		rtnl_lock();
 		switch (cmd) {
 		case SIOCADDRT:
-			err = ip6_route_add(&rtmsg, NULL);
+			err = ip6_route_add(&rtmsg, NULL, NULL);
 			break;
 		case SIOCDELRT:
-			err = ip6_route_del(&rtmsg, NULL);
+			err = ip6_route_del(&rtmsg, NULL, NULL);
 			break;
 		default:
 			err = -EINVAL;
@@ -1210,7 +1238,7 @@
 
 	ipv6_addr_copy(&rt->rt6i_dst.addr, addr);
 	rt->rt6i_dst.plen = 128;
-	rt6_ins(rt, NULL);
+	rt6_ins(rt, NULL, NULL);
 
 	return 0;
 }
@@ -1227,7 +1255,7 @@
 	rt = rt6_lookup(addr, NULL, loopback_dev.ifindex, 1);
 	if (rt) {
 		if (rt->rt6i_dst.plen == 128)
-			err = ip6_del_rt(rt, NULL);
+			err = ip6_del_rt(rt, NULL, NULL);
 		else
 			dst_release(&rt->u.dst);
 	}
@@ -1357,7 +1385,7 @@
 
 	if (inet6_rtm_to_rtmsg(r, arg, &rtmsg))
 		return -EINVAL;
-	return ip6_route_del(&rtmsg, nlh);
+	return ip6_route_del(&rtmsg, nlh, arg);
 }
 
 int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
@@ -1367,7 +1395,7 @@
 
 	if (inet6_rtm_to_rtmsg(r, arg, &rtmsg))
 		return -EINVAL;
-	return ip6_route_add(&rtmsg, nlh);
+	return ip6_route_add(&rtmsg, nlh, arg);
 }
 
 struct rt6_rtnl_dump_arg
diff -urN linux-2.5.69-bk4/net/ipv6/xfrm6_state.c linux-2.5.69-bk5/net/ipv6/xfrm6_state.c
--- linux-2.5.69-bk4/net/ipv6/xfrm6_state.c	2003-05-04 16:53:13.000000000 -0700
+++ linux-2.5.69-bk5/net/ipv6/xfrm6_state.c	2003-05-10 04:36:26.000000000 -0700
@@ -57,7 +57,7 @@
 		    spi == x->id.spi &&
 		    !ipv6_addr_cmp((struct in6_addr *)daddr, (struct in6_addr *)x->id.daddr.a6) &&
 		    proto == x->id.proto) {
-			atomic_inc(&x->refcnt);
+			xfrm_state_hold(x);
 			return x;
 		}
 	}
@@ -91,7 +91,7 @@
 		    }
 	}
 	if (x0) {
-		atomic_inc(&x0->refcnt);
+		xfrm_state_hold(x0);
 	} else if (create && (x0 = xfrm_state_alloc()) != NULL) {
 		memcpy(x0->sel.daddr.a6, daddr, sizeof(struct in6_addr));
 		memcpy(x0->sel.saddr.a6, saddr, sizeof(struct in6_addr));
@@ -105,9 +105,9 @@
 		x0->props.mode = mode;
 		x0->props.reqid = reqid;
 		x0->lft.hard_add_expires_seconds = XFRM_ACQ_EXPIRES;
-		atomic_inc(&x0->refcnt);
+		xfrm_state_hold(x0);
 		mod_timer(&x0->timer, jiffies + XFRM_ACQ_EXPIRES*HZ);
-		atomic_inc(&x0->refcnt);
+		xfrm_state_hold(x0);
 		list_add_tail(&x0->bydst, xfrm6_state_afinfo.state_bydst+h);
 		wake_up(&km_waitq);
 	}
diff -urN linux-2.5.69-bk4/net/key/af_key.c linux-2.5.69-bk5/net/key/af_key.c
--- linux-2.5.69-bk4/net/key/af_key.c	2003-05-04 16:53:08.000000000 -0700
+++ linux-2.5.69-bk5/net/key/af_key.c	2003-05-10 04:36:26.000000000 -0700
@@ -1090,15 +1090,7 @@
 	return x;
 
 out:
-	if (x->aalg)
-		kfree(x->aalg);
-	if (x->ealg)
-		kfree(x->ealg);
-	if (x->calg)
-		kfree(x->calg);
-	if (x->encap)
-		kfree(x->encap);
-	kfree(x);
+	xfrm_state_put(x);
 	return ERR_PTR(-ENOBUFS);
 }
 
diff -urN linux-2.5.69-bk4/net/netsyms.c linux-2.5.69-bk5/net/netsyms.c
--- linux-2.5.69-bk4/net/netsyms.c	2003-05-04 16:53:13.000000000 -0700
+++ linux-2.5.69-bk5/net/netsyms.c	2003-05-10 04:36:26.000000000 -0700
@@ -228,13 +228,11 @@
 #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
 EXPORT_SYMBOL(dev_change_flags);
 #endif
-EXPORT_SYMBOL(vlan_ioctl_set);
 
 EXPORT_SYMBOL(scm_detach_fds);
 
 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
 EXPORT_SYMBOL(br_handle_frame_hook);
-EXPORT_SYMBOL(brioctl_set);
 #endif
 
 #ifdef CONFIG_NET_DIVERT
@@ -285,11 +283,6 @@
 /* needed for ip_gre -cw */
 EXPORT_SYMBOL(ip_statistics);
 
-#ifdef CONFIG_DLCI_MODULE
-extern int (*dlci_ioctl_hook)(unsigned int, void *);
-EXPORT_SYMBOL(dlci_ioctl_hook);
-#endif
-
 EXPORT_SYMBOL(xfrm_user_policy);
 EXPORT_SYMBOL(km_waitq);
 EXPORT_SYMBOL(km_new_mapping);
diff -urN linux-2.5.69-bk4/net/socket.c linux-2.5.69-bk5/net/socket.c
--- linux-2.5.69-bk4/net/socket.c	2003-05-10 04:36:22.000000000 -0700
+++ linux-2.5.69-bk5/net/socket.c	2003-05-10 04:36:26.000000000 -0700
@@ -731,6 +731,7 @@
 	br_ioctl_hook = hook;
 	up(&br_ioctl_mutex);
 }
+EXPORT_SYMBOL(brioctl_set);
 
 static DECLARE_MUTEX(vlan_ioctl_mutex);
 static int (*vlan_ioctl_hook)(unsigned long arg);
@@ -741,12 +742,18 @@
 	vlan_ioctl_hook = hook;
 	up(&vlan_ioctl_mutex);
 }
+EXPORT_SYMBOL(vlan_ioctl_set);
 
-#ifdef CONFIG_DLCI
-extern int dlci_ioctl(unsigned int, void *);
-#else
-int (*dlci_ioctl_hook)(unsigned int, void *);
-#endif
+static DECLARE_MUTEX(dlci_ioctl_mutex);
+static int (*dlci_ioctl_hook)(unsigned int, void *);
+
+void dlci_ioctl_set(int (*hook)(unsigned int, void *))
+{
+	down(&dlci_ioctl_mutex);
+	dlci_ioctl_hook = hook;
+	up(&dlci_ioctl_mutex);
+}
+EXPORT_SYMBOL(dlci_ioctl_set);
 
 /*
  *	With an ioctl, arg may well be a user mode pointer, but we don't know
@@ -820,24 +827,16 @@
 			break;
 		case SIOCADDDLCI:
 		case SIOCDELDLCI:
-		/* Convert this to always call through a hook */
-#ifdef CONFIG_DLCI
-			lock_kernel();
-			err = dlci_ioctl(cmd, (void *)arg);
-			unlock_kernel();
-			break;
-#else
 			err = -ENOPKG;
 #ifdef CONFIG_KMOD
 			if (!dlci_ioctl_hook)
 				request_module("dlci");
 #endif
 			if (dlci_ioctl_hook) {
-				lock_kernel();
+				down(&dlci_ioctl_mutex);
 				err = dlci_ioctl_hook(cmd, (void *)arg);
-				unlock_kernel();
+				up(&dlci_ioctl_mutex);
 			}
-#endif
 			break;
 		default:
 			err = sock->ops->ioctl(sock, cmd, arg);
diff -urN linux-2.5.69-bk4/net/xfrm/xfrm_policy.c linux-2.5.69-bk5/net/xfrm/xfrm_policy.c
--- linux-2.5.69-bk4/net/xfrm/xfrm_policy.c	2003-05-04 16:53:29.000000000 -0700
+++ linux-2.5.69-bk5/net/xfrm/xfrm_policy.c	2003-05-10 04:36:26.000000000 -0700
@@ -100,7 +100,7 @@
 		    fle->dir == dir) {
 			if (fle->genid == xfrm_policy_genid) {
 				if ((pol = fle->pol) != NULL)
-					atomic_inc(&pol->refcnt);
+					xfrm_pol_hold(pol);
 				local_bh_enable();
 				return pol;
 			}
@@ -118,7 +118,7 @@
 			xfrm_pol_put(fle->pol);
 		fle->pol = pol;
 		if (pol)
-			atomic_inc(&pol->refcnt);
+			xfrm_pol_hold(pol);
 	} else {
 		if (flow_count(cpu) > flow_hwm)
 			flow_cache_shrink(cpu);
@@ -131,7 +131,7 @@
 			fle->dir = dir;
 			fle->pol = pol;
 			if (pol)
-				atomic_inc(&pol->refcnt);
+				xfrm_pol_hold(pol);
 			fle->next = flow_table[cpu*XFRM_FLOWCACHE_HASH_SIZE+hash];
 			flow_table[cpu*XFRM_FLOWCACHE_HASH_SIZE+hash] = fle;
 		}
@@ -274,7 +274,7 @@
 	}
 	if (next != LONG_MAX &&
 	    !mod_timer(&xp->timer, jiffies + make_jiffies(next)))
-		atomic_inc(&xp->refcnt);
+		xfrm_pol_hold(xp);
 
 out:
 	xfrm_pol_put(xp);
@@ -392,7 +392,7 @@
 			break;
 		}
 	}
-	atomic_inc(&policy->refcnt);
+	xfrm_pol_hold(policy);
 	policy->next = pol ? pol->next : NULL;
 	*p = policy;
 	xfrm_policy_genid++;
@@ -401,7 +401,7 @@
 	policy->curlft.use_time = 0;
 	if (policy->lft.hard_add_expires_seconds &&
 	    !mod_timer(&policy->timer, jiffies + HZ))
-		atomic_inc(&policy->refcnt);
+		xfrm_pol_hold(policy);
 	write_unlock_bh(&xfrm_policy_lock);
 
 	if (pol) {
@@ -445,7 +445,7 @@
 		if (delete)
 			xfrm_policy_genid++;
 		else
-			atomic_inc(&pol->refcnt);
+			xfrm_pol_hold(pol);
 	}
 	write_unlock_bh(&xfrm_policy_lock);
 	return pol;
@@ -522,7 +522,7 @@
 
 		match = xfrm_selector_match(sel, fl, family);
 		if (match) {
-			atomic_inc(&pol->refcnt);
+			xfrm_pol_hold(pol);
 			break;
 		}
 	}
@@ -540,7 +540,7 @@
 
 		match = xfrm_selector_match(&pol->selector, fl, sk->family);
 		if (match)
-			atomic_inc(&pol->refcnt);
+			xfrm_pol_hold(pol);
 		else
 			pol = NULL;
 	}
@@ -552,7 +552,7 @@
 {
 	pol->next = xfrm_policy_list[XFRM_POLICY_MAX+dir];
 	xfrm_policy_list[XFRM_POLICY_MAX+dir] = pol;
-	atomic_inc(&pol->refcnt);
+	xfrm_pol_hold(pol);
 }
 
 void xfrm_sk_policy_unlink(struct xfrm_policy *pol, int dir)
diff -urN linux-2.5.69-bk4/net/xfrm/xfrm_state.c linux-2.5.69-bk5/net/xfrm/xfrm_state.c
--- linux-2.5.69-bk4/net/xfrm/xfrm_state.c	2003-05-04 16:53:36.000000000 -0700
+++ linux-2.5.69-bk5/net/xfrm/xfrm_state.c	2003-05-10 04:36:26.000000000 -0700
@@ -144,7 +144,7 @@
 resched:
 	if (next != LONG_MAX &&
 	    !mod_timer(&x->timer, jiffies + make_jiffies(next)))
-		atomic_inc(&x->refcnt);
+		xfrm_state_hold(x);
 	goto out;
 
 expired:
@@ -249,7 +249,7 @@
 restart:
 		list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 			if (proto == IPSEC_PROTO_ANY || x->id.proto == proto) {
-				atomic_inc(&x->refcnt);
+				xfrm_state_hold(x);
 				spin_unlock_bh(&xfrm_state_lock);
 
 				xfrm_state_delete(x);
@@ -329,7 +329,7 @@
 	}
 
 	if (best) {
-		atomic_inc(&best->refcnt);
+		xfrm_state_hold(best);
 		spin_unlock_bh(&xfrm_state_lock);
 		return best;
 	}
@@ -344,14 +344,14 @@
 		if (km_query(x, tmpl, pol) == 0) {
 			x->km.state = XFRM_STATE_ACQ;
 			list_add_tail(&x->bydst, xfrm_state_bydst+h);
-			atomic_inc(&x->refcnt);
+			xfrm_state_hold(x);
 			if (x->id.spi) {
 				h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
 				list_add(&x->byspi, xfrm_state_byspi+h);
-				atomic_inc(&x->refcnt);
+				xfrm_state_hold(x);
 			}
 			x->lft.hard_add_expires_seconds = XFRM_ACQ_EXPIRES;
-			atomic_inc(&x->refcnt);
+			xfrm_state_hold(x);
 			mod_timer(&x->timer, XFRM_ACQ_EXPIRES*HZ);
 		} else {
 			x->km.state = XFRM_STATE_DEAD;
@@ -373,15 +373,15 @@
 
 	spin_lock_bh(&xfrm_state_lock);
 	list_add(&x->bydst, xfrm_state_bydst+h);
-	atomic_inc(&x->refcnt);
+	xfrm_state_hold(x);
 
 	h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
 
 	list_add(&x->byspi, xfrm_state_byspi+h);
-	atomic_inc(&x->refcnt);
+	xfrm_state_hold(x);
 
 	if (!mod_timer(&x->timer, jiffies + HZ))
-		atomic_inc(&x->refcnt);
+		xfrm_state_hold(x);
 
 	spin_unlock_bh(&xfrm_state_lock);
 	wake_up(&km_waitq);
@@ -399,7 +399,7 @@
 	    x->curlft.packets >= x->lft.hard_packet_limit) {
 		km_expired(x);
 		if (!mod_timer(&x->timer, jiffies + XFRM_ACQ_EXPIRES*HZ))
-			atomic_inc(&x->refcnt);
+			xfrm_state_hold(x);
 		return -EINVAL;
 	}
 
@@ -466,7 +466,7 @@
 	for (i = 0; i < XFRM_DST_HSIZE; i++) {
 		list_for_each_entry(x, xfrm_state_bydst+i, bydst) {
 			if (x->km.seq == seq) {
-				atomic_inc(&x->refcnt);
+				xfrm_state_hold(x);
 				spin_unlock_bh(&xfrm_state_lock);
 				return x;
 			}
@@ -521,7 +521,7 @@
 		spin_lock_bh(&xfrm_state_lock);
 		h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, x->props.family);
 		list_add(&x->byspi, xfrm_state_byspi+h);
-		atomic_inc(&x->refcnt);
+		xfrm_state_hold(x);
 		spin_unlock_bh(&xfrm_state_lock);
 		wake_up(&km_waitq);
 	}
