]> pilppa.org Git - linux-2.6-omap-h63xx.git/blobdiff - net/dccp/feat.c
fbdev: fix fb_compat_ioctl() deadlocks
[linux-2.6-omap-h63xx.git] / net / dccp / feat.c
index f94c7c9d1a7f0d81aa443d887e0e4252eed32116..933a0ecf8d463b0649fd69f78335533d86950517 100644 (file)
@@ -1,19 +1,11 @@
 /*
  *  net/dccp/feat.c
  *
- *  Feature negotiation for the DCCP protocol (RFC 4340, section 6)
- *
- *  Copyright (c) 2008 The University of Aberdeen, Scotland, UK
- *  Copyright (c) 2008 Gerrit Renker <gerrit@erg.abdn.ac.uk>
- *  Rewrote from scratch, some bits from earlier code by
- *  Copyright (c) 2005 Andrea Bittau <a.bittau@cs.ucl.ac.uk>
- *
+ *  An implementation of the DCCP protocol
+ *  Andrea Bittau <a.bittau@cs.ucl.ac.uk>
  *
  *  ASSUMPTIONS
  *  -----------
- *  o Feature negotiation is coordinated with connection setup (as in TCP), wild
- *    changes of parameters of an established connection are not supported.
- *  o Changing NN values (Ack Ratio only) is supported in state OPEN/PARTOPEN.
  *  o All currently known SP features have 1-byte quantities. If in the future
  *    extensions of RFCs 4340..42 define features with item lengths larger than
  *    one byte, a feature-specific extension of the code will be required.
  *  as published by the Free Software Foundation; either version
  *  2 of the License, or (at your option) any later version.
  */
+
 #include <linux/module.h>
+
 #include "ccid.h"
 #include "feat.h"
 
-/* feature-specific sysctls - initialised to the defaults from RFC 4340, 6.4 */
-unsigned long  sysctl_dccp_sequence_window __read_mostly = 100;
-int            sysctl_dccp_rx_ccid         __read_mostly = 2,
-               sysctl_dccp_tx_ccid         __read_mostly = 2;
+#define DCCP_FEAT_SP_NOAGREE (-123)
 
-/*
- * Feature activation handlers.
- *
- * These all use an u64 argument, to provide enough room for NN/SP features. At
- * this stage the negotiated values have been checked to be within their range.
- */
-static int dccp_hdlr_ccid(struct sock *sk, u64 ccid, bool rx)
+int dccp_feat_change(struct dccp_minisock *dmsk, u8 type, u8 feature,
+                    u8 *val, u8 len, gfp_t gfp)
 {
-       struct dccp_sock *dp = dccp_sk(sk);
-       struct ccid *new_ccid = ccid_new(ccid, sk, rx, gfp_any());
+       struct dccp_opt_pend *opt;
 
-       if (new_ccid == NULL)
-               return -ENOMEM;
+       dccp_feat_debug(type, feature, *val);
 
-       if (rx) {
-               ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
-               dp->dccps_hc_rx_ccid = new_ccid;
-       } else {
-               ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
-               dp->dccps_hc_tx_ccid = new_ccid;
+       if (len > 3) {
+               DCCP_WARN("invalid length %d\n", len);
+               return -EINVAL;
+       }
+       /* XXX add further sanity checks */
+
+       /* check if that feature is already being negotiated */
+       list_for_each_entry(opt, &dmsk->dccpms_pending, dccpop_node) {
+               /* ok we found a negotiation for this option already */
+               if (opt->dccpop_feat == feature && opt->dccpop_type == type) {
+                       dccp_pr_debug("Replacing old\n");
+                       /* replace */
+                       BUG_ON(opt->dccpop_val == NULL);
+                       kfree(opt->dccpop_val);
+                       opt->dccpop_val  = val;
+                       opt->dccpop_len  = len;
+                       opt->dccpop_conf = 0;
+                       return 0;
+               }
        }
-       return 0;
-}
 
-static int dccp_hdlr_seq_win(struct sock *sk, u64 seq_win, bool rx)
-{
-       struct dccp_sock *dp = dccp_sk(sk);
+       /* negotiation for a new feature */
+       opt = kmalloc(sizeof(*opt), gfp);
+       if (opt == NULL)
+               return -ENOMEM;
 
-       if (rx) {
-               dp->dccps_r_seq_win = seq_win;
-               /* propagate changes to update SWL/SWH */
-               dccp_update_gsr(sk, dp->dccps_gsr);
-       } else {
-               dp->dccps_l_seq_win = seq_win;
-               /* propagate changes to update AWL */
-               dccp_update_gss(sk, dp->dccps_gss);
-       }
-       return 0;
-}
+       opt->dccpop_type = type;
+       opt->dccpop_feat = feature;
+       opt->dccpop_len  = len;
+       opt->dccpop_val  = val;
+       opt->dccpop_conf = 0;
+       opt->dccpop_sc   = NULL;
 
-static int dccp_hdlr_ack_ratio(struct sock *sk, u64 ratio, bool rx)
-{
-#ifndef __CCID2_COPES_GRACEFULLY_WITH_DYNAMIC_ACK_RATIO_UPDATES__
-       /*
-        * FIXME: This is required until several problems in the CCID-2 code are
-        * resolved. The CCID-2 code currently does not cope well; using dynamic
-        * Ack Ratios greater than 1 caused instabilities. These were manifest
-        * in hangups and long RTO timeouts (1...3 seconds). Until this has been
-        * stabilised, it is safer not to activate dynamic Ack Ratio changes.
-        */
-       dccp_pr_debug("Not changing %s Ack Ratio from 1 to %u\n",
-                     rx ? "RX" : "TX", (u16)ratio);
-       ratio = 1;
-#endif
-       if (rx)
-               dccp_sk(sk)->dccps_r_ack_ratio = ratio;
-       else
-               dccp_sk(sk)->dccps_l_ack_ratio = ratio;
+       BUG_ON(opt->dccpop_val == NULL);
+
+       list_add_tail(&opt->dccpop_node, &dmsk->dccpms_pending);
        return 0;
 }
 
-static int dccp_hdlr_ackvec(struct sock *sk, u64 enable, bool rx)
+EXPORT_SYMBOL_GPL(dccp_feat_change);
+
+static int dccp_feat_update_ccid(struct sock *sk, u8 type, u8 new_ccid_nr)
 {
        struct dccp_sock *dp = dccp_sk(sk);
+       struct dccp_minisock *dmsk = dccp_msk(sk);
+       /* figure out if we are changing our CCID or the peer's */
+       const int rx = type == DCCPO_CHANGE_R;
+       const u8 ccid_nr = rx ? dmsk->dccpms_rx_ccid : dmsk->dccpms_tx_ccid;
+       struct ccid *new_ccid;
+
+       /* Check if nothing is being changed. */
+       if (ccid_nr == new_ccid_nr)
+               return 0;
+
+       new_ccid = ccid_new(new_ccid_nr, sk, rx, GFP_ATOMIC);
+       if (new_ccid == NULL)
+               return -ENOMEM;
 
        if (rx) {
-               if (enable && dp->dccps_hc_rx_ackvec == NULL) {
-                       dp->dccps_hc_rx_ackvec = dccp_ackvec_alloc(gfp_any());
-                       if (dp->dccps_hc_rx_ackvec == NULL)
-                               return -ENOMEM;
-               } else if (!enable) {
-                       dccp_ackvec_free(dp->dccps_hc_rx_ackvec);
-                       dp->dccps_hc_rx_ackvec = NULL;
-               }
+               ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
+               dp->dccps_hc_rx_ccid = new_ccid;
+               dmsk->dccpms_rx_ccid = new_ccid_nr;
+       } else {
+               ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+               dp->dccps_hc_tx_ccid = new_ccid;
+               dmsk->dccpms_tx_ccid = new_ccid_nr;
        }
-       return 0;
-}
 
-static int dccp_hdlr_ndp(struct sock *sk, u64 enable, bool rx)
-{
-       if (!rx)
-               dccp_sk(sk)->dccps_send_ndp_count = (enable > 0);
        return 0;
 }
 
-/*
- * Minimum Checksum Coverage is located at the RX side (9.2.1). This means that
- * `rx' holds when the sending peer informs about his partial coverage via a
- * ChangeR() option. In the other case, we are the sender and the receiver
- * announces its coverage via ChangeL() options. The policy here is to honour
- * such communication by enabling the corresponding partial coverage - but only
- * if it has not been set manually before; the warning here means that all
- * packets will be dropped.
- */
-static int dccp_hdlr_min_cscov(struct sock *sk, u64 cscov, bool rx)
+static int dccp_feat_update(struct sock *sk, u8 type, u8 feat, u8 val)
 {
-       struct dccp_sock *dp = dccp_sk(sk);
+       dccp_feat_debug(type, feat, val);
 
-       if (rx)
-               dp->dccps_pcrlen = cscov;
-       else {
-               if (dp->dccps_pcslen == 0)
-                       dp->dccps_pcslen = cscov;
-               else if (cscov > dp->dccps_pcslen)
-                       DCCP_WARN("CsCov %u too small, peer requires >= %u\n",
-                                 dp->dccps_pcslen, (u8)cscov);
+       switch (feat) {
+       case DCCPF_CCID:
+               return dccp_feat_update_ccid(sk, type, val);
+       default:
+               dccp_pr_debug("UNIMPLEMENTED: %s(%d, ...)\n",
+                             dccp_feat_typename(type), feat);
+               break;
        }
        return 0;
 }
 
-static const struct {
-       u8                      feat_num;               /* DCCPF_xxx */
-       enum dccp_feat_type     rxtx;                   /* RX or TX  */
-       enum dccp_feat_type     reconciliation;         /* SP or NN  */
-       u8                      default_value;          /* as in 6.4 */
-       int (*activation_hdlr)(struct sock *sk, u64 val, bool rx);
-/*
- *    Lookup table for location and type of features (from RFC 4340/4342)
- *  +--------------------------+----+-----+----+----+---------+-----------+
- *  | Feature                  | Location | Reconc. | Initial |  Section  |
- *  |                          | RX | TX  | SP | NN |  Value  | Reference |
- *  +--------------------------+----+-----+----+----+---------+-----------+
- *  | DCCPF_CCID               |    |  X  | X  |    |   2     | 10        |
- *  | DCCPF_SHORT_SEQNOS       |    |  X  | X  |    |   0     |  7.6.1    |
- *  | DCCPF_SEQUENCE_WINDOW    |    |  X  |    | X  | 100     |  7.5.2    |
- *  | DCCPF_ECN_INCAPABLE      | X  |     | X  |    |   0     | 12.1      |
- *  | DCCPF_ACK_RATIO          |    |  X  |    | X  |   2     | 11.3      |
- *  | DCCPF_SEND_ACK_VECTOR    | X  |     | X  |    |   0     | 11.5      |
- *  | DCCPF_SEND_NDP_COUNT     |    |  X  | X  |    |   0     |  7.7.2    |
- *  | DCCPF_MIN_CSUM_COVER     | X  |     | X  |    |   0     |  9.2.1    |
- *  | DCCPF_DATA_CHECKSUM      | X  |     | X  |    |   0     |  9.3.1    |
- *  | DCCPF_SEND_LEV_RATE      | X  |     | X  |    |   0     | 4342/8.4  |
- *  +--------------------------+----+-----+----+----+---------+-----------+
- */
-} dccp_feat_table[] = {
-       { DCCPF_CCID,            FEAT_AT_TX, FEAT_SP, 2,   dccp_hdlr_ccid     },
-       { DCCPF_SHORT_SEQNOS,    FEAT_AT_TX, FEAT_SP, 0,   NULL },
-       { DCCPF_SEQUENCE_WINDOW, FEAT_AT_TX, FEAT_NN, 100, dccp_hdlr_seq_win  },
-       { DCCPF_ECN_INCAPABLE,   FEAT_AT_RX, FEAT_SP, 0,   NULL },
-       { DCCPF_ACK_RATIO,       FEAT_AT_TX, FEAT_NN, 2,   dccp_hdlr_ack_ratio},
-       { DCCPF_SEND_ACK_VECTOR, FEAT_AT_RX, FEAT_SP, 0,   dccp_hdlr_ackvec   },
-       { DCCPF_SEND_NDP_COUNT,  FEAT_AT_TX, FEAT_SP, 0,   dccp_hdlr_ndp      },
-       { DCCPF_MIN_CSUM_COVER,  FEAT_AT_RX, FEAT_SP, 0,   dccp_hdlr_min_cscov},
-       { DCCPF_DATA_CHECKSUM,   FEAT_AT_RX, FEAT_SP, 0,   NULL },
-       { DCCPF_SEND_LEV_RATE,   FEAT_AT_RX, FEAT_SP, 0,   NULL },
-};
-#define DCCP_FEAT_SUPPORTED_MAX                ARRAY_SIZE(dccp_feat_table)
-
-/**
- * dccp_feat_index  -  Hash function to map feature number into array position
- * Returns consecutive array index or -1 if the feature is not understood.
- */
-static int dccp_feat_index(u8 feat_num)
+static int dccp_feat_reconcile(struct sock *sk, struct dccp_opt_pend *opt,
+                              u8 *rpref, u8 rlen)
 {
-       /* The first 9 entries are occupied by the types from RFC 4340, 6.4 */
-       if (feat_num > DCCPF_RESERVED && feat_num <= DCCPF_DATA_CHECKSUM)
-               return feat_num - 1;
+       struct dccp_sock *dp = dccp_sk(sk);
+       u8 *spref, slen, *res = NULL;
+       int i, j, rc, agree = 1;
 
+       BUG_ON(rpref == NULL);
+
+       /* check if we are the black sheep */
+       if (dp->dccps_role == DCCP_ROLE_CLIENT) {
+               spref = rpref;
+               slen  = rlen;
+               rpref = opt->dccpop_val;
+               rlen  = opt->dccpop_len;
+       } else {
+               spref = opt->dccpop_val;
+               slen  = opt->dccpop_len;
+       }
        /*
-        * Other features: add cases for new feature types here after adding
-        * them to the above table.
+        * Now we have server preference list in spref and client preference in
+        * rpref
         */
-       switch (feat_num) {
-       case DCCPF_SEND_LEV_RATE:
-                       return DCCP_FEAT_SUPPORTED_MAX - 1;
-       }
-       return -1;
-}
-
-static u8 dccp_feat_type(u8 feat_num)
-{
-       int idx = dccp_feat_index(feat_num);
-
-       if (idx < 0)
-               return FEAT_UNKNOWN;
-       return dccp_feat_table[idx].reconciliation;
-}
+       BUG_ON(spref == NULL);
+       BUG_ON(rpref == NULL);
 
-static int dccp_feat_default_value(u8 feat_num)
-{
-       int idx = dccp_feat_index(feat_num);
+       /* FIXME sanity check vals */
 
-       return idx < 0 ? : dccp_feat_table[idx].default_value;
-}
-
-/*
- *     Debugging and verbose-printing section
- */
-static const char *dccp_feat_fname(const u8 feat)
-{
-       static const char *feature_names[] = {
-               [DCCPF_RESERVED]        = "Reserved",
-               [DCCPF_CCID]            = "CCID",
-               [DCCPF_SHORT_SEQNOS]    = "Allow Short Seqnos",
-               [DCCPF_SEQUENCE_WINDOW] = "Sequence Window",
-               [DCCPF_ECN_INCAPABLE]   = "ECN Incapable",
-               [DCCPF_ACK_RATIO]       = "Ack Ratio",
-               [DCCPF_SEND_ACK_VECTOR] = "Send ACK Vector",
-               [DCCPF_SEND_NDP_COUNT]  = "Send NDP Count",
-               [DCCPF_MIN_CSUM_COVER]  = "Min. Csum Coverage",
-               [DCCPF_DATA_CHECKSUM]   = "Send Data Checksum",
-       };
-       if (feat > DCCPF_DATA_CHECKSUM && feat < DCCPF_MIN_CCID_SPECIFIC)
-               return feature_names[DCCPF_RESERVED];
-
-       if (feat ==  DCCPF_SEND_LEV_RATE)
-               return "Send Loss Event Rate";
-       if (feat >= DCCPF_MIN_CCID_SPECIFIC)
-               return "CCID-specific";
-
-       return feature_names[feat];
-}
-
-static const char *dccp_feat_sname[] = { "DEFAULT", "INITIALISING", "CHANGING",
-                                        "UNSTABLE", "STABLE" };
-
-#ifdef CONFIG_IP_DCCP_DEBUG
-static const char *dccp_feat_oname(const u8 opt)
-{
-       switch (opt) {
-       case DCCPO_CHANGE_L:  return "Change_L";
-       case DCCPO_CONFIRM_L: return "Confirm_L";
-       case DCCPO_CHANGE_R:  return "Change_R";
-       case DCCPO_CONFIRM_R: return "Confirm_R";
+       /* Are values in any order?  XXX Lame "algorithm" here */
+       for (i = 0; i < slen; i++) {
+               for (j = 0; j < rlen; j++) {
+                       if (spref[i] == rpref[j]) {
+                               res = &spref[i];
+                               break;
+                       }
+               }
+               if (res)
+                       break;
        }
-       return NULL;
-}
 
-static void dccp_feat_printval(u8 feat_num, dccp_feat_val const *val)
-{
-       u8 i, type = dccp_feat_type(feat_num);
-
-       if (val == NULL || (type == FEAT_SP && val->sp.vec == NULL))
-               dccp_pr_debug_cat("(NULL)");
-       else if (type == FEAT_SP)
-               for (i = 0; i < val->sp.len; i++)
-                       dccp_pr_debug_cat("%s%u", i ? " " : "", val->sp.vec[i]);
-       else if (type == FEAT_NN)
-               dccp_pr_debug_cat("%llu", (unsigned long long)val->nn);
-       else
-               dccp_pr_debug_cat("unknown type %u", type);
-}
-
-static void dccp_feat_printvals(u8 feat_num, u8 *list, u8 len)
-{
-       u8 type = dccp_feat_type(feat_num);
-       dccp_feat_val fval = { .sp.vec = list, .sp.len = len };
-
-       if (type == FEAT_NN)
-               fval.nn = dccp_decode_value_var(list, len);
-       dccp_feat_printval(feat_num, &fval);
-}
+       /* we didn't agree on anything */
+       if (res == NULL) {
+               /* confirm previous value */
+               switch (opt->dccpop_feat) {
+               case DCCPF_CCID:
+                       /* XXX did i get this right? =P */
+                       if (opt->dccpop_type == DCCPO_CHANGE_L)
+                               res = &dccp_msk(sk)->dccpms_tx_ccid;
+                       else
+                               res = &dccp_msk(sk)->dccpms_rx_ccid;
+                       break;
 
-static void dccp_feat_print_entry(struct dccp_feat_entry const *entry)
-{
-       dccp_debug("   * %s %s = ", entry->is_local ? "local" : "remote",
-                                   dccp_feat_fname(entry->feat_num));
-       dccp_feat_printval(entry->feat_num, &entry->val);
-       dccp_pr_debug_cat(", state=%s %s\n", dccp_feat_sname[entry->state],
-                         entry->needs_confirm ? "(Confirm pending)" : "");
-}
+               default:
+                       DCCP_BUG("Fell through, feat=%d", opt->dccpop_feat);
+                       /* XXX implement res */
+                       return -EFAULT;
+               }
 
-#define dccp_feat_print_opt(opt, feat, val, len, mandatory)    do {          \
-       dccp_pr_debug("%s(%s, ", dccp_feat_oname(opt), dccp_feat_fname(feat));\
-       dccp_feat_printvals(feat, val, len);                                  \
-       dccp_pr_debug_cat(") %s\n", mandatory ? "!" : "");      } while (0)
-
-#define dccp_feat_print_fnlist(fn_list)  {             \
-       const struct dccp_feat_entry *___entry;         \
-                                                       \
-       dccp_pr_debug("List Dump:\n");                  \
-       list_for_each_entry(___entry, fn_list, node)    \
-               dccp_feat_print_entry(___entry);        \
-}
-#else  /* ! CONFIG_IP_DCCP_DEBUG */
-#define dccp_feat_print_opt(opt, feat, val, len, mandatory)
-#define dccp_feat_print_fnlist(fn_list)
-#endif
+               dccp_pr_debug("Don't agree... reconfirming %d\n", *res);
+               agree = 0; /* this is used for mandatory options... */
+       }
 
-static int __dccp_feat_activate(struct sock *sk, const int idx,
-                               const bool is_local, dccp_feat_val const *fval)
-{
-       bool rx;
-       u64 val;
+       /* need to put result and our preference list */
+       rlen = 1 + opt->dccpop_len;
+       rpref = kmalloc(rlen, GFP_ATOMIC);
+       if (rpref == NULL)
+               return -ENOMEM;
 
-       if (idx < 0 || idx >= DCCP_FEAT_SUPPORTED_MAX)
-               return -1;
-       if (dccp_feat_table[idx].activation_hdlr == NULL)
-               return 0;
+       *rpref = *res;
+       memcpy(&rpref[1], opt->dccpop_val, opt->dccpop_len);
 
-       if (fval == NULL) {
-               val = dccp_feat_table[idx].default_value;
-       } else if (dccp_feat_table[idx].reconciliation == FEAT_SP) {
-               if (fval->sp.vec == NULL) {
-                       /*
-                        * This can happen when an empty Confirm is sent
-                        * for an SP (i.e. known) feature. In this case
-                        * we would be using the default anyway.
-                        */
-                       DCCP_CRIT("Feature #%d undefined: using default", idx);
-                       val = dccp_feat_table[idx].default_value;
-               } else {
-                       val = fval->sp.vec[0];
+       /* put it in the "confirm queue" */
+       if (opt->dccpop_sc == NULL) {
+               opt->dccpop_sc = kmalloc(sizeof(*opt->dccpop_sc), GFP_ATOMIC);
+               if (opt->dccpop_sc == NULL) {
+                       kfree(rpref);
+                       return -ENOMEM;
                }
        } else {
-               val = fval->nn;
+               /* recycle the confirm slot */
+               BUG_ON(opt->dccpop_sc->dccpoc_val == NULL);
+               kfree(opt->dccpop_sc->dccpoc_val);
+               dccp_pr_debug("recycling confirm slot\n");
+       }
+       memset(opt->dccpop_sc, 0, sizeof(*opt->dccpop_sc));
+
+       opt->dccpop_sc->dccpoc_val = rpref;
+       opt->dccpop_sc->dccpoc_len = rlen;
+
+       /* update the option on our side [we are about to send the confirm] */
+       rc = dccp_feat_update(sk, opt->dccpop_type, opt->dccpop_feat, *res);
+       if (rc) {
+               kfree(opt->dccpop_sc->dccpoc_val);
+               kfree(opt->dccpop_sc);
+               opt->dccpop_sc = NULL;
+               return rc;
        }
 
-       /* Location is RX if this is a local-RX or remote-TX feature */
-       rx = (is_local == (dccp_feat_table[idx].rxtx == FEAT_AT_RX));
-
-       dccp_debug("   -> activating %s %s, %sval=%llu\n", rx ? "RX" : "TX",
-                  dccp_feat_fname(dccp_feat_table[idx].feat_num),
-                  fval ? "" : "default ",  (unsigned long long)val);
-
-       return dccp_feat_table[idx].activation_hdlr(sk, val, rx);
-}
-
-/**
- * dccp_feat_activate  -  Activate feature value on socket
- * @sk: fully connected DCCP socket (after handshake is complete)
- * @feat_num: feature to activate, one of %dccp_feature_numbers
- * @local: whether local (1) or remote (0) @feat_num is meant
- * @fval: the value (SP or NN) to activate, or NULL to use the default value
- * For general use this function is preferable over __dccp_feat_activate().
- */
-static int dccp_feat_activate(struct sock *sk, u8 feat_num, bool local,
-                             dccp_feat_val const *fval)
-{
-       return __dccp_feat_activate(sk, dccp_feat_index(feat_num), local, fval);
-}
-
-/* Test for "Req'd" feature (RFC 4340, 6.4) */
-static inline int dccp_feat_must_be_understood(u8 feat_num)
-{
-       return  feat_num == DCCPF_CCID || feat_num == DCCPF_SHORT_SEQNOS ||
-               feat_num == DCCPF_SEQUENCE_WINDOW;
-}
+       dccp_pr_debug("Will confirm %d\n", *rpref);
 
-/* copy constructor, fval must not already contain allocated memory */
-static int dccp_feat_clone_sp_val(dccp_feat_val *fval, u8 const *val, u8 len)
-{
-       fval->sp.len = len;
-       if (fval->sp.len > 0) {
-               fval->sp.vec = kmemdup(val, len, gfp_any());
-               if (fval->sp.vec == NULL) {
-                       fval->sp.len = 0;
-                       return -ENOBUFS;
-               }
+       /* say we want to change to X but we just got a confirm X, suppress our
+        * change
+        */
+       if (!opt->dccpop_conf) {
+               if (*opt->dccpop_val == *res)
+                       opt->dccpop_conf = 1;
+               dccp_pr_debug("won't ask for change of same feature\n");
        }
-       return 0;
-}
 
-static void dccp_feat_val_destructor(u8 feat_num, dccp_feat_val *val)
-{
-       if (unlikely(val == NULL))
-               return;
-       if (dccp_feat_type(feat_num) == FEAT_SP)
-               kfree(val->sp.vec);
-       memset(val, 0, sizeof(*val));
+       return agree ? 0 : DCCP_FEAT_SP_NOAGREE; /* used for mandatory opts */
 }
 
-static struct dccp_feat_entry *
-             dccp_feat_clone_entry(struct dccp_feat_entry const *original)
+static int dccp_feat_sp(struct sock *sk, u8 type, u8 feature, u8 *val, u8 len)
 {
-       struct dccp_feat_entry *new;
-       u8 type = dccp_feat_type(original->feat_num);
-
-       if (type == FEAT_UNKNOWN)
-               return NULL;
+       struct dccp_minisock *dmsk = dccp_msk(sk);
+       struct dccp_opt_pend *opt;
+       int rc = 1;
+       u8 t;
 
-       new = kmemdup(original, sizeof(struct dccp_feat_entry), gfp_any());
-       if (new == NULL)
-               return NULL;
+       /*
+        * We received a CHANGE.  We gotta match it against our own preference
+        * list.  If we got a CHANGE_R it means it's a change for us, so we need
+        * to compare our CHANGE_L list.
+        */
+       if (type == DCCPO_CHANGE_L)
+               t = DCCPO_CHANGE_R;
+       else
+               t = DCCPO_CHANGE_L;
 
-       if (type == FEAT_SP && dccp_feat_clone_sp_val(&new->val,
-                                                     original->val.sp.vec,
-                                                     original->val.sp.len)) {
-               kfree(new);
-               return NULL;
-       }
-       return new;
-}
+       /* find our preference list for this feature */
+       list_for_each_entry(opt, &dmsk->dccpms_pending, dccpop_node) {
+               if (opt->dccpop_type != t || opt->dccpop_feat != feature)
+                       continue;
 
-static void dccp_feat_entry_destructor(struct dccp_feat_entry *entry)
-{
-       if (entry != NULL) {
-               dccp_feat_val_destructor(entry->feat_num, &entry->val);
-               kfree(entry);
+               /* find the winner from the two preference lists */
+               rc = dccp_feat_reconcile(sk, opt, val, len);
+               break;
        }
-}
 
-/*
- * List management functions
- *
- * Feature negotiation lists rely on and maintain the following invariants:
- * - each feat_num in the list is known, i.e. we know its type and default value
- * - each feat_num/is_local combination is unique (old entries are overwritten)
- * - SP values are always freshly allocated
- * - list is sorted in increasing order of feature number (faster lookup)
- */
-static struct dccp_feat_entry *dccp_feat_list_lookup(struct list_head *fn_list,
-                                                    u8 feat_num, bool is_local)
-{
-       struct dccp_feat_entry *entry;
+       /* We didn't deal with the change.  This can happen if we have no
+        * preference list for the feature.  In fact, it just shouldn't
+        * happen---if we understand a feature, we should have a preference list
+        * with at least the default value.
+        */
+       BUG_ON(rc == 1);
 
-       list_for_each_entry(entry, fn_list, node)
-               if (entry->feat_num == feat_num && entry->is_local == is_local)
-                       return entry;
-               else if (entry->feat_num > feat_num)
-                       break;
-       return NULL;
+       return rc;
 }
 
-/**
- * dccp_feat_entry_new  -  Central list update routine (called by all others)
- * @head:  list to add to
- * @feat:  feature number
- * @local: whether the local (1) or remote feature with number @feat is meant
- * This is the only constructor and serves to ensure the above invariants.
- */
-static struct dccp_feat_entry *
-             dccp_feat_entry_new(struct list_head *head, u8 feat, bool local)
+static int dccp_feat_nn(struct sock *sk, u8 type, u8 feature, u8 *val, u8 len)
 {
-       struct dccp_feat_entry *entry;
-
-       list_for_each_entry(entry, head, node)
-               if (entry->feat_num == feat && entry->is_local == local) {
-                       dccp_feat_val_destructor(entry->feat_num, &entry->val);
-                       return entry;
-               } else if (entry->feat_num > feat) {
-                       head = &entry->node;
-                       break;
-               }
+       struct dccp_opt_pend *opt;
+       struct dccp_minisock *dmsk = dccp_msk(sk);
+       u8 *copy;
+       int rc;
 
-       entry = kmalloc(sizeof(*entry), gfp_any());
-       if (entry != NULL) {
-               entry->feat_num = feat;
-               entry->is_local = local;
-               list_add_tail(&entry->node, head);
+       /* NN features must be Change L (sec. 6.3.2) */
+       if (type != DCCPO_CHANGE_L) {
+               dccp_pr_debug("received %s for NN feature %d\n",
+                               dccp_feat_typename(type), feature);
+               return -EFAULT;
        }
-       return entry;
-}
 
-/**
- * dccp_feat_push_change  -  Add/overwrite a Change option in the list
- * @fn_list: feature-negotiation list to update
- * @feat: one of %dccp_feature_numbers
- * @local: whether local (1) or remote (0) @feat_num is meant
- * @needs_mandatory: whether to use Mandatory feature negotiation options
- * @fval: pointer to NN/SP value to be inserted (will be copied)
- */
-static int dccp_feat_push_change(struct list_head *fn_list, u8 feat, u8 local,
-                                u8 mandatory, dccp_feat_val *fval)
-{
-       struct dccp_feat_entry *new = dccp_feat_entry_new(fn_list, feat, local);
+       /* XXX sanity check opt val */
 
-       if (new == NULL)
+       /* copy option so we can confirm it */
+       opt = kzalloc(sizeof(*opt), GFP_ATOMIC);
+       if (opt == NULL)
                return -ENOMEM;
 
-       new->feat_num        = feat;
-       new->is_local        = local;
-       new->state           = FEAT_INITIALISING;
-       new->needs_confirm   = 0;
-       new->empty_confirm   = 0;
-       new->val             = *fval;
-       new->needs_mandatory = mandatory;
+       copy = kmemdup(val, len, GFP_ATOMIC);
+       if (copy == NULL) {
+               kfree(opt);
+               return -ENOMEM;
+       }
 
-       return 0;
-}
+       opt->dccpop_type = DCCPO_CONFIRM_R; /* NN can only confirm R */
+       opt->dccpop_feat = feature;
+       opt->dccpop_val  = copy;
+       opt->dccpop_len  = len;
 
-/**
- * dccp_feat_push_confirm  -  Add a Confirm entry to the FN list
- * @fn_list: feature-negotiation list to add to
- * @feat: one of %dccp_feature_numbers
- * @local: whether local (1) or remote (0) @feat_num is being confirmed
- * @fval: pointer to NN/SP value to be inserted or NULL
- * Returns 0 on success, a Reset code for further processing otherwise.
- */
-static int dccp_feat_push_confirm(struct list_head *fn_list, u8 feat, u8 local,
-                                 dccp_feat_val *fval)
-{
-       struct dccp_feat_entry *new = dccp_feat_entry_new(fn_list, feat, local);
+       /* change feature */
+       rc = dccp_feat_update(sk, type, feature, *val);
+       if (rc) {
+               kfree(opt->dccpop_val);
+               kfree(opt);
+               return rc;
+       }
 
-       if (new == NULL)
-               return DCCP_RESET_CODE_TOO_BUSY;
+       dccp_feat_debug(type, feature, *copy);
 
-       new->feat_num        = feat;
-       new->is_local        = local;
-       new->state           = FEAT_STABLE;     /* transition in 6.6.2 */
-       new->needs_confirm   = 1;
-       new->empty_confirm   = (fval == NULL);
-       new->val.nn          = 0;               /* zeroes the whole structure */
-       if (!new->empty_confirm)
-               new->val     = *fval;
-       new->needs_mandatory = 0;
+       list_add_tail(&opt->dccpop_node, &dmsk->dccpms_conf);
 
        return 0;
 }
 
-static int dccp_push_empty_confirm(struct list_head *fn_list, u8 feat, u8 local)
+static void dccp_feat_empty_confirm(struct dccp_minisock *dmsk,
+                                   u8 type, u8 feature)
 {
-       return dccp_feat_push_confirm(fn_list, feat, local, NULL);
-}
+       /* XXX check if other confirms for that are queued and recycle slot */
+       struct dccp_opt_pend *opt = kzalloc(sizeof(*opt), GFP_ATOMIC);
 
-static inline void dccp_feat_list_pop(struct dccp_feat_entry *entry)
-{
-       list_del(&entry->node);
-       dccp_feat_entry_destructor(entry);
-}
-
-void dccp_feat_list_purge(struct list_head *fn_list)
-{
-       struct dccp_feat_entry *entry, *next;
-
-       list_for_each_entry_safe(entry, next, fn_list, node)
-               dccp_feat_entry_destructor(entry);
-       INIT_LIST_HEAD(fn_list);
-}
-EXPORT_SYMBOL_GPL(dccp_feat_list_purge);
-
-/* generate @to as full clone of @from - @to must not contain any nodes */
-int dccp_feat_clone_list(struct list_head const *from, struct list_head *to)
-{
-       struct dccp_feat_entry *entry, *new;
-
-       INIT_LIST_HEAD(to);
-       list_for_each_entry(entry, from, node) {
-               new = dccp_feat_clone_entry(entry);
-               if (new == NULL)
-                       goto cloning_failed;
-               list_add_tail(&new->node, to);
+       if (opt == NULL) {
+               /* XXX what do we do?  Ignoring should be fine.  It's a change
+                * after all =P
+                */
+               return;
        }
-       return 0;
 
-cloning_failed:
-       dccp_feat_list_purge(to);
-       return -ENOMEM;
-}
+       switch (type) {
+       case DCCPO_CHANGE_L:
+               opt->dccpop_type = DCCPO_CONFIRM_R;
+               break;
+       case DCCPO_CHANGE_R:
+               opt->dccpop_type = DCCPO_CONFIRM_L;
+               break;
+       default:
+               DCCP_WARN("invalid type %d\n", type);
+               kfree(opt);
+               return;
+       }
+       opt->dccpop_feat = feature;
+       opt->dccpop_val  = NULL;
+       opt->dccpop_len  = 0;
 
-/**
- * dccp_feat_valid_nn_length  -  Enforce length constraints on NN options
- * Length is between 0 and %DCCP_OPTVAL_MAXLEN. Used for outgoing packets only,
- * incoming options are accepted as long as their values are valid.
- */
-static u8 dccp_feat_valid_nn_length(u8 feat_num)
-{
-       if (feat_num == DCCPF_ACK_RATIO)        /* RFC 4340, 11.3 and 6.6.8 */
-               return 2;
-       if (feat_num == DCCPF_SEQUENCE_WINDOW)  /* RFC 4340, 7.5.2 and 6.5  */
-               return 6;
-       return 0;
-}
+       /* change feature */
+       dccp_pr_debug("Empty %s(%d)\n", dccp_feat_typename(type), feature);
 
-static u8 dccp_feat_is_valid_nn_val(u8 feat_num, u64 val)
-{
-       switch (feat_num) {
-       case DCCPF_ACK_RATIO:
-               return val <= DCCPF_ACK_RATIO_MAX;
-       case DCCPF_SEQUENCE_WINDOW:
-               return val >= DCCPF_SEQ_WMIN && val <= DCCPF_SEQ_WMAX;
-       }
-       return 0;       /* feature unknown - so we can't tell */
+       list_add_tail(&opt->dccpop_node, &dmsk->dccpms_conf);
 }
 
-/* check that SP values are within the ranges defined in RFC 4340 */
-static u8 dccp_feat_is_valid_sp_val(u8 feat_num, u8 val)
+static void dccp_feat_flush_confirm(struct sock *sk)
 {
-       switch (feat_num) {
-       case DCCPF_CCID:
-               return val == DCCPC_CCID2 || val == DCCPC_CCID3;
-       /* Type-check Boolean feature values: */
-       case DCCPF_SHORT_SEQNOS:
-       case DCCPF_ECN_INCAPABLE:
-       case DCCPF_SEND_ACK_VECTOR:
-       case DCCPF_SEND_NDP_COUNT:
-       case DCCPF_DATA_CHECKSUM:
-       case DCCPF_SEND_LEV_RATE:
-               return val < 2;
-       case DCCPF_MIN_CSUM_COVER:
-               return val < 16;
-       }
-       return 0;                       /* feature unknown */
-}
+       struct dccp_minisock *dmsk = dccp_msk(sk);
+       /* Check if there is anything to confirm in the first place */
+       int yes = !list_empty(&dmsk->dccpms_conf);
 
-static u8 dccp_feat_sp_list_ok(u8 feat_num, u8 const *sp_list, u8 sp_len)
-{
-       if (sp_list == NULL || sp_len < 1)
-               return 0;
-       while (sp_len--)
-               if (!dccp_feat_is_valid_sp_val(feat_num, *sp_list++))
-                       return 0;
-       return 1;
-}
+       if (!yes) {
+               struct dccp_opt_pend *opt;
 
-/**
- * dccp_feat_insert_opts  -  Generate FN options from current list state
- * @skb: next sk_buff to be sent to the peer
- * @dp: for client during handshake and general negotiation
- * @dreq: used by the server only (all Changes/Confirms in LISTEN/RESPOND)
- */
-int dccp_feat_insert_opts(struct dccp_sock *dp, struct dccp_request_sock *dreq,
-                         struct sk_buff *skb)
-{
-       struct list_head *fn = dreq ? &dreq->dreq_featneg : &dp->dccps_featneg;
-       struct dccp_feat_entry *pos, *next;
-       u8 opt, type, len, *ptr, nn_in_nbo[DCCP_OPTVAL_MAXLEN];
-       bool rpt;
-
-       /* put entries into @skb in the order they appear in the list */
-       list_for_each_entry_safe_reverse(pos, next, fn, node) {
-               opt  = dccp_feat_genopt(pos);
-               type = dccp_feat_type(pos->feat_num);
-               rpt  = false;
-
-               if (pos->empty_confirm) {
-                       len = 0;
-                       ptr = NULL;
-               } else {
-                       if (type == FEAT_SP) {
-                               len = pos->val.sp.len;
-                               ptr = pos->val.sp.vec;
-                               rpt = pos->needs_confirm;
-                       } else if (type == FEAT_NN) {
-                               len = dccp_feat_valid_nn_length(pos->feat_num);
-                               ptr = nn_in_nbo;
-                               dccp_encode_value_var(pos->val.nn, ptr, len);
-                       } else {
-                               DCCP_BUG("unknown feature %u", pos->feat_num);
-                               return -1;
+               list_for_each_entry(opt, &dmsk->dccpms_pending, dccpop_node) {
+                       if (opt->dccpop_conf) {
+                               yes = 1;
+                               break;
                        }
                }
-               dccp_feat_print_opt(opt, pos->feat_num, ptr, len, 0);
-
-               if (dccp_insert_fn_opt(skb, opt, pos->feat_num, ptr, len, rpt))
-                       return -1;
-               if (pos->needs_mandatory && dccp_insert_option_mandatory(skb))
-                       return -1;
-               /*
-                * Enter CHANGING after transmitting the Change option (6.6.2).
-                */
-               if (pos->state == FEAT_INITIALISING)
-                       pos->state = FEAT_CHANGING;
        }
-       return 0;
-}
-
-/**
- * __feat_register_nn  -  Register new NN value on socket
- * @fn: feature-negotiation list to register with
- * @feat: an NN feature from %dccp_feature_numbers
- * @mandatory: use Mandatory option if 1
- * @nn_val: value to register (restricted to 4 bytes)
- * Note that NN features are local by definition (RFC 4340, 6.3.2).
- */
-static int __feat_register_nn(struct list_head *fn, u8 feat,
-                             u8 mandatory, u64 nn_val)
-{
-       dccp_feat_val fval = { .nn = nn_val };
-
-       if (dccp_feat_type(feat) != FEAT_NN ||
-           !dccp_feat_is_valid_nn_val(feat, nn_val))
-               return -EINVAL;
-
-       /* Don't bother with default values, they will be activated anyway. */
-       if (nn_val - (u64)dccp_feat_default_value(feat) == 0)
-               return 0;
-
-       return dccp_feat_push_change(fn, feat, 1, mandatory, &fval);
-}
-
-/**
- * __feat_register_sp  -  Register new SP value/list on socket
- * @fn: feature-negotiation list to register with
- * @feat: an SP feature from %dccp_feature_numbers
- * @is_local: whether the local (1) or the remote (0) @feat is meant
- * @mandatory: use Mandatory option if 1
- * @sp_val: SP value followed by optional preference list
- * @sp_len: length of @sp_val in bytes
- */
-static int __feat_register_sp(struct list_head *fn, u8 feat, u8 is_local,
-                             u8 mandatory, u8 const *sp_val, u8 sp_len)
-{
-       dccp_feat_val fval;
 
-       if (dccp_feat_type(feat) != FEAT_SP ||
-           !dccp_feat_sp_list_ok(feat, sp_val, sp_len))
-               return -EINVAL;
-
-       /* Avoid negotiating alien CCIDs by only advertising supported ones */
-       if (feat == DCCPF_CCID && !ccid_support_check(sp_val, sp_len))
-               return -EOPNOTSUPP;
-
-       if (dccp_feat_clone_sp_val(&fval, sp_val, sp_len))
-               return -ENOMEM;
+       if (!yes)
+               return;
 
-       return dccp_feat_push_change(fn, feat, is_local, mandatory, &fval);
+       /* OK there is something to confirm... */
+       /* XXX check if packet is in flight?  Send delayed ack?? */
+       if (sk->sk_state == DCCP_OPEN)
+               dccp_send_ack(sk);
 }
 
-/**
- * dccp_feat_register_sp  -  Register requests to change SP feature values
- * @sk: client or listening socket
- * @feat: one of %dccp_feature_numbers
- * @is_local: whether the local (1) or remote (0) @feat is meant
- * @list: array of preferred values, in descending order of preference
- * @len: length of @list in bytes
- */
-int dccp_feat_register_sp(struct sock *sk, u8 feat, u8 is_local,
-                         u8 const *list, u8 len)
-{       /* any changes must be registered before establishing the connection */
-       if (sk->sk_state != DCCP_CLOSED)
-               return -EISCONN;
-       if (dccp_feat_type(feat) != FEAT_SP)
-               return -EINVAL;
-       return __feat_register_sp(&dccp_sk(sk)->dccps_featneg, feat, is_local,
-                                 0, list, len);
-}
-
-/* Analogous to dccp_feat_register_sp(), but for non-negotiable values */
-int dccp_feat_register_nn(struct sock *sk, u8 feat, u64 val)
+int dccp_feat_change_recv(struct sock *sk, u8 type, u8 feature, u8 *val, u8 len)
 {
-       /* any changes must be registered before establishing the connection */
-       if (sk->sk_state != DCCP_CLOSED)
-               return -EISCONN;
-       if (dccp_feat_type(feat) != FEAT_NN)
-               return -EINVAL;
-       return __feat_register_nn(&dccp_sk(sk)->dccps_featneg, feat, 0, val);
-}
+       int rc;
 
-/**
- * dccp_feat_signal_nn_change  -  Update NN values for an established connection
- * @sk: DCCP socket of an established connection
- * @feat: NN feature number from %dccp_feature_numbers
- * @nn_val: the new value to use
- * This function is used to communicate NN updates out-of-band. The difference
- * to feature negotiation during connection setup is that values are activated
- * immediately after validation, i.e. we don't wait for the Confirm: either the
- * value is accepted by the peer (and then the waiting is futile), or it is not
- * (Reset or empty Confirm). We don't accept empty Confirms - transmitted values
- * are validated, and the peer "MUST accept any valid value" (RFC 4340, 6.3.2).
- */
-int dccp_feat_signal_nn_change(struct sock *sk, u8 feat, u64 nn_val)
-{
-       struct list_head *fn = &dccp_sk(sk)->dccps_featneg;
-       dccp_feat_val fval = { .nn = nn_val };
-       struct dccp_feat_entry *entry;
+       dccp_feat_debug(type, feature, *val);
 
-       if (sk->sk_state != DCCP_OPEN && sk->sk_state != DCCP_PARTOPEN)
-               return 0;
+       /* figure out if it's SP or NN feature */
+       switch (feature) {
+       /* deal with SP features */
+       case DCCPF_CCID:
+               rc = dccp_feat_sp(sk, type, feature, val, len);
+               break;
 
-       if (dccp_feat_type(feat) != FEAT_NN ||
-           !dccp_feat_is_valid_nn_val(feat, nn_val))
-               return -EINVAL;
+       /* deal with NN features */
+       case DCCPF_ACK_RATIO:
+               rc = dccp_feat_nn(sk, type, feature, val, len);
+               break;
 
-       entry = dccp_feat_list_lookup(fn, feat, 1);
-       if (entry != NULL) {
-               dccp_pr_debug("Ignoring %llu, entry %llu exists in state %s\n",
-                             (unsigned long long)nn_val,
-                             (unsigned long long)entry->val.nn,
-                             dccp_feat_sname[entry->state]);
-               return 0;
+       /* XXX implement other features */
+       default:
+               dccp_pr_debug("UNIMPLEMENTED: not handling %s(%d, ...)\n",
+                             dccp_feat_typename(type), feature);
+               rc = -EFAULT;
+               break;
        }
 
-       if (dccp_feat_activate(sk, feat, 1, &fval))
-               return -EADV;
-
-       inet_csk_schedule_ack(sk);
-       return dccp_feat_push_change(fn, feat, 1, 0, &fval);
-}
-EXPORT_SYMBOL_GPL(dccp_feat_signal_nn_change);
-
-/*
- *     Tracking features whose value depend on the choice of CCID
- *
- * This is designed with an extension in mind so that a list walk could be done
- * before activating any features. However, the existing framework was found to
- * work satisfactorily up until now, the automatic verification is left open.
- * When adding new CCIDs, add a corresponding dependency table here.
- */
-static const struct ccid_dependency *dccp_feat_ccid_deps(u8 ccid, bool is_local)
-{
-       static const struct ccid_dependency ccid2_dependencies[2][2] = {
-               /*
-                * CCID2 mandates Ack Vectors (RFC 4341, 4.): as CCID is a TX
-                * feature and Send Ack Vector is an RX feature, `is_local'
-                * needs to be reversed.
+       /* check if there were problems changing features */
+       if (rc) {
+               /* If we don't agree on SP, we sent a confirm for old value.
+                * However we propagate rc to caller in case option was
+                * mandatory
                 */
-               {       /* Dependencies of the receiver-side (remote) CCID2 */
-                       {
-                               .dependent_feat = DCCPF_SEND_ACK_VECTOR,
-                               .is_local       = true,
-                               .is_mandatory   = true,
-                               .val            = 1
-                       },
-                       { 0, 0, 0, 0 }
-               },
-               {       /* Dependencies of the sender-side (local) CCID2 */
-                       {
-                               .dependent_feat = DCCPF_SEND_ACK_VECTOR,
-                               .is_local       = false,
-                               .is_mandatory   = true,
-                               .val            = 1
-                       },
-                       { 0, 0, 0, 0 }
-               }
-       };
-       static const struct ccid_dependency ccid3_dependencies[2][5] = {
-               {       /*
-                        * Dependencies of the receiver-side CCID3
-                        */
-                       {       /* locally disable Ack Vectors */
-                               .dependent_feat = DCCPF_SEND_ACK_VECTOR,
-                               .is_local       = true,
-                               .is_mandatory   = false,
-                               .val            = 0
-                       },
-                       {       /* see below why Send Loss Event Rate is on */
-                               .dependent_feat = DCCPF_SEND_LEV_RATE,
-                               .is_local       = true,
-                               .is_mandatory   = true,
-                               .val            = 1
-                       },
-                       {       /* NDP Count is needed as per RFC 4342, 6.1.1 */
-                               .dependent_feat = DCCPF_SEND_NDP_COUNT,
-                               .is_local       = false,
-                               .is_mandatory   = true,
-                               .val            = 1
-                       },
-                       { 0, 0, 0, 0 },
-               },
-               {       /*
-                        * CCID3 at the TX side: we request that the HC-receiver
-                        * will not send Ack Vectors (they will be ignored, so
-                        * Mandatory is not set); we enable Send Loss Event Rate
-                        * (Mandatory since the implementation does not support
-                        * the Loss Intervals option of RFC 4342, 8.6).
-                        * The last two options are for peer's information only.
-                       */
-                       {
-                               .dependent_feat = DCCPF_SEND_ACK_VECTOR,
-                               .is_local       = false,
-                               .is_mandatory   = false,
-                               .val            = 0
-                       },
-                       {
-                               .dependent_feat = DCCPF_SEND_LEV_RATE,
-                               .is_local       = false,
-                               .is_mandatory   = true,
-                               .val            = 1
-                       },
-                       {       /* this CCID does not support Ack Ratio */
-                               .dependent_feat = DCCPF_ACK_RATIO,
-                               .is_local       = true,
-                               .is_mandatory   = false,
-                               .val            = 0
-                       },
-                       {       /* tell receiver we are sending NDP counts */
-                               .dependent_feat = DCCPF_SEND_NDP_COUNT,
-                               .is_local       = true,
-                               .is_mandatory   = false,
-                               .val            = 1
-                       },
-                       { 0, 0, 0, 0 }
-               }
-       };
-       switch (ccid) {
-       case DCCPC_CCID2:
-               return ccid2_dependencies[is_local];
-       case DCCPC_CCID3:
-               return ccid3_dependencies[is_local];
-       default:
-               return NULL;
+               if (rc != DCCP_FEAT_SP_NOAGREE)
+                       dccp_feat_empty_confirm(dccp_msk(sk), type, feature);
        }
-}
 
-/**
- * dccp_feat_propagate_ccid - Resolve dependencies of features on choice of CCID
- * @fn: feature-negotiation list to update
- * @id: CCID number to track
- * @is_local: whether TX CCID (1) or RX CCID (0) is meant
- * This function needs to be called after registering all other features.
- */
-static int dccp_feat_propagate_ccid(struct list_head *fn, u8 id, bool is_local)
-{
-       const struct ccid_dependency *table = dccp_feat_ccid_deps(id, is_local);
-       int i, rc = (table == NULL);
-
-       for (i = 0; rc == 0 && table[i].dependent_feat != DCCPF_RESERVED; i++)
-               if (dccp_feat_type(table[i].dependent_feat) == FEAT_SP)
-                       rc = __feat_register_sp(fn, table[i].dependent_feat,
-                                                   table[i].is_local,
-                                                   table[i].is_mandatory,
-                                                   &table[i].val, 1);
-               else
-                       rc = __feat_register_nn(fn, table[i].dependent_feat,
-                                                   table[i].is_mandatory,
-                                                   table[i].val);
-       return rc;
-}
-
-/**
- * dccp_feat_finalise_settings  -  Finalise settings before starting negotiation
- * @dp: client or listening socket (settings will be inherited)
- * This is called after all registrations (socket initialisation, sysctls, and
- * sockopt calls), and before sending the first packet containing Change options
- * (ie. client-Request or server-Response), to ensure internal consistency.
- */
-int dccp_feat_finalise_settings(struct dccp_sock *dp)
-{
-       struct list_head *fn = &dp->dccps_featneg;
-       struct dccp_feat_entry *entry;
-       int i = 2, ccids[2] = { -1, -1 };
+       /* generate the confirm [if required] */
+       dccp_feat_flush_confirm(sk);
 
-       /*
-        * Propagating CCIDs:
-        * 1) not useful to propagate CCID settings if this host advertises more
-        *    than one CCID: the choice of CCID  may still change - if this is
-        *    the client, or if this is the server and the client sends
-        *    singleton CCID values.
-        * 2) since is that propagate_ccid changes the list, we defer changing
-        *    the sorted list until after the traversal.
-        */
-       list_for_each_entry(entry, fn, node)
-               if (entry->feat_num == DCCPF_CCID && entry->val.sp.len == 1)
-                       ccids[entry->is_local] = entry->val.sp.vec[0];
-       while (i--)
-               if (ccids[i] > 0 && dccp_feat_propagate_ccid(fn, ccids[i], i))
-                       return -1;
-       dccp_feat_print_fnlist(fn);
-       return 0;
+       return rc;
 }
 
-/**
- * dccp_feat_server_ccid_dependencies  -  Resolve CCID-dependent features
- * It is the server which resolves the dependencies once the CCID has been
- * fully negotiated. If no CCID has been negotiated, it uses the default CCID.
- */
-int dccp_feat_server_ccid_dependencies(struct dccp_request_sock *dreq)
-{
-       struct list_head *fn = &dreq->dreq_featneg;
-       struct dccp_feat_entry *entry;
-       u8 is_local, ccid;
-
-       for (is_local = 0; is_local <= 1; is_local++) {
-               entry = dccp_feat_list_lookup(fn, DCCPF_CCID, is_local);
-
-               if (entry != NULL && !entry->empty_confirm)
-                       ccid = entry->val.sp.vec[0];
-               else
-                       ccid = dccp_feat_default_value(DCCPF_CCID);
-
-               if (dccp_feat_propagate_ccid(fn, ccid, is_local))
-                       return -1;
-       }
-       return 0;
-}
+EXPORT_SYMBOL_GPL(dccp_feat_change_recv);
 
-/* Select the first entry in @servlist that also occurs in @clilist (6.3.1) */
-static int dccp_feat_preflist_match(u8 *servlist, u8 slen, u8 *clilist, u8 clen)
+int dccp_feat_confirm_recv(struct sock *sk, u8 type, u8 feature,
+                          u8 *val, u8 len)
 {
-       u8 c, s;
+       u8 t;
+       struct dccp_opt_pend *opt;
+       struct dccp_minisock *dmsk = dccp_msk(sk);
+       int found = 0;
+       int all_confirmed = 1;
 
-       for (s = 0; s < slen; s++)
-               for (c = 0; c < clen; c++)
-                       if (servlist[s] == clilist[c])
-                               return servlist[s];
-       return -1;
-}
+       dccp_feat_debug(type, feature, *val);
 
-/**
- * dccp_feat_prefer  -  Move preferred entry to the start of array
- * Reorder the @array_len elements in @array so that @preferred_value comes
- * first. Returns >0 to indicate that @preferred_value does occur in @array.
- */
-static u8 dccp_feat_prefer(u8 preferred_value, u8 *array, u8 array_len)
-{
-       u8 i, does_occur = 0;
+       /* locate our change request */
+       switch (type) {
+       case DCCPO_CONFIRM_L: t = DCCPO_CHANGE_R; break;
+       case DCCPO_CONFIRM_R: t = DCCPO_CHANGE_L; break;
+       default:              DCCP_WARN("invalid type %d\n", type);
+                             return 1;
 
-       if (array != NULL) {
-               for (i = 0; i < array_len; i++)
-                       if (array[i] == preferred_value) {
-                               array[i] = array[0];
-                               does_occur++;
-                       }
-               if (does_occur)
-                       array[0] = preferred_value;
        }
-       return does_occur;
-}
+       /* XXX sanity check feature value */
 
-/**
- * dccp_feat_reconcile  -  Reconcile SP preference lists
- *  @fval: SP list to reconcile into
- *  @arr: received SP preference list
- *  @len: length of @arr in bytes
- *  @is_server: whether this side is the server (and @fv is the server's list)
- *  @reorder: whether to reorder the list in @fv after reconciling with @arr
- * When successful, > 0 is returned and the reconciled list is in @fval.
- * A value of 0 means that negotiation failed (no shared entry).
- */
-static int dccp_feat_reconcile(dccp_feat_val *fv, u8 *arr, u8 len,
-                              bool is_server, bool reorder)
-{
-       int rc;
+       list_for_each_entry(opt, &dmsk->dccpms_pending, dccpop_node) {
+               if (!opt->dccpop_conf && opt->dccpop_type == t &&
+                   opt->dccpop_feat == feature) {
+                       found = 1;
+                       dccp_pr_debug("feature %d found\n", opt->dccpop_feat);
 
-       if (!fv->sp.vec || !arr) {
-               DCCP_CRIT("NULL feature value or array");
-               return 0;
-       }
+                       /* XXX do sanity check */
 
-       if (is_server)
-               rc = dccp_feat_preflist_match(fv->sp.vec, fv->sp.len, arr, len);
-       else
-               rc = dccp_feat_preflist_match(arr, len, fv->sp.vec, fv->sp.len);
-
-       if (!reorder)
-               return rc;
-       if (rc < 0)
-               return 0;
+                       opt->dccpop_conf = 1;
 
-       /*
-        * Reorder list: used for activating features and in dccp_insert_fn_opt.
-        */
-       return dccp_feat_prefer(rc, fv->sp.vec, fv->sp.len);
-}
+                       /* We got a confirmation---change the option */
+                       dccp_feat_update(sk, opt->dccpop_type,
+                                        opt->dccpop_feat, *val);
 
-/**
- * dccp_feat_change_recv  -  Process incoming ChangeL/R options
- * @fn: feature-negotiation list to update
- * @is_mandatory: whether the Change was preceded by a Mandatory option
- * @opt: %DCCPO_CHANGE_L or %DCCPO_CHANGE_R
- * @feat: one of %dccp_feature_numbers
- * @val: NN value or SP value/preference list
- * @len: length of @val in bytes
- * @server: whether this node is the server (1) or the client (0)
- */
-static u8 dccp_feat_change_recv(struct list_head *fn, u8 is_mandatory, u8 opt,
-                               u8 feat, u8 *val, u8 len, const bool server)
-{
-       u8 defval, type = dccp_feat_type(feat);
-       const bool local = (opt == DCCPO_CHANGE_R);
-       struct dccp_feat_entry *entry;
-       dccp_feat_val fval;
-
-       if (len == 0 || type == FEAT_UNKNOWN)           /* 6.1 and 6.6.8 */
-               goto unknown_feature_or_value;
-
-       dccp_feat_print_opt(opt, feat, val, len, is_mandatory);
-
-       /*
-        *      Negotiation of NN features: Change R is invalid, so there is no
-        *      simultaneous negotiation; hence we do not look up in the list.
-        */
-       if (type == FEAT_NN) {
-               if (local || len > sizeof(fval.nn))
-                       goto unknown_feature_or_value;
-
-               /* 6.3.2: "The feature remote MUST accept any valid value..." */
-               fval.nn = dccp_decode_value_var(val, len);
-               if (!dccp_feat_is_valid_nn_val(feat, fval.nn))
-                       goto unknown_feature_or_value;
+                       /* XXX check the return value of dccp_feat_update */
+                       break;
+               }
 
-               return dccp_feat_push_confirm(fn, feat, local, &fval);
+               if (!opt->dccpop_conf)
+                       all_confirmed = 0;
        }
 
-       /*
-        *      Unidirectional/simultaneous negotiation of SP features (6.3.1)
+       /* fix re-transmit timer */
+       /* XXX gotta make sure that no option negotiation occurs during
+        * connection shutdown.  Consider that the CLOSEREQ is sent and timer is
+        * on.  if all options are confirmed it might kill timer which should
+        * remain alive until close is received.
         */
-       entry = dccp_feat_list_lookup(fn, feat, local);
-       if (entry == NULL) {
-               /*
-                * No particular preferences have been registered. We deal with
-                * this situation by assuming that all valid values are equally
-                * acceptable, and apply the following checks:
-                * - if the peer's list is a singleton, we accept a valid value;
-                * - if we are the server, we first try to see if the peer (the
-                *   client) advertises the default value. If yes, we use it,
-                *   otherwise we accept the preferred value;
-                * - else if we are the client, we use the first list element.
-                */
-               if (dccp_feat_clone_sp_val(&fval, val, 1))
-                       return DCCP_RESET_CODE_TOO_BUSY;
-
-               if (len > 1 && server) {
-                       defval = dccp_feat_default_value(feat);
-                       if (dccp_feat_preflist_match(&defval, 1, val, len) > -1)
-                               fval.sp.vec[0] = defval;
-               } else if (!dccp_feat_is_valid_sp_val(feat, fval.sp.vec[0])) {
-                       kfree(fval.sp.vec);
-                       goto unknown_feature_or_value;
-               }
-
-               /* Treat unsupported CCIDs like invalid values */
-               if (feat == DCCPF_CCID && !ccid_support_check(fval.sp.vec, 1)) {
-                       kfree(fval.sp.vec);
-                       goto not_valid_or_not_known;
-               }
-
-               return dccp_feat_push_confirm(fn, feat, local, &fval);
-
-       } else if (entry->state == FEAT_UNSTABLE) {     /* 6.6.2 */
-               return 0;
+       if (all_confirmed) {
+               dccp_pr_debug("clear feat negotiation timer %p\n", sk);
+               inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
        }
 
-       if (dccp_feat_reconcile(&entry->val, val, len, server, true)) {
-               entry->empty_confirm = 0;
-       } else if (is_mandatory) {
-               return DCCP_RESET_CODE_MANDATORY_ERROR;
-       } else if (entry->state == FEAT_INITIALISING) {
-               /*
-                * Failed simultaneous negotiation (server only): try to `save'
-                * the connection by checking whether entry contains the default
-                * value for @feat. If yes, send an empty Confirm to signal that
-                * the received Change was not understood - which implies using
-                * the default value.
-                * If this also fails, we use Reset as the last resort.
-                */
-               WARN_ON(!server);
-               defval = dccp_feat_default_value(feat);
-               if (!dccp_feat_reconcile(&entry->val, &defval, 1, server, true))
-                       return DCCP_RESET_CODE_OPTION_ERROR;
-               entry->empty_confirm = 1;
-       }
-       entry->needs_confirm   = 1;
-       entry->needs_mandatory = 0;
-       entry->state           = FEAT_STABLE;
+       if (!found)
+               dccp_pr_debug("%s(%d, ...) never requested\n",
+                             dccp_feat_typename(type), feature);
        return 0;
-
-unknown_feature_or_value:
-       if (!is_mandatory)
-               return dccp_push_empty_confirm(fn, feat, local);
-
-not_valid_or_not_known:
-       return is_mandatory ? DCCP_RESET_CODE_MANDATORY_ERROR
-                           : DCCP_RESET_CODE_OPTION_ERROR;
 }
 
-/**
- * dccp_feat_confirm_recv  -  Process received Confirm options
- * @fn: feature-negotiation list to update
- * @is_mandatory: whether @opt was preceded by a Mandatory option
- * @opt: %DCCPO_CONFIRM_L or %DCCPO_CONFIRM_R
- * @feat: one of %dccp_feature_numbers
- * @val: NN value or SP value/preference list
- * @len: length of @val in bytes
- * @server: whether this node is server (1) or client (0)
- */
-static u8 dccp_feat_confirm_recv(struct list_head *fn, u8 is_mandatory, u8 opt,
-                                u8 feat, u8 *val, u8 len, const bool server)
-{
-       u8 *plist, plen, type = dccp_feat_type(feat);
-       const bool local = (opt == DCCPO_CONFIRM_R);
-       struct dccp_feat_entry *entry = dccp_feat_list_lookup(fn, feat, local);
-
-       dccp_feat_print_opt(opt, feat, val, len, is_mandatory);
-
-       if (entry == NULL) {    /* nothing queued: ignore or handle error */
-               if (is_mandatory && type == FEAT_UNKNOWN)
-                       return DCCP_RESET_CODE_MANDATORY_ERROR;
-
-               if (!local && type == FEAT_NN)          /* 6.3.2 */
-                       goto confirmation_failed;
-               return 0;
-       }
-
-       if (entry->state != FEAT_CHANGING)              /* 6.6.2 */
-               return 0;
-
-       if (len == 0) {
-               if (dccp_feat_must_be_understood(feat)) /* 6.6.7 */
-                       goto confirmation_failed;
-               /*
-                * Empty Confirm during connection setup: this means reverting
-                * to the `old' value, which in this case is the default. Since
-                * we handle default values automatically when no other values
-                * have been set, we revert to the old value by removing this
-                * entry from the list.
-                */
-               dccp_feat_list_pop(entry);
-               return 0;
-       }
+EXPORT_SYMBOL_GPL(dccp_feat_confirm_recv);
 
-       if (type == FEAT_NN) {
-               if (len > sizeof(entry->val.nn))
-                       goto confirmation_failed;
+void dccp_feat_clean(struct dccp_minisock *dmsk)
+{
+       struct dccp_opt_pend *opt, *next;
 
-               if (entry->val.nn == dccp_decode_value_var(val, len))
-                       goto confirmation_succeeded;
+       list_for_each_entry_safe(opt, next, &dmsk->dccpms_pending,
+                                dccpop_node) {
+               BUG_ON(opt->dccpop_val == NULL);
+               kfree(opt->dccpop_val);
 
-               DCCP_WARN("Bogus Confirm for non-existing value\n");
-               goto confirmation_failed;
-       }
+               if (opt->dccpop_sc != NULL) {
+                       BUG_ON(opt->dccpop_sc->dccpoc_val == NULL);
+                       kfree(opt->dccpop_sc->dccpoc_val);
+                       kfree(opt->dccpop_sc);
+               }
 
-       /*
-        * Parsing SP Confirms: the first element of @val is the preferred
-        * SP value which the peer confirms, the remainder depends on @len.
-        * Note that only the confirmed value need to be a valid SP value.
-        */
-       if (!dccp_feat_is_valid_sp_val(feat, *val))
-               goto confirmation_failed;
-
-       if (len == 1) {         /* peer didn't supply a preference list */
-               plist = val;
-               plen  = len;
-       } else {                /* preferred value + preference list */
-               plist = val + 1;
-               plen  = len - 1;
+               kfree(opt);
        }
+       INIT_LIST_HEAD(&dmsk->dccpms_pending);
 
-       /* Check whether the peer got the reconciliation right (6.6.8) */
-       if (dccp_feat_reconcile(&entry->val, plist, plen, server, 0) != *val) {
-               DCCP_WARN("Confirm selected the wrong value %u\n", *val);
-               return DCCP_RESET_CODE_OPTION_ERROR;
+       list_for_each_entry_safe(opt, next, &dmsk->dccpms_conf, dccpop_node) {
+               BUG_ON(opt == NULL);
+               if (opt->dccpop_val != NULL)
+                       kfree(opt->dccpop_val);
+               kfree(opt);
        }
-       entry->val.sp.vec[0] = *val;
-
-confirmation_succeeded:
-       entry->state = FEAT_STABLE;
-       return 0;
-
-confirmation_failed:
-       DCCP_WARN("Confirmation failed\n");
-       return is_mandatory ? DCCP_RESET_CODE_MANDATORY_ERROR
-                           : DCCP_RESET_CODE_OPTION_ERROR;
+       INIT_LIST_HEAD(&dmsk->dccpms_conf);
 }
 
-/**
- * dccp_feat_handle_nn_established  -  Fast-path reception of NN options
- * @sk:                socket of an established DCCP connection
- * @mandatory: whether @opt was preceded by a Mandatory option
- * @opt:       %DCCPO_CHANGE_L | %DCCPO_CONFIRM_R (NN only)
- * @feat:      NN number, one of %dccp_feature_numbers
- * @val:       NN value
- * @len:       length of @val in bytes
- * This function combines the functionality of change_recv/confirm_recv, with
- * the following differences (reset codes are the same):
- *    - cleanup after receiving the Confirm;
- *    - values are directly activated after successful parsing;
- *    - deliberately restricted to NN features.
- * The restriction to NN features is essential since SP features can have non-
- * predictable outcomes (depending on the remote configuration), and are inter-
- * dependent (CCIDs for instance cause further dependencies).
+EXPORT_SYMBOL_GPL(dccp_feat_clean);
+
+/* this is to be called only when a listening sock creates its child.  It is
+ * assumed by the function---the confirm is not duplicated, but rather it is
+ * "passed on".
  */
-static u8 dccp_feat_handle_nn_established(struct sock *sk, u8 mandatory, u8 opt,
-                                         u8 feat, u8 *val, u8 len)
+int dccp_feat_clone(struct sock *oldsk, struct sock *newsk)
 {
-       struct list_head *fn = &dccp_sk(sk)->dccps_featneg;
-       const bool local = (opt == DCCPO_CONFIRM_R);
-       struct dccp_feat_entry *entry;
-       u8 type = dccp_feat_type(feat);
-       dccp_feat_val fval;
+       struct dccp_minisock *olddmsk = dccp_msk(oldsk);
+       struct dccp_minisock *newdmsk = dccp_msk(newsk);
+       struct dccp_opt_pend *opt;
+       int rc = 0;
 
-       dccp_feat_print_opt(opt, feat, val, len, mandatory);
+       INIT_LIST_HEAD(&newdmsk->dccpms_pending);
+       INIT_LIST_HEAD(&newdmsk->dccpms_conf);
 
-       /* Ignore non-mandatory unknown and non-NN features */
-       if (type == FEAT_UNKNOWN) {
-               if (local && !mandatory)
-                       return 0;
-               goto fast_path_unknown;
-       } else if (type != FEAT_NN) {
-               return 0;
-       }
-
-       /*
-        * We don't accept empty Confirms, since in fast-path feature
-        * negotiation the values are enabled immediately after sending
-        * the Change option.
-        * Empty Changes on the other hand are invalid (RFC 4340, 6.1).
-        */
-       if (len == 0 || len > sizeof(fval.nn))
-               goto fast_path_unknown;
-
-       if (opt == DCCPO_CHANGE_L) {
-               fval.nn = dccp_decode_value_var(val, len);
-               if (!dccp_feat_is_valid_nn_val(feat, fval.nn))
-                       goto fast_path_unknown;
+       list_for_each_entry(opt, &olddmsk->dccpms_pending, dccpop_node) {
+               struct dccp_opt_pend *newopt;
+               /* copy the value of the option */
+               u8 *val = kmemdup(opt->dccpop_val, opt->dccpop_len, GFP_ATOMIC);
 
-               if (dccp_feat_push_confirm(fn, feat, local, &fval) ||
-                   dccp_feat_activate(sk, feat, local, &fval))
-                       return DCCP_RESET_CODE_TOO_BUSY;
+               if (val == NULL)
+                       goto out_clean;
 
-               /* set the `Ack Pending' flag to piggyback a Confirm */
-               inet_csk_schedule_ack(sk);
-
-       } else if (opt == DCCPO_CONFIRM_R) {
-               entry = dccp_feat_list_lookup(fn, feat, local);
-               if (entry == NULL || entry->state != FEAT_CHANGING)
-                       return 0;
-
-               fval.nn = dccp_decode_value_var(val, len);
-               if (fval.nn != entry->val.nn) {
-                       DCCP_WARN("Bogus Confirm for non-existing value\n");
-                       goto fast_path_failed;
+               newopt = kmemdup(opt, sizeof(*newopt), GFP_ATOMIC);
+               if (newopt == NULL) {
+                       kfree(val);
+                       goto out_clean;
                }
 
-               /* It has been confirmed - so remove the entry */
-               dccp_feat_list_pop(entry);
+               /* insert the option */
+               newopt->dccpop_val = val;
+               list_add_tail(&newopt->dccpop_node, &newdmsk->dccpms_pending);
 
-       } else {
-               DCCP_WARN("Received illegal option %u\n", opt);
-               goto fast_path_failed;
+               /* XXX what happens with backlogs and multiple connections at
+                * once...
+                */
+               /* the master socket no longer needs to worry about confirms */
+               opt->dccpop_sc = NULL; /* it's not a memleak---new socket has it */
+
+               /* reset state for a new socket */
+               opt->dccpop_conf = 0;
        }
-       return 0;
 
-fast_path_unknown:
-       if (!mandatory)
-               return dccp_push_empty_confirm(fn, feat, local);
+       /* XXX not doing anything about the conf queue */
+
+out:
+       return rc;
 
-fast_path_failed:
-       return mandatory ? DCCP_RESET_CODE_MANDATORY_ERROR
-                        : DCCP_RESET_CODE_OPTION_ERROR;
+out_clean:
+       dccp_feat_clean(newdmsk);
+       rc = -ENOMEM;
+       goto out;
 }
 
-/**
- * dccp_feat_parse_options  -  Process Feature-Negotiation Options
- * @sk: for general use and used by the client during connection setup
- * @dreq: used by the server during connection setup
- * @mandatory: whether @opt was preceded by a Mandatory option
- * @opt: %DCCPO_CHANGE_L | %DCCPO_CHANGE_R | %DCCPO_CONFIRM_L | %DCCPO_CONFIRM_R
- * @feat: one of %dccp_feature_numbers
- * @val: value contents of @opt
- * @len: length of @val in bytes
- * Returns 0 on success, a Reset code for ending the connection otherwise.
- */
-int dccp_feat_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
-                           u8 mandatory, u8 opt, u8 feat, u8 *val, u8 len)
+EXPORT_SYMBOL_GPL(dccp_feat_clone);
+
+static int __dccp_feat_init(struct dccp_minisock *dmsk, u8 type, u8 feat,
+                           u8 *val, u8 len)
 {
-       struct dccp_sock *dp = dccp_sk(sk);
-       struct list_head *fn = dreq ? &dreq->dreq_featneg : &dp->dccps_featneg;
-       bool server = false;
+       int rc = -ENOMEM;
+       u8 *copy = kmemdup(val, len, GFP_KERNEL);
 
-       switch (sk->sk_state) {
-       /*
-        *      Negotiation during connection setup
-        */
-       case DCCP_LISTEN:
-               server = true;                  /* fall through */
-       case DCCP_REQUESTING:
-               switch (opt) {
-               case DCCPO_CHANGE_L:
-               case DCCPO_CHANGE_R:
-                       return dccp_feat_change_recv(fn, mandatory, opt, feat,
-                                                    val, len, server);
-               case DCCPO_CONFIRM_R:
-               case DCCPO_CONFIRM_L:
-                       return dccp_feat_confirm_recv(fn, mandatory, opt, feat,
-                                                     val, len, server);
-               }
-               break;
-       /*
-        *      Support for exchanging NN options on an established connection
-        *      This is currently restricted to Ack Ratio (RFC 4341, 6.1.2)
-        */
-       case DCCP_OPEN:
-       case DCCP_PARTOPEN:
-               return dccp_feat_handle_nn_established(sk, mandatory, opt, feat,
-                                                      val, len);
+       if (copy != NULL) {
+               rc = dccp_feat_change(dmsk, type, feat, copy, len, GFP_KERNEL);
+               if (rc)
+                       kfree(copy);
        }
-       return 0;       /* ignore FN options in all other states */
+       return rc;
 }
 
-/**
- * dccp_feat_init  -  Seed feature negotiation with host-specific defaults
- * This initialises global defaults, depending on the value of the sysctls.
- * These can later be overridden by registering changes via setsockopt calls.
- * The last link in the chain is finalise_settings, to make sure that between
- * here and the start of actual feature negotiation no inconsistencies enter.
- *
- * All features not appearing below use either defaults or are otherwise
- * later adjusted through dccp_feat_finalise_settings().
- */
-int dccp_feat_init(struct sock *sk)
+int dccp_feat_init(struct dccp_minisock *dmsk)
 {
-       struct list_head *fn = &dccp_sk(sk)->dccps_featneg;
-       u8 on = 1, off = 0;
        int rc;
-       struct {
-               u8 *val;
-               u8 len;
-       } tx, rx;
-
-       /* Non-negotiable (NN) features */
-       rc = __feat_register_nn(fn, DCCPF_SEQUENCE_WINDOW, 0,
-                                   sysctl_dccp_sequence_window);
-       if (rc)
-               return rc;
 
-       /* Server-priority (SP) features */
-
-       /* Advertise that short seqnos are not supported (7.6.1) */
-       rc = __feat_register_sp(fn, DCCPF_SHORT_SEQNOS, true, true, &off, 1);
-       if (rc)
-               return rc;
+       INIT_LIST_HEAD(&dmsk->dccpms_pending);
+       INIT_LIST_HEAD(&dmsk->dccpms_conf);
 
-       /* RFC 4340 12.1: "If a DCCP is not ECN capable, ..." */
-       rc = __feat_register_sp(fn, DCCPF_ECN_INCAPABLE, true, true, &on, 1);
+       /* CCID L */
+       rc = __dccp_feat_init(dmsk, DCCPO_CHANGE_L, DCCPF_CCID,
+                             &dmsk->dccpms_tx_ccid, 1);
        if (rc)
-               return rc;
-
-       /*
-        * We advertise the available list of CCIDs and reorder according to
-        * preferences, to avoid failure resulting from negotiating different
-        * singleton values (which always leads to failure).
-        * These settings can still (later) be overridden via sockopts.
-        */
-       if (ccid_get_builtin_ccids(&tx.val, &tx.len) ||
-           ccid_get_builtin_ccids(&rx.val, &rx.len))
-               return -ENOBUFS;
-
-       /* Pre-load all CCID modules that are going to be advertised */
-       rc = -EUNATCH;
-       if (ccid_request_modules(tx.val, tx.len))
-               goto free_ccid_lists;
-
-       if (!dccp_feat_prefer(sysctl_dccp_tx_ccid, tx.val, tx.len) ||
-           !dccp_feat_prefer(sysctl_dccp_rx_ccid, rx.val, rx.len))
-               goto free_ccid_lists;
+               goto out;
 
-       rc = __feat_register_sp(fn, DCCPF_CCID, true, false, tx.val, tx.len);
+       /* CCID R */
+       rc = __dccp_feat_init(dmsk, DCCPO_CHANGE_R, DCCPF_CCID,
+                             &dmsk->dccpms_rx_ccid, 1);
        if (rc)
-               goto free_ccid_lists;
+               goto out;
 
-       rc = __feat_register_sp(fn, DCCPF_CCID, false, false, rx.val, rx.len);
-
-free_ccid_lists:
-       kfree(tx.val);
-       kfree(rx.val);
+       /* Ack ratio */
+       rc = __dccp_feat_init(dmsk, DCCPO_CHANGE_L, DCCPF_ACK_RATIO,
+                             &dmsk->dccpms_ack_ratio, 1);
+out:
        return rc;
 }
 
-int dccp_feat_activate_values(struct sock *sk, struct list_head *fn_list)
-{
-       struct dccp_sock *dp = dccp_sk(sk);
-       struct dccp_feat_entry *cur, *next;
-       int idx;
-       dccp_feat_val *fvals[DCCP_FEAT_SUPPORTED_MAX][2] = {
-                [0 ... DCCP_FEAT_SUPPORTED_MAX-1] = { NULL, NULL }
-       };
-
-       list_for_each_entry(cur, fn_list, node) {
-               /*
-                * An empty Confirm means that either an unknown feature type
-                * or an invalid value was present. In the first case there is
-                * nothing to activate, in the other the default value is used.
-                */
-               if (cur->empty_confirm)
-                       continue;
+EXPORT_SYMBOL_GPL(dccp_feat_init);
 
-               idx = dccp_feat_index(cur->feat_num);
-               if (idx < 0) {
-                       DCCP_BUG("Unknown feature %u", cur->feat_num);
-                       goto activation_failed;
-               }
-               if (cur->state != FEAT_STABLE) {
-                       DCCP_CRIT("Negotiation of %s %s failed in state %s",
-                                 cur->is_local ? "local" : "remote",
-                                 dccp_feat_fname(cur->feat_num),
-                                 dccp_feat_sname[cur->state]);
-                       goto activation_failed;
-               }
-               fvals[idx][cur->is_local] = &cur->val;
+#ifdef CONFIG_IP_DCCP_DEBUG
+const char *dccp_feat_typename(const u8 type)
+{
+       switch(type) {
+       case DCCPO_CHANGE_L:  return("ChangeL");
+       case DCCPO_CONFIRM_L: return("ConfirmL");
+       case DCCPO_CHANGE_R:  return("ChangeR");
+       case DCCPO_CONFIRM_R: return("ConfirmR");
+       /* the following case must not appear in feature negotation  */
+       default:              dccp_pr_debug("unknown type %d [BUG!]\n", type);
        }
+       return NULL;
+}
 
-       /*
-        * Activate in decreasing order of index, so that the CCIDs are always
-        * activated as the last feature. This avoids the case where a CCID
-        * relies on the initialisation of one or more features that it depends
-        * on (e.g. Send NDP Count, Send Ack Vector, and Ack Ratio features).
-        */
-       for (idx = DCCP_FEAT_SUPPORTED_MAX; --idx >= 0;)
-               if (__dccp_feat_activate(sk, idx, 0, fvals[idx][0]) ||
-                   __dccp_feat_activate(sk, idx, 1, fvals[idx][1])) {
-                       DCCP_CRIT("Could not activate %d", idx);
-                       goto activation_failed;
-               }
+EXPORT_SYMBOL_GPL(dccp_feat_typename);
 
-       /* Clean up Change options which have been confirmed already */
-       list_for_each_entry_safe(cur, next, fn_list, node)
-               if (!cur->needs_confirm)
-                       dccp_feat_list_pop(cur);
+const char *dccp_feat_name(const u8 feat)
+{
+       static const char *feature_names[] = {
+               [DCCPF_RESERVED]        = "Reserved",
+               [DCCPF_CCID]            = "CCID",
+               [DCCPF_SHORT_SEQNOS]    = "Allow Short Seqnos",
+               [DCCPF_SEQUENCE_WINDOW] = "Sequence Window",
+               [DCCPF_ECN_INCAPABLE]   = "ECN Incapable",
+               [DCCPF_ACK_RATIO]       = "Ack Ratio",
+               [DCCPF_SEND_ACK_VECTOR] = "Send ACK Vector",
+               [DCCPF_SEND_NDP_COUNT]  = "Send NDP Count",
+               [DCCPF_MIN_CSUM_COVER]  = "Min. Csum Coverage",
+               [DCCPF_DATA_CHECKSUM]   = "Send Data Checksum",
+       };
+       if (feat > DCCPF_DATA_CHECKSUM && feat < DCCPF_MIN_CCID_SPECIFIC)
+               return feature_names[DCCPF_RESERVED];
 
-       dccp_pr_debug("Activation OK\n");
-       return 0;
+       if (feat >= DCCPF_MIN_CCID_SPECIFIC)
+               return "CCID-specific";
 
-activation_failed:
-       /*
-        * We clean up everything that may have been allocated, since
-        * it is difficult to track at which stage negotiation failed.
-        * This is ok, since all allocation functions below are robust
-        * against NULL arguments.
-        */
-       ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
-       ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
-       dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
-       dccp_ackvec_free(dp->dccps_hc_rx_ackvec);
-       dp->dccps_hc_rx_ackvec = NULL;
-       return -1;
+       return feature_names[feat];
 }
+
+EXPORT_SYMBOL_GPL(dccp_feat_name);
+#endif /* CONFIG_IP_DCCP_DEBUG */