[kernel] r9956 - in dists/sid/linux-2.6/debian: . patches/bugfix patches/bugfix/all patches/series
Maximilian Attems
maks at alioth.debian.org
Fri Dec 14 20:45:03 UTC 2007
Author: maks
Date: Fri Dec 14 20:45:03 2007
New Revision: 9956
Log:
add 2.6.23.10 stable release
Added:
dists/sid/linux-2.6/debian/patches/bugfix/all/2.6.23.10
Removed:
dists/sid/linux-2.6/debian/patches/bugfix/tcp-header-misalignment.patch
Modified:
dists/sid/linux-2.6/debian/changelog
dists/sid/linux-2.6/debian/patches/series/2
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog (original)
+++ dists/sid/linux-2.6/debian/changelog Fri Dec 14 20:45:03 2007
@@ -13,9 +13,71 @@
[ maximilian attems ]
* [ppc] Reenable PMAC_BACKLIGHT.
* [sparc] Add davem get_cpu() SunFire boot patch. (closes: #440720)
- * [net] Add Xu patch: Fix TCP header misalignment.
+ * Add stable release 2.6.23.10:
+ - IPV4: Remove bogus ifdef mess in arp_process
+ - KVM: x86 emulator: Use emulator_write_emulated and not emulator_write_std
+ - KVM: SVM: Fix FPU leak while emulating clts
+ - revert "dpt_i2o: convert to SCSI hotplug model"
+ - KVM: x86 emulator: fix access registers for instructions with ModR/M
+ byte and Mod = 3
+ - KVM: x86 emulator: invd instruction
+ - KVM: SVM: Intercept the 'invd' and 'wbinvd' instructions
+ - KVM: Skip pio instruction when it is emulated, not executed
+ - KVM: VMX: Force vm86 mode if setting flags during real mode
+ - forcedeth: new mcp79 pci ids
+ - forcedeth boot delay fix
+ - PFKEY: Sending an SADB_GET responds with an SADB_GET
+ - Future of Linux 2.6.22.y series
+ - create /sys/.../power when CONFIG_PM is set
+ - USB: fix up EHCI startup synchronization
+ - RXRPC: Add missing select on CRYPTO
+ - KVM: VMX: Reset mmu context when entering real mode
+ - NET: random : secure_tcp_sequence_number should not assume
+ CONFIG_KTIME_SCALAR
+ - NET: Corrects a bug in ip_rt_acct_read()
+ - NETFILTER: Fix NULL pointer dereference in nf_nat_move_storage()
+ - netfilter: Fix kernel panic with REDIRECT target.
+ - IPV6: Restore IPv6 when MTU is big enough
+ - UNIX: EOF on non-blocking SOCK_SEQPACKET
+ - x86 setup: add a near jump to serialize %cr0 on 386/486
+ - Fix synchronize_irq races with IRQ handler
+ - CRYPTO api: Fix potential race in crypto_remove_spawn
+ - TCP: Fix TCP header misalignment
+ - tmpfs: restore missing clear_highpage
+ - TCP: MTUprobe: fix potential sk_send_head corruption
+ - NETFILTER: fix forgotten module release in xt_CONNMARK and xt_CONNSECMARK
+ - fb_ddc: fix DDC lines quirk
+ - VLAN: Fix nested VLAN transmit bug
+ - I4L: fix isdn_ioctl memory overrun vulnerability
+ - isdn: avoid copying overly-long strings
+ - nf_nat: fix memset error
+ - esp_scsi: fix reset cleanup spinlock recursion
+ - libertas: properly account for queue commands
+ - KVM: Fix hang on uniprocessor
+ - USB: make the microtek driver and HAL cooperate
+ - TEXTSEARCH: Do not allow zero length patterns in the textsearch
+ infrastructure
+ - XFRM: Fix leak of expired xfrm_states
+ - NETFILTER: xt_TCPMSS: remove network triggerable WARN_ON
+ - BRIDGE: Lost call to br_fdb_fini() in br_init() error path
+ - DECNET: dn_nl_deladdr() almost always returns no error
+ - BRIDGE: Properly dereference the br_should_route_hook
+ - PKT_SCHED: Check subqueue status before calling hard_start_xmit
+ - Freezer: Fix APM emulation breakage
+ - XFS: Make xfsbufd threads freezable
+ - TCP: Problem bug with sysctl_tcp_congestion_control function
+ - wait_task_stopped(): pass correct exit_code to wait_noreap_copyout()
+ - KVM: x86 emulator: implement 'movnti mem, reg'
+ - TCP: illinois: Incorrect beta usage
+ - futex: fix for futex_wait signal stack corruption
+ - libata: kill spurious NCQ completion detection
+ - hrtimers: avoid overflow for large relative timeouts (CVE-2007-5966)
+ - Input: ALPS - add support for model found in Dell Vostro 1400
+ - PNP: increase the maximum number of resources
+ - sched: some proc entries are missed in sched_domain sys_ctl debug code
+ - ATM: [he] initialize lock and tasklet earlier
- -- maximilian attems <maks at debian.org> Tue, 11 Dec 2007 21:09:29 +0100
+ -- maximilian attems <maks at debian.org> Fri, 14 Dec 2007 21:37:54 +0100
linux-2.6 (2.6.23-1) unstable; urgency=low
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/2.6.23.10
==============================================================================
--- (empty file)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/2.6.23.10 Fri Dec 14 20:45:03 2007
@@ -0,0 +1,2053 @@
+diff --git a/arch/i386/boot/pmjump.S b/arch/i386/boot/pmjump.S
+index 2e55923..26baeab 100644
+--- a/arch/i386/boot/pmjump.S
++++ b/arch/i386/boot/pmjump.S
+@@ -31,14 +31,14 @@ protected_mode_jump:
+ xorl %ebx, %ebx # Flag to indicate this is a boot
+ movl %edx, %esi # Pointer to boot_params table
+ movl %eax, 2f # Patch ljmpl instruction
+- jmp 1f # Short jump to flush instruction q.
+
+-1:
+ movw $__BOOT_DS, %cx
+
+ movl %cr0, %edx
+ orb $1, %dl # Protected mode (PE) bit
+ movl %edx, %cr0
++ jmp 1f # Short jump to serialize on 386/486
++1:
+
+ movw %cx, %ds
+ movw %cx, %es
+diff --git a/crypto/algapi.c b/crypto/algapi.c
+index 38aa9e9..3798ebd 100644
+--- a/crypto/algapi.c
++++ b/crypto/algapi.c
+@@ -98,6 +98,9 @@ static void crypto_remove_spawn(struct crypto_spawn *spawn,
+ return;
+
+ inst->alg.cra_flags |= CRYPTO_ALG_DEAD;
++ if (hlist_unhashed(&inst->list))
++ return;
++
+ if (!tmpl || !crypto_tmpl_get(tmpl))
+ return;
+
+@@ -333,9 +336,6 @@ int crypto_register_instance(struct crypto_template *tmpl,
+ LIST_HEAD(list);
+ int err = -EINVAL;
+
+- if (inst->alg.cra_destroy)
+- goto err;
+-
+ err = crypto_check_alg(&inst->alg);
+ if (err)
+ goto err;
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index d684208..d0a40e7 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -1432,7 +1432,7 @@ static void ahci_port_intr(struct ata_port *ap)
+ struct ata_eh_info *ehi = &ap->eh_info;
+ struct ahci_port_priv *pp = ap->private_data;
+ u32 status, qc_active;
+- int rc, known_irq = 0;
++ int rc;
+
+ status = readl(port_mmio + PORT_IRQ_STAT);
+ writel(status, port_mmio + PORT_IRQ_STAT);
+@@ -1448,74 +1448,11 @@ static void ahci_port_intr(struct ata_port *ap)
+ qc_active = readl(port_mmio + PORT_CMD_ISSUE);
+
+ rc = ata_qc_complete_multiple(ap, qc_active, NULL);
+- if (rc > 0)
+- return;
+ if (rc < 0) {
+ ehi->err_mask |= AC_ERR_HSM;
+ ehi->action |= ATA_EH_SOFTRESET;
+ ata_port_freeze(ap);
+- return;
+- }
+-
+- /* hmmm... a spurious interupt */
+-
+- /* if !NCQ, ignore. No modern ATA device has broken HSM
+- * implementation for non-NCQ commands.
+- */
+- if (!ap->sactive)
+- return;
+-
+- if (status & PORT_IRQ_D2H_REG_FIS) {
+- if (!pp->ncq_saw_d2h)
+- ata_port_printk(ap, KERN_INFO,
+- "D2H reg with I during NCQ, "
+- "this message won't be printed again\n");
+- pp->ncq_saw_d2h = 1;
+- known_irq = 1;
+- }
+-
+- if (status & PORT_IRQ_DMAS_FIS) {
+- if (!pp->ncq_saw_dmas)
+- ata_port_printk(ap, KERN_INFO,
+- "DMAS FIS during NCQ, "
+- "this message won't be printed again\n");
+- pp->ncq_saw_dmas = 1;
+- known_irq = 1;
+- }
+-
+- if (status & PORT_IRQ_SDB_FIS) {
+- const __le32 *f = pp->rx_fis + RX_FIS_SDB;
+-
+- if (le32_to_cpu(f[1])) {
+- /* SDB FIS containing spurious completions
+- * might be dangerous, whine and fail commands
+- * with HSM violation. EH will turn off NCQ
+- * after several such failures.
+- */
+- ata_ehi_push_desc(ehi,
+- "spurious completions during NCQ "
+- "issue=0x%x SAct=0x%x FIS=%08x:%08x",
+- readl(port_mmio + PORT_CMD_ISSUE),
+- readl(port_mmio + PORT_SCR_ACT),
+- le32_to_cpu(f[0]), le32_to_cpu(f[1]));
+- ehi->err_mask |= AC_ERR_HSM;
+- ehi->action |= ATA_EH_SOFTRESET;
+- ata_port_freeze(ap);
+- } else {
+- if (!pp->ncq_saw_sdb)
+- ata_port_printk(ap, KERN_INFO,
+- "spurious SDB FIS %08x:%08x during NCQ, "
+- "this message won't be printed again\n",
+- le32_to_cpu(f[0]), le32_to_cpu(f[1]));
+- pp->ncq_saw_sdb = 1;
+- }
+- known_irq = 1;
+ }
+-
+- if (!known_irq)
+- ata_port_printk(ap, KERN_INFO, "spurious interrupt "
+- "(irq_stat 0x%x active_tag 0x%x sactive 0x%x)\n",
+- status, ap->active_tag, ap->sactive);
+ }
+
+ static void ahci_irq_clear(struct ata_port *ap)
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 78b670d..98e33f9 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -3772,6 +3772,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ /* Devices where NCQ should be avoided */
+ /* NCQ is slow */
+ { "WDC WD740ADFD-00", NULL, ATA_HORKAGE_NONCQ },
++ { "WDC WD740ADFD-00NLR1", NULL, ATA_HORKAGE_NONCQ, },
+ /* http://thread.gmane.org/gmane.linux.ide/14907 */
+ { "FUJITSU MHT2060BH", NULL, ATA_HORKAGE_NONCQ },
+ /* NCQ is broken */
+@@ -3790,22 +3791,6 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "HTS541060G9SA00", "MB3OC60D", ATA_HORKAGE_NONCQ, },
+ { "HTS541080G9SA00", "MB4OC60D", ATA_HORKAGE_NONCQ, },
+ { "HTS541010G9SA00", "MBZOC60D", ATA_HORKAGE_NONCQ, },
+- /* Drives which do spurious command completion */
+- { "HTS541680J9SA00", "SB2IC7EP", ATA_HORKAGE_NONCQ, },
+- { "HTS541612J9SA00", "SBDIC7JP", ATA_HORKAGE_NONCQ, },
+- { "HDT722516DLA380", "V43OA96A", ATA_HORKAGE_NONCQ, },
+- { "Hitachi HTS541616J9SA00", "SB4OC70P", ATA_HORKAGE_NONCQ, },
+- { "Hitachi HTS542525K9SA00", "BBFOC31P", ATA_HORKAGE_NONCQ, },
+- { "WDC WD740ADFD-00NLR1", NULL, ATA_HORKAGE_NONCQ, },
+- { "WDC WD3200AAJS-00RYA0", "12.01B01", ATA_HORKAGE_NONCQ, },
+- { "FUJITSU MHV2080BH", "00840028", ATA_HORKAGE_NONCQ, },
+- { "ST9120822AS", "3.CLF", ATA_HORKAGE_NONCQ, },
+- { "ST9160821AS", "3.CLF", ATA_HORKAGE_NONCQ, },
+- { "ST9160821AS", "3.ALD", ATA_HORKAGE_NONCQ, },
+- { "ST9160821AS", "3.CCD", ATA_HORKAGE_NONCQ, },
+- { "ST3160812AS", "3.ADJ", ATA_HORKAGE_NONCQ, },
+- { "ST980813AS", "3.ADB", ATA_HORKAGE_NONCQ, },
+- { "SAMSUNG HD401LJ", "ZZ100-15", ATA_HORKAGE_NONCQ, },
+
+ /* devices which puke on READ_NATIVE_MAX */
+ { "HDS724040KLSA80", "KFAOA20N", ATA_HORKAGE_BROKEN_HPA, },
+diff --git a/drivers/atm/he.c b/drivers/atm/he.c
+index d33aba6..3b64a99 100644
+--- a/drivers/atm/he.c
++++ b/drivers/atm/he.c
+@@ -394,6 +394,11 @@ he_init_one(struct pci_dev *pci_dev, const struct pci_device_id *pci_ent)
+ he_dev->atm_dev->dev_data = he_dev;
+ atm_dev->dev_data = he_dev;
+ he_dev->number = atm_dev->number;
++#ifdef USE_TASKLET
++ tasklet_init(&he_dev->tasklet, he_tasklet, (unsigned long) he_dev);
++#endif
++ spin_lock_init(&he_dev->global_lock);
++
+ if (he_start(atm_dev)) {
+ he_stop(he_dev);
+ err = -ENODEV;
+@@ -1173,11 +1178,6 @@ he_start(struct atm_dev *dev)
+ if ((err = he_init_irq(he_dev)) != 0)
+ return err;
+
+-#ifdef USE_TASKLET
+- tasklet_init(&he_dev->tasklet, he_tasklet, (unsigned long) he_dev);
+-#endif
+- spin_lock_init(&he_dev->global_lock);
+-
+ /* 4.11 enable pci bus controller state machines */
+ host_cntl |= (OUTFF_ENB | CMDFF_ENB |
+ QUICK_RD_RETRY | QUICK_WR_RETRY | PERR_INT_ENB);
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index ec86d6f..fa43bc4 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -814,9 +814,10 @@ int device_add(struct device *dev)
+ error = device_add_attrs(dev);
+ if (error)
+ goto AttrsError;
+- error = device_pm_add(dev);
++ error = dpm_sysfs_add(dev);
+ if (error)
+ goto PMError;
++ device_pm_add(dev);
+ error = bus_add_device(dev);
+ if (error)
+ goto BusError;
+@@ -841,6 +842,7 @@ int device_add(struct device *dev)
+ return error;
+ BusError:
+ device_pm_remove(dev);
++ dpm_sysfs_remove(dev);
+ PMError:
+ if (dev->bus)
+ blocking_notifier_call_chain(&dev->bus->bus_notifier,
+diff --git a/drivers/base/power/Makefile b/drivers/base/power/Makefile
+index 9caeaea..e8fdd54 100644
+--- a/drivers/base/power/Makefile
++++ b/drivers/base/power/Makefile
+@@ -1,5 +1,6 @@
+ obj-y := shutdown.o
+-obj-$(CONFIG_PM_SLEEP) += main.o suspend.o resume.o sysfs.o
++obj-$(CONFIG_PM) += sysfs.o
++obj-$(CONFIG_PM_SLEEP) += main.o suspend.o resume.o
+ obj-$(CONFIG_PM_TRACE) += trace.o
+
+ ifeq ($(CONFIG_DEBUG_DRIVER),y)
+diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
+index eb9f38d..8a70daf 100644
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -33,20 +33,14 @@ DEFINE_MUTEX(dpm_list_mtx);
+
+ int (*platform_enable_wakeup)(struct device *dev, int is_on);
+
+-int device_pm_add(struct device *dev)
++void device_pm_add(struct device *dev)
+ {
+- int error;
+-
+ pr_debug("PM: Adding info for %s:%s\n",
+ dev->bus ? dev->bus->name : "No Bus",
+ kobject_name(&dev->kobj));
+ mutex_lock(&dpm_list_mtx);
+ list_add_tail(&dev->power.entry, &dpm_active);
+- error = dpm_sysfs_add(dev);
+- if (error)
+- list_del(&dev->power.entry);
+ mutex_unlock(&dpm_list_mtx);
+- return error;
+ }
+
+ void device_pm_remove(struct device *dev)
+diff --git a/drivers/base/power/power.h b/drivers/base/power/power.h
+index 8ba0830..6c4a19b 100644
+--- a/drivers/base/power/power.h
++++ b/drivers/base/power/power.h
+@@ -34,14 +34,26 @@ static inline struct dev_pm_info * to_pm_info(struct list_head * entry)
+ return container_of(entry, struct dev_pm_info, entry);
+ }
+
+-static inline struct device * to_device(struct list_head * entry)
++static inline struct device *to_device(struct list_head *entry)
+ {
+ return container_of(to_pm_info(entry), struct device, power);
+ }
+
+-extern int device_pm_add(struct device *);
++extern void device_pm_add(struct device *);
+ extern void device_pm_remove(struct device *);
+
++#else /* CONFIG_PM_SLEEP */
++
++static inline void device_pm_add(struct device *dev)
++{
++}
++
++static inline void device_pm_remove(struct device *dev)
++{
++}
++#endif
++
++#ifdef CONFIG_PM
+ /*
+ * sysfs.c
+ */
+@@ -62,16 +74,15 @@ extern int resume_device(struct device *);
+ */
+ extern int suspend_device(struct device *, pm_message_t);
+
+-#else /* CONFIG_PM_SLEEP */
+-
++#else /* CONFIG_PM */
+
+-static inline int device_pm_add(struct device * dev)
++static inline int dpm_sysfs_add(struct device *dev)
+ {
+ return 0;
+ }
+-static inline void device_pm_remove(struct device * dev)
+-{
+
++static inline void dpm_sysfs_remove(struct device *dev)
++{
+ }
+
+ #endif
+diff --git a/drivers/block/rd.c b/drivers/block/rd.c
+index 65150b5..b022942 100644
+--- a/drivers/block/rd.c
++++ b/drivers/block/rd.c
+@@ -189,6 +189,18 @@ static int ramdisk_set_page_dirty(struct page *page)
+ return 0;
+ }
+
++/*
++ * releasepage is called by pagevec_strip/try_to_release_page if
++ * buffers_heads_over_limit is true. Without a releasepage function
++ * try_to_free_buffers is called instead. That can unset the dirty
++ * bit of our ram disk pages, which will be eventually freed, even
++ * if the page is still in use.
++ */
++static int ramdisk_releasepage(struct page *page, gfp_t dummy)
++{
++ return 0;
++}
++
+ static const struct address_space_operations ramdisk_aops = {
+ .readpage = ramdisk_readpage,
+ .prepare_write = ramdisk_prepare_write,
+@@ -196,6 +208,7 @@ static const struct address_space_operations ramdisk_aops = {
+ .writepage = ramdisk_writepage,
+ .set_page_dirty = ramdisk_set_page_dirty,
+ .writepages = ramdisk_writepages,
++ .releasepage = ramdisk_releasepage,
+ };
+
+ static int rd_blkdev_pagecache_IO(int rw, struct bio_vec *vec, sector_t sector,
+diff --git a/drivers/char/apm-emulation.c b/drivers/char/apm-emulation.c
+index ec116df..72183bd 100644
+--- a/drivers/char/apm-emulation.c
++++ b/drivers/char/apm-emulation.c
+@@ -295,7 +295,6 @@ static int
+ apm_ioctl(struct inode * inode, struct file *filp, u_int cmd, u_long arg)
+ {
+ struct apm_user *as = filp->private_data;
+- unsigned long flags;
+ int err = -EINVAL;
+
+ if (!as->suser || !as->writer)
+@@ -331,10 +330,16 @@ apm_ioctl(struct inode * inode, struct file *filp, u_int cmd, u_long arg)
+ * Wait for the suspend/resume to complete. If there
+ * are pending acknowledges, we wait here for them.
+ */
+- flags = current->flags;
++ freezer_do_not_count();
+
+ wait_event(apm_suspend_waitqueue,
+ as->suspend_state == SUSPEND_DONE);
++
++ /*
++ * Since we are waiting until the suspend is done, the
++ * try_to_freeze() in freezer_count() will not trigger
++ */
++ freezer_count();
+ } else {
+ as->suspend_state = SUSPEND_WAIT;
+ mutex_unlock(&state_lock);
+@@ -362,14 +367,10 @@ apm_ioctl(struct inode * inode, struct file *filp, u_int cmd, u_long arg)
+ * Wait for the suspend/resume to complete. If there
+ * are pending acknowledges, we wait here for them.
+ */
+- flags = current->flags;
+-
+- wait_event_interruptible(apm_suspend_waitqueue,
++ wait_event_freezable(apm_suspend_waitqueue,
+ as->suspend_state == SUSPEND_DONE);
+ }
+
+- current->flags = flags;
+-
+ mutex_lock(&state_lock);
+ err = as->suspend_result;
+ as->suspend_state = SUSPEND_NONE;
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index af274e5..a9178e3 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1494,7 +1494,7 @@ __u32 secure_tcpv6_sequence_number(__be32 *saddr, __be32 *daddr,
+ seq = twothirdsMD4Transform((const __u32 *)daddr, hash) & HASH_MASK;
+ seq += keyptr->count;
+
+- seq += ktime_get_real().tv64;
++ seq += ktime_to_ns(ktime_get_real());
+
+ return seq;
+ }
+@@ -1556,7 +1556,7 @@ __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
+ * overlaps less than one time per MSL (2 minutes).
+ * Choosing a clock of 64 ns period is OK. (period of 274 s)
+ */
+- seq += ktime_get_real().tv64 >> 6;
++ seq += ktime_to_ns(ktime_get_real()) >> 6;
+ #if 0
+ printk("init_seq(%lx, %lx, %d, %d) = %d\n",
+ saddr, daddr, sport, dport, seq);
+@@ -1616,7 +1616,7 @@ u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr,
+ seq = half_md4_transform(hash, keyptr->secret);
+ seq |= ((u64)keyptr->count) << (32 - HASH_BITS);
+
+- seq += ktime_get_real().tv64;
++ seq += ktime_to_ns(ktime_get_real());
+ seq &= (1ull << 48) - 1;
+ #if 0
+ printk("dccp init_seq(%lx, %lx, %d, %d) = %d\n",
+diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
+index 2c5f11a..a810ff8 100644
+--- a/drivers/input/mouse/alps.c
++++ b/drivers/input/mouse/alps.c
+@@ -53,6 +53,7 @@ static const struct alps_model_info alps_model_data[] = {
+ { { 0x20, 0x02, 0x0e }, 0xf8, 0xf8, ALPS_PASS | ALPS_DUALPOINT }, /* XXX */
+ { { 0x22, 0x02, 0x0a }, 0xf8, 0xf8, ALPS_PASS | ALPS_DUALPOINT },
+ { { 0x22, 0x02, 0x14 }, 0xff, 0xff, ALPS_PASS | ALPS_DUALPOINT }, /* Dell Latitude D600 */
++ { { 0x73, 0x02, 0x50 }, 0xcf, 0xff, ALPS_FW_BK_1 } /* Dell Vostro 1400 */
+ };
+
+ /*
+diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
+index 4910bca..f67239a 100644
+--- a/drivers/isdn/i4l/isdn_common.c
++++ b/drivers/isdn/i4l/isdn_common.c
+@@ -1515,6 +1515,7 @@ isdn_ioctl(struct inode *inode, struct file *file, uint cmd, ulong arg)
+ if (copy_from_user(&iocts, argp,
+ sizeof(isdn_ioctl_struct)))
+ return -EFAULT;
++ iocts.drvid[sizeof(iocts.drvid)-1] = 0;
+ if (strlen(iocts.drvid)) {
+ if ((p = strchr(iocts.drvid, ',')))
+ *p = 0;
+@@ -1599,6 +1600,7 @@ isdn_ioctl(struct inode *inode, struct file *file, uint cmd, ulong arg)
+ if (copy_from_user(&iocts, argp,
+ sizeof(isdn_ioctl_struct)))
+ return -EFAULT;
++ iocts.drvid[sizeof(iocts.drvid)-1] = 0;
+ if (strlen(iocts.drvid)) {
+ drvidx = -1;
+ for (i = 0; i < ISDN_MAX_DRIVERS; i++)
+@@ -1643,7 +1645,7 @@ isdn_ioctl(struct inode *inode, struct file *file, uint cmd, ulong arg)
+ } else {
+ p = (char __user *) iocts.arg;
+ for (i = 0; i < 10; i++) {
+- sprintf(bname, "%s%s",
++ snprintf(bname, sizeof(bname), "%s%s",
+ strlen(dev->drv[drvidx]->msn2eaz[i]) ?
+ dev->drv[drvidx]->msn2eaz[i] : "_",
+ (i < 9) ? "," : "\0");
+@@ -1673,6 +1675,7 @@ isdn_ioctl(struct inode *inode, struct file *file, uint cmd, ulong arg)
+ char *p;
+ if (copy_from_user(&iocts, argp, sizeof(isdn_ioctl_struct)))
+ return -EFAULT;
++ iocts.drvid[sizeof(iocts.drvid)-1] = 0;
+ if (strlen(iocts.drvid)) {
+ if ((p = strchr(iocts.drvid, ',')))
+ *p = 0;
+diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c
+index aa83277..75e1423 100644
+--- a/drivers/isdn/i4l/isdn_net.c
++++ b/drivers/isdn/i4l/isdn_net.c
+@@ -2126,7 +2126,7 @@ isdn_net_find_icall(int di, int ch, int idx, setup_parm *setup)
+ u_long flags;
+ isdn_net_dev *p;
+ isdn_net_phone *n;
+- char nr[32];
++ char nr[ISDN_MSNLEN];
+ char *my_eaz;
+
+ /* Search name in netdev-chain */
+@@ -2135,7 +2135,7 @@ isdn_net_find_icall(int di, int ch, int idx, setup_parm *setup)
+ nr[1] = '\0';
+ printk(KERN_INFO "isdn_net: Incoming call without OAD, assuming '0'\n");
+ } else
+- strcpy(nr, setup->phone);
++ strlcpy(nr, setup->phone, ISDN_MSNLEN);
+ si1 = (int) setup->si1;
+ si2 = (int) setup->si2;
+ if (!setup->eazmsn[0]) {
+@@ -2802,7 +2802,7 @@ isdn_net_setcfg(isdn_net_ioctl_cfg * cfg)
+ chidx = -1;
+ }
+ }
+- strcpy(lp->msn, cfg->eaz);
++ strlcpy(lp->msn, cfg->eaz, sizeof(lp->msn));
+ lp->pre_device = drvidx;
+ lp->pre_channel = chidx;
+ lp->onhtime = cfg->onhtime;
+@@ -2951,7 +2951,7 @@ isdn_net_addphone(isdn_net_ioctl_phone * phone)
+ if (p) {
+ if (!(n = kmalloc(sizeof(isdn_net_phone), GFP_KERNEL)))
+ return -ENOMEM;
+- strcpy(n->num, phone->phone);
++ strlcpy(n->num, phone->phone, sizeof(n->num));
+ n->next = p->local->phone[phone->outgoing & 1];
+ p->local->phone[phone->outgoing & 1] = n;
+ return 0;
+diff --git a/drivers/kvm/kvm_main.c b/drivers/kvm/kvm_main.c
+index cd05579..b58fdf3 100644
+--- a/drivers/kvm/kvm_main.c
++++ b/drivers/kvm/kvm_main.c
+@@ -273,6 +273,11 @@ void kvm_flush_remote_tlbs(struct kvm *kvm)
+ }
+ }
+
++ /* Uniprocessor kernel does not respect cpus in first_cpu. So
++ * do not go there if we have nothing to do. */
++ if (cpus_empty(cpus))
++ return;
++
+ /*
+ * We really want smp_call_function_mask() here. But that's not
+ * available, so ipi all cpus in parallel and wait for them
+@@ -1158,10 +1163,7 @@ int emulate_invlpg(struct kvm_vcpu *vcpu, gva_t address)
+
+ int emulate_clts(struct kvm_vcpu *vcpu)
+ {
+- unsigned long cr0;
+-
+- cr0 = vcpu->cr0 & ~CR0_TS_MASK;
+- kvm_arch_ops->set_cr0(vcpu, cr0);
++ kvm_arch_ops->set_cr0(vcpu, vcpu->cr0 & ~X86_CR0_TS);
+ return X86EMUL_CONTINUE;
+ }
+
+@@ -1755,8 +1757,6 @@ static int complete_pio(struct kvm_vcpu *vcpu)
+ io->count -= io->cur_count;
+ io->cur_count = 0;
+
+- if (!io->count)
+- kvm_arch_ops->skip_emulated_instruction(vcpu);
+ return 0;
+ }
+
+@@ -1802,6 +1802,7 @@ int kvm_setup_pio(struct kvm_vcpu *vcpu, struct kvm_run *run, int in,
+
+ pio_dev = vcpu_find_pio_dev(vcpu, port);
+ if (!string) {
++ kvm_arch_ops->skip_emulated_instruction(vcpu);
+ kvm_arch_ops->cache_regs(vcpu);
+ memcpy(vcpu->pio_data, &vcpu->regs[VCPU_REGS_RAX], 4);
+ kvm_arch_ops->decache_regs(vcpu);
+@@ -1848,6 +1849,9 @@ int kvm_setup_pio(struct kvm_vcpu *vcpu, struct kvm_run *run, int in,
+ vcpu->run->io.count = now;
+ vcpu->pio.cur_count = now;
+
++ if (now == count)
++ kvm_arch_ops->skip_emulated_instruction(vcpu);
++
+ for (i = 0; i < nr_pages; ++i) {
+ spin_lock(&vcpu->kvm->lock);
+ page = gva_to_page(vcpu, address + i * PAGE_SIZE);
+diff --git a/drivers/kvm/mmu.c b/drivers/kvm/mmu.c
+index 23965aa..56ab369 100644
+--- a/drivers/kvm/mmu.c
++++ b/drivers/kvm/mmu.c
+@@ -1066,6 +1066,7 @@ int kvm_mmu_reset_context(struct kvm_vcpu *vcpu)
+ destroy_kvm_mmu(vcpu);
+ return init_kvm_mmu(vcpu);
+ }
++EXPORT_SYMBOL_GPL(kvm_mmu_reset_context);
+
+ int kvm_mmu_load(struct kvm_vcpu *vcpu)
+ {
+diff --git a/drivers/kvm/svm.c b/drivers/kvm/svm.c
+index bc818cc..fae8cc5 100644
+--- a/drivers/kvm/svm.c
++++ b/drivers/kvm/svm.c
+@@ -506,6 +506,7 @@ static void init_vmcb(struct vmcb *vmcb)
+ */
+ /* (1ULL << INTERCEPT_SELECTIVE_CR0) | */
+ (1ULL << INTERCEPT_CPUID) |
++ (1ULL << INTERCEPT_INVD) |
+ (1ULL << INTERCEPT_HLT) |
+ (1ULL << INTERCEPT_INVLPGA) |
+ (1ULL << INTERCEPT_IOIO_PROT) |
+@@ -519,6 +520,7 @@ static void init_vmcb(struct vmcb *vmcb)
+ (1ULL << INTERCEPT_STGI) |
+ (1ULL << INTERCEPT_CLGI) |
+ (1ULL << INTERCEPT_SKINIT) |
++ (1ULL << INTERCEPT_WBINVD) |
+ (1ULL << INTERCEPT_MONITOR) |
+ (1ULL << INTERCEPT_MWAIT);
+
+@@ -1319,6 +1321,7 @@ static int (*svm_exit_handlers[])(struct kvm_vcpu *vcpu,
+ [SVM_EXIT_VINTR] = interrupt_window_interception,
+ /* [SVM_EXIT_CR0_SEL_WRITE] = emulate_on_interception, */
+ [SVM_EXIT_CPUID] = cpuid_interception,
++ [SVM_EXIT_INVD] = emulate_on_interception,
+ [SVM_EXIT_HLT] = halt_interception,
+ [SVM_EXIT_INVLPG] = emulate_on_interception,
+ [SVM_EXIT_INVLPGA] = invalid_op_interception,
+@@ -1333,6 +1336,7 @@ static int (*svm_exit_handlers[])(struct kvm_vcpu *vcpu,
+ [SVM_EXIT_STGI] = invalid_op_interception,
+ [SVM_EXIT_CLGI] = invalid_op_interception,
+ [SVM_EXIT_SKINIT] = invalid_op_interception,
++ [SVM_EXIT_WBINVD] = emulate_on_interception,
+ [SVM_EXIT_MONITOR] = invalid_op_interception,
+ [SVM_EXIT_MWAIT] = invalid_op_interception,
+ };
+diff --git a/drivers/kvm/vmx.c b/drivers/kvm/vmx.c
+index 80628f6..916da29 100644
+--- a/drivers/kvm/vmx.c
++++ b/drivers/kvm/vmx.c
+@@ -463,6 +463,8 @@ static unsigned long vmx_get_rflags(struct kvm_vcpu *vcpu)
+
+ static void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)
+ {
++ if (vcpu->rmode.active)
++ rflags |= IOPL_MASK | X86_EFLAGS_VM;
+ vmcs_writel(GUEST_RFLAGS, rflags);
+ }
+
+@@ -955,6 +957,7 @@ static void enter_rmode(struct kvm_vcpu *vcpu)
+ fix_rmode_seg(VCPU_SREG_GS, &vcpu->rmode.gs);
+ fix_rmode_seg(VCPU_SREG_FS, &vcpu->rmode.fs);
+
++ kvm_mmu_reset_context(vcpu);
+ init_rmode_tss(vcpu->kvm);
+ }
+
+diff --git a/drivers/kvm/x86_emulate.c b/drivers/kvm/x86_emulate.c
+index 4b8a0cc..9fce95b 100644
+--- a/drivers/kvm/x86_emulate.c
++++ b/drivers/kvm/x86_emulate.c
+@@ -156,7 +156,7 @@ static u8 opcode_table[256] = {
+ static u16 twobyte_table[256] = {
+ /* 0x00 - 0x0F */
+ 0, SrcMem | ModRM | DstReg, 0, 0, 0, 0, ImplicitOps, 0,
+- 0, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
++ ImplicitOps, ImplicitOps, 0, 0, 0, ImplicitOps | ModRM, 0, 0,
+ /* 0x10 - 0x1F */
+ 0, 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0,
+ /* 0x20 - 0x2F */
+@@ -198,7 +198,8 @@ static u16 twobyte_table[256] = {
+ 0, 0, ByteOp | DstReg | SrcMem | ModRM | Mov,
+ DstReg | SrcMem16 | ModRM | Mov,
+ /* 0xC0 - 0xCF */
+- 0, 0, 0, 0, 0, 0, 0, ImplicitOps | ModRM, 0, 0, 0, 0, 0, 0, 0, 0,
++ 0, 0, 0, DstMem | SrcReg | ModRM | Mov, 0, 0, 0, ImplicitOps | ModRM,
++ 0, 0, 0, 0, 0, 0, 0, 0,
+ /* 0xD0 - 0xDF */
+ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ /* 0xE0 - 0xEF */
+@@ -772,6 +773,14 @@ done_prefixes:
+ case SrcMem:
+ src.bytes = (d & ByteOp) ? 1 : op_bytes;
+ srcmem_common:
++ /*
++ * For instructions with a ModR/M byte, switch to register
++ * access if Mod = 3.
++ */
++ if ((d & ModRM) && modrm_mod == 3) {
++ src.type = OP_REG;
++ break;
++ }
+ src.type = OP_MEM;
+ src.ptr = (unsigned long *)cr2;
+ if ((rc = ops->read_emulated((unsigned long)src.ptr,
+@@ -838,6 +847,15 @@ done_prefixes:
+ dst.type = OP_MEM;
+ dst.ptr = (unsigned long *)cr2;
+ dst.bytes = (d & ByteOp) ? 1 : op_bytes;
++ dst.val = 0;
++ /*
++ * For instructions with a ModR/M byte, switch to register
++ * access if Mod = 3.
++ */
++ if ((d & ModRM) && modrm_mod == 3) {
++ dst.type = OP_REG;
++ break;
++ }
+ if (d & BitOp) {
+ unsigned long mask = ~(dst.bytes * 8 - 1);
+
+@@ -1048,7 +1066,7 @@ done_prefixes:
+ }
+ register_address_increment(_regs[VCPU_REGS_RSP],
+ -dst.bytes);
+- if ((rc = ops->write_std(
++ if ((rc = ops->write_emulated(
+ register_address(ctxt->ss_base,
+ _regs[VCPU_REGS_RSP]),
+ &dst.val, dst.bytes, ctxt)) != 0)
+@@ -1324,6 +1342,10 @@ twobyte_insn:
+ dst.bytes = op_bytes;
+ dst.val = (d & ByteOp) ? (s8) src.val : (s16) src.val;
+ break;
++ case 0xc3: /* movnti */
++ dst.bytes = op_bytes;
++ dst.val = (op_bytes == 4) ? (u32) src.val : (u64) src.val;
++ break;
+ }
+ goto writeback;
+
+@@ -1331,6 +1353,8 @@ twobyte_special_insn:
+ /* Disable writeback. */
+ no_wb = 1;
+ switch (b) {
++ case 0x08: /* invd */
++ break;
+ case 0x09: /* wbinvd */
+ break;
+ case 0x0d: /* GrpP (prefetch) */
+diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
+index d68796e..fcbe508 100644
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -5280,19 +5280,15 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
+ if (readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_SYNC_PHY_INIT) {
+ np->mac_in_use = readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_MGMT_ST;
+ dprintk(KERN_INFO "%s: mgmt unit is running. mac in use %x.\n", pci_name(pci_dev), np->mac_in_use);
+- for (i = 0; i < 5000; i++) {
+- msleep(1);
+- if (nv_mgmt_acquire_sema(dev)) {
+- /* management unit setup the phy already? */
+- if ((readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_SYNC_MASK) ==
+- NVREG_XMITCTL_SYNC_PHY_INIT) {
+- /* phy is inited by mgmt unit */
+- phyinitialized = 1;
+- dprintk(KERN_INFO "%s: Phy already initialized by mgmt unit.\n", pci_name(pci_dev));
+- } else {
+- /* we need to init the phy */
+- }
+- break;
++ if (nv_mgmt_acquire_sema(dev)) {
++ /* management unit setup the phy already? */
++ if ((readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_SYNC_MASK) ==
++ NVREG_XMITCTL_SYNC_PHY_INIT) {
++ /* phy is inited by mgmt unit */
++ phyinitialized = 1;
++ dprintk(KERN_INFO "%s: Phy already initialized by mgmt unit.\n", pci_name(pci_dev));
++ } else {
++ /* we need to init the phy */
+ }
+ }
+ }
+@@ -5582,6 +5578,22 @@ static struct pci_device_id pci_tbl[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_35),
+ .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
+ },
++ { /* MCP79 Ethernet Controller */
++ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_36),
++ .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
++ },
++ { /* MCP79 Ethernet Controller */
++ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_37),
++ .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
++ },
++ { /* MCP79 Ethernet Controller */
++ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_38),
++ .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
++ },
++ { /* MCP79 Ethernet Controller */
++ PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_39),
++ .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT,
++ },
+ {0,},
+ };
+
+diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
+index 86fff8d..847d34f 100644
+--- a/drivers/net/wireless/libertas/cmd.c
++++ b/drivers/net/wireless/libertas/cmd.c
+@@ -881,6 +881,10 @@ static int wlan_cmd_mesh_access(wlan_private * priv,
+ return 0;
+ }
+
++/*
++ * Note: NEVER use libertas_queue_cmd() with addtail==0 other than for
++ * the command timer, because it does not account for queued commands.
++ */
+ void libertas_queue_cmd(wlan_adapter * adapter, struct cmd_ctrl_node *cmdnode, u8 addtail)
+ {
+ unsigned long flags;
+@@ -910,10 +914,11 @@ void libertas_queue_cmd(wlan_adapter * adapter, struct cmd_ctrl_node *cmdnode, u
+
+ spin_lock_irqsave(&adapter->driver_lock, flags);
+
+- if (addtail)
++ if (addtail) {
+ list_add_tail((struct list_head *)cmdnode,
+ &adapter->cmdpendingq);
+- else
++ adapter->nr_cmd_pending++;
++ } else
+ list_add((struct list_head *)cmdnode, &adapter->cmdpendingq);
+
+ spin_unlock_irqrestore(&adapter->driver_lock, flags);
+@@ -1400,7 +1405,6 @@ int libertas_prepare_and_send_command(wlan_private * priv,
+ cmdnode->cmdwaitqwoken = 0;
+
+ libertas_queue_cmd(adapter, cmdnode, 1);
+- adapter->nr_cmd_pending++;
+ wake_up_interruptible(&priv->mainthread.waitq);
+
+ if (wait_option & cmd_option_waitforrsp) {
+diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
+index 0e3b8d0..5abf5ea 100644
+--- a/drivers/pnp/pnpacpi/rsparser.c
++++ b/drivers/pnp/pnpacpi/rsparser.c
+@@ -82,9 +82,11 @@ static void pnpacpi_parse_allocated_irqresource(struct pnp_resource_table *res,
+ while (!(res->irq_resource[i].flags & IORESOURCE_UNSET) &&
+ i < PNP_MAX_IRQ)
+ i++;
+- if (i >= PNP_MAX_IRQ)
++ if (i >= PNP_MAX_IRQ) {
++ printk(KERN_ERR "pnpacpi: exceeded the max number of IRQ "
++ "resources: %d \n", PNP_MAX_IRQ);
+ return;
+-
++ }
+ res->irq_resource[i].flags = IORESOURCE_IRQ; // Also clears _UNSET flag
+ res->irq_resource[i].flags |= irq_flags(triggering, polarity);
+ irq = acpi_register_gsi(gsi, triggering, polarity);
+@@ -163,6 +165,9 @@ static void pnpacpi_parse_allocated_dmaresource(struct pnp_resource_table *res,
+ }
+ res->dma_resource[i].start = dma;
+ res->dma_resource[i].end = dma;
++ } else {
++ printk(KERN_ERR "pnpacpi: exceeded the max number of DMA "
++ "resources: %d \n", PNP_MAX_DMA);
+ }
+ }
+
+@@ -184,6 +189,9 @@ static void pnpacpi_parse_allocated_ioresource(struct pnp_resource_table *res,
+ }
+ res->port_resource[i].start = io;
+ res->port_resource[i].end = io + len - 1;
++ } else {
++ printk(KERN_ERR "pnpacpi: exceeded the max number of IO "
++ "resources: %d \n", PNP_MAX_PORT);
+ }
+ }
+
+@@ -207,6 +215,9 @@ static void pnpacpi_parse_allocated_memresource(struct pnp_resource_table *res,
+
+ res->mem_resource[i].start = mem;
+ res->mem_resource[i].end = mem + len - 1;
++ } else {
++ printk(KERN_ERR "pnpacpi: exceeded the max number of mem "
++ "resources: %d\n", PNP_MAX_MEM);
+ }
+ }
+
+diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
+index 502732a..6b2197b 100644
+--- a/drivers/scsi/dpt_i2o.c
++++ b/drivers/scsi/dpt_i2o.c
+@@ -173,20 +173,20 @@ static struct pci_device_id dptids[] = {
+ };
+ MODULE_DEVICE_TABLE(pci,dptids);
+
+-static void adpt_exit(void);
+-
+-static int adpt_detect(void)
++static int adpt_detect(struct scsi_host_template* sht)
+ {
+ struct pci_dev *pDev = NULL;
+ adpt_hba* pHba;
+
++ adpt_init();
++
+ PINFO("Detecting Adaptec I2O RAID controllers...\n");
+
+ /* search for all Adatpec I2O RAID cards */
+ while ((pDev = pci_get_device( PCI_DPT_VENDOR_ID, PCI_ANY_ID, pDev))) {
+ if(pDev->device == PCI_DPT_DEVICE_ID ||
+ pDev->device == PCI_DPT_RAPTOR_DEVICE_ID){
+- if(adpt_install_hba(pDev) ){
++ if(adpt_install_hba(sht, pDev) ){
+ PERROR("Could not Init an I2O RAID device\n");
+ PERROR("Will not try to detect others.\n");
+ return hba_count-1;
+@@ -248,33 +248,34 @@ rebuild_sys_tab:
+ }
+
+ for (pHba = hba_chain; pHba; pHba = pHba->next) {
+- if (adpt_scsi_register(pHba) < 0) {
++ if( adpt_scsi_register(pHba,sht) < 0){
+ adpt_i2o_delete_hba(pHba);
+ continue;
+ }
+ pHba->initialized = TRUE;
+ pHba->state &= ~DPTI_STATE_RESET;
+- scsi_scan_host(pHba->host);
+ }
+
+ // Register our control device node
+ // nodes will need to be created in /dev to access this
+ // the nodes can not be created from within the driver
+ if (hba_count && register_chrdev(DPTI_I2O_MAJOR, DPT_DRIVER, &adpt_fops)) {
+- adpt_exit();
++ adpt_i2o_sys_shutdown();
+ return 0;
+ }
+ return hba_count;
+ }
+
+
+-static int adpt_release(adpt_hba *pHba)
++/*
++ * scsi_unregister will be called AFTER we return.
++ */
++static int adpt_release(struct Scsi_Host *host)
+ {
+- struct Scsi_Host *shost = pHba->host;
+- scsi_remove_host(shost);
++ adpt_hba* pHba = (adpt_hba*) host->hostdata[0];
+ // adpt_i2o_quiesce_hba(pHba);
+ adpt_i2o_delete_hba(pHba);
+- scsi_host_put(shost);
++ scsi_unregister(host);
+ return 0;
+ }
+
+@@ -881,7 +882,7 @@ static int adpt_reboot_event(struct notifier_block *n, ulong code, void *p)
+ #endif
+
+
+-static int adpt_install_hba(struct pci_dev* pDev)
++static int adpt_install_hba(struct scsi_host_template* sht, struct pci_dev* pDev)
+ {
+
+ adpt_hba* pHba = NULL;
+@@ -1030,6 +1031,8 @@ static void adpt_i2o_delete_hba(adpt_hba* pHba)
+
+
+ mutex_lock(&adpt_configuration_lock);
++ // scsi_unregister calls our adpt_release which
++ // does a quiese
+ if(pHba->host){
+ free_irq(pHba->host->irq, pHba);
+ }
+@@ -1081,6 +1084,17 @@ static void adpt_i2o_delete_hba(adpt_hba* pHba)
+ }
+
+
++static int adpt_init(void)
++{
++ printk("Loading Adaptec I2O RAID: Version " DPT_I2O_VERSION "\n");
++#ifdef REBOOT_NOTIFIER
++ register_reboot_notifier(&adpt_reboot_notifier);
++#endif
++
++ return 0;
++}
++
++
+ static struct adpt_device* adpt_find_device(adpt_hba* pHba, u32 chan, u32 id, u32 lun)
+ {
+ struct adpt_device* d;
+@@ -2166,6 +2180,37 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_d
+ }
+
+
++static s32 adpt_scsi_register(adpt_hba* pHba,struct scsi_host_template * sht)
++{
++ struct Scsi_Host *host = NULL;
++
++ host = scsi_register(sht, sizeof(adpt_hba*));
++ if (host == NULL) {
++ printk ("%s: scsi_register returned NULL\n",pHba->name);
++ return -1;
++ }
++ host->hostdata[0] = (unsigned long)pHba;
++ pHba->host = host;
++
++ host->irq = pHba->pDev->irq;
++ /* no IO ports, so don't have to set host->io_port and
++ * host->n_io_port
++ */
++ host->io_port = 0;
++ host->n_io_port = 0;
++ /* see comments in scsi_host.h */
++ host->max_id = 16;
++ host->max_lun = 256;
++ host->max_channel = pHba->top_scsi_channel + 1;
++ host->cmd_per_lun = 1;
++ host->unique_id = (uint) pHba;
++ host->sg_tablesize = pHba->sg_tablesize;
++ host->can_queue = pHba->post_fifo_size;
++
++ return 0;
++}
++
++
+ static s32 adpt_i2o_to_scsi(void __iomem *reply, struct scsi_cmnd* cmd)
+ {
+ adpt_hba* pHba;
+@@ -3284,10 +3329,12 @@ static static void adpt_delay(int millisec)
+
+ #endif
+
+-static struct scsi_host_template adpt_template = {
++static struct scsi_host_template driver_template = {
+ .name = "dpt_i2o",
+ .proc_name = "dpt_i2o",
+ .proc_info = adpt_proc_info,
++ .detect = adpt_detect,
++ .release = adpt_release,
+ .info = adpt_info,
+ .queuecommand = adpt_queue,
+ .eh_abort_handler = adpt_abort,
+@@ -3301,62 +3348,5 @@ static struct scsi_host_template adpt_template = {
+ .cmd_per_lun = 1,
+ .use_clustering = ENABLE_CLUSTERING,
+ };
+-
+-static s32 adpt_scsi_register(adpt_hba* pHba)
+-{
+- struct Scsi_Host *host;
+-
+- host = scsi_host_alloc(&adpt_template, sizeof(adpt_hba*));
+- if (host == NULL) {
+- printk ("%s: scsi_host_alloc returned NULL\n",pHba->name);
+- return -1;
+- }
+- host->hostdata[0] = (unsigned long)pHba;
+- pHba->host = host;
+-
+- host->irq = pHba->pDev->irq;
+- /* no IO ports, so don't have to set host->io_port and
+- * host->n_io_port
+- */
+- host->io_port = 0;
+- host->n_io_port = 0;
+- /* see comments in scsi_host.h */
+- host->max_id = 16;
+- host->max_lun = 256;
+- host->max_channel = pHba->top_scsi_channel + 1;
+- host->cmd_per_lun = 1;
+- host->unique_id = (uint) pHba;
+- host->sg_tablesize = pHba->sg_tablesize;
+- host->can_queue = pHba->post_fifo_size;
+-
+- if (scsi_add_host(host, &pHba->pDev->dev)) {
+- scsi_host_put(host);
+- return -1;
+- }
+-
+- return 0;
+-}
+-
+-static int __init adpt_init(void)
+-{
+- int count;
+-
+- printk("Loading Adaptec I2O RAID: Version " DPT_I2O_VERSION "\n");
+-#ifdef REBOOT_NOTIFIER
+- register_reboot_notifier(&adpt_reboot_notifier);
+-#endif
+-
+- count = adpt_detect();
+-
+- return count > 0 ? 0 : -ENODEV;
+-}
+-
+-static void __exit adpt_exit(void)
+-{
+- while (hba_chain)
+- adpt_release(hba_chain);
+-}
+-
+-module_init(adpt_init);
+-module_exit(adpt_exit);
++#include "scsi_module.c"
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/scsi/dpti.h b/drivers/scsi/dpti.h
+index 0892f6c..fd79068 100644
+--- a/drivers/scsi/dpti.h
++++ b/drivers/scsi/dpti.h
+@@ -28,9 +28,11 @@
+ * SCSI interface function Prototypes
+ */
+
++static int adpt_detect(struct scsi_host_template * sht);
+ static int adpt_queue(struct scsi_cmnd * cmd, void (*cmdcomplete) (struct scsi_cmnd *));
+ static int adpt_abort(struct scsi_cmnd * cmd);
+ static int adpt_reset(struct scsi_cmnd* cmd);
++static int adpt_release(struct Scsi_Host *host);
+ static int adpt_slave_configure(struct scsi_device *);
+
+ static const char *adpt_info(struct Scsi_Host *pSHost);
+@@ -47,6 +49,8 @@ static int adpt_device_reset(struct scsi_cmnd* cmd);
+
+ #define DPT_DRIVER_NAME "Adaptec I2O RAID"
+
++#ifndef HOSTS_C
++
+ #include "dpt/sys_info.h"
+ #include <linux/wait.h>
+ #include "dpt/dpti_i2o.h"
+@@ -285,7 +289,7 @@ static s32 adpt_i2o_init_outbound_q(adpt_hba* pHba);
+ static s32 adpt_i2o_hrt_get(adpt_hba* pHba);
+ static s32 adpt_scsi_to_i2o(adpt_hba* pHba, struct scsi_cmnd* cmd, struct adpt_device* dptdevice);
+ static s32 adpt_i2o_to_scsi(void __iomem *reply, struct scsi_cmnd* cmd);
+-static s32 adpt_scsi_register(adpt_hba* pHba);
++static s32 adpt_scsi_register(adpt_hba* pHba,struct scsi_host_template * sht);
+ static s32 adpt_hba_reset(adpt_hba* pHba);
+ static s32 adpt_i2o_reset_hba(adpt_hba* pHba);
+ static s32 adpt_rescan(adpt_hba* pHba);
+@@ -295,7 +299,7 @@ static void adpt_i2o_delete_hba(adpt_hba* pHba);
+ static void adpt_inquiry(adpt_hba* pHba);
+ static void adpt_fail_posted_scbs(adpt_hba* pHba);
+ static struct adpt_device* adpt_find_device(adpt_hba* pHba, u32 chan, u32 id, u32 lun);
+-static int adpt_install_hba(struct pci_dev* pDev) ;
++static int adpt_install_hba(struct scsi_host_template* sht, struct pci_dev* pDev) ;
+ static int adpt_i2o_online_hba(adpt_hba* pHba);
+ static void adpt_i2o_post_wait_complete(u32, int);
+ static int adpt_i2o_systab_send(adpt_hba* pHba);
+@@ -339,4 +343,5 @@ static void adpt_i386_info(sysInfo_S* si);
+ #define FW_DEBUG_BLED_OFFSET 8
+
+ #define FW_DEBUG_FLAGS_NO_HEADERS_B 0x01
++#endif /* !HOSTS_C */
+ #endif /* _DPT_H */
+diff --git a/drivers/scsi/esp_scsi.c b/drivers/scsi/esp_scsi.c
+index 95cf7b6..f2c91bc 100644
+--- a/drivers/scsi/esp_scsi.c
++++ b/drivers/scsi/esp_scsi.c
+@@ -2026,8 +2026,8 @@ static void esp_reset_cleanup(struct esp *esp)
+ tp->flags |= ESP_TGT_CHECK_NEGO;
+
+ if (tp->starget)
+- starget_for_each_device(tp->starget, NULL,
+- esp_clear_hold);
++ __starget_for_each_device(tp->starget, NULL,
++ esp_clear_hold);
+ }
+ esp->flags &= ~ESP_FLAG_RESETTING;
+ }
+diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
+index a5de1a8..537c4e4 100644
+--- a/drivers/scsi/scsi.c
++++ b/drivers/scsi/scsi.c
+@@ -886,11 +886,11 @@ EXPORT_SYMBOL(__scsi_iterate_devices);
+ * starget_for_each_device - helper to walk all devices of a target
+ * @starget: target whose devices we want to iterate over.
+ *
+- * This traverses over each devices of @shost. The devices have
++ * This traverses over each device of @starget. The devices have
+ * a reference that must be released by scsi_host_put when breaking
+ * out of the loop.
+ */
+-void starget_for_each_device(struct scsi_target *starget, void * data,
++void starget_for_each_device(struct scsi_target *starget, void *data,
+ void (*fn)(struct scsi_device *, void *))
+ {
+ struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
+@@ -905,6 +905,33 @@ void starget_for_each_device(struct scsi_target *starget, void * data,
+ EXPORT_SYMBOL(starget_for_each_device);
+
+ /**
++ * __starget_for_each_device - helper to walk all devices of a target
++ * (UNLOCKED)
++ * @starget: target whose devices we want to iterate over.
++ *
++ * This traverses over each device of @starget. It does _not_
++ * take a reference on the scsi_device, so the whole loop must be
++ * protected by shost->host_lock.
++ *
++ * Note: The only reason why drivers would want to use this is because
++ * they need to access the device list in irq context. Otherwise you
++ * really want to use starget_for_each_device instead.
++ **/
++void __starget_for_each_device(struct scsi_target *starget, void *data,
++ void (*fn)(struct scsi_device *, void *))
++{
++ struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
++ struct scsi_device *sdev;
++
++ __shost_for_each_device(sdev, shost) {
++ if ((sdev->channel == starget->channel) &&
++ (sdev->id == starget->id))
++ fn(sdev, data);
++ }
++}
++EXPORT_SYMBOL(__starget_for_each_device);
++
++/**
+ * __scsi_device_lookup_by_target - find a device given the target (UNLOCKED)
+ * @starget: SCSI target pointer
+ * @lun: SCSI Logical Unit Number
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index 31310ca..ed49cec 100644
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -575,12 +575,15 @@ static int ehci_run (struct usb_hcd *hcd)
+ * from the companions to the EHCI controller. If any of the
+ * companions are in the middle of a port reset at the time, it
+ * could cause trouble. Write-locking ehci_cf_port_reset_rwsem
+- * guarantees that no resets are in progress.
++ * guarantees that no resets are in progress. After we set CF,
++ * a short delay lets the hardware catch up; new resets shouldn't
++ * be started before the port switching actions could complete.
+ */
+ down_write(&ehci_cf_port_reset_rwsem);
+ hcd->state = HC_STATE_RUNNING;
+ ehci_writel(ehci, FLAG_CF, &ehci->regs->configured_flag);
+ ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
++ msleep(5);
+ up_write(&ehci_cf_port_reset_rwsem);
+
+ temp = HC_VERSION(ehci_readl(ehci, &ehci->caps->hc_capbase));
+diff --git a/drivers/usb/image/microtek.c b/drivers/usb/image/microtek.c
+index 768b2c1..af0461e 100644
+--- a/drivers/usb/image/microtek.c
++++ b/drivers/usb/image/microtek.c
+@@ -824,7 +824,7 @@ static int mts_usb_probe(struct usb_interface *intf,
+ goto out_kfree2;
+
+ new_desc->host->hostdata[0] = (unsigned long)new_desc;
+- if (scsi_add_host(new_desc->host, NULL)) {
++ if (scsi_add_host(new_desc->host, &dev->dev)) {
+ err_retval = -EIO;
+ goto out_host_put;
+ }
+diff --git a/drivers/video/fb_ddc.c b/drivers/video/fb_ddc.c
+index f836137..a0df632 100644
+--- a/drivers/video/fb_ddc.c
++++ b/drivers/video/fb_ddc.c
+@@ -56,13 +56,12 @@ unsigned char *fb_ddc_read(struct i2c_adapter *adapter)
+ int i, j;
+
+ algo_data->setscl(algo_data->data, 1);
+- algo_data->setscl(algo_data->data, 0);
+
+ for (i = 0; i < 3; i++) {
+ /* For some old monitors we need the
+ * following process to initialize/stop DDC
+ */
+- algo_data->setsda(algo_data->data, 0);
++ algo_data->setsda(algo_data->data, 1);
+ msleep(13);
+
+ algo_data->setscl(algo_data->data, 1);
+@@ -97,14 +96,15 @@ unsigned char *fb_ddc_read(struct i2c_adapter *adapter)
+ algo_data->setsda(algo_data->data, 1);
+ msleep(15);
+ algo_data->setscl(algo_data->data, 0);
++ algo_data->setsda(algo_data->data, 0);
+ if (edid)
+ break;
+ }
+ /* Release the DDC lines when done or the Apple Cinema HD display
+ * will switch off
+ */
+- algo_data->setsda(algo_data->data, 0);
+- algo_data->setscl(algo_data->data, 0);
++ algo_data->setsda(algo_data->data, 1);
++ algo_data->setscl(algo_data->data, 1);
+
+ return edid;
+ }
+diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
+index be9e65b..386fbff 100644
+--- a/fs/xfs/linux-2.6/xfs_buf.c
++++ b/fs/xfs/linux-2.6/xfs_buf.c
+@@ -1744,6 +1744,8 @@ xfsbufd(
+
+ current->flags |= PF_MEMALLOC;
+
++ set_freezable();
++
+ do {
+ if (unlikely(freezing(current))) {
+ set_bit(XBT_FORCE_SLEEP, &target->bt_flags);
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index 85d434b..97de8aa 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -1237,6 +1237,10 @@
+ #define PCI_DEVICE_ID_NVIDIA_NVENET_33 0x0761
+ #define PCI_DEVICE_ID_NVIDIA_NVENET_34 0x0762
+ #define PCI_DEVICE_ID_NVIDIA_NVENET_35 0x0763
++#define PCI_DEVICE_ID_NVIDIA_NVENET_36 0x0AB0
++#define PCI_DEVICE_ID_NVIDIA_NVENET_37 0x0AB1
++#define PCI_DEVICE_ID_NVIDIA_NVENET_38 0x0AB2
++#define PCI_DEVICE_ID_NVIDIA_NVENET_39 0x0AB3
+
+ #define PCI_VENDOR_ID_IMS 0x10e0
+ #define PCI_DEVICE_ID_IMS_TT128 0x9128
+diff --git a/include/linux/pnp.h b/include/linux/pnp.h
+index 16b46aa..62decab 100644
+--- a/include/linux/pnp.h
++++ b/include/linux/pnp.h
+@@ -13,8 +13,8 @@
+ #include <linux/errno.h>
+ #include <linux/mod_devicetable.h>
+
+-#define PNP_MAX_PORT 8
+-#define PNP_MAX_MEM 4
++#define PNP_MAX_PORT 24
++#define PNP_MAX_MEM 12
+ #define PNP_MAX_IRQ 2
+ #define PNP_MAX_DMA 2
+ #define PNP_NAME_LEN 50
+diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
+index 1c4eb41..9c4ad75 100644
+--- a/include/linux/thread_info.h
++++ b/include/linux/thread_info.h
+@@ -7,12 +7,25 @@
+ #ifndef _LINUX_THREAD_INFO_H
+ #define _LINUX_THREAD_INFO_H
+
++#include <linux/types.h>
++
+ /*
+- * System call restart block.
++ * System call restart block.
+ */
+ struct restart_block {
+ long (*fn)(struct restart_block *);
+- unsigned long arg0, arg1, arg2, arg3;
++ union {
++ struct {
++ unsigned long arg0, arg1, arg2, arg3;
++ };
++ /* For futex_wait */
++ struct {
++ u32 *uaddr;
++ u32 val;
++ u32 flags;
++ u64 time;
++ } futex;
++ };
+ };
+
+ extern long do_no_restart_syscall(struct restart_block *parm);
+diff --git a/include/net/sock.h b/include/net/sock.h
+index bdd9ebe..8a71ab3 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1200,6 +1200,9 @@ static inline struct sk_buff *sk_stream_alloc_pskb(struct sock *sk,
+ {
+ struct sk_buff *skb;
+
++ /* The TCP header must be at least 32-bit aligned. */
++ size = ALIGN(size, 4);
++
+ skb = alloc_skb_fclone(size + sk->sk_prot->max_header, gfp);
+ if (skb) {
+ skb->truesize += mem;
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 54053de..704d51e 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1256,6 +1256,9 @@ static inline void tcp_insert_write_queue_before(struct sk_buff *new,
+ struct sock *sk)
+ {
+ __skb_insert(new, skb->prev, skb, &sk->sk_write_queue);
++
++ if (sk->sk_send_head == skb)
++ sk->sk_send_head = new;
+ }
+
+ static inline void tcp_unlink_write_queue(struct sk_buff *skb, struct sock *sk)
+diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
+index d5057bc..c1d659d 100644
+--- a/include/scsi/scsi_device.h
++++ b/include/scsi/scsi_device.h
+@@ -222,6 +222,9 @@ extern struct scsi_device *__scsi_device_lookup_by_target(struct scsi_target *,
+ uint);
+ extern void starget_for_each_device(struct scsi_target *, void *,
+ void (*fn)(struct scsi_device *, void *));
++extern void __starget_for_each_device(struct scsi_target *, void *,
++ void (*fn)(struct scsi_device *,
++ void *));
+
+ /* only exposed to implement shost_for_each_device */
+ extern struct scsi_device *__scsi_iterate_devices(struct Scsi_Host *,
+diff --git a/kernel/exit.c b/kernel/exit.c
+index 096c27d..b5fee81 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -1365,7 +1365,7 @@ static int wait_task_stopped(struct task_struct *p, int delayed_group_leader,
+ if (unlikely(!exit_code) || unlikely(p->exit_state))
+ goto bail_ref;
+ return wait_noreap_copyout(p, pid, uid,
+- why, (exit_code << 8) | 0x7f,
++ why, exit_code,
+ infop, ru);
+ }
+
+diff --git a/kernel/futex.c b/kernel/futex.c
+index fcc94e7..b658a9a 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1149,9 +1149,9 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
+
+ /*
+ * In case we must use restart_block to restart a futex_wait,
+- * we encode in the 'arg3' shared capability
++ * we encode in the 'flags' shared capability
+ */
+-#define ARG3_SHARED 1
++#define FLAGS_SHARED 1
+
+ static long futex_wait_restart(struct restart_block *restart);
+
+@@ -1290,12 +1290,13 @@ static int futex_wait(u32 __user *uaddr, struct rw_semaphore *fshared,
+ struct restart_block *restart;
+ restart = ¤t_thread_info()->restart_block;
+ restart->fn = futex_wait_restart;
+- restart->arg0 = (unsigned long)uaddr;
+- restart->arg1 = (unsigned long)val;
+- restart->arg2 = (unsigned long)abs_time;
+- restart->arg3 = 0;
++ restart->futex.uaddr = (u32 *)uaddr;
++ restart->futex.val = val;
++ restart->futex.time = abs_time->tv64;
++ restart->futex.flags = 0;
++
+ if (fshared)
+- restart->arg3 |= ARG3_SHARED;
++ restart->futex.flags |= FLAGS_SHARED;
+ return -ERESTART_RESTARTBLOCK;
+ }
+
+@@ -1310,15 +1311,15 @@ static int futex_wait(u32 __user *uaddr, struct rw_semaphore *fshared,
+
+ static long futex_wait_restart(struct restart_block *restart)
+ {
+- u32 __user *uaddr = (u32 __user *)restart->arg0;
+- u32 val = (u32)restart->arg1;
+- ktime_t *abs_time = (ktime_t *)restart->arg2;
++ u32 __user *uaddr = (u32 __user *)restart->futex.uaddr;
+ struct rw_semaphore *fshared = NULL;
++ ktime_t t;
+
++ t.tv64 = restart->futex.time;
+ restart->fn = do_no_restart_syscall;
+- if (restart->arg3 & ARG3_SHARED)
++ if (restart->futex.flags & FLAGS_SHARED)
+ fshared = ¤t->mm->mmap_sem;
+- return (long)futex_wait(uaddr, fshared, val, abs_time);
++ return (long)futex_wait(uaddr, fshared, restart->futex.val, &t);
+ }
+
+
+diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
+index c21ca6b..ee8d0ac 100644
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -826,6 +826,14 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
+ #ifdef CONFIG_TIME_LOW_RES
+ tim = ktime_add(tim, base->resolution);
+ #endif
++ /*
++ * Careful here: User space might have asked for a
++ * very long sleep, so the add above might result in a
++ * negative number, which enqueues the timer in front
++ * of the queue.
++ */
++ if (tim.tv64 < 0)
++ tim.tv64 = KTIME_MAX;
+ }
+ timer->expires = tim;
+
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 7230d91..fdccfd5 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -29,12 +29,28 @@
+ void synchronize_irq(unsigned int irq)
+ {
+ struct irq_desc *desc = irq_desc + irq;
++ unsigned int status;
+
+ if (irq >= NR_IRQS)
+ return;
+
+- while (desc->status & IRQ_INPROGRESS)
+- cpu_relax();
++ do {
++ unsigned long flags;
++
++ /*
++ * Wait until we're out of the critical section. This might
++ * give the wrong answer due to the lack of memory barriers.
++ */
++ while (desc->status & IRQ_INPROGRESS)
++ cpu_relax();
++
++ /* Ok, that indicated we're done: double-check carefully. */
++ spin_lock_irqsave(&desc->lock, flags);
++ status = desc->status;
++ spin_unlock_irqrestore(&desc->lock, flags);
++
++ /* Oops, that failed? */
++ } while (status & IRQ_INPROGRESS);
+ }
+ EXPORT_SYMBOL(synchronize_irq);
+
+diff --git a/kernel/sched.c b/kernel/sched.c
+index 6107a0c..7582d01 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -5306,7 +5306,7 @@ set_table_entry(struct ctl_table *entry,
+ static struct ctl_table *
+ sd_alloc_ctl_domain_table(struct sched_domain *sd)
+ {
+- struct ctl_table *table = sd_alloc_ctl_entry(14);
++ struct ctl_table *table = sd_alloc_ctl_entry(12);
+
+ set_table_entry(&table[0], "min_interval", &sd->min_interval,
+ sizeof(long), 0644, proc_doulongvec_minmax);
+@@ -5326,10 +5326,10 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
+ sizeof(int), 0644, proc_dointvec_minmax);
+ set_table_entry(&table[8], "imbalance_pct", &sd->imbalance_pct,
+ sizeof(int), 0644, proc_dointvec_minmax);
+- set_table_entry(&table[10], "cache_nice_tries",
++ set_table_entry(&table[9], "cache_nice_tries",
+ &sd->cache_nice_tries,
+ sizeof(int), 0644, proc_dointvec_minmax);
+- set_table_entry(&table[12], "flags", &sd->flags,
++ set_table_entry(&table[10], "flags", &sd->flags,
+ sizeof(int), 0644, proc_dointvec_minmax);
+
+ return table;
+diff --git a/lib/textsearch.c b/lib/textsearch.c
+index 88c98a2..be8bda3 100644
+--- a/lib/textsearch.c
++++ b/lib/textsearch.c
+@@ -7,7 +7,7 @@
+ * 2 of the License, or (at your option) any later version.
+ *
+ * Authors: Thomas Graf <tgraf at suug.ch>
+- * Pablo Neira Ayuso <pablo at eurodev.net>
++ * Pablo Neira Ayuso <pablo at netfilter.org>
+ *
+ * ==========================================================================
+ *
+@@ -250,7 +250,8 @@ unsigned int textsearch_find_continuous(struct ts_config *conf,
+ * the various search algorithms.
+ *
+ * Returns a new textsearch configuration according to the specified
+- * parameters or a ERR_PTR().
++ * parameters or a ERR_PTR(). If a zero length pattern is passed, this
++ * function returns EINVAL.
+ */
+ struct ts_config *textsearch_prepare(const char *algo, const void *pattern,
+ unsigned int len, gfp_t gfp_mask, int flags)
+@@ -259,6 +260,9 @@ struct ts_config *textsearch_prepare(const char *algo, const void *pattern,
+ struct ts_config *conf;
+ struct ts_ops *ops;
+
++ if (len == 0)
++ return ERR_PTR(-EINVAL);
++
+ ops = lookup_ts_algo(algo);
+ #ifdef CONFIG_KMOD
+ /*
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 95558e4..4622ffa 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1071,7 +1071,7 @@ shmem_alloc_page(gfp_t gfp, struct shmem_inode_info *info,
+ pvma.vm_policy = mpol_shared_policy_lookup(&info->policy, idx);
+ pvma.vm_pgoff = idx;
+ pvma.vm_end = PAGE_SIZE;
+- page = alloc_page_vma(gfp | __GFP_ZERO, &pvma, 0);
++ page = alloc_page_vma(gfp, &pvma, 0);
+ mpol_free(pvma.vm_policy);
+ return page;
+ }
+@@ -1091,7 +1091,7 @@ shmem_swapin(struct shmem_inode_info *info,swp_entry_t entry,unsigned long idx)
+ static inline struct page *
+ shmem_alloc_page(gfp_t gfp,struct shmem_inode_info *info, unsigned long idx)
+ {
+- return alloc_page(gfp | __GFP_ZERO);
++ return alloc_page(gfp);
+ }
+ #endif
+
+@@ -1304,6 +1304,7 @@ repeat:
+
+ info->alloced++;
+ spin_unlock(&info->lock);
++ clear_highpage(filepage);
+ flush_dcache_page(filepage);
+ SetPageUptodate(filepage);
+ }
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index 328759c..6f5e738 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -459,7 +459,8 @@ int vlan_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ * OTHER THINGS LIKE FDDI/TokenRing/802.3 SNAPs...
+ */
+
+- if (veth->h_vlan_proto != htons(ETH_P_8021Q)) {
++ if (veth->h_vlan_proto != htons(ETH_P_8021Q) ||
++ VLAN_DEV_INFO(dev)->flags & VLAN_FLAG_REORDER_HDR) {
+ int orig_headroom = skb_headroom(skb);
+ unsigned short veth_TCI;
+
+diff --git a/net/bridge/br.c b/net/bridge/br.c
+index 848b8fa..94ae4d2 100644
+--- a/net/bridge/br.c
++++ b/net/bridge/br.c
+@@ -39,7 +39,7 @@ static int __init br_init(void)
+
+ err = br_fdb_init();
+ if (err)
+- goto err_out1;
++ goto err_out;
+
+ err = br_netfilter_init();
+ if (err)
+@@ -65,6 +65,8 @@ err_out3:
+ err_out2:
+ br_netfilter_fini();
+ err_out1:
++ br_fdb_fini();
++err_out:
+ llc_sap_put(br_stp_sap);
+ return err;
+ }
+diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
+index 3a8a015..5706cd1 100644
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -122,6 +122,7 @@ static inline int is_link_local(const unsigned char *dest)
+ struct sk_buff *br_handle_frame(struct net_bridge_port *p, struct sk_buff *skb)
+ {
+ const unsigned char *dest = eth_hdr(skb)->h_dest;
++ int (*rhook)(struct sk_buff **pskb);
+
+ if (!is_valid_ether_addr(eth_hdr(skb)->h_source))
+ goto drop;
+@@ -143,9 +144,9 @@ struct sk_buff *br_handle_frame(struct net_bridge_port *p, struct sk_buff *skb)
+
+ switch (p->state) {
+ case BR_STATE_FORWARDING:
+-
+- if (br_should_route_hook) {
+- if (br_should_route_hook(&skb))
++ rhook = rcu_dereference(br_should_route_hook);
++ if (rhook != NULL) {
++ if (rhook(&skb))
+ return skb;
+ dest = eth_hdr(skb)->h_dest;
+ }
+diff --git a/net/bridge/netfilter/ebtable_broute.c b/net/bridge/netfilter/ebtable_broute.c
+index d37ce04..bc17cf5 100644
+--- a/net/bridge/netfilter/ebtable_broute.c
++++ b/net/bridge/netfilter/ebtable_broute.c
+@@ -70,13 +70,13 @@ static int __init ebtable_broute_init(void)
+ if (ret < 0)
+ return ret;
+ /* see br_input.c */
+- br_should_route_hook = ebt_broute;
++ rcu_assign_pointer(br_should_route_hook, ebt_broute);
+ return ret;
+ }
+
+ static void __exit ebtable_broute_fini(void)
+ {
+- br_should_route_hook = NULL;
++ rcu_assign_pointer(br_should_route_hook, NULL);
+ synchronize_net();
+ ebt_unregister_table(&broute_table);
+ }
+diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
+index 8def682..fbafa97 100644
+--- a/net/decnet/dn_dev.c
++++ b/net/decnet/dn_dev.c
+@@ -650,16 +650,18 @@ static int dn_nl_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
+ struct dn_dev *dn_db;
+ struct ifaddrmsg *ifm;
+ struct dn_ifaddr *ifa, **ifap;
+- int err = -EADDRNOTAVAIL;
++ int err;
+
+ err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, dn_ifa_policy);
+ if (err < 0)
+ goto errout;
+
++ err = -ENODEV;
+ ifm = nlmsg_data(nlh);
+ if ((dn_db = dn_dev_by_index(ifm->ifa_index)) == NULL)
+ goto errout;
+
++ err = -EADDRNOTAVAIL;
+ for (ifap = &dn_db->ifa_list; (ifa = *ifap); ifap = &ifa->ifa_next) {
+ if (tb[IFA_LOCAL] &&
+ nla_memcmp(tb[IFA_LOCAL], &ifa->ifa_local, 2))
+diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
+index 9ab9d53..652da8e 100644
+--- a/net/ipv4/arp.c
++++ b/net/ipv4/arp.c
+@@ -110,12 +110,8 @@
+ #include <net/tcp.h>
+ #include <net/sock.h>
+ #include <net/arp.h>
+-#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
+ #include <net/ax25.h>
+-#if defined(CONFIG_NETROM) || defined(CONFIG_NETROM_MODULE)
+ #include <net/netrom.h>
+-#endif
+-#endif
+ #if defined(CONFIG_ATM_CLIP) || defined(CONFIG_ATM_CLIP_MODULE)
+ #include <net/atmclip.h>
+ struct neigh_table *clip_tbl_hook;
+@@ -729,20 +725,10 @@ static int arp_process(struct sk_buff *skb)
+ htons(dev_type) != arp->ar_hrd)
+ goto out;
+ break;
+-#ifdef CONFIG_NET_ETHERNET
+ case ARPHRD_ETHER:
+-#endif
+-#ifdef CONFIG_TR
+ case ARPHRD_IEEE802_TR:
+-#endif
+-#ifdef CONFIG_FDDI
+ case ARPHRD_FDDI:
+-#endif
+-#ifdef CONFIG_NET_FC
+ case ARPHRD_IEEE802:
+-#endif
+-#if defined(CONFIG_NET_ETHERNET) || defined(CONFIG_TR) || \
+- defined(CONFIG_FDDI) || defined(CONFIG_NET_FC)
+ /*
+ * ETHERNET, Token Ring and Fibre Channel (which are IEEE 802
+ * devices, according to RFC 2625) devices will accept ARP
+@@ -757,21 +743,16 @@ static int arp_process(struct sk_buff *skb)
+ arp->ar_pro != htons(ETH_P_IP))
+ goto out;
+ break;
+-#endif
+-#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
+ case ARPHRD_AX25:
+ if (arp->ar_pro != htons(AX25_P_IP) ||
+ arp->ar_hrd != htons(ARPHRD_AX25))
+ goto out;
+ break;
+-#if defined(CONFIG_NETROM) || defined(CONFIG_NETROM_MODULE)
+ case ARPHRD_NETROM:
+ if (arp->ar_pro != htons(AX25_P_IP) ||
+ arp->ar_hrd != htons(ARPHRD_NETROM))
+ goto out;
+ break;
+-#endif
+-#endif
+ }
+
+ /* Understand only these message types */
+diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
+index deab27f..9731d2c 100644
+--- a/net/ipv4/netfilter/nf_nat_core.c
++++ b/net/ipv4/netfilter/nf_nat_core.c
+@@ -607,13 +607,10 @@ static void nf_nat_move_storage(struct nf_conn *conntrack, void *old)
+ struct nf_conn_nat *new_nat = nf_ct_ext_find(conntrack, NF_CT_EXT_NAT);
+ struct nf_conn_nat *old_nat = (struct nf_conn_nat *)old;
+ struct nf_conn *ct = old_nat->ct;
+- unsigned int srchash;
+
+- if (!(ct->status & IPS_NAT_DONE_MASK))
++ if (!ct || !(ct->status & IPS_NAT_DONE_MASK))
+ return;
+
+- srchash = hash_by_src(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+-
+ write_lock_bh(&nf_nat_lock);
+ hlist_replace_rcu(&old_nat->bysource, &new_nat->bysource);
+ new_nat->ct = ct;
+@@ -681,7 +678,7 @@ static int clean_nat(struct nf_conn *i, void *data)
+
+ if (!nat)
+ return 0;
+- memset(nat, 0, sizeof(nat));
++ memset(nat, 0, sizeof(*nat));
+ i->status &= ~(IPS_NAT_MASK | IPS_NAT_DONE_MASK | IPS_SEQ_ADJUST);
+ return 0;
+ }
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index c7ca94b..198b732 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -2913,18 +2913,14 @@ static int ip_rt_acct_read(char *buffer, char **start, off_t offset,
+ offset /= sizeof(u32);
+
+ if (length > 0) {
+- u32 *src = ((u32 *) IP_RT_ACCT_CPU(0)) + offset;
+ u32 *dst = (u32 *) buffer;
+
+- /* Copy first cpu. */
+ *start = buffer;
+- memcpy(dst, src, length);
++ memset(dst, 0, length);
+
+- /* Add the other cpus in, one int at a time */
+ for_each_possible_cpu(i) {
+ unsigned int j;
+-
+- src = ((u32 *) IP_RT_ACCT_CPU(i)) + offset;
++ u32 *src = ((u32 *) IP_RT_ACCT_CPU(i)) + offset;
+
+ for (j = 0; j < length/4; j++)
+ dst[j] += src[j];
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index 53ef0f4..6ea1306 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -121,7 +121,7 @@ static int sysctl_tcp_congestion_control(ctl_table *table, int __user *name,
+
+ tcp_get_default_congestion_control(val);
+ ret = sysctl_string(&tbl, name, nlen, oldval, oldlenp, newval, newlen);
+- if (ret == 0 && newval && newlen)
++ if (ret == 1 && newval && newlen)
+ ret = tcp_set_default_congestion_control(val);
+ return ret;
+ }
+diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
+index 64f1cba..5aa5f54 100644
+--- a/net/ipv4/tcp_illinois.c
++++ b/net/ipv4/tcp_illinois.c
+@@ -298,7 +298,7 @@ static u32 tcp_illinois_ssthresh(struct sock *sk)
+ struct illinois *ca = inet_csk_ca(sk);
+
+ /* Multiplicative decrease */
+- return max((tp->snd_cwnd * ca->beta) >> BETA_SHIFT, 2U);
++ return max(tp->snd_cwnd - ((tp->snd_cwnd * ca->beta) >> BETA_SHIFT), 2U);
+ }
+
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 666d8a5..097165f 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1287,7 +1287,6 @@ static int tcp_mtu_probe(struct sock *sk)
+
+ skb = tcp_send_head(sk);
+ tcp_insert_write_queue_before(nskb, skb, sk);
+- tcp_advance_send_head(sk, skb);
+
+ TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(skb)->seq;
+ TCP_SKB_CB(nskb)->end_seq = TCP_SKB_CB(skb)->seq + probe_size;
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 45b4c82..0917944 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -2281,6 +2281,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
+ break;
+ }
+
++ if (!idev && dev->mtu >= IPV6_MIN_MTU)
++ idev = ipv6_add_dev(dev);
++
+ if (idev)
+ idev->if_flags |= IF_READY;
+ } else {
+@@ -2345,12 +2348,18 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
+ break;
+
+ case NETDEV_CHANGEMTU:
+- if ( idev && dev->mtu >= IPV6_MIN_MTU) {
++ if (idev && dev->mtu >= IPV6_MIN_MTU) {
+ rt6_mtu_change(dev, dev->mtu);
+ idev->cnf.mtu6 = dev->mtu;
+ break;
+ }
+
++ if (!idev && dev->mtu >= IPV6_MIN_MTU) {
++ idev = ipv6_add_dev(dev);
++ if (idev)
++ break;
++ }
++
+ /* MTU falled under IPV6_MIN_MTU. Stop IPv6 on this interface. */
+
+ case NETDEV_DOWN:
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 5502df1..7a5e993 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -1546,7 +1546,7 @@ static int pfkey_get(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr,
+
+ out_hdr = (struct sadb_msg *) out_skb->data;
+ out_hdr->sadb_msg_version = hdr->sadb_msg_version;
+- out_hdr->sadb_msg_type = SADB_DUMP;
++ out_hdr->sadb_msg_type = SADB_GET;
+ out_hdr->sadb_msg_satype = pfkey_proto2satype(proto);
+ out_hdr->sadb_msg_errno = 0;
+ out_hdr->sadb_msg_reserved = 0;
+diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
+index a1a65a1..cf6ba66 100644
+--- a/net/netfilter/nf_conntrack_extend.c
++++ b/net/netfilter/nf_conntrack_extend.c
+@@ -109,7 +109,7 @@ void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
+ rcu_read_lock();
+ t = rcu_dereference(nf_ct_ext_types[i]);
+ if (t && t->move)
+- t->move(ct, ct->ext + ct->ext->offset[id]);
++ t->move(ct, ct->ext + ct->ext->offset[i]);
+ rcu_read_unlock();
+ }
+ kfree(ct->ext);
+diff --git a/net/netfilter/xt_CONNMARK.c b/net/netfilter/xt_CONNMARK.c
+index 5a00c54..5bc5227 100644
+--- a/net/netfilter/xt_CONNMARK.c
++++ b/net/netfilter/xt_CONNMARK.c
+@@ -85,11 +85,6 @@ checkentry(const char *tablename,
+ {
+ const struct xt_connmark_target_info *matchinfo = targinfo;
+
+- if (nf_ct_l3proto_try_module_get(target->family) < 0) {
+- printk(KERN_WARNING "can't load conntrack support for "
+- "proto=%d\n", target->family);
+- return false;
+- }
+ if (matchinfo->mode == XT_CONNMARK_RESTORE) {
+ if (strcmp(tablename, "mangle") != 0) {
+ printk(KERN_WARNING "CONNMARK: restore can only be "
+@@ -102,6 +97,11 @@ checkentry(const char *tablename,
+ printk(KERN_WARNING "CONNMARK: Only supports 32bit mark\n");
+ return false;
+ }
++ if (nf_ct_l3proto_try_module_get(target->family) < 0) {
++ printk(KERN_WARNING "can't load conntrack support for "
++ "proto=%d\n", target->family);
++ return false;
++ }
+ return true;
+ }
+
+diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c
+index 63d7313..23f780d 100644
+--- a/net/netfilter/xt_CONNSECMARK.c
++++ b/net/netfilter/xt_CONNSECMARK.c
+@@ -91,11 +91,6 @@ static bool checkentry(const char *tablename, const void *entry,
+ {
+ const struct xt_connsecmark_target_info *info = targinfo;
+
+- if (nf_ct_l3proto_try_module_get(target->family) < 0) {
+- printk(KERN_WARNING "can't load conntrack support for "
+- "proto=%d\n", target->family);
+- return false;
+- }
+ switch (info->mode) {
+ case CONNSECMARK_SAVE:
+ case CONNSECMARK_RESTORE:
+@@ -106,6 +101,11 @@ static bool checkentry(const char *tablename, const void *entry,
+ return false;
+ }
+
++ if (nf_ct_l3proto_try_module_get(target->family) < 0) {
++ printk(KERN_WARNING "can't load conntrack support for "
++ "proto=%d\n", target->family);
++ return false;
++ }
+ return true;
+ }
+
+diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
+index d40f7e4..b41c524 100644
+--- a/net/netfilter/xt_TCPMSS.c
++++ b/net/netfilter/xt_TCPMSS.c
+@@ -178,10 +178,8 @@ xt_tcpmss_target6(struct sk_buff **pskb,
+
+ nexthdr = ipv6h->nexthdr;
+ tcphoff = ipv6_skip_exthdr(*pskb, sizeof(*ipv6h), &nexthdr);
+- if (tcphoff < 0) {
+- WARN_ON(1);
++ if (tcphoff < 0)
+ return NF_DROP;
+- }
+ ret = tcpmss_mangle_packet(pskb, targinfo, tcphoff,
+ sizeof(*ipv6h) + sizeof(struct tcphdr));
+ if (ret < 0)
+diff --git a/net/rxrpc/Kconfig b/net/rxrpc/Kconfig
+index e662f1d..0d3103c 100644
+--- a/net/rxrpc/Kconfig
++++ b/net/rxrpc/Kconfig
+@@ -5,6 +5,7 @@
+ config AF_RXRPC
+ tristate "RxRPC session sockets"
+ depends on INET && EXPERIMENTAL
++ select CRYPTO
+ select KEYS
+ help
+ Say Y or M here to include support for RxRPC session sockets (just
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index c81649c..a35d7ce 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -135,7 +135,7 @@ static inline int qdisc_restart(struct net_device *dev)
+ struct Qdisc *q = dev->qdisc;
+ struct sk_buff *skb;
+ unsigned lockless;
+- int ret;
++ int ret = NETDEV_TX_BUSY;
+
+ /* Dequeue packet */
+ if (unlikely((skb = dev_dequeue_skb(dev, q)) == NULL))
+@@ -158,7 +158,8 @@ static inline int qdisc_restart(struct net_device *dev)
+ /* And release queue */
+ spin_unlock(&dev->queue_lock);
+
+- ret = dev_hard_start_xmit(skb, dev);
++ if (!netif_subqueue_stopped(dev, skb->queue_mapping))
++ ret = dev_hard_start_xmit(skb, dev);
+
+ if (!lockless)
+ netif_tx_unlock(dev);
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index a05c342..fa85358 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1632,8 +1632,15 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
+ mutex_lock(&u->readlock);
+
+ skb = skb_recv_datagram(sk, flags, noblock, &err);
+- if (!skb)
++ if (!skb) {
++ unix_state_lock(sk);
++ /* Signal EOF on disconnected non-blocking SEQPACKET socket. */
++ if (sk->sk_type == SOCK_SEQPACKET && err == -EAGAIN &&
++ (sk->sk_shutdown & RCV_SHUTDOWN))
++ err = 0;
++ unix_state_unlock(sk);
+ goto out_unlock;
++ }
+
+ wake_up_interruptible(&u->peer_wait);
+
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index d4356e6..4e28f8d 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -370,7 +370,7 @@ int __xfrm_state_delete(struct xfrm_state *x)
+ * The xfrm_state_alloc call gives a reference, and that
+ * is what we are dropping here.
+ */
+- __xfrm_state_put(x);
++ xfrm_state_put(x);
+ err = 0;
+ }
+
Modified: dists/sid/linux-2.6/debian/patches/series/2
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/2 (original)
+++ dists/sid/linux-2.6/debian/patches/series/2 Fri Dec 14 20:45:03 2007
@@ -1,4 +1,4 @@
+ bugfix/arm/glantank-rtc.patch
+ features/all/export-gfs2-locking-symbols.patch
+ bugfix/sparc/sunfire-get_cpu.patch
-+ bugfix/tcp-header-misalignment.patch
++ bugfix/all/2.6.23.10
More information about the Kernel-svn-changes
mailing list