diff --git a/iscsi-scst/kernel/patches/rhel/put_page_callback-2.6.32-431.patch b/iscsi-scst/kernel/patches/rhel/put_page_callback-2.6.32-431.patch
new file mode 100644
index 000000000..be8793f3a
--- /dev/null
+++ b/iscsi-scst/kernel/patches/rhel/put_page_callback-2.6.32-431.patch
@@ -0,0 +1,453 @@
+[PATCH] put_page_callback-2.6.32-431.patch
+
+---
+ include/linux/Kbuild     |  1 +
+ include/linux/mm_types.h | 12 ++++++++++++
+ include/linux/net.h      | 40 +++++++++++++++++++++++++++++++++++++++
+ net/Kconfig              | 12 ++++++++++++
+ net/core/dev.c           |  2 +-
+ net/core/skbuff.c        | 34 ++++++++++++++++-----------------
+ net/ipv4/Makefile        |  1 +
+ net/ipv4/ip_output.c     |  4 ++--
+ net/ipv4/tcp.c           |  8 ++++----
+ net/ipv4/tcp_output.c    |  2 +-
+ net/ipv4/tcp_zero_copy.c | 49 ++++++++++++++++++++++++++++++++++++++++++++++++
+ net/ipv6/ip6_output.c    |  2 +-
+ 12 files changed, 141 insertions(+), 26 deletions(-)
+ create mode 100644 net/ipv4/tcp_zero_copy.c
+
+diff --git a/include/linux/Kbuild b/include/linux/Kbuild
+index 1ac23c9..352c604 100644
+--- a/include/linux/Kbuild
++++ b/include/linux/Kbuild
+@@ -113,6 +113,7 @@ header-y += map_to_7segment.h
+ header-y += matroxfb.h
+ header-y += meye.h
+ header-y += minix_fs.h
++header-y += mm.h
+ header-y += mmtimer.h
+ header-y += mqueue.h
+ header-y += mtio.h
+diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
+index 645f205..7b6de1f 100644
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -106,6 +106,18 @@ struct page {
+ 	 */
+ 	void *shadow;
+ #endif
++
++#if defined(CONFIG_TCP_ZERO_COPY_TRANSFER_COMPLETION_NOTIFICATION)
++	/*
++	 * Used to implement support for notification on zero-copy TCP transfer
++	 * completion. It might look as not good to have this field here and
++	 * it's better to have it in struct sk_buff, but it would make the code
++	 * much more complicated and fragile, since all skb then would have to
++	 * contain only pages with the same value in this field.
++	 */
++	 void *net_priv;
++#endif
++
+ };
+ 
+ /*
+diff --git a/include/linux/net.h b/include/linux/net.h
+index 58ada6b..b0adbdc 100644
+--- a/include/linux/net.h
++++ b/include/linux/net.h
+@@ -20,6 +20,7 @@
+ 
+ #include <linux/socket.h>
+ #include <asm/socket.h>
++#include <linux/mm.h>
+ 
+ #define NPROTO		AF_MAX
+ 
+@@ -389,5 +390,44 @@ static const struct proto_ops name##_ops = {			\
+ extern struct ratelimit_state net_ratelimit_state;
+ #endif
+ 
++#if defined(CONFIG_TCP_ZERO_COPY_TRANSFER_COMPLETION_NOTIFICATION)
++/* Support for notification on zero-copy TCP transfer completion */
++typedef void (*net_get_page_callback_t)(struct page *page);
++typedef void (*net_put_page_callback_t)(struct page *page);
++
++extern net_get_page_callback_t net_get_page_callback;
++extern net_put_page_callback_t net_put_page_callback;
++
++extern int net_set_get_put_page_callbacks(
++	net_get_page_callback_t get_callback,
++	net_put_page_callback_t put_callback);
++
++/*
++ * See comment for net_set_get_put_page_callbacks() why those functions
++ * don't need any protection.
++ */
++static inline void net_get_page(struct page *page)
++{
++	if (page->net_priv != 0)
++		net_get_page_callback(page);
++	get_page(page);
++}
++static inline void net_put_page(struct page *page)
++{
++	if (page->net_priv != 0)
++		net_put_page_callback(page);
++	put_page(page);
++}
++#else
++static inline void net_get_page(struct page *page)
++{
++	get_page(page);
++}
++static inline void net_put_page(struct page *page)
++{
++	put_page(page);
++}
++#endif /* CONFIG_TCP_ZERO_COPY_TRANSFER_COMPLETION_NOTIFICATION */
++
+ #endif /* __KERNEL__ */
+ #endif	/* _LINUX_NET_H */
+diff --git a/net/Kconfig b/net/Kconfig
+index de77d58..58d7398 100644
+--- a/net/Kconfig
++++ b/net/Kconfig
+@@ -72,6 +72,18 @@ config INET
+ 
+ 	  Short answer: say Y.
+ 
++config TCP_ZERO_COPY_TRANSFER_COMPLETION_NOTIFICATION
++	bool "TCP/IP zero-copy transfer completion notification"
++        depends on INET
++        default SCST_ISCSI
++	---help---
++	  Adds support for sending a notification upon completion of a
++          zero-copy TCP/IP transfer. This can speed up certain TCP/IP
++          software. Currently this is only used by the iSCSI target driver
++          iSCSI-SCST.
++
++          If unsure, say N.
++
+ if INET
+ source "net/ipv4/Kconfig"
+ source "net/ipv6/Kconfig"
+diff --git a/net/core/dev.c b/net/core/dev.c
+index da35549..57f0a77 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3622,7 +3622,7 @@ pull:
+ 		skb_shinfo(skb)->frags[0].size -= grow;
+ 
+ 		if (unlikely(!skb_shinfo(skb)->frags[0].size)) {
+-			put_page(skb_shinfo(skb)->frags[0].page);
++			net_put_page(skb_shinfo(skb)->frags[0].page);
+ 			memmove(skb_shinfo(skb)->frags,
+ 				skb_shinfo(skb)->frags + 1,
+ 				--skb_shinfo(skb)->nr_frags);
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 361f45a..3b78821 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -76,13 +76,13 @@ static struct kmem_cache *skbuff_fclone_cache __read_mostly;
+ static void sock_pipe_buf_release(struct pipe_inode_info *pipe,
+ 				  struct pipe_buffer *buf)
+ {
+-	put_page(buf->page);
++	net_put_page(buf->page);
+ }
+ 
+ static void sock_pipe_buf_get(struct pipe_inode_info *pipe,
+ 				struct pipe_buffer *buf)
+ {
+-	get_page(buf->page);
++	net_get_page(buf->page);
+ }
+ 
+ static int sock_pipe_buf_steal(struct pipe_inode_info *pipe,
+@@ -394,7 +394,7 @@ static void skb_release_data(struct sk_buff *skb)
+ 		if (skb_shinfo(skb)->nr_frags) {
+ 			int i;
+ 			for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
+-				put_page(skb_shinfo(skb)->frags[i].page);
++				net_put_page(skb_shinfo(skb)->frags[i].page);
+ 		}
+ 
+ 		/*
+@@ -699,7 +699,7 @@ static int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
+ 		if (!page) {
+ 			while (head) {
+ 				struct page *next = (struct page *)head->private;
+-				put_page(head);
++				net_put_page(head);
+ 				head = next;
+ 			}
+ 			return -ENOMEM;
+@@ -714,7 +714,7 @@ static int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
+ 
+ 	/* skb frags release userspace buffers */
+ 	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
+-		put_page(skb_shinfo(skb)->frags[i].page);
++		net_put_page(skb_shinfo(skb)->frags[i].page);
+ 
+ 	uarg->callback(uarg);
+ 
+@@ -880,7 +880,7 @@ struct sk_buff *__pskb_copy(struct sk_buff *skb, int headroom, gfp_t gfp_mask)
+ 		}
+ 		for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+ 			skb_shinfo(n)->frags[i] = skb_shinfo(skb)->frags[i];
+-			get_page(skb_shinfo(n)->frags[i].page);
++			net_get_page(skb_shinfo(n)->frags[i].page);
+ 		}
+ 		skb_shinfo(n)->nr_frags = i;
+ 	}
+@@ -961,7 +961,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
+ 			skb_tx(skb)->dev_zerocopy = 0;
+ 		}
+ 		for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
+-			get_page(skb_shinfo(skb)->frags[i].page);
++			net_get_page(skb_shinfo(skb)->frags[i].page);
+ 
+ 		if (skb_has_frag_list(skb))
+ 			skb_clone_fraglist(skb);
+@@ -1240,7 +1240,7 @@ drop_pages:
+ 		skb_shinfo(skb)->nr_frags = i;
+ 
+ 		for (; i < nfrags; i++)
+-			put_page(skb_shinfo(skb)->frags[i].page);
++			net_put_page(skb_shinfo(skb)->frags[i].page);
+ 
+ 		if (skb_has_frag_list(skb))
+ 			skb_drop_fraglist(skb);
+@@ -1409,7 +1409,7 @@ pull_pages:
+ 	k = 0;
+ 	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+ 		if (skb_shinfo(skb)->frags[i].size <= eat) {
+-			put_page(skb_shinfo(skb)->frags[i].page);
++			net_put_page(skb_shinfo(skb)->frags[i].page);
+ 			eat -= skb_shinfo(skb)->frags[i].size;
+ 		} else {
+ 			skb_shinfo(skb)->frags[k] = skb_shinfo(skb)->frags[i];
+@@ -1511,7 +1511,7 @@ EXPORT_SYMBOL(skb_copy_bits);
+  */
+ static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
+ {
+-	put_page(spd->pages[i]);
++	net_put_page(spd->pages[i]);
+ }
+ 
+ static inline struct page *linear_to_page(struct page *page, unsigned int *len,
+@@ -1535,7 +1535,7 @@ new_page:
+ 		off = sk->sk_sndmsg_off;
+ 		mlen = PAGE_SIZE - off;
+ 		if (mlen < 64 && mlen < *len) {
+-			put_page(p);
++			net_put_page(p);
+ 			goto new_page;
+ 		}
+ 
+@@ -1545,7 +1545,7 @@ new_page:
+ 	memcpy(page_address(p) + off, page_address(page) + *offset, *len);
+ 	sk->sk_sndmsg_off += *len;
+ 	*offset = off;
+-	get_page(p);
++	net_get_page(p);
+ 
+ 	return p;
+ }
+@@ -1566,7 +1566,7 @@ static inline int spd_fill_page(struct splice_pipe_desc *spd, struct page *page,
+ 		if (!page)
+ 			return 1;
+ 	} else
+-		get_page(page);
++		net_get_page(page);
+ 
+ 	spd->pages[spd->nr_pages] = page;
+ 	spd->partial[spd->nr_pages].len = *len;
+@@ -2196,7 +2196,7 @@ static inline void skb_split_no_header(struct sk_buff *skb,
+ 				 *    where splitting is expensive.
+ 				 * 2. Split is accurately. We make this.
+ 				 */
+-				get_page(skb_shinfo(skb)->frags[i].page);
++				net_get_page(skb_shinfo(skb)->frags[i].page);
+ 				skb_shinfo(skb1)->frags[0].page_offset += len - pos;
+ 				skb_shinfo(skb1)->frags[0].size -= len - pos;
+ 				skb_shinfo(skb)->frags[i].size	= len - pos;
+@@ -2319,7 +2319,7 @@ int skb_shift(struct sk_buff *tgt, struct sk_buff *skb, int shiftlen)
+ 			to++;
+ 
+ 		} else {
+-			get_page(fragfrom->page);
++			net_get_page(fragfrom->page);
+ 			fragto->page = fragfrom->page;
+ 			fragto->page_offset = fragfrom->page_offset;
+ 			fragto->size = todo;
+@@ -2341,7 +2341,7 @@ int skb_shift(struct sk_buff *tgt, struct sk_buff *skb, int shiftlen)
+ 		fragto = &skb_shinfo(tgt)->frags[merge];
+ 
+ 		fragto->size += fragfrom->size;
+-		put_page(fragfrom->page);
++		net_put_page(fragfrom->page);
+ 	}
+ 
+ 	/* Reposition in the original skb */
+@@ -2753,7 +2753,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
+ 
+ 		while (pos < offset + len && i < nfrags) {
+ 			*frag = skb_shinfo(skb)->frags[i];
+-			get_page(frag->page);
++			net_get_page(frag->page);
+ 			size = frag->size;
+ 
+ 			if (pos < offset) {
+diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
+index e18daba..65f5371 100644
+--- a/net/ipv4/Makefile
++++ b/net/ipv4/Makefile
+@@ -51,6 +51,7 @@ obj-$(CONFIG_TCP_CONG_LP) += tcp_lp.o
+ obj-$(CONFIG_TCP_CONG_YEAH) += tcp_yeah.o
+ obj-$(CONFIG_TCP_CONG_ILLINOIS) += tcp_illinois.o
+ obj-$(CONFIG_NETLABEL) += cipso_ipv4.o
++obj-$(CONFIG_TCP_ZERO_COPY_TRANSFER_COMPLETION_NOTIFICATION) += tcp_zero_copy.o
+ 
+ obj-$(CONFIG_XFRM) += xfrm4_policy.o xfrm4_state.o xfrm4_input.o \
+ 		      xfrm4_output.o
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 200cd2a..a9673b2 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -991,7 +991,7 @@ alloc_new_skb:
+ 						err = -EMSGSIZE;
+ 						goto error;
+ 					}
+-					get_page(page);
++					net_get_page(page);
+ 					skb_fill_page_desc(skb, i, page, off, 0);
+ 					frag = &skb_shinfo(skb)->frags[i];
+ 				}
+@@ -1223,7 +1223,7 @@ ssize_t	ip_append_page(struct sock *sk, struct page *page,
+ 		if (skb_can_coalesce(skb, i, page, offset)) {
+ 			skb_shinfo(skb)->frags[i-1].size += len;
+ 		} else if (i < MAX_SKB_FRAGS) {
+-			get_page(page);
++			net_get_page(page);
+ 			skb_fill_page_desc(skb, i, page, offset, len);
+ 		} else {
+ 			err = -EMSGSIZE;
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 3396457..d469b0e 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -826,7 +826,7 @@ new_segment:
+ 		if (can_coalesce) {
+ 			skb_shinfo(skb)->frags[i - 1].size += copy;
+ 		} else {
+-			get_page(page);
++			net_get_page(page);
+ 			skb_fill_page_desc(skb, i, page, offset, copy);
+ 		}
+ 		skb_tx(skb)->shared_frag = 1;
+@@ -1035,7 +1035,7 @@ new_segment:
+ 					goto new_segment;
+ 				} else if (page) {
+ 					if (off == PAGE_SIZE) {
+-						put_page(page);
++						net_put_page(page);
+ 						TCP_PAGE(sk) = page = NULL;
+ 						off = 0;
+ 					}
+@@ -1076,9 +1076,9 @@ new_segment:
+ 				} else {
+ 					skb_fill_page_desc(skb, i, page, off, copy);
+ 					if (TCP_PAGE(sk)) {
+-						get_page(page);
++						net_get_page(page);
+ 					} else if (off + copy < PAGE_SIZE) {
+-						get_page(page);
++						net_get_page(page);
+ 						TCP_PAGE(sk) = page;
+ 					}
+ 				}
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 566d73d..e05f0b8 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1061,7 +1061,7 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
+ 	k = 0;
+ 	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+ 		if (skb_shinfo(skb)->frags[i].size <= eat) {
+-			put_page(skb_shinfo(skb)->frags[i].page);
++			net_put_page(skb_shinfo(skb)->frags[i].page);
+ 			eat -= skb_shinfo(skb)->frags[i].size;
+ 		} else {
+ 			skb_shinfo(skb)->frags[k] = skb_shinfo(skb)->frags[i];
+diff --git a/net/ipv4/tcp_zero_copy.c b/net/ipv4/tcp_zero_copy.c
+new file mode 100644
+index 0000000..9cd990c
+--- /dev/null
++++ b/net/ipv4/tcp_zero_copy.c
+@@ -0,0 +1,49 @@
++/*
++ *	Support routines for TCP zero copy transmit
++ *
++ *	Created by Vladislav Bolkhovitin
++ *
++ *	This program is free software; you can redistribute it and/or
++ *      modify it under the terms of the GNU General Public License
++ *      version 2 as published by the Free Software Foundation.
++ */
++
++#include <linux/skbuff.h>
++
++net_get_page_callback_t net_get_page_callback __read_mostly;
++EXPORT_SYMBOL(net_get_page_callback);
++
++net_put_page_callback_t net_put_page_callback __read_mostly;
++EXPORT_SYMBOL(net_put_page_callback);
++
++/*
++ * Caller of this function must ensure that at the moment when it's called
++ * there are no pages in the system with net_priv field set to non-zero
++ * value. Hence, this function, as well as net_get_page() and net_put_page(),
++ * don't need any protection.
++ */
++int net_set_get_put_page_callbacks(
++	net_get_page_callback_t get_callback,
++	net_put_page_callback_t put_callback)
++{
++	int res = 0;
++
++	if ((net_get_page_callback != NULL) && (get_callback != NULL) &&
++	    (net_get_page_callback != get_callback)) {
++		res = -EBUSY;
++		goto out;
++	}
++
++	if ((net_put_page_callback != NULL) && (put_callback != NULL) &&
++	    (net_put_page_callback != put_callback)) {
++		res = -EBUSY;
++		goto out;
++	}
++
++	net_get_page_callback = get_callback;
++	net_put_page_callback = put_callback;
++
++out:
++	return res;
++}
++EXPORT_SYMBOL(net_set_get_put_page_callbacks);
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 26e1dda..4655fdf 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1353,7 +1353,7 @@ alloc_new_skb:
+ 						err = -EMSGSIZE;
+ 						goto error;
+ 					}
+-					get_page(page);
++					net_get_page(page);
+ 					skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
+ 					frag = &skb_shinfo(skb)->frags[i];
+ 				}
+-- 
+1.8.1.4
+