diff --git a/conf/confbase.Y b/conf/confbase.Y
index c6678e77..b793acb0 100644
--- a/conf/confbase.Y
+++ b/conf/confbase.Y
@@ -73,6 +73,7 @@ CF_DECLS
 %type <iface> ipa_scope
 
 %type <i> expr bool pxlen
+%type <i32> expr_us
 %type <time> datetime
 %type <a> ipa
 %type <px> prefix prefix_or_ipa
@@ -86,7 +87,7 @@ CF_DECLS
 %left '!'
 %nonassoc '.'
 
-CF_KEYWORDS(DEFINE, ON, OFF, YES, NO)
+CF_KEYWORDS(DEFINE, ON, OFF, YES, NO, XS, XMS, XUS)
 
 CF_GRAMMAR
 
@@ -124,6 +125,14 @@ expr:
      $$ = SYM_VAL($1).i; }
  ;
 
+
+/* XXX fix X* symbols, they collide with macros */
+expr_us:
+   expr XS  { $$ = (u32) $1 * 1000000; }
+ | expr XMS { $$ = (u32) $1 * 1000; }
+ | expr XUS { $$ = (u32) $1 * 1; }
+ ;
+
 /* expr_u16: expr { check_u16($1); $$ = $1; }; */
 
 /* Switches */
diff --git a/configure.in b/configure.in
index 96f2a50e..fc18657d 100644
--- a/configure.in
+++ b/configure.in
@@ -47,11 +47,11 @@ AC_SUBST(runtimedir)
 if test "$enable_ipv6" = yes ; then
 	ip=ipv6
 	SUFFIX=6
-	all_protocols=bgp,ospf,pipe,radv,rip,static
+	all_protocols=bfd,bgp,ospf,pipe,radv,rip,static
 else
 	ip=ipv4
 	SUFFIX=""
-	all_protocols=bgp,ospf,pipe,rip,static
+	all_protocols=bfd,bgp,ospf,pipe,rip,static
 fi
 
 if test "$given_suffix" = yes ; then
@@ -92,7 +92,7 @@ if test "$bird_cflags_default" = yes ; then
 	BIRD_CHECK_GCC_OPTION(bird_cv_c_option_fno_strict_aliasing, -fno-strict-aliasing)
 	BIRD_CHECK_GCC_OPTION(bird_cv_c_option_fno_strict_overflow, -fno-strict-overflow)
 
-	CFLAGS="$CFLAGS -Wall -Wstrict-prototypes -Wno-parentheses"
+	CFLAGS="$CFLAGS -pthread -Wall -Wstrict-prototypes -Wno-parentheses"
 	BIRD_ADD_GCC_OPTION(bird_cv_c_option_wno_pointer_sign, -Wno-pointer-sign)
 	BIRD_ADD_GCC_OPTION(bird_cv_c_option_fno_strict_aliasing, -fno-strict-aliasing)
 	BIRD_ADD_GCC_OPTION(bird_cv_c_option_fno_strict_overflow, -fno-strict-overflow)
diff --git a/lib/hash.h b/lib/hash.h
index 7464f140..3ac9eebd 100644
--- a/lib/hash.h
+++ b/lib/hash.h
@@ -1,62 +1,110 @@
 
 
-#define HASH(type)		struct { type **data; uint used, size; }
+#define HASH(type)		struct { type **data; uint count, order; }
 #define HASH_TYPE(v)		typeof(** (v).data)
-#define HASH_SIZE(v)		((v).size * sizeof(* (v).data))
+#define HASH_SIZE(v)		(1 << (v).order)
+#define HASH_MASK(v)		((1 << (v).order)-1)
 
-#define HASH_INIT(v,pool,isize)						\
+
+#define HASH_INIT(v,pool,init_order)					\
   ({									\
-    (v).used = 0;							\
-    (v).size = (isize);							\
-    (v).data = mb_allocz(pool, HASH_SIZE(v));				\
+    (v).count = 0;							\
+    (v).order = (init_order);						\
+    (v).data = mb_allocz(pool, HASH_SIZE(v) * sizeof(* (v).data));	\
   })
 
-#define HASH_FIND(v,id,key)						\
+#define HASH_FIND(v,id,key...)						\
   ({									\
-    HASH_TYPE(v) *_n = (v).data[id##_FN(key, (v).size)];		\
-    while (_n && !id##_EQ(_n, key))					\
-      _n = _n->id##_NEXT;						\
+    uint _h = id##_FN((key)) & HASH_MASK(v);				\
+    HASH_TYPE(v) *_n = (v).data[_h];					\
+    while (_n && !id##_EQ(id##_KEY(_n), (key)))				\
+      _n = id##_NEXT(_n);						\
     _n;									\
   })
 
-#define HASH_INSERT(v,id,key,node)					\
+#define HASH_INSERT(v,id,node)						\
   ({									\
-    HASH_TYPE(v) **_nn = (v).data + id##_FN(key, (v).size);		\
-    node->id##_NEXT = *_nn;						\
+    uint _h = id##_FN(id##_KEY((node))) & HASH_MASK(v);			\
+    HASH_TYPE(v) **_nn = (v).data + _h;					\
+    id##_NEXT(node) = *_nn;						\
     *_nn = node;							\
+    (v).count++;							\
   })
 
-#define HASH_DELETE(v,id,key)						\
+#define HASH_DO_REMOVE(v,id,_nn)					\
   ({									\
-    HASH_TYPE(v) **_nn = (v).data + id##_FN(key, (v).size);		\
-    while ((*_nn) && !id##_EQ(*_nn, key))				\
-      _nn = &((*_nn)->id##_NEXT);					\
-									\
     HASH_TYPE(v) *_n = *_nn;						\
     if (_n)								\
-      *_nn = _n->id##_NEXT;						\
+    {									\
+      *_nn = id##_NEXT(_n);						\
+      (v).count--;							\
+    }									\
     _n;									\
   })
 
+#define HASH_DELETE(v,id,key...)					\
+  ({									\
+    uint _h = id##_FN((key)) & HASH_MASK(v);				\
+    HASH_TYPE(v) **_nn = (v).data + _h;					\
+									\
+    while ((*_nn) && !id##_EQ(id##_KEY((*_nn)), (key)))			\
+      _nn = &(id##_NEXT((*_nn)));					\
+									\
+    HASH_DO_REMOVE(v,id,_nn);						\
+  })
+
 #define HASH_REMOVE(v,id,node)						\
   ({									\
-    HASH_TYPE(v) **_nn = (v).data + id##_FN(key, (v).size);		\
-    while ((*_nn) && (*_nn != (node)))					\
-      _nn = &((*_nn)->id##_NEXT);					\
+    uint _h = id##_FN(id##_KEY((node))) & HASH_MASK(v);			\
+    HASH_TYPE(v) **_nn = (v).data + _h;					\
 									\
-    HASH_TYPE(v) *_n = *_nn;						\
-    if (_n)								\
-      *_nn = _n->id##_NEXT;						\
-    _n;									\
+    while ((*_nn) && (*_nn != (node)))					\
+      _nn = &(id##_NEXT((*_nn)));					\
+									\
+    HASH_DO_REMOVE(v,id,_nn);						\
   })
 
 
+#define HASH_REHASH(v,id,pool,step)					\
+  ({									\
+    HASH_TYPE(v) *_n, *_n2, **_od;					\
+    uint _i, _s;							\
+									\
+    _s = HASH_SIZE(v);							\
+    _od = (v).data;							\
+    (v).count = 0;							\
+    (v).order += (step);						\
+    (v).data = mb_allocz(pool, HASH_SIZE(v) * sizeof(* (v).data));	\
+									\
+    for (_i = 0; _i < _s; _i++)						\
+      for (_n = _od[_i]; _n && (_n2 = id##_NEXT(_n), 1); _n = _n2)	\
+	HASH_INSERT(v, id, _n);						\
+									\
+    mb_free(_od);							\
+  })
+
+#define HASH_DEFINE_REHASH_FN(id, type)					\
+  static void id##_REHASH_FN(void *v, pool *p, int step)		\
+  { HASH_REHASH(* (HASH(type) *) v, id, p, step); }
+
+#define HASH_TRY_REHASH_UP(v,id,pool)					\
+  ({									\
+    if (((v).order < id##_REHASH_MAX) && ((v).count > HASH_SIZE(v)))	\
+      id##_REHASH_FN(&v, pool, 1);					\
+  })
+
+#define HASH_TRY_REHASH_DOWN(v,id,pool)					\
+  ({									\
+    if (((v).order > id##_REHASH_MIN) && ((v).count < HASH_SIZE(v)/2))	\
+      id##_REHASH_FN(&v, pool, -1);					\
+  })
 
 #define HASH_WALK(v,next,n)						\
   do {									\
     HASH_TYPE(v) *n;							\
     uint _i;								\
-    for (_i = 0; _i < ((v).size); _i++)					\
+    uint _s = HASH_SIZE(v);						\
+    for (_i = 0; _i < _s; _i++)						\
       for (n = (v).data[_i]; n; n = n->next)
 
 #define HASH_WALK_END } while (0)
@@ -66,18 +114,10 @@
   do {									\
     HASH_TYPE(v) *n, *_next;						\
     uint _i;								\
-    for (_i = 0; _i < ((v).size); _i++)					\
+    uint _s = HASH_SIZE(v);						\
+    for (_i = 0; _i < _s; _i++)						\
       for (n = (v).data[_i]; n && (_next = n->next, 1); n = _next)
 
 #define HASH_WALK_DELSAFE_END } while (0)
 
-/*
-define HASH_REHASH(s)							\
-  ({									\
-    type *_n;								\
-    uint _i;								\
-    for (_i = 0; _i < (size_f); _i++)					\
-      for (_n = (hash)[_i]; _n != NULL; _n = 
 
-*/
-  
diff --git a/lib/heap.h b/lib/heap.h
index ecb9a1bd..c8c3d348 100644
--- a/lib/heap.h
+++ b/lib/heap.h
@@ -72,8 +72,8 @@
  **/
 #define HEAP_INIT(heap,num,type,less,swap)						\
   do {											\
-    uns _i = num;									\
-    uns _j, _l;										\
+    uint _i = num;									\
+    uint _j, _l;										\
     type x;										\
     while (_i >= 1)									\
       {											\
@@ -89,7 +89,7 @@
  **/
 #define HEAP_DELMIN(heap,num,type,less,swap)						\
   do {											\
-    uns _j, _l;										\
+    uint _j, _l;										\
     type x;										\
     swap(heap,1,num,x);									\
     num--;										\
@@ -102,7 +102,7 @@
  **/
 #define HEAP_INSERT(heap,num,type,less,swap)						\
   do {											\
-    uns _j, _u;										\
+    uint _j, _u;										\
     type x;										\
     _j = num;										\
     HEAP_BUBBLE_UP_J(heap,num,less,swap);						\
@@ -115,7 +115,7 @@
  **/
 #define HEAP_INCREASE(heap,num,type,less,swap,pos)					\
   do {											\
-    uns _j, _l;										\
+    uint _j, _l;										\
     type x;										\
     _j = pos;										\
     HEAP_BUBBLE_DOWN_J(heap,num,less,swap);						\
@@ -128,7 +128,7 @@
  **/
 #define HEAP_DECREASE(heap,num,type,less,swap,pos)					\
   do {											\
-    uns _j, _u;										\
+    uint _j, _u;										\
     type x;										\
     _j = pos;										\
     HEAP_BUBBLE_UP_J(heap,num,less,swap);						\
@@ -139,7 +139,7 @@
  **/
 #define HEAP_DELETE(heap,num,type,less,swap,pos)					\
   do {											\
-    uns _j, _l, _u;									\
+    uint _j, _l, _u;									\
     type x;										\
     _j = pos;										\
     swap(heap,_j,num,x);								\
diff --git a/lib/lists.c b/lib/lists.c
index 58ffd230..d323a4b6 100644
--- a/lib/lists.c
+++ b/lib/lists.c
@@ -100,6 +100,25 @@ rem_node(node *n)
   x->prev = z;
 }
 
+/**
+ * rem2_node - remove a node from a list, with cleanup
+ * @n: node to be removed
+ *
+ * Removes a node @n from the list it's linked in and resets its pointers to NULL.
+ * Useful if you want to distinguish between linked and unlinked nodes.
+ */
+LIST_INLINE void
+rem2_node(node *n)
+{
+  node *z = n->prev;
+  node *x = n->next;
+
+  z->next = x;
+  x->prev = z;
+  n->next = NULL;
+  n->prev = NULL;
+}
+
 /**
  * replace_node - replace a node in a list with another one
  * @old: node to be removed
diff --git a/lib/lists.h b/lib/lists.h
index 0b0fdbe3..9153029c 100644
--- a/lib/lists.h
+++ b/lib/lists.h
@@ -51,6 +51,7 @@ typedef struct list {			/* In fact two overlayed nodes */
 void add_tail(list *, node *);
 void add_head(list *, node *);
 void rem_node(node *);
+void rem2_node(node *);
 void add_tail_list(list *, list *);
 void init_list(list *);
 void insert_node(node *, node *);
diff --git a/lib/resource.c b/lib/resource.c
index 775b0c53..bf4b3ae9 100644
--- a/lib/resource.c
+++ b/lib/resource.c
@@ -220,7 +220,8 @@ ralloc(pool *p, struct resclass *c)
   bzero(r, c->size);
 
   r->class = c;
-  add_tail(&p->inside, &r->n);
+  if (p)
+    add_tail(&p->inside, &r->n);
   return r;
 }
 
@@ -423,6 +424,6 @@ buffer_realloc(void **buf, unsigned *size, unsigned need, unsigned item_size)
   while (nsize < need)
     nsize = STEP_UP(nsize);
 
-  *buf = mb_realloc(*buf, nsize*isize);
+  *buf = mb_realloc(*buf, nsize * item_size);
   *size = nsize;
 }
diff --git a/lib/resource.h b/lib/resource.h
index 5cb5e274..1a62d389 100644
--- a/lib/resource.h
+++ b/lib/resource.h
@@ -52,7 +52,7 @@ extern pool root_pool;
 
 void *mb_alloc(pool *, unsigned size);
 void *mb_allocz(pool *, unsigned size);
-void *mb_realloc(pool *p, void *m, unsigned size);
+void *mb_realloc(void *m, unsigned size);
 void mb_free(void *);
 
 /* Memory pools with linear allocation */
@@ -78,6 +78,9 @@ void sl_free(slab *, void *);
  * outside resource manager and possibly sysdep code.
  */
 
+void buffer_realloc(void **buf, unsigned *size, unsigned need, unsigned item_size);
+
+
 #ifdef HAVE_LIBDMALLOC
 /*
  * The standard dmalloc macros tend to produce lots of namespace
@@ -103,3 +106,4 @@ void *xrealloc(void *, unsigned);
 #endif
 
 #endif
+
diff --git a/nest/proto.c b/nest/proto.c
index 60495aa0..0c85c2d9 100644
--- a/nest/proto.c
+++ b/nest/proto.c
@@ -718,6 +718,9 @@ protos_build(void)
 #ifdef CONFIG_BGP
   proto_build(&proto_bgp);
 #endif
+  // XXX
+  proto_build(&proto_bfd);
+
   proto_pool = rp_new(&root_pool, "Protocols");
   proto_flush_event = ev_new(proto_pool);
   proto_flush_event->hook = proto_flush_loop;
diff --git a/nest/protocol.h b/nest/protocol.h
index 033a0ede..96923447 100644
--- a/nest/protocol.h
+++ b/nest/protocol.h
@@ -75,7 +75,7 @@ void protos_dump_all(void);
 
 extern struct protocol
   proto_device, proto_radv, proto_rip, proto_static,
-  proto_ospf, proto_pipe, proto_bgp;
+  proto_ospf, proto_pipe, proto_bgp, proto_bfd;
 
 /*
  *	Routing Protocol Instance
@@ -358,6 +358,12 @@ void proto_notify_state(struct proto *p, unsigned state);
 #define D_EVENTS 16		/* Protocol events */
 #define D_PACKETS 32		/* Packets sent/received */
 
+#ifndef PARSER
+#define TRACE(flags, msg, args...) \
+  do { if (p->p.debug & flags) log(L_TRACE "%s: " msg, p->p.name , ## args ); } while(0)
+#endif
+
+
 /*
  *	MRTDump flags
  */
diff --git a/proto/bfd/Makefile b/proto/bfd/Makefile
index 77b8bd2c..c28cedec 100644
--- a/proto/bfd/Makefile
+++ b/proto/bfd/Makefile
@@ -1,4 +1,4 @@
-source=bfd.c
+source=bfd.c packets.c io.c
 root-rel=../../
 dir-name=proto/bfd
 
diff --git a/proto/bfd/bfd.c b/proto/bfd/bfd.c
index 4c7fe1f1..6e38102b 100644
--- a/proto/bfd/bfd.c
+++ b/proto/bfd/bfd.c
@@ -1,138 +1,47 @@
-#include "nest/bird.h"
-#include "nest/iface.h"
-#include "nest/protocol.h"
-#include "nest/route.h"
-#include "nest/cli.h"
-#include "conf/conf.h"
-#include "lib/socket.h"
-#include "lib/resource.h"
-#include "lib/string.h"
+/*
+ *	BIRD -- Bidirectional Forwarding Detection (BFD)
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ */
 
 #include "bfd.h"
 
 
-#define HASH_ID_KEY	loc_id
-#define HASH_ID_NEXT	next_id
-#define HASH_ID_EQ(a,b)	((a)==(b))
-#define HASH_ID_FN(a)	(a)
+#define HASH_ID_KEY(n)		n->loc_id
+#define HASH_ID_NEXT(n)		n->next_id
+#define HASH_ID_EQ(a,b)		(a == b)
+#define HASH_ID_FN(k)		(k)
 
-#define HASH_IP_KEY	addr
-#define HASH_IP_NEXT	next_ip
-#define HASH_IP_EQ(a,b)	((a)==(b))
-#define HASH_IP_FN(a)	(a == b)
+#define HASH_IP_KEY(n)		n->addr
+#define HASH_IP_NEXT(n)		n->next_ip
+#define HASH_IP_EQ(a,b)		ipa_equal(a,b)
+#define HASH_IP_FN(k)		ipa_hash(k)
 
-static u32
-bfd_get_free_id(struct bfd_proto *p)
+static inline void bfd_notify_kick(struct bfd_proto *p);
+
+static void 
+bfd_session_update_state(struct bfd_session *s, uint state, uint diag)
 {
-  u32 id;
-  for (id = random_u32(); 1; id++)
-    if (id && !bfd_find_session_by_id(p, id))
-      break;
+  struct bfd_proto *p = s->bfd;
+  int notify;
 
-  return id;
-}
+  if (s->loc_state == state)
+    return;
 
-static void
-bfd_add_session(struct bfd_proto *p, ip_addr addr, struct bfd_session_config *opts)
-{
-  birdloop_enter(p->loop);
+  //TRACE(D_EVENTS, "Session changed %I %d %d", s->addr, state, diag);
+  debug("STATE %I %d %d %d\n", s->addr, s->loc_state, state, diag);
+    
+  bfd_lock_sessions(p);
+  s->loc_state = state;
+  s->loc_diag = diag;
 
-  struct bfd_session *s = sl_alloc(p->session_slab);
-  bzero(s, sizeof(struct bfd_session));
+  notify = !NODE_VALID(&s->n);
+  if (notify)
+    add_tail(&p->notify_list, &s->n);
+  bfd_unlock_sessions(p);
 
-  /* Initialization of state variables - see RFC 5880 3.8.1 */
-  s->loc_state = BFD_STATE_DOWN;
-  s->rem_state = BFD_STATE_DOWN;
-  s->loc_id = bfd_get_free_id(p);
-  s->des_min_tx_int = s->des_min_tx_new = s->opts->idle_tx_int;
-  s->req_min_rx_int = s->req_min_rx_new = s->opts->min_rx_int;
-  s->detect_mult = s->opts->multiplier;
-  s->rem_min_rx_int = 1;
-
-  HASH_INSERT(p->session_hash_id, HASH_ID, s);
-  HASH_INSERT(p->session_hash_ip, HASH_IP, s);
-
-  s->tx_timer = tm2_new_set(xxx, bfd_rx_timer_hook, s, 0, 0);
-  s->hold_timer = tm2_new_set(xxx, bfd_hold_timer_hook, s, 0, 0);
-  bfd_session_update_tx_interval(s);
-
-  birdloop_leave(p->loop);
-}
-
-static void
-bfd_open_session(struct bfd_proto *p, struct bfd_session *s, ip_addr local, struct iface *ifa)
-{
-  birdloop_enter(p->loop);
-
-  s->bsock = bfd_get_socket(p, local, ifa);
-  s->local = local;
-  s->iface = ifa;
-  s->opened = 1;
-
-  bfd_session_control_tx_timer(s);
-
-  birdloop_leave(p->loop);
-}
-
-static void
-bfd_close_session(struct bfd_proto *p, struct bfd_session *s)
-{
-  birdloop_enter(p->loop);
-
-  bfd_free_socket(s->bsock);
-  s->bsock = NULL;
-  s->local = IPA_NONE;
-  s->iface = NULL;
-  s->opened = 0;
-
-  bfd_session_control_tx_timer(s);
-
-  birdloop_leave(p->loop);
-}
-
-static void
-bfd_remove_session(struct bfd_proto *p, struct bfd_session *s)
-{
-  birdloop_enter(p->loop);
-
-  bfd_free_socket(s->bsock);
-
-  rfree(s->tx_timer);
-  rfree(s->hold_timer);
-
-  HASH_REMOVE(p->session_hash_id, HASH_ID, s);
-  HASH_REMOVE(p->session_hash_ip, HASH_IP, s);
-
-  sl_free(p->session_slab, s);
-
-  birdloop_leave(p->loop);
-}
-
-struct bfd_session *
-bfd_find_session_by_id(struct bfd_proto *p, u32 id)
-{
-  return HASH_FIND(p->session_hash_id, HASH_ID, id);
-}
-
-struct bfd_session *
-bfd_find_session_by_addr(struct bfd_proto *p, ip_addr addr)
-{
-  return HASH_FIND(p->session_hash_ip, HASH_IP, addr);
-}
-
-static void
-bfd_rx_timer_hook(timer2 *t)
-{
-  struct bfd_session *s = timer->data;
-
-  s->last_tx = xxx_now;
-  bfd_send_ctl(s->bfd, s, 0);
-}
-
-static void
-bfd_hold_timer_hook(timer2 *t)
-{
-  bfd_session_timeout(timer->data);
+  if (notify)
+    bfd_notify_kick(p);
 }
 
 static void 
@@ -143,10 +52,43 @@ bfd_session_timeout(struct bfd_session *s)
   s->rem_min_tx_int = 0;
   s->rem_min_rx_int = 1;
   s->rem_demand_mode = 0;
+  s->rem_detect_mult = 0;
 
   bfd_session_update_state(s, BFD_STATE_DOWN, BFD_DIAG_TIMEOUT);
 }
 
+static void
+bfd_session_update_tx_interval(struct bfd_session *s)
+{
+  u32 tx_int = MAX(s->des_min_tx_int, s->rem_min_rx_int);
+  u32 tx_int_l = tx_int - (tx_int / 4);	 // 75 %
+  u32 tx_int_h = tx_int - (tx_int / 10); // 90 %
+
+  s->tx_timer->recurrent = tx_int_l;
+  s->tx_timer->randomize = tx_int_h - tx_int_l;
+
+  /* Do not set timer if no previous event */
+  if (!s->last_tx)
+    return;
+
+  /* Set timer relative to last tx_timer event */
+  tm2_set(s->tx_timer, s->last_tx + tx_int_l);
+}
+
+static void
+bfd_session_update_detection_time(struct bfd_session *s, int kick)
+{
+  btime timeout = (btime) MAX(s->req_min_rx_int, s->rem_min_tx_int) * s->rem_detect_mult;
+
+  if (kick)
+    s->last_rx = current_time();
+
+  if (!s->last_rx)
+    return;
+
+  tm2_set(s->hold_timer, s->last_rx + timeout);
+}
+
 static void
 bfd_session_control_tx_timer(struct bfd_session *s)
 {
@@ -178,38 +120,6 @@ bfd_session_control_tx_timer(struct bfd_session *s)
 }
 
 static void
-bfd_session_update_tx_interval(struct bfd_session *s)
-{
-  u32 tx_int = MAX(s->des_min_tx_int, s->rem_min_rx_int);
-  u32 tx_int_l = tx_int - (tx_int / 4);	 // 75 %
-  u32 tx_int_h = tx_int - (tx_int / 10); // 90 %
-
-  s->tx_timer->recurrent = tx_int_l;
-  s->tx_timer->randomize = tx_int_h - tx_int_l;
-
-  /* Do not set timer if no previous event */
-  if (!s->last_tx)
-    return;
-
-  /* Set timer relative to last tx_timer event */
-  tm2_set(s->tx_timer, s->last_tx + tx_int_l);
-}
-
-static void
-bfd_session_update_detection_time(struct bfd_session *s, int kick)
-{
-  xxx_time timeout = (xxx_time) MAX(s->req_min_rx_int, s->rem_min_tx_int) * s->rem_detect_mult;
-
-  if (kick)
-    s->last_rx = xxx_now;
-
-  if (!s->last_rx)
-    return;
-
-  tm2_set(s->hold_timer, s->last_rx + timeout);
-}
-
-void
 bfd_session_request_poll(struct bfd_session *s, u8 request)
 {
   s->poll_scheduled |= request;
@@ -222,7 +132,7 @@ bfd_session_request_poll(struct bfd_session *s, u8 request)
   bfd_send_ctl(s->bfd, s, 0);
 }
 
-void
+static void
 bfd_session_terminate_poll(struct bfd_session *s)
 {
   u8 poll_done = s->poll_active & ~s->poll_scheduled;
@@ -237,16 +147,16 @@ bfd_session_terminate_poll(struct bfd_session *s)
 
   /* Timers are updated by caller - bfd_session_process_ctl() */
 
-  xxx_restart_poll();
+  // xxx_restart_poll();
 }
 
 void
-bfd_session_process_ctl(struct bfd_session *s, u8 flags, u32 old_rx_int, u32 old_tx_int)
+bfd_session_process_ctl(struct bfd_session *s, u8 flags, u32 old_tx_int, u32 old_rx_int)
 {
   if (s->poll_active && (flags & BFD_FLAG_FINAL))
     bfd_session_terminate_poll(s);
 
-  if ((s->des_min_tx_int != old_rx_int) || (s->rem_min_rx_int != old_tx_int))
+  if ((s->des_min_tx_int != old_tx_int) || (s->rem_min_rx_int != old_rx_int))
     bfd_session_update_tx_interval(s);
 
   bfd_session_update_detection_time(s, 1);
@@ -281,10 +191,9 @@ bfd_session_process_ctl(struct bfd_session *s, u8 flags, u32 old_rx_int, u32 old
   bfd_session_control_tx_timer(s);
 
   if (flags & BFD_FLAG_POLL)
-    bfd_send_ctl(p, s, 1);
+    bfd_send_ctl(s->bfd, s, 1);
 }
 
-
 static void
 bfd_session_set_min_tx(struct bfd_session *s, u32 val)
 {
@@ -325,6 +234,151 @@ bfd_session_set_min_rx(struct bfd_session *s, u32 val)
   bfd_session_request_poll(s, BFD_POLL_RX);
 }
 
+struct bfd_session *
+bfd_find_session_by_id(struct bfd_proto *p, u32 id)
+{
+  return HASH_FIND(p->session_hash_id, HASH_ID, id);
+}
+
+struct bfd_session *
+bfd_find_session_by_addr(struct bfd_proto *p, ip_addr addr)
+{
+  return HASH_FIND(p->session_hash_ip, HASH_IP, addr);
+}
+
+static void
+bfd_tx_timer_hook(timer2 *t)
+{
+  struct bfd_session *s = t->data;
+
+  s->last_tx = current_time();
+  //  debug("TX %d\n", (s32)  (s->last_tx TO_MS));
+  bfd_send_ctl(s->bfd, s, 0);
+}
+
+static void
+bfd_hold_timer_hook(timer2 *t)
+{
+  bfd_session_timeout(t->data);
+}
+
+static u32
+bfd_get_free_id(struct bfd_proto *p)
+{
+  u32 id;
+  for (id = random_u32(); 1; id++)
+    if (id && !bfd_find_session_by_id(p, id))
+      break;
+
+  return id;
+}
+
+static struct bfd_session *
+bfd_add_session(struct bfd_proto *p, ip_addr addr, struct bfd_session_config *opts)
+{
+  birdloop_enter(p->loop);
+
+  struct bfd_session *s = sl_alloc(p->session_slab);
+  bzero(s, sizeof(struct bfd_session));
+
+  s->addr = addr;
+  s->loc_id = bfd_get_free_id(p);
+  debug("XXX INS1 %d %d %u %I\n", p->session_hash_id.count,  p->session_hash_ip.count, s->loc_id, s->addr);
+  HASH_INSERT(p->session_hash_id, HASH_ID, s);
+  debug("XXX INS2 %d %d\n", p->session_hash_id.count,  p->session_hash_ip.count);
+  HASH_INSERT(p->session_hash_ip, HASH_IP, s);
+  debug("XXX INS3 %d %d\n", p->session_hash_id.count,  p->session_hash_ip.count);
+  s->bfd = p;
+
+  /* Initialization of state variables - see RFC 5880 6.8.1 */
+  s->loc_state = BFD_STATE_DOWN;
+  s->rem_state = BFD_STATE_DOWN;
+  s->des_min_tx_int = s->des_min_tx_new = opts->min_tx_int; // XXX  opts->idle_tx_int;
+  s->req_min_rx_int = s->req_min_rx_new = opts->min_rx_int;
+  s->rem_min_rx_int = 1;
+  s->detect_mult = opts->multiplier;
+  s->passive = opts->passive;
+
+  s->tx_timer = tm2_new_init(p->tpool, bfd_tx_timer_hook, s, 0, 0);
+  s->hold_timer = tm2_new_init(p->tpool, bfd_hold_timer_hook, s, 0, 0);
+  bfd_session_update_tx_interval(s);
+
+  birdloop_leave(p->loop);
+
+  return s;
+}
+
+static void
+bfd_open_session(struct bfd_proto *p, struct bfd_session *s, ip_addr local, struct iface *ifa)
+{
+  birdloop_enter(p->loop);
+
+  s->bsock = bfd_get_socket(p, local, ifa);
+  // s->local = local;
+  // s->iface = ifa;
+  s->opened = 1;
+
+  bfd_session_control_tx_timer(s);
+
+  birdloop_leave(p->loop);
+}
+
+static void
+bfd_close_session(struct bfd_proto *p, struct bfd_session *s)
+{
+  birdloop_enter(p->loop);
+
+  bfd_free_socket(s->bsock);
+  s->bsock = NULL;
+  // s->local = IPA_NONE;
+  // s->iface = NULL;
+  s->opened = 0;
+
+  bfd_session_update_state(s, BFD_STATE_DOWN, BFD_DIAG_PATH_DOWN);
+  bfd_session_control_tx_timer(s);
+
+  birdloop_leave(p->loop);
+}
+
+static void
+bfd_remove_session(struct bfd_proto *p, struct bfd_session *s)
+{
+  birdloop_enter(p->loop);
+
+  bfd_free_socket(s->bsock);
+
+  rfree(s->tx_timer);
+  rfree(s->hold_timer);
+
+  debug("XXX REM1 %d %d %u %I\n", p->session_hash_id.count,  p->session_hash_ip.count, s->loc_id, s->addr);
+  HASH_REMOVE(p->session_hash_id, HASH_ID, s);
+  debug("XXX REM2 %d %d\n", p->session_hash_id.count,  p->session_hash_ip.count);
+  HASH_REMOVE(p->session_hash_ip, HASH_IP, s);
+  debug("XXX REM3 %d %d\n", p->session_hash_id.count,  p->session_hash_ip.count);
+
+  sl_free(p->session_slab, s);
+
+  birdloop_leave(p->loop);
+}
+
+static void
+bfd_configure_session(struct bfd_proto *p, struct bfd_session *s,
+		      struct bfd_session_config *opts)
+{
+  birdloop_enter(p->loop);
+
+ // XXX  opts->idle_tx_int;
+
+  bfd_session_set_min_tx(s, opts->min_tx_int);
+  bfd_session_set_min_rx(s, opts->min_rx_int);
+  s->detect_mult = opts->multiplier;
+  s->passive = opts->passive;
+
+  bfd_session_control_tx_timer(s);
+
+  birdloop_leave(p->loop);
+}
+
 static void
 bfd_start_neighbor(struct bfd_proto *p, struct bfd_neighbor *n)
 {
@@ -354,7 +408,7 @@ bfd_start_neighbor(struct bfd_proto *p, struct bfd_neighbor *n)
   if (nb->scope > 0)
     bfd_open_session(p, n->session, nb->iface->addr->ip, nb->iface);
   else
-    TRACE(D_EVENTS, "Waiting for %I%J to become my neighbor", n->addr, cf->iface);
+    TRACE(D_EVENTS, "Waiting for %I%J to become my neighbor", n->addr, n->iface);
 }
 
 static void
@@ -370,7 +424,6 @@ bfd_stop_neighbor(struct bfd_proto *p, struct bfd_neighbor *n)
   bfd_remove_session(p, n->session);
 }
 
-
 static void
 bfd_neigh_notify(struct neighbor *nb)
 {
@@ -388,14 +441,91 @@ bfd_neigh_notify(struct neighbor *nb)
 }
 
 
+/* This core notify code should be replaced after main loop transition to birdloop */
+
+int pipe(int pipefd[2]);
+void pipe_drain(int fd);
+void pipe_kick(int fd);
+
+static int
+bfd_notify_hook(sock *sk, int len)
+{
+  struct bfd_proto *p = sk->data;
+  struct bfd_session *s;
+  list tmp_list;
+
+  pipe_drain(sk->fd);
+
+  bfd_lock_sessions(p);
+  init_list(&tmp_list);
+  add_tail_list(&tmp_list, &p->notify_list);
+  init_list(&p->notify_list);
+  bfd_unlock_sessions(p);
+
+  WALK_LIST_FIRST(s, tmp_list)
+  {
+    bfd_lock_sessions(p);
+    rem2_node(&s->n);
+    bfd_unlock_sessions(p);
+
+    // XXX do something
+    TRACE(D_EVENTS, "Notify: session changed %I %d %d", s->addr, s->loc_state, s->loc_diag);
+  }
+
+  return 0;
+}
+
+static inline void
+bfd_notify_kick(struct bfd_proto *p)
+{
+  pipe_kick(p->notify_ws->fd);
+}
+
+static void
+bfd_noterr_hook(sock *sk, int err)
+{
+  struct bfd_proto *p = sk->data;
+  log(L_ERR "%s: Notify socket error: %m", p->p.name, err);
+}
+
+static void
+bfd_notify_init(struct bfd_proto *p)
+{
+  int pfds[2];
+  sock *sk;
+
+  int rv = pipe(pfds);
+  if (rv < 0)
+    die("pipe: %m");
+
+  sk = sk_new(p->p.pool);
+  sk->type = SK_MAGIC;
+  sk->rx_hook = bfd_notify_hook;
+  sk->err_hook = bfd_noterr_hook;
+  sk->fd = pfds[0];
+  sk->data = p;
+  if (sk_open(sk) < 0)
+    die("bfd: sk_open failed");
+  p->notify_rs = sk;
+
+  /* The write sock is not added to any event loop */
+  sk = sk_new(p->p.pool);
+  sk->type = SK_MAGIC;
+  sk->fd = pfds[1];
+  sk->data = p;
+  sk->flags = SKF_THREAD;
+  if (sk_open(sk) < 0)
+    die("bfd: sk_open failed");
+  p->notify_ws = sk;
+}
+
 
 static struct proto *
 bfd_init(struct proto_config *c)
 {
   struct proto *p = proto_new(c, sizeof(struct bfd_proto));
 
-  p->if_notify = bfd_if_notify;
-  p->ifa_notify = bfd_ifa_notify;
+  p->neigh_notify = bfd_neigh_notify;
 
   return p;
 }
@@ -406,16 +536,33 @@ bfd_start(struct proto *P)
   struct bfd_proto *p = (struct bfd_proto *) P;
   struct bfd_config *cf = (struct bfd_config *) (P->cf);
 
-  p->session_slab = sl_new(P->pool, sizeof(struct bfd_session));
-  init_list(&p->sockets);
+  p->loop = birdloop_new(P->pool);
+  p->tpool = rp_new(NULL, "BFD thread root");
+  pthread_spin_init(&p->lock, PTHREAD_PROCESS_PRIVATE);
 
-  HASH_INIT(p->session_hash_id, P->pool, 16);
-  HASH_INIT(p->session_hash_ip, P->pool, 16);
+  p->session_slab = sl_new(P->pool, sizeof(struct bfd_session));
+  HASH_INIT(p->session_hash_id, P->pool, 4);
+  HASH_INIT(p->session_hash_ip, P->pool, 4);
+
+  init_list(&p->sock_list);
+
+
+  birdloop_mask_wakeups(p->loop);
+
+  init_list(&p->notify_list);
+  bfd_notify_init(p);
+
+  birdloop_enter(p->loop);
+  p->rx_1 = bfd_open_rx_sk(p, 0);
+  p->rx_m = bfd_open_rx_sk(p, 1);
+  birdloop_leave(p->loop);
 
   struct bfd_neighbor *n;
-  WALK_LIST(n, cf->neighbors)
+  WALK_LIST(n, cf->neigh_list)
     bfd_start_neighbor(p, n);
 
+  birdloop_unmask_wakeups(p->loop);
+
   return PS_UP;
 }
 
@@ -440,14 +587,11 @@ bfd_match_neighbor(struct bfd_proto *p, struct bfd_neighbor *on, struct bfd_conf
 {
   struct bfd_neighbor *nn;
 
-  if (r->neigh)
-    r->neigh->data = NULL;
-
-  WALK_LIST(nn, new->neighbors)
+  WALK_LIST(nn, new->neigh_list)
     if (bfd_same_neighbor(nn, on))
     {
       nn->session = on->session;
-      // XXX reconfiguration of session?
+      bfd_configure_session(p, nn->session, nn->opts);
       return;
     }
 
@@ -462,13 +606,17 @@ bfd_reconfigure(struct proto *P, struct proto_config *c)
   struct bfd_config *new = (struct bfd_config *) c;
   struct bfd_neighbor *n;
 
-  WALK_LIST(n, old->neighbors)
+  birdloop_mask_wakeups(p->loop);
+
+  WALK_LIST(n, old->neigh_list)
     bfd_match_neighbor(p, n, new);
 
-  WALK_LIST(n, new->neighbors)
+  WALK_LIST(n, new->neigh_list)
     if (!n->session)
       bfd_start_neighbor(p, n);
 
+  birdloop_unmask_wakeups(p->loop);
+
   return 1;
 }
 
@@ -476,15 +624,52 @@ static void
 bfd_copy_config(struct proto_config *dest, struct proto_config *src)
 {
   struct bfd_config *d = (struct bfd_config *) dest;
-  struct bfd_config *s = (struct bfd_config *) src;
+  // struct bfd_config *s = (struct bfd_config *) src;
 
-  /* We clean up patt_list, ifaces are non-sharable */
-  init_list(&d->patt_list);
+  /* We clean up neigh_list, ifaces are non-sharable */
+  init_list(&d->neigh_list);
 
-  /* We copy pref_list, shallow copy suffices */
-  cfg_copy_list(&d->pref_list, &s->pref_list, sizeof(struct bfd_prefix_config));
 }
 
+void
+bfd_show_sessions(struct proto *P)
+{
+  struct bfd_proto *p = (struct bfd_proto *) P;
+  uint state, diag;
+  u32 tx_int, timeout;
+  const char *ifname;
+
+  if (p->p.proto_state != PS_UP)
+  {
+    cli_msg(-1013, "%s: is not up", p->p.name);
+    cli_msg(0, "");
+    return;
+  }
+
+  cli_msg(-1013, "%s:", p->p.name);
+  cli_msg(-1013, "%-12s\t%s\t%s\t%s\t%s", "Router IP", "Iface",
+	  "State", "TX Int", "Timeout");
+
+  debug("XXX WALK %d %d\n", p->session_hash_id.count,  p->session_hash_ip.count);
+
+  HASH_WALK(p->session_hash_id, next_id, s)
+  {
+    // FIXME this is unsafe
+    state = s->loc_state;
+    diag = s->loc_diag;
+    ifname = (s->bsock && s->bsock->sk->iface) ? s->bsock->sk->iface->name : "---";
+    tx_int = (MAX(s->des_min_tx_int, s->rem_min_rx_int) TO_MS);
+    timeout = (MAX(s->req_min_rx_int, s->rem_min_tx_int) TO_MS) * s->rem_detect_mult;
+
+    cli_msg(-1013, "%I\t%s\t%d %d\t%u\t%u",
+	    s->addr, ifname, state, diag, tx_int, timeout);
+  }
+  HASH_WALK_END;
+
+  cli_msg(0, "");
+}
+
+
 struct protocol proto_bfd = {
   .name =		"BFD",
   .template =		"bfd%d",
diff --git a/proto/bfd/bfd.h b/proto/bfd/bfd.h
index a54053d3..97ccb507 100644
--- a/proto/bfd/bfd.h
+++ b/proto/bfd/bfd.h
@@ -1,7 +1,28 @@
+/*
+ *	BIRD -- Bidirectional Forwarding Detection (BFD)
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ */
 
 #ifndef _BIRD_BFD_H_
 #define _BIRD_BFD_H_
 
+#include <pthread.h>
+
+#include "nest/bird.h"
+#include "nest/cli.h"
+#include "nest/iface.h"
+#include "nest/protocol.h"
+#include "nest/route.h"
+#include "conf/conf.h"
+#include "lib/hash.h"
+#include "lib/resource.h"
+#include "lib/socket.h"
+#include "lib/string.h"
+
+#include "io.h"
+
+
 #define BFD_CONTROL_PORT	3784
 #define BFD_ECHO_PORT		3785
 #define BFD_MULTI_CTL_PORT	4784
@@ -15,7 +36,7 @@
 struct bfd_config
 {
   struct proto_config c;
-  list neighbors;		/* List of struct bfd_neighbor */
+  list neigh_list;		/* List of struct bfd_neighbor */
 };
 
 struct bfd_session_config
@@ -42,12 +63,21 @@ struct bfd_neighbor
 struct bfd_proto
 {
   struct proto p;
+  struct birdloop *loop;
+  pool *tpool;
+  pthread_spinlock_t lock;
 
   slab *session_slab;
   HASH(struct bfd_session) session_hash_id;
   HASH(struct bfd_session) session_hash_ip;
 
-  list sockets;
+  sock *notify_rs;
+  sock *notify_ws;
+  list notify_list;
+
+  sock *rx_1;
+  sock *rx_m;
+  list sock_list;
 };
 
 struct bfd_socket
@@ -60,16 +90,20 @@ struct bfd_socket
 struct bfd_session
 {
   node n;
+  ip_addr addr;				/* Address of session */
   struct bfd_session *next_id;		/* Next in bfd.session_hash_id */
   struct bfd_session *next_ip;		/* Next in bfd.session_hash_ip */
+  struct bfd_proto *bfd;
 
   u8 opened;
+  u8 passive;
   u8 poll_active;
   u8 poll_scheduled;
   
   u8 loc_state;
   u8 rem_state;
   u8 loc_diag;
+  u8 rem_diag;
   u32 loc_id;				/* Local session ID (local discriminator) */
   u32 rem_id;				/* Remote session ID (remote discriminator) */
   u32 des_min_tx_int;			/* Desired min rx interval, local option */
@@ -83,11 +117,13 @@ struct bfd_session
   u8 detect_mult;			/* Announced detect_mult, local option */
   u8 rem_detect_mult;			/* Last received detect_mult */
 
-  xxx_time last_tx;			/* Time of last sent periodic control packet */
-  xxx_time last_rx;			/* Time of last received valid control packet */
+  btime last_tx;			/* Time of last sent periodic control packet */
+  btime last_rx;			/* Time of last received valid control packet */
 
   timer2 *tx_timer;			/* Periodic control packet timer */
   timer2 *hold_timer;			/* Timer for session down detection time */
+
+  struct bfd_socket *bsock;		/* Socket associated with session */
 };
 
 
@@ -110,9 +146,30 @@ struct bfd_session
 #define BFD_POLL_TX		1
 #define BFD_POLL_RX		2
 
+#define BFD_FLAG_POLL		(1 << 5)
+#define BFD_FLAG_FINAL		(1 << 4)
+#define BFD_FLAG_CPI		(1 << 3)
+#define BFD_FLAG_AP		(1 << 2)
+#define BFD_FLAG_DEMAND		(1 << 1)
+#define BFD_FLAG_MULTIPOINT	(1 << 0)
+
+
+static inline void bfd_lock_sessions(struct bfd_proto *p) { pthread_spin_lock(&p->lock); }
+static inline void bfd_unlock_sessions(struct bfd_proto *p) { pthread_spin_unlock(&p->lock); }
+
+/* bfd.c */
+struct bfd_session * bfd_find_session_by_id(struct bfd_proto *p, u32 id);
+struct bfd_session * bfd_find_session_by_addr(struct bfd_proto *p, ip_addr addr);
+void bfd_session_process_ctl(struct bfd_session *s, u8 flags, u32 old_tx_int, u32 old_rx_int);
+void bfd_show_sessions(struct proto *P);
+
+/* packets.c */
+void bfd_send_ctl(struct bfd_proto *p, struct bfd_session *s, int final);
+sock * bfd_open_rx_sk(struct bfd_proto *p, int multihop);
+struct bfd_socket * bfd_get_socket(struct bfd_proto *p, ip_addr local, struct iface *ifa);
+void bfd_free_socket(struct bfd_socket *sk);
 
 
 
 
-
-#endif _BIRD_BFD_H_
+#endif /* _BIRD_BFD_H_ */
diff --git a/proto/bfd/config.Y b/proto/bfd/config.Y
index a5414d4e..f1193d70 100644
--- a/proto/bfd/config.Y
+++ b/proto/bfd/config.Y
@@ -22,7 +22,7 @@ static struct bfd_neighbor *this_bfd_neighbor;
 CF_DECLS
 
 CF_KEYWORDS(BFD, MIN, IDLE, RX, TX, INTERVAL, MULTIPLIER, MULTIHOP, PASSIVE,
-	NEIGHBOR)
+	NEIGHBOR, DEV)
 
 %type <iface> bfd_neigh_iface
 %type <a> bfd_neigh_local
@@ -34,7 +34,7 @@ CF_ADDTO(proto, bfd_proto)
 bfd_proto_start: proto_start BFD
 {
   this_proto = proto_config_new(&proto_bfd, sizeof(struct bfd_config), $1);
-  init_list(&BFD_CFG->neighbors);
+  init_list(&BFD_CFG->neigh_list);
 };
 
 bfd_proto_item:
@@ -99,7 +99,7 @@ bfd_neigh_local:
 bfd_neighbor: NEIGHBOR ipa bfd_neigh_iface bfd_neigh_local bfd_session
 {
   this_bfd_neighbor = cfg_allocz(sizeof(struct bfd_neighbor));
-  add_tail(&BFD_CFG->neighbors, NODE this_bfd_neighbor);
+  add_tail(&BFD_CFG->neigh_list, NODE this_bfd_neighbor);
 
   BFD_NEIGHBOR->addr = $2;
   BFD_NEIGHBOR->local = $4;
@@ -108,6 +108,9 @@ bfd_neighbor: NEIGHBOR ipa bfd_neigh_iface bfd_neigh_local bfd_session
 };
 
 
+CF_CLI(SHOW BFD SESSIONS, optsym, [<name>], [[Show information about BFD sessions]])
+{ bfd_show_sessions(proto_get_named($4, &proto_bfd)); };
+
 CF_CODE
 
 CF_END
diff --git a/proto/bfd/io.c b/proto/bfd/io.c
index f7fbc67a..c5f2d1b0 100644
--- a/proto/bfd/io.c
+++ b/proto/bfd/io.c
@@ -1,18 +1,44 @@
+/*
+ *	BIRD -- I/O and event loop
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <poll.h>
+#include <pthread.h>
+#include <time.h>
+#include <sys/time.h>
+
+#include "nest/bird.h"
+#include "proto/bfd/io.h"
 
 #include "lib/buffer.h"
 #include "lib/heap.h"
+#include "lib/lists.h"
+#include "lib/resource.h"
+#include "lib/event.h"
+#include "lib/socket.h"
+
 
 struct birdloop
 {
   pool *pool;
+  pthread_t thread;
+  pthread_mutex_t mutex;
 
-  int wakeup_fds[2];
-  u8 poll_active;
-
-  xxx_time last_time;
-  xxx_time real_time;
+  btime last_time;
+  btime real_time;
   u8 use_monotonic_clock;
 
+  u8 poll_active;
+  u8 wakeup_masked;
+  int wakeup_fds[2];
+
   BUFFER(timer2 *) timers;
   list event_list;
   list sock_list;
@@ -22,13 +48,35 @@ struct birdloop
   BUFFER(struct pollfd) poll_fd;
   u8 poll_changed;
   u8 close_scheduled;
-
 };
 
 
+
+static pthread_key_t current_loop_key;
+
+static inline struct birdloop *
+birdloop_current(void)
+{
+  return pthread_getspecific(current_loop_key);
+}
+
+static inline void
+birdloop_set_current(struct birdloop *loop)
+{
+  pthread_setspecific(current_loop_key, loop);
+}
+
+static inline void
+birdloop_init_current(void)
+{
+  pthread_key_create(&current_loop_key, NULL);
+}
+
+
+
 static void times_update_alt(struct birdloop *loop);
 
-static int
+static void
 times_init(struct birdloop *loop)
 {
   struct timespec ts;
@@ -47,12 +95,12 @@ times_init(struct birdloop *loop)
   }
 
   /*
-  if ((tv.tv_sec < 0) || (((s64) tv.tv_sec) > ((s64) 1 << 40)))
+  if ((ts.tv_sec < 0) || (((s64) ts.tv_sec) > ((s64) 1 << 40)))
     log(L_WARN "Monotonic clock is crazy");
   */
 
   loop->use_monotonic_clock = 1;
-  loop->last_time = (tv.tv_sec S) + (tv.tv_nsec / 1000);
+  loop->last_time = (ts.tv_sec S) + (ts.tv_nsec / 1000);
   loop->real_time = 0;
 }
 
@@ -66,7 +114,7 @@ times_update_pri(struct birdloop *loop)
   if (rv < 0)
     die("clock_gettime: %m");
 
-  xxx_time new_time = (tv.tv_sec S) + (tv.tv_nsec / 1000);
+  btime new_time = (ts.tv_sec S) + (ts.tv_nsec / 1000);
 
   /*
   if (new_time < loop->last_time)
@@ -87,8 +135,8 @@ times_update_alt(struct birdloop *loop)
   if (rv < 0)
     die("gettimeofday: %m");
 
-  xxx_time new_time = (tv.tv_sec S) + tv.tv_usec;
-  xxx_time delta = new_time - loop->real_time;
+  btime new_time = (tv.tv_sec S) + tv.tv_usec;
+  btime delta = new_time - loop->real_time;
 
   if ((delta < 0) || (delta > (60 S)))
   {
@@ -113,15 +161,18 @@ times_update(struct birdloop *loop)
     times_update_alt(loop);
 }
 
+btime
+current_time(void)
+{
+  return birdloop_current()->last_time;
+}
+
 
 
 static void
 pipe_new(int *pfds)
 {
-  int pfds[2], rv;
-  sock *sk;
-  
-  rv = pipe(pfds);
+  int rv = pipe(pfds);
   if (rv < 0)
     die("pipe: %m");
 
@@ -132,20 +183,14 @@ pipe_new(int *pfds)
     die("fcntl(O_NONBLOCK): %m");
 }
 
-static void
-wakeup_init(struct birdloop *loop)
-{
-  pipe_new(loop->wakeup_fds);
-}
-
-static void
-wakeup_drain(struct birdloop *loop)
+void
+pipe_drain(int fd)
 {
   char buf[64];
   int rv;
   
  try:
-  rv = read(loop->wakeup_fds[0], buf, 64);
+  rv = read(fd, buf, 64);
   if (rv < 0)
   {
     if (errno == EINTR)
@@ -158,14 +203,14 @@ wakeup_drain(struct birdloop *loop)
     goto try;
 }
 
-static void
-wakeup_kick(struct birdloop *loop)
+void
+pipe_kick(int fd)
 {
   u64 v = 1;
   int rv;
 
  try:
-  rv = write(loop->wakeup_fds[1], &v, sizeof(u64));
+  rv = write(fd, &v, sizeof(u64));
   if (rv < 0)
   {
     if (errno == EINTR)
@@ -176,16 +221,45 @@ wakeup_kick(struct birdloop *loop)
   }
 }
 
+static inline void
+wakeup_init(struct birdloop *loop)
+{
+  pipe_new(loop->wakeup_fds);
+}
+
+static inline void
+wakeup_drain(struct birdloop *loop)
+{
+  pipe_drain(loop->wakeup_fds[0]);
+}
+
+static inline void
+wakeup_do_kick(struct birdloop *loop) 
+{
+  pipe_kick(loop->wakeup_fds[1]);
+}
+
+static inline void
+wakeup_kick(struct birdloop *loop)
+{
+  if (!loop->wakeup_masked)
+    wakeup_do_kick(loop);
+  else
+    loop->wakeup_masked = 2;
+}
 
 
 
-static inline uint events_waiting(struct birdloop *loop)
-{ return !EMPTY_LIST(loop->event_list); }
+static inline uint
+events_waiting(struct birdloop *loop)
+{
+  return !EMPTY_LIST(loop->event_list);
+}
 
-static void
+static inline void
 events_init(struct birdloop *loop)
 {
-  list_init(&poll->event_list);
+  init_list(&loop->event_list);
 }
 
 static void
@@ -198,6 +272,8 @@ events_fire(struct birdloop *loop)
 void
 ev2_schedule(event *e)
 {
+  struct birdloop *loop = birdloop_current();
+
   if (loop->poll_active && EMPTY_LIST(loop->event_list))
     wakeup_kick(loop);
 
@@ -208,6 +284,7 @@ ev2_schedule(event *e)
 }
 
 
+
 #define TIMER_LESS(a,b)		((a)->expires < (b)->expires)
 #define TIMER_SWAP(heap,a,b,t)	(t = heap[a], heap[a] = heap[b], heap[b] = t, \
 				   heap[a]->index = (a), heap[b]->index = (b))
@@ -239,14 +316,15 @@ tm2_dump(resource *r)
   if (t->recurrent)
     debug("recur %d, ", t->recurrent);
   if (t->expires)
-    debug("expires in %d sec)\n", t->expires - xxx_now);
+    debug("expires in %d ms)\n", (t->expires - current_time()) TO_MS);
   else
     debug("inactive)\n");
 }
 
+
 static struct resclass tm2_class = {
   "Timer",
-  sizeof(timer),
+  sizeof(timer2),
   tm2_free,
   tm2_dump,
   NULL,
@@ -262,9 +340,9 @@ tm2_new(pool *p)
 }
 
 void
-tm2_start(timer2 *t, xxx_time after)
+tm2_set(timer2 *t, btime when)
 {
-  xxx_time when = loop->last_time + after;
+  struct birdloop *loop = birdloop_current();
   uint tc = timers_count(loop);
 
   if (!t->expires)
@@ -289,13 +367,21 @@ tm2_start(timer2 *t, xxx_time after)
     wakeup_kick(loop);
 }
 
+void
+tm2_start(timer2 *t, btime after)
+{
+  tm2_set(t, current_time() + MAX(after, 0));
+}
+
 void
 tm2_stop(timer2 *t)
 {
   if (!t->expires)
     return;
 
-  uint tc = timers_count(XXX);
+  struct birdloop *loop = birdloop_current();
+  uint tc = timers_count(loop);
+
   HEAP_DELETE(loop->timers.data, tc, timer2 *, TIMER_LESS, TIMER_SWAP, t->index);
   BUFFER_POP(loop->timers);
 
@@ -313,7 +399,7 @@ timers_init(struct birdloop *loop)
 static void
 timers_fire(struct birdloop *loop)
 {
-  xxx_time base_time;
+  btime base_time;
   timer2 *t;
 
   times_update(loop);
@@ -326,16 +412,15 @@ timers_fire(struct birdloop *loop)
 
     if (t->recurrent)
     {
-      xxx_time after = t->recurrent;
-      xxx_time delta = loop->last_time - t->expires;
+      btime when = t->expires + t->recurrent;
       
+      if (when <= loop->last_time)
+	when = loop->last_time + t->recurrent;
+
       if (t->randomize)
-	after += random() % (t->randomize + 1);
+	when += random() % (t->randomize + 1);
 
-      if (delta > after)
-	delta = 0;
-
-      tm2_start(t, after - delta);
+      tm2_set(t, when);
     }
     else
       tm2_stop(t);
@@ -345,15 +430,16 @@ timers_fire(struct birdloop *loop)
 }
 
 
+
 static void
 sockets_init(struct birdloop *loop)
 {
-  list_init(&poll->sock_list);
-  poll->sock_num = 0;
+  init_list(&loop->sock_list);
+  loop->sock_num = 0;
 
   BUFFER_INIT(loop->poll_sk, loop->pool, 4);
   BUFFER_INIT(loop->poll_fd, loop->pool, 4);
-  poll_changed = 0;
+  loop->poll_changed = 1;	/* add wakeup fd */
 }
 
 static void
@@ -372,7 +458,9 @@ sockets_add(struct birdloop *loop, sock *s)
 void
 sk_start(sock *s)
 {
-  sockets_add(xxx_loop, s);
+  struct birdloop *loop = birdloop_current();
+
+  sockets_add(loop, s);
 }
 
 static void
@@ -382,7 +470,7 @@ sockets_remove(struct birdloop *loop, sock *s)
   loop->sock_num--;
 
   if (s->index >= 0)
-    s->poll_sk.data[sk->index] = NULL;
+    loop->poll_sk.data[s->index] = NULL;
 
   s->index = -1;
   loop->poll_changed = 1;
@@ -393,7 +481,9 @@ sockets_remove(struct birdloop *loop, sock *s)
 void
 sk_stop(sock *s)
 {
-  sockets_remove(xxx_loop, s);
+  struct birdloop *loop = birdloop_current();
+
+  sockets_remove(loop, s);
 
   if (loop->poll_active)
   {
@@ -413,7 +503,7 @@ static void
 sockets_update(struct birdloop *loop, sock *s)
 {
   if (s->index >= 0)
-    s->poll_fd.data[s->index].events = sk_want_events(s);
+    loop->poll_fd.data[s->index].events = sk_want_events(s);
 }
 
 static void
@@ -427,7 +517,7 @@ sockets_prepare(struct birdloop *loop)
   int i = 0;
   node *n;
 
-  WALK_LIST(n, &loop->sock_list)
+  WALK_LIST(n, loop->sock_list)
   {
     sock *s = SKIP_BACK(sock, n, n);
 
@@ -470,6 +560,8 @@ sockets_close_fds(struct birdloop *loop)
   loop->close_scheduled = 0;
 }
 
+int sk_read(sock *s);
+int sk_write(sock *s);
 
 static void
 sockets_fire(struct birdloop *loop)
@@ -507,11 +599,20 @@ sockets_fire(struct birdloop *loop)
 }
 
 
+
+static void * birdloop_main(void *arg);
+
 struct birdloop *
 birdloop_new(pool *p)
 {
+  /* FIXME: this init should be elsewhere and thread-safe */
+  static int init = 0;
+  if (!init)
+    { birdloop_init_current(); init = 1; }
+
   struct birdloop *loop = mb_allocz(p, sizeof(struct birdloop));
-  p->pool = p;
+  loop->pool = p;
+  pthread_mutex_init(&loop->mutex, NULL);
 
   times_init(loop);
   wakeup_init(loop);
@@ -520,28 +621,58 @@ birdloop_new(pool *p)
   timers_init(loop);
   sockets_init(loop);
 
+
+  int rv = pthread_create(&loop->thread, NULL, birdloop_main, loop);
+  if (rv < 0)
+    die("pthread_create(): %m");
+
   return loop;
 }
 
 void
 birdloop_enter(struct birdloop *loop)
 {
-  pthread_mutex_lock(loop->mutex);
+  /* TODO: these functions could save and restore old context */
+  pthread_mutex_lock(&loop->mutex);
+  birdloop_set_current(loop);
 }
 
 void
 birdloop_leave(struct birdloop *loop)
 {
-  pthread_mutex_unlock(loop->mutex);
+  /* TODO: these functions could save and restore old context */
+  birdloop_set_current(NULL);
+  pthread_mutex_unlock(&loop->mutex);
 }
 
+void
+birdloop_mask_wakeups(struct birdloop *loop)
+{
+  pthread_mutex_lock(&loop->mutex);
+  loop->wakeup_masked = 1;
+  pthread_mutex_unlock(&loop->mutex);
+}
 
 void
-birdloop_main(struct birdloop *loop)
+birdloop_unmask_wakeups(struct birdloop *loop)
 {
-  timer2 *t;
-  int timeout;
+  pthread_mutex_lock(&loop->mutex);
+  if (loop->wakeup_masked == 2)
+    wakeup_do_kick(loop);
+  loop->wakeup_masked = 0;
+  pthread_mutex_unlock(&loop->mutex);
+}
 
+static void *
+birdloop_main(void *arg)
+{
+  struct birdloop *loop = arg;
+  timer2 *t;
+  int rv, timeout;
+
+  birdloop_set_current(loop);
+
+  pthread_mutex_lock(&loop->mutex);
   while (1)
   {
     events_fire(loop);
@@ -559,7 +690,7 @@ birdloop_main(struct birdloop *loop)
       sockets_prepare(loop);
 
     loop->poll_active = 1;
-    pthread_mutex_unlock(loop->mutex);
+    pthread_mutex_unlock(&loop->mutex);
 
   try:
     rv = poll(loop->poll_fd.data, loop->poll_fd.used, timeout);
@@ -570,7 +701,7 @@ birdloop_main(struct birdloop *loop)
       die("poll: %m");
     }
 
-    pthread_mutex_lock(loop->mutex);
+    pthread_mutex_lock(&loop->mutex);
     loop->poll_active = 0;
 
     if (loop->close_scheduled)
@@ -581,6 +712,8 @@ birdloop_main(struct birdloop *loop)
 
     timers_fire(loop);
   }
+
+  return NULL;
 }
 
 
diff --git a/proto/bfd/io.h b/proto/bfd/io.h
index 7fc45194..c186ba2b 100644
--- a/proto/bfd/io.h
+++ b/proto/bfd/io.h
@@ -1,44 +1,69 @@
+/*
+ *	BIRD -- I/O and event loop
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ */
 
-typedef s64 xxx_time;
+#ifndef _BIRD_BFD_IO_H_
+#define _BIRD_BFD_IO_H_
 
-typedef struct timer
+#include "nest/bird.h"
+#include "lib/lists.h"
+#include "lib/resource.h"
+#include "lib/event.h"
+#include "lib/socket.h"
+// #include "lib/timer.h"
+
+
+#define S	*1000000
+#define MS	*1000
+#define US	*1
+#define TO_S	/1000000
+#define TO_MS	/1000
+#define TO_US	/1
+
+
+typedef s64 btime;
+
+typedef struct timer2
 {
   resource r;
   void (*hook)(struct timer2 *);
   void *data;
 
-  xxx_time expires;			/* 0=inactive */
-  unsigned randomize;			/* Amount of randomization */
-  unsigned recurrent;			/* Timer recurrence */
+  btime expires;			/* 0=inactive */
+  uint randomize;			/* Amount of randomization */
+  uint recurrent;			/* Timer recurrence */
 
   int index;
-} timer;
+} timer2;
 
 
+btime current_time(void);
 
 void ev2_schedule(event *e);
 
 
-
 timer2 *tm2_new(pool *p);
-void tm2_start(timer2 *t, xxx_time after);
+void tm2_set(timer2 *t, btime when);
+void tm2_start(timer2 *t, btime after);
 void tm2_stop(timer2 *t);
 
-static inline xxx_time
-tm2_remains(timer2 *t)
+static inline int
+tm2_active(timer2 *t)
 {
-  return (t->expires > xxxnow) ? t->expires - xxxnow : 0;
+  return t->expires != 0;
 }
 
-static inline void
-tm2_start_max(timer2 *t, xxx_time after)
+static inline btime 
+tm2_remains(timer2 *t)
 {
-  xxx_time rem = tm2_remains(t);
-  tm2_start(t, MAX(rem, after));
+  btime now = current_time();
+  return (t->expires > now) ? (t->expires - now) : 0;
 }
 
 static inline timer2 *
-tm2_new_set(pool *p, void (*hook)(struct timer2 *), void *data, uint rec, uint rand)
+tm2_new_init(pool *p, void (*hook)(struct timer2 *), void *data, uint rec, uint rand)
 {
   timer2 *t = tm2_new(p);
   t->hook = hook;
@@ -48,6 +73,14 @@ tm2_new_set(pool *p, void (*hook)(struct timer2 *), void *data, uint rec, uint r
   return t;
 }
 
+/*
+static inline void
+tm2_start_max(timer2 *t, btime after)
+{
+  btime rem = tm2_remains(t);
+  tm2_start(t, _MAX(rem, after));
+}
+*/
 
 
 void sk_start(sock *s);
@@ -58,5 +91,8 @@ void sk_stop(sock *s);
 struct birdloop *birdloop_new(pool *p);
 void birdloop_enter(struct birdloop *loop);
 void birdloop_leave(struct birdloop *loop);
-void birdloop_main(struct birdloop *loop);
+void birdloop_mask_wakeups(struct birdloop *loop);
+void birdloop_unmask_wakeups(struct birdloop *loop);
 
+
+#endif /* _BIRD_BFD_IO_H_ */
diff --git a/proto/bfd/packets.c b/proto/bfd/packets.c
index e48a5aaa..8f7a1f65 100644
--- a/proto/bfd/packets.c
+++ b/proto/bfd/packets.c
@@ -1,11 +1,10 @@
+/*
+ *	BIRD -- Bidirectional Forwarding Detection (BFD)
+ *
+ *	Can be freely distributed and used under the terms of the GNU GPL.
+ */
 
-
-#define BFD_FLAG_POLL		(1 << 5)
-#define BFD_FLAG_FINAL		(1 << 4)
-#define BFD_FLAG_CPI		(1 << 3)
-#define BFD_FLAG_AP		(1 << 2)
-#define BFD_FLAG_DEMAND		(1 << 1)
-#define BFD_FLAG_MULTIPOINT	(1 << 0)
+#include "bfd.h"
 
 
 struct bfd_ctl_packet
@@ -21,12 +20,14 @@ struct bfd_ctl_packet
   u32 req_min_echo_rx_int;
 };
 
+#define BFD_BASE_LEN sizeof(struct bfd_ctl_packet)
 
-static inline void bfd_pack_vdiag(u8 version, u8 diag)
+
+static inline u8 bfd_pack_vdiag(u8 version, u8 diag)
 { return (version << 5) | diag; }
 
-static inline void bfd_pack_flags(u8 state, u8 flags)
-{ return (state << 6) | diag; }
+static inline u8 bfd_pack_flags(u8 state, u8 flags)
+{ return (state << 6) | flags; }
 
 static inline u8 bfd_pkt_get_version(struct bfd_ctl_packet *pkt)
 { return pkt->vdiag >> 5; }
@@ -45,17 +46,17 @@ static inline void bfd_pkt_set_state(struct bfd_ctl_packet *pkt, u8 val)
 void
 bfd_send_ctl(struct bfd_proto *p, struct bfd_session *s, int final)
 {
-  sock *sk = p->skX;
-  struct bfd_ctl_packet *pkt = (struct ospf_packet *) sk->tbuf;
+  sock *sk = s->bsock->sk;
+  struct bfd_ctl_packet *pkt = (struct bfd_ctl_packet *) sk->tbuf;
 
   pkt->vdiag = bfd_pack_vdiag(1, s->loc_diag);
   pkt->flags = bfd_pack_flags(s->loc_state, 0);
   pkt->detect_mult = s->detect_mult;
-  pkt->length = 24;
+  pkt->length = BFD_BASE_LEN;
   pkt->snd_id = htonl(s->loc_id);
   pkt->rcv_id = htonl(s->rem_id);
-  pkt->des_min_tx_int = htonl(s->des_min_tx_int);
-  pkt->req_min_rx_int = htonl(s->req_min_rx_int);
+  pkt->des_min_tx_int = htonl(s->des_min_tx_new);
+  pkt->req_min_rx_int = htonl(s->req_min_rx_new);
   pkt->req_min_echo_rx_int = 0;
 
   if (final)
@@ -63,15 +64,21 @@ bfd_send_ctl(struct bfd_proto *p, struct bfd_session *s, int final)
   else if (s->poll_active)
     pkt->flags |= BFD_FLAG_POLL;
 
-  // XXX
-  sk_send_to(sk, len, dst, 0);  
+  if (sk->tbuf != sk->tpos)
+    log(L_ERR "%s: old packet was overwritten in TX buffer", p->p.name);
+
+  sk_send_to(sk, pkt->length, s->addr, sk->dport);
 }
 
-int
-bfd_ctl_rx_hook(sock *sk, int len)
+#define DROP(DSC,VAL) do { err_dsc = DSC; err_val = VAL; goto drop; } while(0)
+
+static int
+bfd_rx_hook(sock *sk, int len)
 {
-  struct bfd_proto *p = sk->data;
-  struct bfd_ctl_packet *pkt =sk->rbuf;
+  struct bfd_proto *p =  sk->data;
+  struct bfd_ctl_packet *pkt = (struct bfd_ctl_packet *) sk->rbuf;
+  const char *err_dsc = NULL;
+  uint err_val = 0;
 
   if (len < BFD_BASE_LEN)
     DROP("too short", len);
@@ -108,11 +115,11 @@ bfd_ctl_rx_hook(sock *sk, int len)
     if (ps > BFD_STATE_DOWN)
       DROP("invalid init state", ps);
       
-    s = bfd_find_session_by_ip(p, sk->faddr);
+    s = bfd_find_session_by_addr(p, sk->faddr);
 
     /* FIXME: better session matching and message */
     if (!s || !s->opened)
-      return;
+      return 1;
   }
 
   /* FIXME: better authentication handling and message */
@@ -120,17 +127,18 @@ bfd_ctl_rx_hook(sock *sk, int len)
     DROP("authentication not supported", 0);
 
 
-  u32 old_rx_int = s->des_min_tx_int;
-  u32 old_tx_int = s->rem_min_rx_int;
+  u32 old_tx_int = s->des_min_tx_int;
+  u32 old_rx_int = s->rem_min_rx_int;
 
   s->rem_id = ntohl(pkt->snd_id);
   s->rem_state = bfd_pkt_get_state(pkt);
+  s->rem_diag = bfd_pkt_get_diag(pkt);
   s->rem_demand_mode = pkt->flags & BFD_FLAG_DEMAND;
   s->rem_min_tx_int = ntohl(pkt->des_min_tx_int);
   s->rem_min_rx_int = ntohl(pkt->req_min_rx_int);
   s->rem_detect_mult = pkt->detect_mult;
 
-  bfd_session_process_ctl(s, pkt->flags, xxx);
+  bfd_session_process_ctl(s, pkt->flags, old_tx_int, old_rx_int);
   return 1;
 
  drop:
@@ -138,10 +146,17 @@ bfd_ctl_rx_hook(sock *sk, int len)
   return 1;
 }
 
+static void
+bfd_err_hook(sock *sk, int err)
+{
+  struct bfd_proto *p = sk->data;
+  log(L_ERR "%s: Socket error: %m", p->p.name, err);
+}
+
 sock *
 bfd_open_rx_sk(struct bfd_proto *p, int multihop)
 {
-  sock *sk = sk_new(p->p.pool);
+  sock *sk = sk_new(p->tpool);
   sk->type = SK_UDP;
   sk->sport = !multihop ? BFD_CONTROL_PORT : BFD_MULTI_CTL_PORT;
   sk->data = p;
@@ -149,33 +164,59 @@ bfd_open_rx_sk(struct bfd_proto *p, int multihop)
   sk->rbsize = 64; // XXX
   sk->rx_hook = bfd_rx_hook;
   sk->err_hook = bfd_err_hook;
-  
-  sk->flags = SKF_LADDR_RX | (!multihop ? SKF_TTL_RX : 0);
+
+  /* TODO: configurable ToS and priority */
+  sk->tos = IP_PREC_INTERNET_CONTROL;
+  sk->priority = sk_priority_control;
+  sk->flags = SKF_THREAD | SKF_LADDR_RX | (!multihop ? SKF_TTL_RX : 0);
+
+#ifdef IPV6
+  sk->flags |= SKF_V6ONLY;
+#endif
 
   if (sk_open(sk) < 0)
     goto err;
+
+  sk_start(sk);
+  return sk;
+
+ err:
+  rfree(sk);
+  return NULL;
 }
 
 static inline sock *
 bfd_open_tx_sk(struct bfd_proto *p, ip_addr local, struct iface *ifa)
 {
-  sock *sk = sk_new(p->p.pool);
+  sock *sk = sk_new(p->tpool);
   sk->type = SK_UDP;
   sk->saddr = local;
+  sk->dport = ifa ? BFD_CONTROL_PORT : BFD_MULTI_CTL_PORT;
+  sk->iface = ifa;
   sk->data = p;
 
   sk->tbsize = 64; // XXX
   sk->err_hook = bfd_err_hook;
- 
-  sk->iface = new;
 
-  sk->tos = PATT->tx_tos;
-  sk->priority = PATT->tx_priority;
-  sk->ttl = PATT->ttl_security ? 255 : 1;
+  /* TODO: configurable ToS, priority and TTL security */
+  sk->tos = IP_PREC_INTERNET_CONTROL;
+  sk->priority = sk_priority_control;
+  sk->ttl = ifa ? 255 : -1;
+  sk->flags = SKF_THREAD;
+
+#ifdef IPV6
+  sk->flags |= SKF_V6ONLY;
+#endif
 
   if (sk_open(sk) < 0)
     goto err;
 
+  sk_start(sk);
+  return sk;
+
+ err:
+  rfree(sk);
+  return NULL;
 }
 
 struct bfd_socket *
@@ -183,14 +224,14 @@ bfd_get_socket(struct bfd_proto *p, ip_addr local, struct iface *ifa)
 {
   struct bfd_socket *sk;
 
-  WALK_LIST(sk, p->sockets)
+  WALK_LIST(sk, p->sock_list)
     if (ipa_equal(sk->sk->saddr, local) && (sk->sk->iface == ifa))
       return sk->uc++, sk;
 
-  sk = mb_allocz(p->p.pool, sizeof(struct bfd_socket));
+  sk = mb_allocz(p->tpool, sizeof(struct bfd_socket));
   sk->sk = bfd_open_tx_sk(p, local, ifa);
   sk->uc = 1;
-  add_tail(&p->sockets, &sk->n);
+  add_tail(&p->sock_list, &sk->n);
 
   return sk;
 }
diff --git a/proto/ospf/topology.c b/proto/ospf/topology.c
index 5d93c0e9..f25db9a7 100644
--- a/proto/ospf/topology.c
+++ b/proto/ospf/topology.c
@@ -103,7 +103,8 @@ lsab_alloc(struct proto_ospf *po, unsigned size)
   if (po->lsab_used > po->lsab_size)
     {
       po->lsab_size = MAX(po->lsab_used, 2 * po->lsab_size);
-      po->lsab = mb_realloc(po->proto.pool, po->lsab, po->lsab_size);
+      po->lsab = po->lsab ? mb_realloc(po->lsab, po->lsab_size):
+	mb_alloc(po->proto.pool, po->lsab_size);
     }
   return ((byte *) po->lsab) + offset;
 }
diff --git a/proto/rip/rip.c b/proto/rip/rip.c
index 3ec070b3..ad285bb3 100644
--- a/proto/rip/rip.c
+++ b/proto/rip/rip.c
@@ -63,6 +63,7 @@
 #define P ((struct rip_proto *) p)
 #define P_CF ((struct rip_proto_config *)p->cf)
 
+#undef TRACE
 #define TRACE(level, msg, args...) do { if (p->debug & level) { log(L_TRACE "%s: " msg, p->name , ## args); } } while(0)
 
 static struct rip_interface *new_iface(struct proto *p, struct iface *new, unsigned long flags, struct iface_patt *patt);
diff --git a/sysdep/config.h b/sysdep/config.h
index 7bfb05d6..e2320411 100644
--- a/sysdep/config.h
+++ b/sysdep/config.h
@@ -34,6 +34,7 @@ typedef INTEGER_64 s64;
 typedef unsigned INTEGER_64 u64;
 typedef u8 byte;
 typedef u16 word;
+typedef unsigned int uint;
 
 #endif
 
diff --git a/sysdep/unix/io.c b/sysdep/unix/io.c
index c1c2168e..f3ea5d39 100644
--- a/sysdep/unix/io.c
+++ b/sysdep/unix/io.c
@@ -1420,7 +1420,9 @@ sk_send_full(sock *s, unsigned len, struct iface *ifa,
 }
 */
 
-static int
+ /* sk_read() and sk_write() are called from BFD's event loop */
+
+int
 sk_read(sock *s)
 {
   switch (s->type)
@@ -1497,7 +1499,7 @@ sk_read(sock *s)
     }
 }
 
-static int
+int
 sk_write(sock *s)
 {
   switch (s->type)