1.1 --- a/patches/linux-2.6.12/linux-2.6.12.3.patch	Sun Aug 14 21:45:26 2005 +0000
     1.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.3 @@ -1,1047 +0,0 @@
     1.4 -diff --git a/Makefile b/Makefile
     1.5 ---- a/Makefile
     1.6 -+++ b/Makefile
     1.7 -@@ -1,7 +1,7 @@
     1.8 - VERSION = 2
     1.9 - PATCHLEVEL = 6
    1.10 - SUBLEVEL = 12
    1.11 --EXTRAVERSION =
    1.12 -+EXTRAVERSION = .3
    1.13 - NAME=Woozy Numbat
    1.14 - 
    1.15 - # *DOCUMENTATION*
    1.16 -diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
    1.17 ---- a/arch/ia64/kernel/ptrace.c
    1.18 -+++ b/arch/ia64/kernel/ptrace.c
    1.19 -@@ -945,6 +945,13 @@ access_uarea (struct task_struct *child,
    1.20 - 				*data = (pt->cr_ipsr & IPSR_MASK);
    1.21 - 			return 0;
    1.22 - 
    1.23 -+		      case PT_AR_RSC:
    1.24 -+			if (write_access)
    1.25 -+				pt->ar_rsc = *data | (3 << 2); /* force PL3 */
    1.26 -+			else
    1.27 -+				*data = pt->ar_rsc;
    1.28 -+			return 0;
    1.29 -+
    1.30 - 		      case PT_AR_RNAT:
    1.31 - 			urbs_end = ia64_get_user_rbs_end(child, pt, NULL);
    1.32 - 			rnat_addr = (long) ia64_rse_rnat_addr((long *)
    1.33 -@@ -996,9 +1003,6 @@ access_uarea (struct task_struct *child,
    1.34 - 		      case PT_AR_BSPSTORE:
    1.35 - 			ptr = pt_reg_addr(pt, ar_bspstore);
    1.36 - 			break;
    1.37 --		      case PT_AR_RSC:
    1.38 --			ptr = pt_reg_addr(pt, ar_rsc);
    1.39 --			break;
    1.40 - 		      case PT_AR_UNAT:
    1.41 - 			ptr = pt_reg_addr(pt, ar_unat);
    1.42 - 			break;
    1.43 -@@ -1234,7 +1238,7 @@ ptrace_getregs (struct task_struct *chil
    1.44 - static long
    1.45 - ptrace_setregs (struct task_struct *child, struct pt_all_user_regs __user *ppr)
    1.46 - {
    1.47 --	unsigned long psr, ec, lc, rnat, bsp, cfm, nat_bits, val = 0;
    1.48 -+	unsigned long psr, rsc, ec, lc, rnat, bsp, cfm, nat_bits, val = 0;
    1.49 - 	struct unw_frame_info info;
    1.50 - 	struct switch_stack *sw;
    1.51 - 	struct ia64_fpreg fpval;
    1.52 -@@ -1267,7 +1271,7 @@ ptrace_setregs (struct task_struct *chil
    1.53 - 	/* app regs */
    1.54 - 
    1.55 - 	retval |= __get_user(pt->ar_pfs, &ppr->ar[PT_AUR_PFS]);
    1.56 --	retval |= __get_user(pt->ar_rsc, &ppr->ar[PT_AUR_RSC]);
    1.57 -+	retval |= __get_user(rsc, &ppr->ar[PT_AUR_RSC]);
    1.58 - 	retval |= __get_user(pt->ar_bspstore, &ppr->ar[PT_AUR_BSPSTORE]);
    1.59 - 	retval |= __get_user(pt->ar_unat, &ppr->ar[PT_AUR_UNAT]);
    1.60 - 	retval |= __get_user(pt->ar_ccv, &ppr->ar[PT_AUR_CCV]);
    1.61 -@@ -1365,6 +1369,7 @@ ptrace_setregs (struct task_struct *chil
    1.62 - 	retval |= __get_user(nat_bits, &ppr->nat);
    1.63 - 
    1.64 - 	retval |= access_uarea(child, PT_CR_IPSR, &psr, 1);
    1.65 -+	retval |= access_uarea(child, PT_AR_RSC, &rsc, 1);
    1.66 - 	retval |= access_uarea(child, PT_AR_EC, &ec, 1);
    1.67 - 	retval |= access_uarea(child, PT_AR_LC, &lc, 1);
    1.68 - 	retval |= access_uarea(child, PT_AR_RNAT, &rnat, 1);
    1.69 -diff --git a/arch/ia64/kernel/signal.c b/arch/ia64/kernel/signal.c
    1.70 ---- a/arch/ia64/kernel/signal.c
    1.71 -+++ b/arch/ia64/kernel/signal.c
    1.72 -@@ -94,7 +94,7 @@ sys_sigaltstack (const stack_t __user *u
    1.73 - static long
    1.74 - restore_sigcontext (struct sigcontext __user *sc, struct sigscratch *scr)
    1.75 - {
    1.76 --	unsigned long ip, flags, nat, um, cfm;
    1.77 -+	unsigned long ip, flags, nat, um, cfm, rsc;
    1.78 - 	long err;
    1.79 - 
    1.80 - 	/* Always make any pending restarted system calls return -EINTR */
    1.81 -@@ -106,7 +106,7 @@ restore_sigcontext (struct sigcontext __
    1.82 - 	err |= __get_user(ip, &sc->sc_ip);			/* instruction pointer */
    1.83 - 	err |= __get_user(cfm, &sc->sc_cfm);
    1.84 - 	err |= __get_user(um, &sc->sc_um);			/* user mask */
    1.85 --	err |= __get_user(scr->pt.ar_rsc, &sc->sc_ar_rsc);
    1.86 -+	err |= __get_user(rsc, &sc->sc_ar_rsc);
    1.87 - 	err |= __get_user(scr->pt.ar_unat, &sc->sc_ar_unat);
    1.88 - 	err |= __get_user(scr->pt.ar_fpsr, &sc->sc_ar_fpsr);
    1.89 - 	err |= __get_user(scr->pt.ar_pfs, &sc->sc_ar_pfs);
    1.90 -@@ -119,6 +119,7 @@ restore_sigcontext (struct sigcontext __
    1.91 - 	err |= __copy_from_user(&scr->pt.r15, &sc->sc_gr[15], 8);	/* r15 */
    1.92 - 
    1.93 - 	scr->pt.cr_ifs = cfm | (1UL << 63);
    1.94 -+	scr->pt.ar_rsc = rsc | (3 << 2); /* force PL3 */
    1.95 - 
    1.96 - 	/* establish new instruction pointer: */
    1.97 - 	scr->pt.cr_iip = ip & ~0x3UL;
    1.98 -diff --git a/arch/ppc/kernel/time.c b/arch/ppc/kernel/time.c
    1.99 ---- a/arch/ppc/kernel/time.c
   1.100 -+++ b/arch/ppc/kernel/time.c
   1.101 -@@ -89,6 +89,9 @@ unsigned long tb_to_ns_scale;
   1.102 - 
   1.103 - extern unsigned long wall_jiffies;
   1.104 - 
   1.105 -+/* used for timezone offset */
   1.106 -+static long timezone_offset;
   1.107 -+
   1.108 - DEFINE_SPINLOCK(rtc_lock);
   1.109 - 
   1.110 - EXPORT_SYMBOL(rtc_lock);
   1.111 -@@ -170,7 +173,7 @@ void timer_interrupt(struct pt_regs * re
   1.112 - 		     xtime.tv_sec - last_rtc_update >= 659 &&
   1.113 - 		     abs((xtime.tv_nsec / 1000) - (1000000-1000000/HZ)) < 500000/HZ &&
   1.114 - 		     jiffies - wall_jiffies == 1) {
   1.115 --		  	if (ppc_md.set_rtc_time(xtime.tv_sec+1 + time_offset) == 0)
   1.116 -+		  	if (ppc_md.set_rtc_time(xtime.tv_sec+1 + timezone_offset) == 0)
   1.117 - 				last_rtc_update = xtime.tv_sec+1;
   1.118 - 			else
   1.119 - 				/* Try again one minute later */
   1.120 -@@ -286,7 +289,7 @@ void __init time_init(void)
   1.121 - 	unsigned old_stamp, stamp, elapsed;
   1.122 - 
   1.123 -         if (ppc_md.time_init != NULL)
   1.124 --                time_offset = ppc_md.time_init();
   1.125 -+                timezone_offset = ppc_md.time_init();
   1.126 - 
   1.127 - 	if (__USE_RTC()) {
   1.128 - 		/* 601 processor: dec counts down by 128 every 128ns */
   1.129 -@@ -331,10 +334,10 @@ void __init time_init(void)
   1.130 - 	set_dec(tb_ticks_per_jiffy);
   1.131 - 
   1.132 - 	/* If platform provided a timezone (pmac), we correct the time */
   1.133 --        if (time_offset) {
   1.134 --		sys_tz.tz_minuteswest = -time_offset / 60;
   1.135 -+        if (timezone_offset) {
   1.136 -+		sys_tz.tz_minuteswest = -timezone_offset / 60;
   1.137 - 		sys_tz.tz_dsttime = 0;
   1.138 --		xtime.tv_sec -= time_offset;
   1.139 -+		xtime.tv_sec -= timezone_offset;
   1.140 -         }
   1.141 -         set_normalized_timespec(&wall_to_monotonic,
   1.142 -                                 -xtime.tv_sec, -xtime.tv_nsec);
   1.143 -diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
   1.144 ---- a/arch/um/kernel/process.c
   1.145 -+++ b/arch/um/kernel/process.c
   1.146 -@@ -130,7 +130,7 @@ int start_fork_tramp(void *thread_arg, u
   1.147 - 	return(arg.pid);
   1.148 - }
   1.149 - 
   1.150 --static int ptrace_child(void)
   1.151 -+static int ptrace_child(void *arg)
   1.152 - {
   1.153 - 	int ret;
   1.154 - 	int pid = os_getpid(), ppid = getppid();
   1.155 -@@ -159,16 +159,20 @@ static int ptrace_child(void)
   1.156 - 	_exit(ret);
   1.157 - }
   1.158 - 
   1.159 --static int start_ptraced_child(void)
   1.160 -+static int start_ptraced_child(void **stack_out)
   1.161 - {
   1.162 -+	void *stack;
   1.163 -+	unsigned long sp;
   1.164 - 	int pid, n, status;
   1.165 - 	
   1.166 --	pid = fork();
   1.167 --	if(pid == 0)
   1.168 --		ptrace_child();
   1.169 --
   1.170 -+	stack = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC,
   1.171 -+		     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
   1.172 -+	if(stack == MAP_FAILED)
   1.173 -+		panic("check_ptrace : mmap failed, errno = %d", errno);
   1.174 -+	sp = (unsigned long) stack + PAGE_SIZE - sizeof(void *);
   1.175 -+	pid = clone(ptrace_child, (void *) sp, SIGCHLD, NULL);
   1.176 - 	if(pid < 0)
   1.177 --		panic("check_ptrace : fork failed, errno = %d", errno);
   1.178 -+		panic("check_ptrace : clone failed, errno = %d", errno);
   1.179 - 	CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED));
   1.180 - 	if(n < 0)
   1.181 - 		panic("check_ptrace : wait failed, errno = %d", errno);
   1.182 -@@ -176,6 +180,7 @@ static int start_ptraced_child(void)
   1.183 - 		panic("check_ptrace : expected SIGSTOP, got status = %d",
   1.184 - 		      status);
   1.185 - 
   1.186 -+	*stack_out = stack;
   1.187 - 	return(pid);
   1.188 - }
   1.189 - 
   1.190 -@@ -183,12 +188,12 @@ static int start_ptraced_child(void)
   1.191 -  * just avoid using sysemu, not panic, but only if SYSEMU features are broken.
   1.192 -  * So only for SYSEMU features we test mustpanic, while normal host features
   1.193 -  * must work anyway!*/
   1.194 --static int stop_ptraced_child(int pid, int exitcode, int mustexit)
   1.195 -+static int stop_ptraced_child(int pid, void *stack, int exitcode, int mustpanic)
   1.196 - {
   1.197 - 	int status, n, ret = 0;
   1.198 - 
   1.199 - 	if(ptrace(PTRACE_CONT, pid, 0, 0) < 0)
   1.200 --		panic("stop_ptraced_child : ptrace failed, errno = %d", errno);
   1.201 -+		panic("check_ptrace : ptrace failed, errno = %d", errno);
   1.202 - 	CATCH_EINTR(n = waitpid(pid, &status, 0));
   1.203 - 	if(!WIFEXITED(status) || (WEXITSTATUS(status) != exitcode)) {
   1.204 - 		int exit_with = WEXITSTATUS(status);
   1.205 -@@ -199,13 +204,15 @@ static int stop_ptraced_child(int pid, i
   1.206 - 		printk("check_ptrace : child exited with exitcode %d, while "
   1.207 - 		      "expecting %d; status 0x%x", exit_with,
   1.208 - 		      exitcode, status);
   1.209 --		if (mustexit)
   1.210 -+		if (mustpanic)
   1.211 - 			panic("\n");
   1.212 - 		else
   1.213 - 			printk("\n");
   1.214 - 		ret = -1;
   1.215 - 	}
   1.216 - 
   1.217 -+	if(munmap(stack, PAGE_SIZE) < 0)
   1.218 -+		panic("check_ptrace : munmap failed, errno = %d", errno);
   1.219 - 	return ret;
   1.220 - }
   1.221 - 
   1.222 -@@ -227,11 +234,12 @@ __uml_setup("nosysemu", nosysemu_cmd_par
   1.223 - 
   1.224 - static void __init check_sysemu(void)
   1.225 - {
   1.226 -+	void *stack;
   1.227 - 	int pid, syscall, n, status, count=0;
   1.228 - 
   1.229 - 	printk("Checking syscall emulation patch for ptrace...");
   1.230 - 	sysemu_supported = 0;
   1.231 --	pid = start_ptraced_child();
   1.232 -+	pid = start_ptraced_child(&stack);
   1.233 - 
   1.234 - 	if(ptrace(PTRACE_SYSEMU, pid, 0, 0) < 0)
   1.235 - 		goto fail;
   1.236 -@@ -249,7 +257,7 @@ static void __init check_sysemu(void)
   1.237 - 		panic("check_sysemu : failed to modify system "
   1.238 - 		      "call return, errno = %d", errno);
   1.239 - 
   1.240 --	if (stop_ptraced_child(pid, 0, 0) < 0)
   1.241 -+	if (stop_ptraced_child(pid, stack, 0, 0) < 0)
   1.242 - 		goto fail_stopped;
   1.243 - 
   1.244 - 	sysemu_supported = 1;
   1.245 -@@ -257,7 +265,7 @@ static void __init check_sysemu(void)
   1.246 - 	set_using_sysemu(!force_sysemu_disabled);
   1.247 - 
   1.248 - 	printk("Checking advanced syscall emulation patch for ptrace...");
   1.249 --	pid = start_ptraced_child();
   1.250 -+	pid = start_ptraced_child(&stack);
   1.251 - 	while(1){
   1.252 - 		count++;
   1.253 - 		if(ptrace(PTRACE_SYSEMU_SINGLESTEP, pid, 0, 0) < 0)
   1.254 -@@ -282,7 +290,7 @@ static void __init check_sysemu(void)
   1.255 - 			break;
   1.256 - 		}
   1.257 - 	}
   1.258 --	if (stop_ptraced_child(pid, 0, 0) < 0)
   1.259 -+	if (stop_ptraced_child(pid, stack, 0, 0) < 0)
   1.260 - 		goto fail_stopped;
   1.261 - 
   1.262 - 	sysemu_supported = 2;
   1.263 -@@ -293,17 +301,18 @@ static void __init check_sysemu(void)
   1.264 - 	return;
   1.265 - 
   1.266 - fail:
   1.267 --	stop_ptraced_child(pid, 1, 0);
   1.268 -+	stop_ptraced_child(pid, stack, 1, 0);
   1.269 - fail_stopped:
   1.270 - 	printk("missing\n");
   1.271 - }
   1.272 - 
   1.273 - void __init check_ptrace(void)
   1.274 - {
   1.275 -+	void *stack;
   1.276 - 	int pid, syscall, n, status;
   1.277 - 
   1.278 - 	printk("Checking that ptrace can change system call numbers...");
   1.279 --	pid = start_ptraced_child();
   1.280 -+	pid = start_ptraced_child(&stack);
   1.281 - 
   1.282 - 	if (ptrace(PTRACE_OLDSETOPTIONS, pid, 0, (void *)PTRACE_O_TRACESYSGOOD) < 0)
   1.283 - 		panic("check_ptrace: PTRACE_SETOPTIONS failed, errno = %d", errno);
   1.284 -@@ -330,7 +339,7 @@ void __init check_ptrace(void)
   1.285 - 			break;
   1.286 - 		}
   1.287 - 	}
   1.288 --	stop_ptraced_child(pid, 0, 1);
   1.289 -+	stop_ptraced_child(pid, stack, 0, 1);
   1.290 - 	printk("OK\n");
   1.291 - 	check_sysemu();
   1.292 - }
   1.293 -@@ -362,10 +371,11 @@ void forward_pending_sigio(int target)
   1.294 - static inline int check_skas3_ptrace_support(void)
   1.295 - {
   1.296 - 	struct ptrace_faultinfo fi;
   1.297 -+	void *stack;
   1.298 - 	int pid, n, ret = 1;
   1.299 - 
   1.300 - 	printf("Checking for the skas3 patch in the host...");
   1.301 --	pid = start_ptraced_child();
   1.302 -+	pid = start_ptraced_child(&stack);
   1.303 - 
   1.304 - 	n = ptrace(PTRACE_FAULTINFO, pid, 0, &fi);
   1.305 - 	if (n < 0) {
   1.306 -@@ -380,7 +390,7 @@ static inline int check_skas3_ptrace_sup
   1.307 - 	}
   1.308 - 
   1.309 - 	init_registers(pid);
   1.310 --	stop_ptraced_child(pid, 1, 1);
   1.311 -+	stop_ptraced_child(pid, stack, 1, 1);
   1.312 - 
   1.313 - 	return(ret);
   1.314 - }
   1.315 -diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
   1.316 ---- a/drivers/acpi/pci_irq.c
   1.317 -+++ b/drivers/acpi/pci_irq.c
   1.318 -@@ -433,8 +433,9 @@ acpi_pci_irq_enable (
   1.319 - 		printk(KERN_WARNING PREFIX "PCI Interrupt %s[%c]: no GSI",
   1.320 - 			pci_name(dev), ('A' + pin));
   1.321 - 		/* Interrupt Line values above 0xF are forbidden */
   1.322 --		if (dev->irq >= 0 && (dev->irq <= 0xF)) {
   1.323 -+		if (dev->irq > 0 && (dev->irq <= 0xF)) {
   1.324 - 			printk(" - using IRQ %d\n", dev->irq);
   1.325 -+			acpi_register_gsi(dev->irq, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW);
   1.326 - 			return_VALUE(0);
   1.327 - 		}
   1.328 - 		else {
   1.329 -diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
   1.330 ---- a/drivers/char/tpm/tpm.c
   1.331 -+++ b/drivers/char/tpm/tpm.c
   1.332 -@@ -32,12 +32,6 @@
   1.333 - 
   1.334 - #define	TPM_BUFSIZE			2048
   1.335 - 
   1.336 --/* PCI configuration addresses */
   1.337 --#define	PCI_GEN_PMCON_1			0xA0
   1.338 --#define	PCI_GEN1_DEC			0xE4
   1.339 --#define	PCI_LPC_EN			0xE6
   1.340 --#define	PCI_GEN2_DEC			0xEC
   1.341 --
   1.342 - static LIST_HEAD(tpm_chip_list);
   1.343 - static DEFINE_SPINLOCK(driver_lock);
   1.344 - static int dev_mask[32];
   1.345 -@@ -61,72 +55,6 @@ void tpm_time_expired(unsigned long ptr)
   1.346 - EXPORT_SYMBOL_GPL(tpm_time_expired);
   1.347 - 
   1.348 - /*
   1.349 -- * Initialize the LPC bus and enable the TPM ports
   1.350 -- */
   1.351 --int tpm_lpc_bus_init(struct pci_dev *pci_dev, u16 base)
   1.352 --{
   1.353 --	u32 lpcenable, tmp;
   1.354 --	int is_lpcm = 0;
   1.355 --
   1.356 --	switch (pci_dev->vendor) {
   1.357 --	case PCI_VENDOR_ID_INTEL:
   1.358 --		switch (pci_dev->device) {
   1.359 --		case PCI_DEVICE_ID_INTEL_82801CA_12:
   1.360 --		case PCI_DEVICE_ID_INTEL_82801DB_12:
   1.361 --			is_lpcm = 1;
   1.362 --			break;
   1.363 --		}
   1.364 --		/* init ICH (enable LPC) */
   1.365 --		pci_read_config_dword(pci_dev, PCI_GEN1_DEC, &lpcenable);
   1.366 --		lpcenable |= 0x20000000;
   1.367 --		pci_write_config_dword(pci_dev, PCI_GEN1_DEC, lpcenable);
   1.368 --
   1.369 --		if (is_lpcm) {
   1.370 --			pci_read_config_dword(pci_dev, PCI_GEN1_DEC,
   1.371 --					      &lpcenable);
   1.372 --			if ((lpcenable & 0x20000000) == 0) {
   1.373 --				dev_err(&pci_dev->dev,
   1.374 --					"cannot enable LPC\n");
   1.375 --				return -ENODEV;
   1.376 --			}
   1.377 --		}
   1.378 --
   1.379 --		/* initialize TPM registers */
   1.380 --		pci_read_config_dword(pci_dev, PCI_GEN2_DEC, &tmp);
   1.381 --
   1.382 --		if (!is_lpcm)
   1.383 --			tmp = (tmp & 0xFFFF0000) | (base & 0xFFF0);
   1.384 --		else
   1.385 --			tmp =
   1.386 --			    (tmp & 0xFFFF0000) | (base & 0xFFF0) |
   1.387 --			    0x00000001;
   1.388 --
   1.389 --		pci_write_config_dword(pci_dev, PCI_GEN2_DEC, tmp);
   1.390 --
   1.391 --		if (is_lpcm) {
   1.392 --			pci_read_config_dword(pci_dev, PCI_GEN_PMCON_1,
   1.393 --					      &tmp);
   1.394 --			tmp |= 0x00000004;	/* enable CLKRUN */
   1.395 --			pci_write_config_dword(pci_dev, PCI_GEN_PMCON_1,
   1.396 --					       tmp);
   1.397 --		}
   1.398 --		tpm_write_index(0x0D, 0x55);	/* unlock 4F */
   1.399 --		tpm_write_index(0x0A, 0x00);	/* int disable */
   1.400 --		tpm_write_index(0x08, base);	/* base addr lo */
   1.401 --		tpm_write_index(0x09, (base & 0xFF00) >> 8);	/* base addr hi */
   1.402 --		tpm_write_index(0x0D, 0xAA);	/* lock 4F */
   1.403 --		break;
   1.404 --	case PCI_VENDOR_ID_AMD:
   1.405 --		/* nothing yet */
   1.406 --		break;
   1.407 --	}
   1.408 --
   1.409 --	return 0;
   1.410 --}
   1.411 --
   1.412 --EXPORT_SYMBOL_GPL(tpm_lpc_bus_init);
   1.413 --
   1.414 --/*
   1.415 -  * Internal kernel interface to transmit TPM commands
   1.416 -  */
   1.417 - static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
   1.418 -@@ -590,10 +518,6 @@ int tpm_pm_resume(struct pci_dev *pci_de
   1.419 - 	if (chip == NULL)
   1.420 - 		return -ENODEV;
   1.421 - 
   1.422 --	spin_lock(&driver_lock);
   1.423 --	tpm_lpc_bus_init(pci_dev, chip->vendor->base);
   1.424 --	spin_unlock(&driver_lock);
   1.425 --
   1.426 - 	return 0;
   1.427 - }
   1.428 - 
   1.429 -diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
   1.430 ---- a/drivers/char/tpm/tpm.h
   1.431 -+++ b/drivers/char/tpm/tpm.h
   1.432 -@@ -79,8 +79,6 @@ static inline void tpm_write_index(int i
   1.433 - }
   1.434 - 
   1.435 - extern void tpm_time_expired(unsigned long);
   1.436 --extern int tpm_lpc_bus_init(struct pci_dev *, u16);
   1.437 --
   1.438 - extern int tpm_register_hardware(struct pci_dev *,
   1.439 - 				 struct tpm_vendor_specific *);
   1.440 - extern int tpm_open(struct inode *, struct file *);
   1.441 -diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c
   1.442 ---- a/drivers/char/tpm/tpm_atmel.c
   1.443 -+++ b/drivers/char/tpm/tpm_atmel.c
   1.444 -@@ -22,7 +22,10 @@
   1.445 - #include "tpm.h"
   1.446 - 
   1.447 - /* Atmel definitions */
   1.448 --#define	TPM_ATML_BASE			0x400
   1.449 -+enum tpm_atmel_addr {
   1.450 -+	TPM_ATMEL_BASE_ADDR_LO = 0x08,
   1.451 -+	TPM_ATMEL_BASE_ADDR_HI = 0x09
   1.452 -+};
   1.453 - 
   1.454 - /* write status bits */
   1.455 - #define	ATML_STATUS_ABORT		0x01
   1.456 -@@ -127,7 +130,6 @@ static struct tpm_vendor_specific tpm_at
   1.457 - 	.cancel = tpm_atml_cancel,
   1.458 - 	.req_complete_mask = ATML_STATUS_BUSY | ATML_STATUS_DATA_AVAIL,
   1.459 - 	.req_complete_val = ATML_STATUS_DATA_AVAIL,
   1.460 --	.base = TPM_ATML_BASE,
   1.461 - 	.miscdev = { .fops = &atmel_ops, },
   1.462 - };
   1.463 - 
   1.464 -@@ -136,14 +138,16 @@ static int __devinit tpm_atml_init(struc
   1.465 - {
   1.466 - 	u8 version[4];
   1.467 - 	int rc = 0;
   1.468 -+	int lo, hi;
   1.469 - 
   1.470 - 	if (pci_enable_device(pci_dev))
   1.471 - 		return -EIO;
   1.472 - 
   1.473 --	if (tpm_lpc_bus_init(pci_dev, TPM_ATML_BASE)) {
   1.474 --		rc = -ENODEV;
   1.475 --		goto out_err;
   1.476 --	}
   1.477 -+	lo = tpm_read_index( TPM_ATMEL_BASE_ADDR_LO );
   1.478 -+	hi = tpm_read_index( TPM_ATMEL_BASE_ADDR_HI );
   1.479 -+
   1.480 -+	tpm_atmel.base = (hi<<8)|lo;
   1.481 -+	dev_dbg( &pci_dev->dev, "Operating with base: 0x%x\n", tpm_atmel.base);
   1.482 - 
   1.483 - 	/* verify that it is an Atmel part */
   1.484 - 	if (tpm_read_index(4) != 'A' || tpm_read_index(5) != 'T'
   1.485 -diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
   1.486 ---- a/drivers/char/tpm/tpm_nsc.c
   1.487 -+++ b/drivers/char/tpm/tpm_nsc.c
   1.488 -@@ -24,6 +24,10 @@
   1.489 - /* National definitions */
   1.490 - #define	TPM_NSC_BASE			0x360
   1.491 - #define	TPM_NSC_IRQ			0x07
   1.492 -+#define	TPM_NSC_BASE0_HI		0x60
   1.493 -+#define	TPM_NSC_BASE0_LO		0x61
   1.494 -+#define	TPM_NSC_BASE1_HI		0x62
   1.495 -+#define	TPM_NSC_BASE1_LO		0x63
   1.496 - 
   1.497 - #define	NSC_LDN_INDEX			0x07
   1.498 - #define	NSC_SID_INDEX			0x20
   1.499 -@@ -234,7 +238,6 @@ static struct tpm_vendor_specific tpm_ns
   1.500 - 	.cancel = tpm_nsc_cancel,
   1.501 - 	.req_complete_mask = NSC_STATUS_OBF,
   1.502 - 	.req_complete_val = NSC_STATUS_OBF,
   1.503 --	.base = TPM_NSC_BASE,
   1.504 - 	.miscdev = { .fops = &nsc_ops, },
   1.505 - 	
   1.506 - };
   1.507 -@@ -243,15 +246,16 @@ static int __devinit tpm_nsc_init(struct
   1.508 - 				  const struct pci_device_id *pci_id)
   1.509 - {
   1.510 - 	int rc = 0;
   1.511 -+	int lo, hi;
   1.512 -+
   1.513 -+	hi = tpm_read_index(TPM_NSC_BASE0_HI);
   1.514 -+	lo = tpm_read_index(TPM_NSC_BASE0_LO);
   1.515 -+
   1.516 -+	tpm_nsc.base = (hi<<8) | lo;
   1.517 - 
   1.518 - 	if (pci_enable_device(pci_dev))
   1.519 - 		return -EIO;
   1.520 - 
   1.521 --	if (tpm_lpc_bus_init(pci_dev, TPM_NSC_BASE)) {
   1.522 --		rc = -ENODEV;
   1.523 --		goto out_err;
   1.524 --	}
   1.525 --
   1.526 - 	/* verify that it is a National part (SID) */
   1.527 - 	if (tpm_read_index(NSC_SID_INDEX) != 0xEF) {
   1.528 - 		rc = -ENODEV;
   1.529 -diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
   1.530 ---- a/drivers/char/tty_ioctl.c
   1.531 -+++ b/drivers/char/tty_ioctl.c
   1.532 -@@ -476,11 +476,11 @@ int n_tty_ioctl(struct tty_struct * tty,
   1.533 - 			ld = tty_ldisc_ref(tty);
   1.534 - 			switch (arg) {
   1.535 - 			case TCIFLUSH:
   1.536 --				if (ld->flush_buffer)
   1.537 -+				if (ld && ld->flush_buffer)
   1.538 - 					ld->flush_buffer(tty);
   1.539 - 				break;
   1.540 - 			case TCIOFLUSH:
   1.541 --				if (ld->flush_buffer)
   1.542 -+				if (ld && ld->flush_buffer)
   1.543 - 					ld->flush_buffer(tty);
   1.544 - 				/* fall through */
   1.545 - 			case TCOFLUSH:
   1.546 -diff --git a/drivers/media/video/cx88/cx88-video.c b/drivers/media/video/cx88/cx88-video.c
   1.547 ---- a/drivers/media/video/cx88/cx88-video.c
   1.548 -+++ b/drivers/media/video/cx88/cx88-video.c
   1.549 -@@ -261,7 +261,7 @@ static struct cx88_ctrl cx8800_ctls[] = 
   1.550 - 			.default_value = 0,
   1.551 - 			.type          = V4L2_CTRL_TYPE_INTEGER,
   1.552 - 		},
   1.553 --		.off                   = 0,
   1.554 -+		.off                   = 128,
   1.555 - 		.reg                   = MO_HUE,
   1.556 - 		.mask                  = 0x00ff,
   1.557 - 		.shift                 = 0,
   1.558 -diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
   1.559 ---- a/drivers/net/e1000/e1000_main.c
   1.560 -+++ b/drivers/net/e1000/e1000_main.c
   1.561 -@@ -2307,6 +2307,7 @@ e1000_xmit_frame(struct sk_buff *skb, st
   1.562 - 	tso = e1000_tso(adapter, skb);
   1.563 - 	if (tso < 0) {
   1.564 - 		dev_kfree_skb_any(skb);
   1.565 -+		spin_unlock_irqrestore(&adapter->tx_lock, flags);
   1.566 - 		return NETDEV_TX_OK;
   1.567 - 	}
   1.568 - 
   1.569 -diff --git a/drivers/net/hamradio/Kconfig b/drivers/net/hamradio/Kconfig
   1.570 ---- a/drivers/net/hamradio/Kconfig
   1.571 -+++ b/drivers/net/hamradio/Kconfig
   1.572 -@@ -17,7 +17,7 @@ config MKISS
   1.573 - 
   1.574 - config 6PACK
   1.575 - 	tristate "Serial port 6PACK driver"
   1.576 --	depends on AX25 && BROKEN_ON_SMP
   1.577 -+	depends on AX25
   1.578 - 	---help---
   1.579 - 	  6pack is a transmission protocol for the data exchange between your
   1.580 - 	  PC and your TNC (the Terminal Node Controller acts as a kind of
   1.581 -diff --git a/drivers/net/shaper.c b/drivers/net/shaper.c
   1.582 ---- a/drivers/net/shaper.c
   1.583 -+++ b/drivers/net/shaper.c
   1.584 -@@ -135,10 +135,8 @@ static int shaper_start_xmit(struct sk_b
   1.585 - {
   1.586 - 	struct shaper *shaper = dev->priv;
   1.587 -  	struct sk_buff *ptr;
   1.588 --   
   1.589 --	if (down_trylock(&shaper->sem))
   1.590 --		return -1;
   1.591 - 
   1.592 -+	spin_lock(&shaper->lock);
   1.593 -  	ptr=shaper->sendq.prev;
   1.594 -  	
   1.595 -  	/*
   1.596 -@@ -232,7 +230,7 @@ static int shaper_start_xmit(struct sk_b
   1.597 -                 shaper->stats.collisions++;
   1.598 -  	}
   1.599 - 	shaper_kick(shaper);
   1.600 --	up(&shaper->sem);
   1.601 -+	spin_unlock(&shaper->lock);
   1.602 -  	return 0;
   1.603 - }
   1.604 - 
   1.605 -@@ -271,11 +269,9 @@ static void shaper_timer(unsigned long d
   1.606 - {
   1.607 - 	struct shaper *shaper = (struct shaper *)data;
   1.608 - 
   1.609 --	if (!down_trylock(&shaper->sem)) {
   1.610 --		shaper_kick(shaper);
   1.611 --		up(&shaper->sem);
   1.612 --	} else
   1.613 --		mod_timer(&shaper->timer, jiffies);
   1.614 -+	spin_lock(&shaper->lock);
   1.615 -+	shaper_kick(shaper);
   1.616 -+	spin_unlock(&shaper->lock);
   1.617 - }
   1.618 - 
   1.619 - /*
   1.620 -@@ -332,21 +328,6 @@ static void shaper_kick(struct shaper *s
   1.621 - 
   1.622 - 
   1.623 - /*
   1.624 -- *	Flush the shaper queues on a closedown
   1.625 -- */
   1.626 -- 
   1.627 --static void shaper_flush(struct shaper *shaper)
   1.628 --{
   1.629 --	struct sk_buff *skb;
   1.630 --
   1.631 --	down(&shaper->sem);
   1.632 --	while((skb=skb_dequeue(&shaper->sendq))!=NULL)
   1.633 --		dev_kfree_skb(skb);
   1.634 --	shaper_kick(shaper);
   1.635 --	up(&shaper->sem);
   1.636 --}
   1.637 --
   1.638 --/*
   1.639 -  *	Bring the interface up. We just disallow this until a 
   1.640 -  *	bind.
   1.641 -  */
   1.642 -@@ -375,7 +356,15 @@ static int shaper_open(struct net_device
   1.643 - static int shaper_close(struct net_device *dev)
   1.644 - {
   1.645 - 	struct shaper *shaper=dev->priv;
   1.646 --	shaper_flush(shaper);
   1.647 -+	struct sk_buff *skb;
   1.648 -+
   1.649 -+	while ((skb = skb_dequeue(&shaper->sendq)) != NULL)
   1.650 -+		dev_kfree_skb(skb);
   1.651 -+
   1.652 -+	spin_lock_bh(&shaper->lock);
   1.653 -+	shaper_kick(shaper);
   1.654 -+	spin_unlock_bh(&shaper->lock);
   1.655 -+
   1.656 - 	del_timer_sync(&shaper->timer);
   1.657 - 	return 0;
   1.658 - }
   1.659 -@@ -576,6 +565,7 @@ static void shaper_init_priv(struct net_
   1.660 - 	init_timer(&sh->timer);
   1.661 - 	sh->timer.function=shaper_timer;
   1.662 - 	sh->timer.data=(unsigned long)sh;
   1.663 -+	spin_lock_init(&sh->lock);
   1.664 - }
   1.665 - 
   1.666 - /*
   1.667 -diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
   1.668 ---- a/drivers/pci/pci-driver.c
   1.669 -+++ b/drivers/pci/pci-driver.c
   1.670 -@@ -396,7 +396,7 @@ int pci_register_driver(struct pci_drive
   1.671 - 	/* FIXME, once all of the existing PCI drivers have been fixed to set
   1.672 - 	 * the pci shutdown function, this test can go away. */
   1.673 - 	if (!drv->driver.shutdown)
   1.674 --		drv->driver.shutdown = pci_device_shutdown,
   1.675 -+		drv->driver.shutdown = pci_device_shutdown;
   1.676 - 	drv->driver.owner = drv->owner;
   1.677 - 	drv->driver.kobj.ktype = &pci_driver_kobj_type;
   1.678 - 	pci_init_dynids(&drv->dynids);
   1.679 -diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
   1.680 ---- a/drivers/scsi/qla2xxx/qla_os.c
   1.681 -+++ b/drivers/scsi/qla2xxx/qla_os.c
   1.682 -@@ -1150,7 +1150,7 @@ iospace_error_exit:
   1.683 -  */
   1.684 - int qla2x00_probe_one(struct pci_dev *pdev, struct qla_board_info *brd_info)
   1.685 - {
   1.686 --	int	ret;
   1.687 -+	int	ret = -ENODEV;
   1.688 - 	device_reg_t __iomem *reg;
   1.689 - 	struct Scsi_Host *host;
   1.690 - 	scsi_qla_host_t *ha;
   1.691 -@@ -1161,7 +1161,7 @@ int qla2x00_probe_one(struct pci_dev *pd
   1.692 - 	fc_port_t *fcport;
   1.693 - 
   1.694 - 	if (pci_enable_device(pdev))
   1.695 --		return -1;
   1.696 -+		goto probe_out;
   1.697 - 
   1.698 - 	host = scsi_host_alloc(&qla2x00_driver_template,
   1.699 - 	    sizeof(scsi_qla_host_t));
   1.700 -@@ -1183,9 +1183,8 @@ int qla2x00_probe_one(struct pci_dev *pd
   1.701 - 
   1.702 - 	/* Configure PCI I/O space */
   1.703 - 	ret = qla2x00_iospace_config(ha);
   1.704 --	if (ret != 0) {
   1.705 --		goto probe_alloc_failed;
   1.706 --	}
   1.707 -+	if (ret)
   1.708 -+		goto probe_failed;
   1.709 - 
   1.710 - 	/* Sanitize the information from PCI BIOS. */
   1.711 - 	host->irq = pdev->irq;
   1.712 -@@ -1258,23 +1257,10 @@ int qla2x00_probe_one(struct pci_dev *pd
   1.713 - 		qla_printk(KERN_WARNING, ha,
   1.714 - 		    "[ERROR] Failed to allocate memory for adapter\n");
   1.715 - 
   1.716 --		goto probe_alloc_failed;
   1.717 -+		ret = -ENOMEM;
   1.718 -+		goto probe_failed;
   1.719 - 	}
   1.720 - 
   1.721 --	pci_set_drvdata(pdev, ha);
   1.722 --	host->this_id = 255;
   1.723 --	host->cmd_per_lun = 3;
   1.724 --	host->unique_id = ha->instance;
   1.725 --	host->max_cmd_len = MAX_CMDSZ;
   1.726 --	host->max_channel = ha->ports - 1;
   1.727 --	host->max_id = ha->max_targets;
   1.728 --	host->max_lun = ha->max_luns;
   1.729 --	host->transportt = qla2xxx_transport_template;
   1.730 --	if (scsi_add_host(host, &pdev->dev))
   1.731 --		goto probe_alloc_failed;
   1.732 --
   1.733 --	qla2x00_alloc_sysfs_attr(ha);
   1.734 --
   1.735 - 	if (qla2x00_initialize_adapter(ha) &&
   1.736 - 	    !(ha->device_flags & DFLG_NO_CABLE)) {
   1.737 - 
   1.738 -@@ -1285,11 +1271,10 @@ int qla2x00_probe_one(struct pci_dev *pd
   1.739 - 		    "Adapter flags %x.\n",
   1.740 - 		    ha->host_no, ha->device_flags));
   1.741 - 
   1.742 -+		ret = -ENODEV;
   1.743 - 		goto probe_failed;
   1.744 - 	}
   1.745 - 
   1.746 --	qla2x00_init_host_attr(ha);
   1.747 --
   1.748 - 	/*
   1.749 - 	 * Startup the kernel thread for this host adapter
   1.750 - 	 */
   1.751 -@@ -1299,17 +1284,26 @@ int qla2x00_probe_one(struct pci_dev *pd
   1.752 - 		qla_printk(KERN_WARNING, ha,
   1.753 - 		    "Unable to start DPC thread!\n");
   1.754 - 
   1.755 -+		ret = -ENODEV;
   1.756 - 		goto probe_failed;
   1.757 - 	}
   1.758 - 	wait_for_completion(&ha->dpc_inited);
   1.759 - 
   1.760 -+	host->this_id = 255;
   1.761 -+	host->cmd_per_lun = 3;
   1.762 -+	host->unique_id = ha->instance;
   1.763 -+	host->max_cmd_len = MAX_CMDSZ;
   1.764 -+	host->max_channel = ha->ports - 1;
   1.765 -+	host->max_lun = MAX_LUNS;
   1.766 -+	host->transportt = qla2xxx_transport_template;
   1.767 -+
   1.768 - 	if (IS_QLA2100(ha) || IS_QLA2200(ha))
   1.769 - 		ret = request_irq(host->irq, qla2100_intr_handler,
   1.770 - 		    SA_INTERRUPT|SA_SHIRQ, ha->brd_info->drv_name, ha);
   1.771 - 	else
   1.772 - 		ret = request_irq(host->irq, qla2300_intr_handler,
   1.773 - 		    SA_INTERRUPT|SA_SHIRQ, ha->brd_info->drv_name, ha);
   1.774 --	if (ret != 0) {
   1.775 -+	if (ret) {
   1.776 - 		qla_printk(KERN_WARNING, ha,
   1.777 - 		    "Failed to reserve interrupt %d already in use.\n",
   1.778 - 		    host->irq);
   1.779 -@@ -1363,9 +1357,18 @@ int qla2x00_probe_one(struct pci_dev *pd
   1.780 - 		msleep(10);
   1.781 - 	}
   1.782 - 
   1.783 -+	pci_set_drvdata(pdev, ha);
   1.784 - 	ha->flags.init_done = 1;
   1.785 - 	num_hosts++;
   1.786 - 
   1.787 -+	ret = scsi_add_host(host, &pdev->dev);
   1.788 -+	if (ret)
   1.789 -+		goto probe_failed;
   1.790 -+
   1.791 -+	qla2x00_alloc_sysfs_attr(ha);
   1.792 -+
   1.793 -+	qla2x00_init_host_attr(ha);
   1.794 -+
   1.795 - 	qla_printk(KERN_INFO, ha, "\n"
   1.796 - 	    " QLogic Fibre Channel HBA Driver: %s\n"
   1.797 - 	    "  QLogic %s - %s\n"
   1.798 -@@ -1384,9 +1387,6 @@ int qla2x00_probe_one(struct pci_dev *pd
   1.799 - probe_failed:
   1.800 - 	fc_remove_host(ha->host);
   1.801 - 
   1.802 --	scsi_remove_host(host);
   1.803 --
   1.804 --probe_alloc_failed:
   1.805 - 	qla2x00_free_device(ha);
   1.806 - 
   1.807 - 	scsi_host_put(host);
   1.808 -@@ -1394,7 +1394,8 @@ probe_alloc_failed:
   1.809 - probe_disable_device:
   1.810 - 	pci_disable_device(pdev);
   1.811 - 
   1.812 --	return -1;
   1.813 -+probe_out:
   1.814 -+	return ret;
   1.815 - }
   1.816 - EXPORT_SYMBOL_GPL(qla2x00_probe_one);
   1.817 - 
   1.818 -diff --git a/fs/char_dev.c b/fs/char_dev.c
   1.819 ---- a/fs/char_dev.c
   1.820 -+++ b/fs/char_dev.c
   1.821 -@@ -139,7 +139,7 @@ __unregister_chrdev_region(unsigned majo
   1.822 - 	struct char_device_struct *cd = NULL, **cp;
   1.823 - 	int i = major_to_index(major);
   1.824 - 
   1.825 --	up(&chrdevs_lock);
   1.826 -+	down(&chrdevs_lock);
   1.827 - 	for (cp = &chrdevs[i]; *cp; cp = &(*cp)->next)
   1.828 - 		if ((*cp)->major == major &&
   1.829 - 		    (*cp)->baseminor == baseminor &&
   1.830 -diff --git a/fs/exec.c b/fs/exec.c
   1.831 ---- a/fs/exec.c
   1.832 -+++ b/fs/exec.c
   1.833 -@@ -649,6 +649,7 @@ static inline int de_thread(struct task_
   1.834 - 	}
   1.835 - 	sig->group_exit_task = NULL;
   1.836 - 	sig->notify_count = 0;
   1.837 -+	sig->real_timer.data = (unsigned long)current;
   1.838 - 	spin_unlock_irq(lock);
   1.839 - 
   1.840 - 	/*
   1.841 -diff --git a/include/asm-i386/string.h b/include/asm-i386/string.h
   1.842 ---- a/include/asm-i386/string.h
   1.843 -+++ b/include/asm-i386/string.h
   1.844 -@@ -116,7 +116,8 @@ __asm__ __volatile__(
   1.845 - 	"orb $1,%%al\n"
   1.846 - 	"3:"
   1.847 - 	:"=a" (__res), "=&S" (d0), "=&D" (d1)
   1.848 --		     :"1" (cs),"2" (ct));
   1.849 -+	:"1" (cs),"2" (ct)
   1.850 -+	:"memory");
   1.851 - return __res;
   1.852 - }
   1.853 - 
   1.854 -@@ -138,8 +139,9 @@ __asm__ __volatile__(
   1.855 - 	"3:\tsbbl %%eax,%%eax\n\t"
   1.856 - 	"orb $1,%%al\n"
   1.857 - 	"4:"
   1.858 --		     :"=a" (__res), "=&S" (d0), "=&D" (d1), "=&c" (d2)
   1.859 --		     :"1" (cs),"2" (ct),"3" (count));
   1.860 -+	:"=a" (__res), "=&S" (d0), "=&D" (d1), "=&c" (d2)
   1.861 -+	:"1" (cs),"2" (ct),"3" (count)
   1.862 -+	:"memory");
   1.863 - return __res;
   1.864 - }
   1.865 - 
   1.866 -@@ -158,7 +160,9 @@ __asm__ __volatile__(
   1.867 - 	"movl $1,%1\n"
   1.868 - 	"2:\tmovl %1,%0\n\t"
   1.869 - 	"decl %0"
   1.870 --	:"=a" (__res), "=&S" (d0) : "1" (s),"0" (c));
   1.871 -+	:"=a" (__res), "=&S" (d0)
   1.872 -+	:"1" (s),"0" (c)
   1.873 -+	:"memory");
   1.874 - return __res;
   1.875 - }
   1.876 - 
   1.877 -@@ -175,7 +179,9 @@ __asm__ __volatile__(
   1.878 - 	"leal -1(%%esi),%0\n"
   1.879 - 	"2:\ttestb %%al,%%al\n\t"
   1.880 - 	"jne 1b"
   1.881 --	:"=g" (__res), "=&S" (d0), "=&a" (d1) :"0" (0),"1" (s),"2" (c));
   1.882 -+	:"=g" (__res), "=&S" (d0), "=&a" (d1)
   1.883 -+	:"0" (0),"1" (s),"2" (c)
   1.884 -+	:"memory");
   1.885 - return __res;
   1.886 - }
   1.887 - 
   1.888 -@@ -189,7 +195,9 @@ __asm__ __volatile__(
   1.889 - 	"scasb\n\t"
   1.890 - 	"notl %0\n\t"
   1.891 - 	"decl %0"
   1.892 --	:"=c" (__res), "=&D" (d0) :"1" (s),"a" (0), "0" (0xffffffffu));
   1.893 -+	:"=c" (__res), "=&D" (d0)
   1.894 -+	:"1" (s),"a" (0), "0" (0xffffffffu)
   1.895 -+	:"memory");
   1.896 - return __res;
   1.897 - }
   1.898 - 
   1.899 -@@ -333,7 +341,9 @@ __asm__ __volatile__(
   1.900 - 	"je 1f\n\t"
   1.901 - 	"movl $1,%0\n"
   1.902 - 	"1:\tdecl %0"
   1.903 --	:"=D" (__res), "=&c" (d0) : "a" (c),"0" (cs),"1" (count));
   1.904 -+	:"=D" (__res), "=&c" (d0)
   1.905 -+	:"a" (c),"0" (cs),"1" (count)
   1.906 -+	:"memory");
   1.907 - return __res;
   1.908 - }
   1.909 - 
   1.910 -@@ -369,7 +379,7 @@ __asm__ __volatile__(
   1.911 - 	"je 2f\n\t"
   1.912 - 	"stosb\n"
   1.913 - 	"2:"
   1.914 --	: "=&c" (d0), "=&D" (d1)
   1.915 -+	:"=&c" (d0), "=&D" (d1)
   1.916 - 	:"a" (c), "q" (count), "0" (count/4), "1" ((long) s)
   1.917 - 	:"memory");
   1.918 - return (s);	
   1.919 -@@ -392,7 +402,8 @@ __asm__ __volatile__(
   1.920 - 	"jne 1b\n"
   1.921 - 	"3:\tsubl %2,%0"
   1.922 - 	:"=a" (__res), "=&d" (d0)
   1.923 --	:"c" (s),"1" (count));
   1.924 -+	:"c" (s),"1" (count)
   1.925 -+	:"memory");
   1.926 - return __res;
   1.927 - }
   1.928 - /* end of additional stuff */
   1.929 -@@ -473,7 +484,8 @@ static inline void * memscan(void * addr
   1.930 - 		"dec %%edi\n"
   1.931 - 		"1:"
   1.932 - 		: "=D" (addr), "=c" (size)
   1.933 --		: "0" (addr), "1" (size), "a" (c));
   1.934 -+		: "0" (addr), "1" (size), "a" (c)
   1.935 -+		: "memory");
   1.936 - 	return addr;
   1.937 - }
   1.938 - 
   1.939 -diff --git a/include/linux/if_shaper.h b/include/linux/if_shaper.h
   1.940 ---- a/include/linux/if_shaper.h
   1.941 -+++ b/include/linux/if_shaper.h
   1.942 -@@ -23,7 +23,7 @@ struct shaper
   1.943 - 	__u32 shapeclock;
   1.944 - 	unsigned long recovery;	/* Time we can next clock a packet out on
   1.945 - 				   an empty queue */
   1.946 --	struct semaphore sem;
   1.947 -+	spinlock_t lock;
   1.948 -         struct net_device_stats stats;
   1.949 - 	struct net_device *dev;
   1.950 - 	int  (*hard_start_xmit) (struct sk_buff *skb,
   1.951 -diff --git a/mm/memory.c b/mm/memory.c
   1.952 ---- a/mm/memory.c
   1.953 -+++ b/mm/memory.c
   1.954 -@@ -1164,7 +1164,7 @@ int remap_pfn_range(struct vm_area_struc
   1.955 - {
   1.956 - 	pgd_t *pgd;
   1.957 - 	unsigned long next;
   1.958 --	unsigned long end = addr + size;
   1.959 -+	unsigned long end = addr + PAGE_ALIGN(size);
   1.960 - 	struct mm_struct *mm = vma->vm_mm;
   1.961 - 	int err;
   1.962 - 
   1.963 -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
   1.964 ---- a/net/ipv4/ip_output.c
   1.965 -+++ b/net/ipv4/ip_output.c
   1.966 -@@ -111,7 +111,6 @@ static int ip_dev_loopback_xmit(struct s
   1.967 - #ifdef CONFIG_NETFILTER_DEBUG
   1.968 - 	nf_debug_ip_loopback_xmit(newskb);
   1.969 - #endif
   1.970 --	nf_reset(newskb);
   1.971 - 	netif_rx(newskb);
   1.972 - 	return 0;
   1.973 - }
   1.974 -@@ -196,8 +195,6 @@ static inline int ip_finish_output2(stru
   1.975 - 	nf_debug_ip_finish_output2(skb);
   1.976 - #endif /*CONFIG_NETFILTER_DEBUG*/
   1.977 - 
   1.978 --	nf_reset(skb);
   1.979 --
   1.980 - 	if (hh) {
   1.981 - 		int hh_alen;
   1.982 - 
   1.983 -diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
   1.984 ---- a/net/ipv4/netfilter/ip_conntrack_standalone.c
   1.985 -+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
   1.986 -@@ -432,6 +432,13 @@ static unsigned int ip_conntrack_defrag(
   1.987 - 				        const struct net_device *out,
   1.988 - 				        int (*okfn)(struct sk_buff *))
   1.989 - {
   1.990 -+#if !defined(CONFIG_IP_NF_NAT) && !defined(CONFIG_IP_NF_NAT_MODULE)
   1.991 -+	/* Previously seen (loopback)?  Ignore.  Do this before
   1.992 -+           fragment check. */
   1.993 -+	if ((*pskb)->nfct)
   1.994 -+		return NF_ACCEPT;
   1.995 -+#endif
   1.996 -+
   1.997 - 	/* Gather fragments. */
   1.998 - 	if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
   1.999 - 		*pskb = ip_ct_gather_frags(*pskb,
  1.1000 -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
  1.1001 ---- a/net/netlink/af_netlink.c
  1.1002 -+++ b/net/netlink/af_netlink.c
  1.1003 -@@ -315,8 +315,8 @@ err:
  1.1004 - static void netlink_remove(struct sock *sk)
  1.1005 - {
  1.1006 - 	netlink_table_grab();
  1.1007 --	nl_table[sk->sk_protocol].hash.entries--;
  1.1008 --	sk_del_node_init(sk);
  1.1009 -+	if (sk_del_node_init(sk))
  1.1010 -+		nl_table[sk->sk_protocol].hash.entries--;
  1.1011 - 	if (nlk_sk(sk)->groups)
  1.1012 - 		__sk_del_bind_node(sk);
  1.1013 - 	netlink_table_ungrab();
  1.1014 -@@ -429,7 +429,12 @@ retry:
  1.1015 - 	err = netlink_insert(sk, pid);
  1.1016 - 	if (err == -EADDRINUSE)
  1.1017 - 		goto retry;
  1.1018 --	return 0;
  1.1019 -+
  1.1020 -+	/* If 2 threads race to autobind, that is fine.  */
  1.1021 -+	if (err == -EBUSY)
  1.1022 -+		err = 0;
  1.1023 -+
  1.1024 -+	return err;
  1.1025 - }
  1.1026 - 
  1.1027 - static inline int netlink_capable(struct socket *sock, unsigned int flag) 
  1.1028 -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
  1.1029 ---- a/net/packet/af_packet.c
  1.1030 -+++ b/net/packet/af_packet.c
  1.1031 -@@ -274,6 +274,9 @@ static int packet_rcv_spkt(struct sk_buf
  1.1032 - 	dst_release(skb->dst);
  1.1033 - 	skb->dst = NULL;
  1.1034 - 
  1.1035 -+	/* drop conntrack reference */
  1.1036 -+	nf_reset(skb);
  1.1037 -+
  1.1038 - 	spkt = (struct sockaddr_pkt*)skb->cb;
  1.1039 - 
  1.1040 - 	skb_push(skb, skb->data-skb->mac.raw);
  1.1041 -@@ -517,6 +520,9 @@ static int packet_rcv(struct sk_buff *sk
  1.1042 - 	dst_release(skb->dst);
  1.1043 - 	skb->dst = NULL;
  1.1044 - 
  1.1045 -+	/* drop conntrack reference */
  1.1046 -+	nf_reset(skb);
  1.1047 -+
  1.1048 - 	spin_lock(&sk->sk_receive_queue.lock);
  1.1049 - 	po->stats.tp_packets++;
  1.1050 - 	__skb_queue_tail(&sk->sk_receive_queue, skb);

     2.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     2.2 +++ b/patches/linux-2.6.12/linux-2.6.12.4.patch	Sun Aug 14 22:45:44 2005 +0000
     2.3 @@ -0,0 +1,1266 @@
     2.4 +diff --git a/Makefile b/Makefile
     2.5 +--- a/Makefile
     2.6 ++++ b/Makefile
     2.7 +@@ -1,7 +1,7 @@
     2.8 + VERSION = 2
     2.9 + PATCHLEVEL = 6
    2.10 + SUBLEVEL = 12
    2.11 +-EXTRAVERSION =
    2.12 ++EXTRAVERSION = .4
    2.13 + NAME=Woozy Numbat
    2.14 + 
    2.15 + # *DOCUMENTATION*
    2.16 +@@ -1149,7 +1149,7 @@ endif # KBUILD_EXTMOD
    2.17 + #(which is the most common case IMHO) to avoid unneeded clutter in the big tags file.
    2.18 + #Adding $(srctree) adds about 20M on i386 to the size of the output file!
    2.19 + 
    2.20 +-ifeq ($(KBUILD_OUTPUT),)
    2.21 ++ifeq ($(src),$(obj))
    2.22 + __srctree =
    2.23 + else
    2.24 + __srctree = $(srctree)/
    2.25 +diff --git a/arch/i386/kernel/cpu/cpufreq/powernow-k8.c b/arch/i386/kernel/cpu/cpufreq/powernow-k8.c
    2.26 +--- a/arch/i386/kernel/cpu/cpufreq/powernow-k8.c
    2.27 ++++ b/arch/i386/kernel/cpu/cpufreq/powernow-k8.c
    2.28 +@@ -44,7 +44,7 @@
    2.29 + 
    2.30 + #define PFX "powernow-k8: "
    2.31 + #define BFX PFX "BIOS error: "
    2.32 +-#define VERSION "version 1.40.2"
    2.33 ++#define VERSION "version 1.40.4"
    2.34 + #include "powernow-k8.h"
    2.35 + 
    2.36 + /* serialize freq changes  */
    2.37 +@@ -978,7 +978,7 @@ static int __init powernowk8_cpu_init(st
    2.38 + {
    2.39 + 	struct powernow_k8_data *data;
    2.40 + 	cpumask_t oldmask = CPU_MASK_ALL;
    2.41 +-	int rc;
    2.42 ++	int rc, i;
    2.43 + 
    2.44 + 	if (!check_supported_cpu(pol->cpu))
    2.45 + 		return -ENODEV;
    2.46 +@@ -1064,7 +1064,9 @@ static int __init powernowk8_cpu_init(st
    2.47 + 	printk("cpu_init done, current fid 0x%x, vid 0x%x\n",
    2.48 + 	       data->currfid, data->currvid);
    2.49 + 
    2.50 +-	powernow_data[pol->cpu] = data;
    2.51 ++	for_each_cpu_mask(i, cpu_core_map[pol->cpu]) {
    2.52 ++		powernow_data[i] = data;
    2.53 ++	}
    2.54 + 
    2.55 + 	return 0;
    2.56 + 
    2.57 +diff --git a/arch/i386/kernel/process.c b/arch/i386/kernel/process.c
    2.58 +--- a/arch/i386/kernel/process.c
    2.59 ++++ b/arch/i386/kernel/process.c
    2.60 +@@ -827,6 +827,8 @@ asmlinkage int sys_get_thread_area(struc
    2.61 + 	if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
    2.62 + 		return -EINVAL;
    2.63 + 
    2.64 ++	memset(&info, 0, sizeof(info));
    2.65 ++
    2.66 + 	desc = current->thread.tls_array + idx - GDT_ENTRY_TLS_MIN;
    2.67 + 
    2.68 + 	info.entry_number = idx;
    2.69 +diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
    2.70 +--- a/arch/ia64/kernel/ptrace.c
    2.71 ++++ b/arch/ia64/kernel/ptrace.c
    2.72 +@@ -945,6 +945,13 @@ access_uarea (struct task_struct *child,
    2.73 + 				*data = (pt->cr_ipsr & IPSR_MASK);
    2.74 + 			return 0;
    2.75 + 
    2.76 ++		      case PT_AR_RSC:
    2.77 ++			if (write_access)
    2.78 ++				pt->ar_rsc = *data | (3 << 2); /* force PL3 */
    2.79 ++			else
    2.80 ++				*data = pt->ar_rsc;
    2.81 ++			return 0;
    2.82 ++
    2.83 + 		      case PT_AR_RNAT:
    2.84 + 			urbs_end = ia64_get_user_rbs_end(child, pt, NULL);
    2.85 + 			rnat_addr = (long) ia64_rse_rnat_addr((long *)
    2.86 +@@ -996,9 +1003,6 @@ access_uarea (struct task_struct *child,
    2.87 + 		      case PT_AR_BSPSTORE:
    2.88 + 			ptr = pt_reg_addr(pt, ar_bspstore);
    2.89 + 			break;
    2.90 +-		      case PT_AR_RSC:
    2.91 +-			ptr = pt_reg_addr(pt, ar_rsc);
    2.92 +-			break;
    2.93 + 		      case PT_AR_UNAT:
    2.94 + 			ptr = pt_reg_addr(pt, ar_unat);
    2.95 + 			break;
    2.96 +@@ -1234,7 +1238,7 @@ ptrace_getregs (struct task_struct *chil
    2.97 + static long
    2.98 + ptrace_setregs (struct task_struct *child, struct pt_all_user_regs __user *ppr)
    2.99 + {
   2.100 +-	unsigned long psr, ec, lc, rnat, bsp, cfm, nat_bits, val = 0;
   2.101 ++	unsigned long psr, rsc, ec, lc, rnat, bsp, cfm, nat_bits, val = 0;
   2.102 + 	struct unw_frame_info info;
   2.103 + 	struct switch_stack *sw;
   2.104 + 	struct ia64_fpreg fpval;
   2.105 +@@ -1267,7 +1271,7 @@ ptrace_setregs (struct task_struct *chil
   2.106 + 	/* app regs */
   2.107 + 
   2.108 + 	retval |= __get_user(pt->ar_pfs, &ppr->ar[PT_AUR_PFS]);
   2.109 +-	retval |= __get_user(pt->ar_rsc, &ppr->ar[PT_AUR_RSC]);
   2.110 ++	retval |= __get_user(rsc, &ppr->ar[PT_AUR_RSC]);
   2.111 + 	retval |= __get_user(pt->ar_bspstore, &ppr->ar[PT_AUR_BSPSTORE]);
   2.112 + 	retval |= __get_user(pt->ar_unat, &ppr->ar[PT_AUR_UNAT]);
   2.113 + 	retval |= __get_user(pt->ar_ccv, &ppr->ar[PT_AUR_CCV]);
   2.114 +@@ -1365,6 +1369,7 @@ ptrace_setregs (struct task_struct *chil
   2.115 + 	retval |= __get_user(nat_bits, &ppr->nat);
   2.116 + 
   2.117 + 	retval |= access_uarea(child, PT_CR_IPSR, &psr, 1);
   2.118 ++	retval |= access_uarea(child, PT_AR_RSC, &rsc, 1);
   2.119 + 	retval |= access_uarea(child, PT_AR_EC, &ec, 1);
   2.120 + 	retval |= access_uarea(child, PT_AR_LC, &lc, 1);
   2.121 + 	retval |= access_uarea(child, PT_AR_RNAT, &rnat, 1);
   2.122 +diff --git a/arch/ia64/kernel/signal.c b/arch/ia64/kernel/signal.c
   2.123 +--- a/arch/ia64/kernel/signal.c
   2.124 ++++ b/arch/ia64/kernel/signal.c
   2.125 +@@ -94,7 +94,7 @@ sys_sigaltstack (const stack_t __user *u
   2.126 + static long
   2.127 + restore_sigcontext (struct sigcontext __user *sc, struct sigscratch *scr)
   2.128 + {
   2.129 +-	unsigned long ip, flags, nat, um, cfm;
   2.130 ++	unsigned long ip, flags, nat, um, cfm, rsc;
   2.131 + 	long err;
   2.132 + 
   2.133 + 	/* Always make any pending restarted system calls return -EINTR */
   2.134 +@@ -106,7 +106,7 @@ restore_sigcontext (struct sigcontext __
   2.135 + 	err |= __get_user(ip, &sc->sc_ip);			/* instruction pointer */
   2.136 + 	err |= __get_user(cfm, &sc->sc_cfm);
   2.137 + 	err |= __get_user(um, &sc->sc_um);			/* user mask */
   2.138 +-	err |= __get_user(scr->pt.ar_rsc, &sc->sc_ar_rsc);
   2.139 ++	err |= __get_user(rsc, &sc->sc_ar_rsc);
   2.140 + 	err |= __get_user(scr->pt.ar_unat, &sc->sc_ar_unat);
   2.141 + 	err |= __get_user(scr->pt.ar_fpsr, &sc->sc_ar_fpsr);
   2.142 + 	err |= __get_user(scr->pt.ar_pfs, &sc->sc_ar_pfs);
   2.143 +@@ -119,6 +119,7 @@ restore_sigcontext (struct sigcontext __
   2.144 + 	err |= __copy_from_user(&scr->pt.r15, &sc->sc_gr[15], 8);	/* r15 */
   2.145 + 
   2.146 + 	scr->pt.cr_ifs = cfm | (1UL << 63);
   2.147 ++	scr->pt.ar_rsc = rsc | (3 << 2); /* force PL3 */
   2.148 + 
   2.149 + 	/* establish new instruction pointer: */
   2.150 + 	scr->pt.cr_iip = ip & ~0x3UL;
   2.151 +diff --git a/arch/ppc/kernel/time.c b/arch/ppc/kernel/time.c
   2.152 +--- a/arch/ppc/kernel/time.c
   2.153 ++++ b/arch/ppc/kernel/time.c
   2.154 +@@ -89,6 +89,9 @@ unsigned long tb_to_ns_scale;
   2.155 + 
   2.156 + extern unsigned long wall_jiffies;
   2.157 + 
   2.158 ++/* used for timezone offset */
   2.159 ++static long timezone_offset;
   2.160 ++
   2.161 + DEFINE_SPINLOCK(rtc_lock);
   2.162 + 
   2.163 + EXPORT_SYMBOL(rtc_lock);
   2.164 +@@ -170,7 +173,7 @@ void timer_interrupt(struct pt_regs * re
   2.165 + 		     xtime.tv_sec - last_rtc_update >= 659 &&
   2.166 + 		     abs((xtime.tv_nsec / 1000) - (1000000-1000000/HZ)) < 500000/HZ &&
   2.167 + 		     jiffies - wall_jiffies == 1) {
   2.168 +-		  	if (ppc_md.set_rtc_time(xtime.tv_sec+1 + time_offset) == 0)
   2.169 ++		  	if (ppc_md.set_rtc_time(xtime.tv_sec+1 + timezone_offset) == 0)
   2.170 + 				last_rtc_update = xtime.tv_sec+1;
   2.171 + 			else
   2.172 + 				/* Try again one minute later */
   2.173 +@@ -286,7 +289,7 @@ void __init time_init(void)
   2.174 + 	unsigned old_stamp, stamp, elapsed;
   2.175 + 
   2.176 +         if (ppc_md.time_init != NULL)
   2.177 +-                time_offset = ppc_md.time_init();
   2.178 ++                timezone_offset = ppc_md.time_init();
   2.179 + 
   2.180 + 	if (__USE_RTC()) {
   2.181 + 		/* 601 processor: dec counts down by 128 every 128ns */
   2.182 +@@ -331,10 +334,10 @@ void __init time_init(void)
   2.183 + 	set_dec(tb_ticks_per_jiffy);
   2.184 + 
   2.185 + 	/* If platform provided a timezone (pmac), we correct the time */
   2.186 +-        if (time_offset) {
   2.187 +-		sys_tz.tz_minuteswest = -time_offset / 60;
   2.188 ++        if (timezone_offset) {
   2.189 ++		sys_tz.tz_minuteswest = -timezone_offset / 60;
   2.190 + 		sys_tz.tz_dsttime = 0;
   2.191 +-		xtime.tv_sec -= time_offset;
   2.192 ++		xtime.tv_sec -= timezone_offset;
   2.193 +         }
   2.194 +         set_normalized_timespec(&wall_to_monotonic,
   2.195 +                                 -xtime.tv_sec, -xtime.tv_nsec);
   2.196 +diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
   2.197 +--- a/arch/um/kernel/process.c
   2.198 ++++ b/arch/um/kernel/process.c
   2.199 +@@ -130,7 +130,7 @@ int start_fork_tramp(void *thread_arg, u
   2.200 + 	return(arg.pid);
   2.201 + }
   2.202 + 
   2.203 +-static int ptrace_child(void)
   2.204 ++static int ptrace_child(void *arg)
   2.205 + {
   2.206 + 	int ret;
   2.207 + 	int pid = os_getpid(), ppid = getppid();
   2.208 +@@ -159,16 +159,20 @@ static int ptrace_child(void)
   2.209 + 	_exit(ret);
   2.210 + }
   2.211 + 
   2.212 +-static int start_ptraced_child(void)
   2.213 ++static int start_ptraced_child(void **stack_out)
   2.214 + {
   2.215 ++	void *stack;
   2.216 ++	unsigned long sp;
   2.217 + 	int pid, n, status;
   2.218 + 	
   2.219 +-	pid = fork();
   2.220 +-	if(pid == 0)
   2.221 +-		ptrace_child();
   2.222 +-
   2.223 ++	stack = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC,
   2.224 ++		     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
   2.225 ++	if(stack == MAP_FAILED)
   2.226 ++		panic("check_ptrace : mmap failed, errno = %d", errno);
   2.227 ++	sp = (unsigned long) stack + PAGE_SIZE - sizeof(void *);
   2.228 ++	pid = clone(ptrace_child, (void *) sp, SIGCHLD, NULL);
   2.229 + 	if(pid < 0)
   2.230 +-		panic("check_ptrace : fork failed, errno = %d", errno);
   2.231 ++		panic("check_ptrace : clone failed, errno = %d", errno);
   2.232 + 	CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED));
   2.233 + 	if(n < 0)
   2.234 + 		panic("check_ptrace : wait failed, errno = %d", errno);
   2.235 +@@ -176,6 +180,7 @@ static int start_ptraced_child(void)
   2.236 + 		panic("check_ptrace : expected SIGSTOP, got status = %d",
   2.237 + 		      status);
   2.238 + 
   2.239 ++	*stack_out = stack;
   2.240 + 	return(pid);
   2.241 + }
   2.242 + 
   2.243 +@@ -183,12 +188,12 @@ static int start_ptraced_child(void)
   2.244 +  * just avoid using sysemu, not panic, but only if SYSEMU features are broken.
   2.245 +  * So only for SYSEMU features we test mustpanic, while normal host features
   2.246 +  * must work anyway!*/
   2.247 +-static int stop_ptraced_child(int pid, int exitcode, int mustexit)
   2.248 ++static int stop_ptraced_child(int pid, void *stack, int exitcode, int mustpanic)
   2.249 + {
   2.250 + 	int status, n, ret = 0;
   2.251 + 
   2.252 + 	if(ptrace(PTRACE_CONT, pid, 0, 0) < 0)
   2.253 +-		panic("stop_ptraced_child : ptrace failed, errno = %d", errno);
   2.254 ++		panic("check_ptrace : ptrace failed, errno = %d", errno);
   2.255 + 	CATCH_EINTR(n = waitpid(pid, &status, 0));
   2.256 + 	if(!WIFEXITED(status) || (WEXITSTATUS(status) != exitcode)) {
   2.257 + 		int exit_with = WEXITSTATUS(status);
   2.258 +@@ -199,13 +204,15 @@ static int stop_ptraced_child(int pid, i
   2.259 + 		printk("check_ptrace : child exited with exitcode %d, while "
   2.260 + 		      "expecting %d; status 0x%x", exit_with,
   2.261 + 		      exitcode, status);
   2.262 +-		if (mustexit)
   2.263 ++		if (mustpanic)
   2.264 + 			panic("\n");
   2.265 + 		else
   2.266 + 			printk("\n");
   2.267 + 		ret = -1;
   2.268 + 	}
   2.269 + 
   2.270 ++	if(munmap(stack, PAGE_SIZE) < 0)
   2.271 ++		panic("check_ptrace : munmap failed, errno = %d", errno);
   2.272 + 	return ret;
   2.273 + }
   2.274 + 
   2.275 +@@ -227,11 +234,12 @@ __uml_setup("nosysemu", nosysemu_cmd_par
   2.276 + 
   2.277 + static void __init check_sysemu(void)
   2.278 + {
   2.279 ++	void *stack;
   2.280 + 	int pid, syscall, n, status, count=0;
   2.281 + 
   2.282 + 	printk("Checking syscall emulation patch for ptrace...");
   2.283 + 	sysemu_supported = 0;
   2.284 +-	pid = start_ptraced_child();
   2.285 ++	pid = start_ptraced_child(&stack);
   2.286 + 
   2.287 + 	if(ptrace(PTRACE_SYSEMU, pid, 0, 0) < 0)
   2.288 + 		goto fail;
   2.289 +@@ -249,7 +257,7 @@ static void __init check_sysemu(void)
   2.290 + 		panic("check_sysemu : failed to modify system "
   2.291 + 		      "call return, errno = %d", errno);
   2.292 + 
   2.293 +-	if (stop_ptraced_child(pid, 0, 0) < 0)
   2.294 ++	if (stop_ptraced_child(pid, stack, 0, 0) < 0)
   2.295 + 		goto fail_stopped;
   2.296 + 
   2.297 + 	sysemu_supported = 1;
   2.298 +@@ -257,7 +265,7 @@ static void __init check_sysemu(void)
   2.299 + 	set_using_sysemu(!force_sysemu_disabled);
   2.300 + 
   2.301 + 	printk("Checking advanced syscall emulation patch for ptrace...");
   2.302 +-	pid = start_ptraced_child();
   2.303 ++	pid = start_ptraced_child(&stack);
   2.304 + 	while(1){
   2.305 + 		count++;
   2.306 + 		if(ptrace(PTRACE_SYSEMU_SINGLESTEP, pid, 0, 0) < 0)
   2.307 +@@ -282,7 +290,7 @@ static void __init check_sysemu(void)
   2.308 + 			break;
   2.309 + 		}
   2.310 + 	}
   2.311 +-	if (stop_ptraced_child(pid, 0, 0) < 0)
   2.312 ++	if (stop_ptraced_child(pid, stack, 0, 0) < 0)
   2.313 + 		goto fail_stopped;
   2.314 + 
   2.315 + 	sysemu_supported = 2;
   2.316 +@@ -293,17 +301,18 @@ static void __init check_sysemu(void)
   2.317 + 	return;
   2.318 + 
   2.319 + fail:
   2.320 +-	stop_ptraced_child(pid, 1, 0);
   2.321 ++	stop_ptraced_child(pid, stack, 1, 0);
   2.322 + fail_stopped:
   2.323 + 	printk("missing\n");
   2.324 + }
   2.325 + 
   2.326 + void __init check_ptrace(void)
   2.327 + {
   2.328 ++	void *stack;
   2.329 + 	int pid, syscall, n, status;
   2.330 + 
   2.331 + 	printk("Checking that ptrace can change system call numbers...");
   2.332 +-	pid = start_ptraced_child();
   2.333 ++	pid = start_ptraced_child(&stack);
   2.334 + 
   2.335 + 	if (ptrace(PTRACE_OLDSETOPTIONS, pid, 0, (void *)PTRACE_O_TRACESYSGOOD) < 0)
   2.336 + 		panic("check_ptrace: PTRACE_SETOPTIONS failed, errno = %d", errno);
   2.337 +@@ -330,7 +339,7 @@ void __init check_ptrace(void)
   2.338 + 			break;
   2.339 + 		}
   2.340 + 	}
   2.341 +-	stop_ptraced_child(pid, 0, 1);
   2.342 ++	stop_ptraced_child(pid, stack, 0, 1);
   2.343 + 	printk("OK\n");
   2.344 + 	check_sysemu();
   2.345 + }
   2.346 +@@ -362,10 +371,11 @@ void forward_pending_sigio(int target)
   2.347 + static inline int check_skas3_ptrace_support(void)
   2.348 + {
   2.349 + 	struct ptrace_faultinfo fi;
   2.350 ++	void *stack;
   2.351 + 	int pid, n, ret = 1;
   2.352 + 
   2.353 + 	printf("Checking for the skas3 patch in the host...");
   2.354 +-	pid = start_ptraced_child();
   2.355 ++	pid = start_ptraced_child(&stack);
   2.356 + 
   2.357 + 	n = ptrace(PTRACE_FAULTINFO, pid, 0, &fi);
   2.358 + 	if (n < 0) {
   2.359 +@@ -380,7 +390,7 @@ static inline int check_skas3_ptrace_sup
   2.360 + 	}
   2.361 + 
   2.362 + 	init_registers(pid);
   2.363 +-	stop_ptraced_child(pid, 1, 1);
   2.364 ++	stop_ptraced_child(pid, stack, 1, 1);
   2.365 + 
   2.366 + 	return(ret);
   2.367 + }
   2.368 +diff --git a/arch/x86_64/ia32/syscall32.c b/arch/x86_64/ia32/syscall32.c
   2.369 +--- a/arch/x86_64/ia32/syscall32.c
   2.370 ++++ b/arch/x86_64/ia32/syscall32.c
   2.371 +@@ -57,6 +57,7 @@ int syscall32_setup_pages(struct linux_b
   2.372 + 	int npages = (VSYSCALL32_END - VSYSCALL32_BASE) >> PAGE_SHIFT;
   2.373 + 	struct vm_area_struct *vma;
   2.374 + 	struct mm_struct *mm = current->mm;
   2.375 ++	int ret;
   2.376 + 
   2.377 + 	vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
   2.378 + 	if (!vma)
   2.379 +@@ -78,7 +79,11 @@ int syscall32_setup_pages(struct linux_b
   2.380 + 	vma->vm_mm = mm;
   2.381 + 
   2.382 + 	down_write(&mm->mmap_sem);
   2.383 +-	insert_vm_struct(mm, vma);
   2.384 ++	if ((ret = insert_vm_struct(mm, vma))) {
   2.385 ++		up_write(&mm->mmap_sem);
   2.386 ++		kmem_cache_free(vm_area_cachep, vma);
   2.387 ++		return ret;
   2.388 ++	}
   2.389 + 	mm->total_vm += npages;
   2.390 + 	up_write(&mm->mmap_sem);
   2.391 + 	return 0;
   2.392 +diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
   2.393 +--- a/drivers/acpi/pci_irq.c
   2.394 ++++ b/drivers/acpi/pci_irq.c
   2.395 +@@ -433,8 +433,9 @@ acpi_pci_irq_enable (
   2.396 + 		printk(KERN_WARNING PREFIX "PCI Interrupt %s[%c]: no GSI",
   2.397 + 			pci_name(dev), ('A' + pin));
   2.398 + 		/* Interrupt Line values above 0xF are forbidden */
   2.399 +-		if (dev->irq >= 0 && (dev->irq <= 0xF)) {
   2.400 ++		if (dev->irq > 0 && (dev->irq <= 0xF)) {
   2.401 + 			printk(" - using IRQ %d\n", dev->irq);
   2.402 ++			acpi_register_gsi(dev->irq, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW);
   2.403 + 			return_VALUE(0);
   2.404 + 		}
   2.405 + 		else {
   2.406 +diff --git a/drivers/char/rocket.c b/drivers/char/rocket.c
   2.407 +--- a/drivers/char/rocket.c
   2.408 ++++ b/drivers/char/rocket.c
   2.409 +@@ -277,7 +277,7 @@ static void rp_do_receive(struct r_port 
   2.410 + 		ToRecv = space;
   2.411 + 
   2.412 + 	if (ToRecv <= 0)
   2.413 +-		return;
   2.414 ++		goto done;
   2.415 + 
   2.416 + 	/*
   2.417 + 	 * if status indicates there are errored characters in the
   2.418 +@@ -359,6 +359,7 @@ static void rp_do_receive(struct r_port 
   2.419 + 	}
   2.420 + 	/*  Push the data up to the tty layer */
   2.421 + 	ld->receive_buf(tty, tty->flip.char_buf, tty->flip.flag_buf, count);
   2.422 ++done:
   2.423 + 	tty_ldisc_deref(ld);
   2.424 + }
   2.425 + 
   2.426 +diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
   2.427 +--- a/drivers/char/tpm/tpm.c
   2.428 ++++ b/drivers/char/tpm/tpm.c
   2.429 +@@ -32,12 +32,6 @@
   2.430 + 
   2.431 + #define	TPM_BUFSIZE			2048
   2.432 + 
   2.433 +-/* PCI configuration addresses */
   2.434 +-#define	PCI_GEN_PMCON_1			0xA0
   2.435 +-#define	PCI_GEN1_DEC			0xE4
   2.436 +-#define	PCI_LPC_EN			0xE6
   2.437 +-#define	PCI_GEN2_DEC			0xEC
   2.438 +-
   2.439 + static LIST_HEAD(tpm_chip_list);
   2.440 + static DEFINE_SPINLOCK(driver_lock);
   2.441 + static int dev_mask[32];
   2.442 +@@ -61,72 +55,6 @@ void tpm_time_expired(unsigned long ptr)
   2.443 + EXPORT_SYMBOL_GPL(tpm_time_expired);
   2.444 + 
   2.445 + /*
   2.446 +- * Initialize the LPC bus and enable the TPM ports
   2.447 +- */
   2.448 +-int tpm_lpc_bus_init(struct pci_dev *pci_dev, u16 base)
   2.449 +-{
   2.450 +-	u32 lpcenable, tmp;
   2.451 +-	int is_lpcm = 0;
   2.452 +-
   2.453 +-	switch (pci_dev->vendor) {
   2.454 +-	case PCI_VENDOR_ID_INTEL:
   2.455 +-		switch (pci_dev->device) {
   2.456 +-		case PCI_DEVICE_ID_INTEL_82801CA_12:
   2.457 +-		case PCI_DEVICE_ID_INTEL_82801DB_12:
   2.458 +-			is_lpcm = 1;
   2.459 +-			break;
   2.460 +-		}
   2.461 +-		/* init ICH (enable LPC) */
   2.462 +-		pci_read_config_dword(pci_dev, PCI_GEN1_DEC, &lpcenable);
   2.463 +-		lpcenable |= 0x20000000;
   2.464 +-		pci_write_config_dword(pci_dev, PCI_GEN1_DEC, lpcenable);
   2.465 +-
   2.466 +-		if (is_lpcm) {
   2.467 +-			pci_read_config_dword(pci_dev, PCI_GEN1_DEC,
   2.468 +-					      &lpcenable);
   2.469 +-			if ((lpcenable & 0x20000000) == 0) {
   2.470 +-				dev_err(&pci_dev->dev,
   2.471 +-					"cannot enable LPC\n");
   2.472 +-				return -ENODEV;
   2.473 +-			}
   2.474 +-		}
   2.475 +-
   2.476 +-		/* initialize TPM registers */
   2.477 +-		pci_read_config_dword(pci_dev, PCI_GEN2_DEC, &tmp);
   2.478 +-
   2.479 +-		if (!is_lpcm)
   2.480 +-			tmp = (tmp & 0xFFFF0000) | (base & 0xFFF0);
   2.481 +-		else
   2.482 +-			tmp =
   2.483 +-			    (tmp & 0xFFFF0000) | (base & 0xFFF0) |
   2.484 +-			    0x00000001;
   2.485 +-
   2.486 +-		pci_write_config_dword(pci_dev, PCI_GEN2_DEC, tmp);
   2.487 +-
   2.488 +-		if (is_lpcm) {
   2.489 +-			pci_read_config_dword(pci_dev, PCI_GEN_PMCON_1,
   2.490 +-					      &tmp);
   2.491 +-			tmp |= 0x00000004;	/* enable CLKRUN */
   2.492 +-			pci_write_config_dword(pci_dev, PCI_GEN_PMCON_1,
   2.493 +-					       tmp);
   2.494 +-		}
   2.495 +-		tpm_write_index(0x0D, 0x55);	/* unlock 4F */
   2.496 +-		tpm_write_index(0x0A, 0x00);	/* int disable */
   2.497 +-		tpm_write_index(0x08, base);	/* base addr lo */
   2.498 +-		tpm_write_index(0x09, (base & 0xFF00) >> 8);	/* base addr hi */
   2.499 +-		tpm_write_index(0x0D, 0xAA);	/* lock 4F */
   2.500 +-		break;
   2.501 +-	case PCI_VENDOR_ID_AMD:
   2.502 +-		/* nothing yet */
   2.503 +-		break;
   2.504 +-	}
   2.505 +-
   2.506 +-	return 0;
   2.507 +-}
   2.508 +-
   2.509 +-EXPORT_SYMBOL_GPL(tpm_lpc_bus_init);
   2.510 +-
   2.511 +-/*
   2.512 +  * Internal kernel interface to transmit TPM commands
   2.513 +  */
   2.514 + static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
   2.515 +@@ -590,10 +518,6 @@ int tpm_pm_resume(struct pci_dev *pci_de
   2.516 + 	if (chip == NULL)
   2.517 + 		return -ENODEV;
   2.518 + 
   2.519 +-	spin_lock(&driver_lock);
   2.520 +-	tpm_lpc_bus_init(pci_dev, chip->vendor->base);
   2.521 +-	spin_unlock(&driver_lock);
   2.522 +-
   2.523 + 	return 0;
   2.524 + }
   2.525 + 
   2.526 +diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
   2.527 +--- a/drivers/char/tpm/tpm.h
   2.528 ++++ b/drivers/char/tpm/tpm.h
   2.529 +@@ -79,8 +79,6 @@ static inline void tpm_write_index(int i
   2.530 + }
   2.531 + 
   2.532 + extern void tpm_time_expired(unsigned long);
   2.533 +-extern int tpm_lpc_bus_init(struct pci_dev *, u16);
   2.534 +-
   2.535 + extern int tpm_register_hardware(struct pci_dev *,
   2.536 + 				 struct tpm_vendor_specific *);
   2.537 + extern int tpm_open(struct inode *, struct file *);
   2.538 +diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c
   2.539 +--- a/drivers/char/tpm/tpm_atmel.c
   2.540 ++++ b/drivers/char/tpm/tpm_atmel.c
   2.541 +@@ -22,7 +22,10 @@
   2.542 + #include "tpm.h"
   2.543 + 
   2.544 + /* Atmel definitions */
   2.545 +-#define	TPM_ATML_BASE			0x400
   2.546 ++enum tpm_atmel_addr {
   2.547 ++	TPM_ATMEL_BASE_ADDR_LO = 0x08,
   2.548 ++	TPM_ATMEL_BASE_ADDR_HI = 0x09
   2.549 ++};
   2.550 + 
   2.551 + /* write status bits */
   2.552 + #define	ATML_STATUS_ABORT		0x01
   2.553 +@@ -127,7 +130,6 @@ static struct tpm_vendor_specific tpm_at
   2.554 + 	.cancel = tpm_atml_cancel,
   2.555 + 	.req_complete_mask = ATML_STATUS_BUSY | ATML_STATUS_DATA_AVAIL,
   2.556 + 	.req_complete_val = ATML_STATUS_DATA_AVAIL,
   2.557 +-	.base = TPM_ATML_BASE,
   2.558 + 	.miscdev = { .fops = &atmel_ops, },
   2.559 + };
   2.560 + 
   2.561 +@@ -136,14 +138,16 @@ static int __devinit tpm_atml_init(struc
   2.562 + {
   2.563 + 	u8 version[4];
   2.564 + 	int rc = 0;
   2.565 ++	int lo, hi;
   2.566 + 
   2.567 + 	if (pci_enable_device(pci_dev))
   2.568 + 		return -EIO;
   2.569 + 
   2.570 +-	if (tpm_lpc_bus_init(pci_dev, TPM_ATML_BASE)) {
   2.571 +-		rc = -ENODEV;
   2.572 +-		goto out_err;
   2.573 +-	}
   2.574 ++	lo = tpm_read_index( TPM_ATMEL_BASE_ADDR_LO );
   2.575 ++	hi = tpm_read_index( TPM_ATMEL_BASE_ADDR_HI );
   2.576 ++
   2.577 ++	tpm_atmel.base = (hi<<8)|lo;
   2.578 ++	dev_dbg( &pci_dev->dev, "Operating with base: 0x%x\n", tpm_atmel.base);
   2.579 + 
   2.580 + 	/* verify that it is an Atmel part */
   2.581 + 	if (tpm_read_index(4) != 'A' || tpm_read_index(5) != 'T'
   2.582 +diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
   2.583 +--- a/drivers/char/tpm/tpm_nsc.c
   2.584 ++++ b/drivers/char/tpm/tpm_nsc.c
   2.585 +@@ -24,6 +24,10 @@
   2.586 + /* National definitions */
   2.587 + #define	TPM_NSC_BASE			0x360
   2.588 + #define	TPM_NSC_IRQ			0x07
   2.589 ++#define	TPM_NSC_BASE0_HI		0x60
   2.590 ++#define	TPM_NSC_BASE0_LO		0x61
   2.591 ++#define	TPM_NSC_BASE1_HI		0x62
   2.592 ++#define	TPM_NSC_BASE1_LO		0x63
   2.593 + 
   2.594 + #define	NSC_LDN_INDEX			0x07
   2.595 + #define	NSC_SID_INDEX			0x20
   2.596 +@@ -234,7 +238,6 @@ static struct tpm_vendor_specific tpm_ns
   2.597 + 	.cancel = tpm_nsc_cancel,
   2.598 + 	.req_complete_mask = NSC_STATUS_OBF,
   2.599 + 	.req_complete_val = NSC_STATUS_OBF,
   2.600 +-	.base = TPM_NSC_BASE,
   2.601 + 	.miscdev = { .fops = &nsc_ops, },
   2.602 + 	
   2.603 + };
   2.604 +@@ -243,15 +246,16 @@ static int __devinit tpm_nsc_init(struct
   2.605 + 				  const struct pci_device_id *pci_id)
   2.606 + {
   2.607 + 	int rc = 0;
   2.608 ++	int lo, hi;
   2.609 ++
   2.610 ++	hi = tpm_read_index(TPM_NSC_BASE0_HI);
   2.611 ++	lo = tpm_read_index(TPM_NSC_BASE0_LO);
   2.612 ++
   2.613 ++	tpm_nsc.base = (hi<<8) | lo;
   2.614 + 
   2.615 + 	if (pci_enable_device(pci_dev))
   2.616 + 		return -EIO;
   2.617 + 
   2.618 +-	if (tpm_lpc_bus_init(pci_dev, TPM_NSC_BASE)) {
   2.619 +-		rc = -ENODEV;
   2.620 +-		goto out_err;
   2.621 +-	}
   2.622 +-
   2.623 + 	/* verify that it is a National part (SID) */
   2.624 + 	if (tpm_read_index(NSC_SID_INDEX) != 0xEF) {
   2.625 + 		rc = -ENODEV;
   2.626 +diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
   2.627 +--- a/drivers/char/tty_ioctl.c
   2.628 ++++ b/drivers/char/tty_ioctl.c
   2.629 +@@ -476,11 +476,11 @@ int n_tty_ioctl(struct tty_struct * tty,
   2.630 + 			ld = tty_ldisc_ref(tty);
   2.631 + 			switch (arg) {
   2.632 + 			case TCIFLUSH:
   2.633 +-				if (ld->flush_buffer)
   2.634 ++				if (ld && ld->flush_buffer)
   2.635 + 					ld->flush_buffer(tty);
   2.636 + 				break;
   2.637 + 			case TCIOFLUSH:
   2.638 +-				if (ld->flush_buffer)
   2.639 ++				if (ld && ld->flush_buffer)
   2.640 + 					ld->flush_buffer(tty);
   2.641 + 				/* fall through */
   2.642 + 			case TCOFLUSH:
   2.643 +diff --git a/drivers/media/video/cx88/cx88-video.c b/drivers/media/video/cx88/cx88-video.c
   2.644 +--- a/drivers/media/video/cx88/cx88-video.c
   2.645 ++++ b/drivers/media/video/cx88/cx88-video.c
   2.646 +@@ -261,7 +261,7 @@ static struct cx88_ctrl cx8800_ctls[] = 
   2.647 + 			.default_value = 0,
   2.648 + 			.type          = V4L2_CTRL_TYPE_INTEGER,
   2.649 + 		},
   2.650 +-		.off                   = 0,
   2.651 ++		.off                   = 128,
   2.652 + 		.reg                   = MO_HUE,
   2.653 + 		.mask                  = 0x00ff,
   2.654 + 		.shift                 = 0,
   2.655 +diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
   2.656 +--- a/drivers/net/e1000/e1000_main.c
   2.657 ++++ b/drivers/net/e1000/e1000_main.c
   2.658 +@@ -2307,6 +2307,7 @@ e1000_xmit_frame(struct sk_buff *skb, st
   2.659 + 	tso = e1000_tso(adapter, skb);
   2.660 + 	if (tso < 0) {
   2.661 + 		dev_kfree_skb_any(skb);
   2.662 ++		spin_unlock_irqrestore(&adapter->tx_lock, flags);
   2.663 + 		return NETDEV_TX_OK;
   2.664 + 	}
   2.665 + 
   2.666 +diff --git a/drivers/net/hamradio/Kconfig b/drivers/net/hamradio/Kconfig
   2.667 +--- a/drivers/net/hamradio/Kconfig
   2.668 ++++ b/drivers/net/hamradio/Kconfig
   2.669 +@@ -17,7 +17,7 @@ config MKISS
   2.670 + 
   2.671 + config 6PACK
   2.672 + 	tristate "Serial port 6PACK driver"
   2.673 +-	depends on AX25 && BROKEN_ON_SMP
   2.674 ++	depends on AX25
   2.675 + 	---help---
   2.676 + 	  6pack is a transmission protocol for the data exchange between your
   2.677 + 	  PC and your TNC (the Terminal Node Controller acts as a kind of
   2.678 +diff --git a/drivers/net/shaper.c b/drivers/net/shaper.c
   2.679 +--- a/drivers/net/shaper.c
   2.680 ++++ b/drivers/net/shaper.c
   2.681 +@@ -135,10 +135,8 @@ static int shaper_start_xmit(struct sk_b
   2.682 + {
   2.683 + 	struct shaper *shaper = dev->priv;
   2.684 +  	struct sk_buff *ptr;
   2.685 +-   
   2.686 +-	if (down_trylock(&shaper->sem))
   2.687 +-		return -1;
   2.688 + 
   2.689 ++	spin_lock(&shaper->lock);
   2.690 +  	ptr=shaper->sendq.prev;
   2.691 +  	
   2.692 +  	/*
   2.693 +@@ -232,7 +230,7 @@ static int shaper_start_xmit(struct sk_b
   2.694 +                 shaper->stats.collisions++;
   2.695 +  	}
   2.696 + 	shaper_kick(shaper);
   2.697 +-	up(&shaper->sem);
   2.698 ++	spin_unlock(&shaper->lock);
   2.699 +  	return 0;
   2.700 + }
   2.701 + 
   2.702 +@@ -271,11 +269,9 @@ static void shaper_timer(unsigned long d
   2.703 + {
   2.704 + 	struct shaper *shaper = (struct shaper *)data;
   2.705 + 
   2.706 +-	if (!down_trylock(&shaper->sem)) {
   2.707 +-		shaper_kick(shaper);
   2.708 +-		up(&shaper->sem);
   2.709 +-	} else
   2.710 +-		mod_timer(&shaper->timer, jiffies);
   2.711 ++	spin_lock(&shaper->lock);
   2.712 ++	shaper_kick(shaper);
   2.713 ++	spin_unlock(&shaper->lock);
   2.714 + }
   2.715 + 
   2.716 + /*
   2.717 +@@ -332,21 +328,6 @@ static void shaper_kick(struct shaper *s
   2.718 + 
   2.719 + 
   2.720 + /*
   2.721 +- *	Flush the shaper queues on a closedown
   2.722 +- */
   2.723 +- 
   2.724 +-static void shaper_flush(struct shaper *shaper)
   2.725 +-{
   2.726 +-	struct sk_buff *skb;
   2.727 +-
   2.728 +-	down(&shaper->sem);
   2.729 +-	while((skb=skb_dequeue(&shaper->sendq))!=NULL)
   2.730 +-		dev_kfree_skb(skb);
   2.731 +-	shaper_kick(shaper);
   2.732 +-	up(&shaper->sem);
   2.733 +-}
   2.734 +-
   2.735 +-/*
   2.736 +  *	Bring the interface up. We just disallow this until a 
   2.737 +  *	bind.
   2.738 +  */
   2.739 +@@ -375,7 +356,15 @@ static int shaper_open(struct net_device
   2.740 + static int shaper_close(struct net_device *dev)
   2.741 + {
   2.742 + 	struct shaper *shaper=dev->priv;
   2.743 +-	shaper_flush(shaper);
   2.744 ++	struct sk_buff *skb;
   2.745 ++
   2.746 ++	while ((skb = skb_dequeue(&shaper->sendq)) != NULL)
   2.747 ++		dev_kfree_skb(skb);
   2.748 ++
   2.749 ++	spin_lock_bh(&shaper->lock);
   2.750 ++	shaper_kick(shaper);
   2.751 ++	spin_unlock_bh(&shaper->lock);
   2.752 ++
   2.753 + 	del_timer_sync(&shaper->timer);
   2.754 + 	return 0;
   2.755 + }
   2.756 +@@ -576,6 +565,7 @@ static void shaper_init_priv(struct net_
   2.757 + 	init_timer(&sh->timer);
   2.758 + 	sh->timer.function=shaper_timer;
   2.759 + 	sh->timer.data=(unsigned long)sh;
   2.760 ++	spin_lock_init(&sh->lock);
   2.761 + }
   2.762 + 
   2.763 + /*
   2.764 +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
   2.765 +--- a/drivers/pci/pci-driver.c
   2.766 ++++ b/drivers/pci/pci-driver.c
   2.767 +@@ -396,7 +396,7 @@ int pci_register_driver(struct pci_drive
   2.768 + 	/* FIXME, once all of the existing PCI drivers have been fixed to set
   2.769 + 	 * the pci shutdown function, this test can go away. */
   2.770 + 	if (!drv->driver.shutdown)
   2.771 +-		drv->driver.shutdown = pci_device_shutdown,
   2.772 ++		drv->driver.shutdown = pci_device_shutdown;
   2.773 + 	drv->driver.owner = drv->owner;
   2.774 + 	drv->driver.kobj.ktype = &pci_driver_kobj_type;
   2.775 + 	pci_init_dynids(&drv->dynids);
   2.776 +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
   2.777 +--- a/drivers/scsi/qla2xxx/qla_init.c
   2.778 ++++ b/drivers/scsi/qla2xxx/qla_init.c
   2.779 +@@ -1914,9 +1914,11 @@ qla2x00_reg_remote_port(scsi_qla_host_t 
   2.780 + 		rport_ids.roles |= FC_RPORT_ROLE_FCP_TARGET;
   2.781 + 
   2.782 + 	fcport->rport = rport = fc_remote_port_add(ha->host, 0, &rport_ids);
   2.783 +-	if (!rport)
   2.784 ++	if (!rport) {
   2.785 + 		qla_printk(KERN_WARNING, ha,
   2.786 + 		    "Unable to allocate fc remote port!\n");
   2.787 ++		return;
   2.788 ++	}
   2.789 + 
   2.790 + 	if (rport->scsi_target_id != -1 && rport->scsi_target_id < MAX_TARGETS)
   2.791 + 		fcport->os_target_id = rport->scsi_target_id;
   2.792 +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
   2.793 +--- a/drivers/scsi/qla2xxx/qla_os.c
   2.794 ++++ b/drivers/scsi/qla2xxx/qla_os.c
   2.795 +@@ -1150,7 +1150,7 @@ iospace_error_exit:
   2.796 +  */
   2.797 + int qla2x00_probe_one(struct pci_dev *pdev, struct qla_board_info *brd_info)
   2.798 + {
   2.799 +-	int	ret;
   2.800 ++	int	ret = -ENODEV;
   2.801 + 	device_reg_t __iomem *reg;
   2.802 + 	struct Scsi_Host *host;
   2.803 + 	scsi_qla_host_t *ha;
   2.804 +@@ -1161,7 +1161,7 @@ int qla2x00_probe_one(struct pci_dev *pd
   2.805 + 	fc_port_t *fcport;
   2.806 + 
   2.807 + 	if (pci_enable_device(pdev))
   2.808 +-		return -1;
   2.809 ++		goto probe_out;
   2.810 + 
   2.811 + 	host = scsi_host_alloc(&qla2x00_driver_template,
   2.812 + 	    sizeof(scsi_qla_host_t));
   2.813 +@@ -1183,9 +1183,8 @@ int qla2x00_probe_one(struct pci_dev *pd
   2.814 + 
   2.815 + 	/* Configure PCI I/O space */
   2.816 + 	ret = qla2x00_iospace_config(ha);
   2.817 +-	if (ret != 0) {
   2.818 +-		goto probe_alloc_failed;
   2.819 +-	}
   2.820 ++	if (ret)
   2.821 ++		goto probe_failed;
   2.822 + 
   2.823 + 	/* Sanitize the information from PCI BIOS. */
   2.824 + 	host->irq = pdev->irq;
   2.825 +@@ -1258,23 +1257,10 @@ int qla2x00_probe_one(struct pci_dev *pd
   2.826 + 		qla_printk(KERN_WARNING, ha,
   2.827 + 		    "[ERROR] Failed to allocate memory for adapter\n");
   2.828 + 
   2.829 +-		goto probe_alloc_failed;
   2.830 ++		ret = -ENOMEM;
   2.831 ++		goto probe_failed;
   2.832 + 	}
   2.833 + 
   2.834 +-	pci_set_drvdata(pdev, ha);
   2.835 +-	host->this_id = 255;
   2.836 +-	host->cmd_per_lun = 3;
   2.837 +-	host->unique_id = ha->instance;
   2.838 +-	host->max_cmd_len = MAX_CMDSZ;
   2.839 +-	host->max_channel = ha->ports - 1;
   2.840 +-	host->max_id = ha->max_targets;
   2.841 +-	host->max_lun = ha->max_luns;
   2.842 +-	host->transportt = qla2xxx_transport_template;
   2.843 +-	if (scsi_add_host(host, &pdev->dev))
   2.844 +-		goto probe_alloc_failed;
   2.845 +-
   2.846 +-	qla2x00_alloc_sysfs_attr(ha);
   2.847 +-
   2.848 + 	if (qla2x00_initialize_adapter(ha) &&
   2.849 + 	    !(ha->device_flags & DFLG_NO_CABLE)) {
   2.850 + 
   2.851 +@@ -1285,11 +1271,10 @@ int qla2x00_probe_one(struct pci_dev *pd
   2.852 + 		    "Adapter flags %x.\n",
   2.853 + 		    ha->host_no, ha->device_flags));
   2.854 + 
   2.855 ++		ret = -ENODEV;
   2.856 + 		goto probe_failed;
   2.857 + 	}
   2.858 + 
   2.859 +-	qla2x00_init_host_attr(ha);
   2.860 +-
   2.861 + 	/*
   2.862 + 	 * Startup the kernel thread for this host adapter
   2.863 + 	 */
   2.864 +@@ -1299,17 +1284,26 @@ int qla2x00_probe_one(struct pci_dev *pd
   2.865 + 		qla_printk(KERN_WARNING, ha,
   2.866 + 		    "Unable to start DPC thread!\n");
   2.867 + 
   2.868 ++		ret = -ENODEV;
   2.869 + 		goto probe_failed;
   2.870 + 	}
   2.871 + 	wait_for_completion(&ha->dpc_inited);
   2.872 + 
   2.873 ++	host->this_id = 255;
   2.874 ++	host->cmd_per_lun = 3;
   2.875 ++	host->unique_id = ha->instance;
   2.876 ++	host->max_cmd_len = MAX_CMDSZ;
   2.877 ++	host->max_channel = ha->ports - 1;
   2.878 ++	host->max_lun = MAX_LUNS;
   2.879 ++	host->transportt = qla2xxx_transport_template;
   2.880 ++
   2.881 + 	if (IS_QLA2100(ha) || IS_QLA2200(ha))
   2.882 + 		ret = request_irq(host->irq, qla2100_intr_handler,
   2.883 + 		    SA_INTERRUPT|SA_SHIRQ, ha->brd_info->drv_name, ha);
   2.884 + 	else
   2.885 + 		ret = request_irq(host->irq, qla2300_intr_handler,
   2.886 + 		    SA_INTERRUPT|SA_SHIRQ, ha->brd_info->drv_name, ha);
   2.887 +-	if (ret != 0) {
   2.888 ++	if (ret) {
   2.889 + 		qla_printk(KERN_WARNING, ha,
   2.890 + 		    "Failed to reserve interrupt %d already in use.\n",
   2.891 + 		    host->irq);
   2.892 +@@ -1363,9 +1357,18 @@ int qla2x00_probe_one(struct pci_dev *pd
   2.893 + 		msleep(10);
   2.894 + 	}
   2.895 + 
   2.896 ++	pci_set_drvdata(pdev, ha);
   2.897 + 	ha->flags.init_done = 1;
   2.898 + 	num_hosts++;
   2.899 + 
   2.900 ++	ret = scsi_add_host(host, &pdev->dev);
   2.901 ++	if (ret)
   2.902 ++		goto probe_failed;
   2.903 ++
   2.904 ++	qla2x00_alloc_sysfs_attr(ha);
   2.905 ++
   2.906 ++	qla2x00_init_host_attr(ha);
   2.907 ++
   2.908 + 	qla_printk(KERN_INFO, ha, "\n"
   2.909 + 	    " QLogic Fibre Channel HBA Driver: %s\n"
   2.910 + 	    "  QLogic %s - %s\n"
   2.911 +@@ -1384,9 +1387,6 @@ int qla2x00_probe_one(struct pci_dev *pd
   2.912 + probe_failed:
   2.913 + 	fc_remove_host(ha->host);
   2.914 + 
   2.915 +-	scsi_remove_host(host);
   2.916 +-
   2.917 +-probe_alloc_failed:
   2.918 + 	qla2x00_free_device(ha);
   2.919 + 
   2.920 + 	scsi_host_put(host);
   2.921 +@@ -1394,7 +1394,8 @@ probe_alloc_failed:
   2.922 + probe_disable_device:
   2.923 + 	pci_disable_device(pdev);
   2.924 + 
   2.925 +-	return -1;
   2.926 ++probe_out:
   2.927 ++	return ret;
   2.928 + }
   2.929 + EXPORT_SYMBOL_GPL(qla2x00_probe_one);
   2.930 + 
   2.931 +diff --git a/fs/bio.c b/fs/bio.c
   2.932 +--- a/fs/bio.c
   2.933 ++++ b/fs/bio.c
   2.934 +@@ -261,6 +261,7 @@ inline void __bio_clone(struct bio *bio,
   2.935 + 	 */
   2.936 + 	bio->bi_vcnt = bio_src->bi_vcnt;
   2.937 + 	bio->bi_size = bio_src->bi_size;
   2.938 ++	bio->bi_idx = bio_src->bi_idx;
   2.939 + 	bio_phys_segments(q, bio);
   2.940 + 	bio_hw_segments(q, bio);
   2.941 + }
   2.942 +diff --git a/fs/char_dev.c b/fs/char_dev.c
   2.943 +--- a/fs/char_dev.c
   2.944 ++++ b/fs/char_dev.c
   2.945 +@@ -139,7 +139,7 @@ __unregister_chrdev_region(unsigned majo
   2.946 + 	struct char_device_struct *cd = NULL, **cp;
   2.947 + 	int i = major_to_index(major);
   2.948 + 
   2.949 +-	up(&chrdevs_lock);
   2.950 ++	down(&chrdevs_lock);
   2.951 + 	for (cp = &chrdevs[i]; *cp; cp = &(*cp)->next)
   2.952 + 		if ((*cp)->major == major &&
   2.953 + 		    (*cp)->baseminor == baseminor &&
   2.954 +diff --git a/fs/exec.c b/fs/exec.c
   2.955 +--- a/fs/exec.c
   2.956 ++++ b/fs/exec.c
   2.957 +@@ -649,6 +649,7 @@ static inline int de_thread(struct task_
   2.958 + 	}
   2.959 + 	sig->group_exit_task = NULL;
   2.960 + 	sig->notify_count = 0;
   2.961 ++	sig->real_timer.data = (unsigned long)current;
   2.962 + 	spin_unlock_irq(lock);
   2.963 + 
   2.964 + 	/*
   2.965 +diff --git a/include/asm-i386/string.h b/include/asm-i386/string.h
   2.966 +--- a/include/asm-i386/string.h
   2.967 ++++ b/include/asm-i386/string.h
   2.968 +@@ -116,7 +116,8 @@ __asm__ __volatile__(
   2.969 + 	"orb $1,%%al\n"
   2.970 + 	"3:"
   2.971 + 	:"=a" (__res), "=&S" (d0), "=&D" (d1)
   2.972 +-		     :"1" (cs),"2" (ct));
   2.973 ++	:"1" (cs),"2" (ct)
   2.974 ++	:"memory");
   2.975 + return __res;
   2.976 + }
   2.977 + 
   2.978 +@@ -138,8 +139,9 @@ __asm__ __volatile__(
   2.979 + 	"3:\tsbbl %%eax,%%eax\n\t"
   2.980 + 	"orb $1,%%al\n"
   2.981 + 	"4:"
   2.982 +-		     :"=a" (__res), "=&S" (d0), "=&D" (d1), "=&c" (d2)
   2.983 +-		     :"1" (cs),"2" (ct),"3" (count));
   2.984 ++	:"=a" (__res), "=&S" (d0), "=&D" (d1), "=&c" (d2)
   2.985 ++	:"1" (cs),"2" (ct),"3" (count)
   2.986 ++	:"memory");
   2.987 + return __res;
   2.988 + }
   2.989 + 
   2.990 +@@ -158,7 +160,9 @@ __asm__ __volatile__(
   2.991 + 	"movl $1,%1\n"
   2.992 + 	"2:\tmovl %1,%0\n\t"
   2.993 + 	"decl %0"
   2.994 +-	:"=a" (__res), "=&S" (d0) : "1" (s),"0" (c));
   2.995 ++	:"=a" (__res), "=&S" (d0)
   2.996 ++	:"1" (s),"0" (c)
   2.997 ++	:"memory");
   2.998 + return __res;
   2.999 + }
  2.1000 + 
  2.1001 +@@ -175,7 +179,9 @@ __asm__ __volatile__(
  2.1002 + 	"leal -1(%%esi),%0\n"
  2.1003 + 	"2:\ttestb %%al,%%al\n\t"
  2.1004 + 	"jne 1b"
  2.1005 +-	:"=g" (__res), "=&S" (d0), "=&a" (d1) :"0" (0),"1" (s),"2" (c));
  2.1006 ++	:"=g" (__res), "=&S" (d0), "=&a" (d1)
  2.1007 ++	:"0" (0),"1" (s),"2" (c)
  2.1008 ++	:"memory");
  2.1009 + return __res;
  2.1010 + }
  2.1011 + 
  2.1012 +@@ -189,7 +195,9 @@ __asm__ __volatile__(
  2.1013 + 	"scasb\n\t"
  2.1014 + 	"notl %0\n\t"
  2.1015 + 	"decl %0"
  2.1016 +-	:"=c" (__res), "=&D" (d0) :"1" (s),"a" (0), "0" (0xffffffffu));
  2.1017 ++	:"=c" (__res), "=&D" (d0)
  2.1018 ++	:"1" (s),"a" (0), "0" (0xffffffffu)
  2.1019 ++	:"memory");
  2.1020 + return __res;
  2.1021 + }
  2.1022 + 
  2.1023 +@@ -333,7 +341,9 @@ __asm__ __volatile__(
  2.1024 + 	"je 1f\n\t"
  2.1025 + 	"movl $1,%0\n"
  2.1026 + 	"1:\tdecl %0"
  2.1027 +-	:"=D" (__res), "=&c" (d0) : "a" (c),"0" (cs),"1" (count));
  2.1028 ++	:"=D" (__res), "=&c" (d0)
  2.1029 ++	:"a" (c),"0" (cs),"1" (count)
  2.1030 ++	:"memory");
  2.1031 + return __res;
  2.1032 + }
  2.1033 + 
  2.1034 +@@ -369,7 +379,7 @@ __asm__ __volatile__(
  2.1035 + 	"je 2f\n\t"
  2.1036 + 	"stosb\n"
  2.1037 + 	"2:"
  2.1038 +-	: "=&c" (d0), "=&D" (d1)
  2.1039 ++	:"=&c" (d0), "=&D" (d1)
  2.1040 + 	:"a" (c), "q" (count), "0" (count/4), "1" ((long) s)
  2.1041 + 	:"memory");
  2.1042 + return (s);	
  2.1043 +@@ -392,7 +402,8 @@ __asm__ __volatile__(
  2.1044 + 	"jne 1b\n"
  2.1045 + 	"3:\tsubl %2,%0"
  2.1046 + 	:"=a" (__res), "=&d" (d0)
  2.1047 +-	:"c" (s),"1" (count));
  2.1048 ++	:"c" (s),"1" (count)
  2.1049 ++	:"memory");
  2.1050 + return __res;
  2.1051 + }
  2.1052 + /* end of additional stuff */
  2.1053 +@@ -473,7 +484,8 @@ static inline void * memscan(void * addr
  2.1054 + 		"dec %%edi\n"
  2.1055 + 		"1:"
  2.1056 + 		: "=D" (addr), "=c" (size)
  2.1057 +-		: "0" (addr), "1" (size), "a" (c));
  2.1058 ++		: "0" (addr), "1" (size), "a" (c)
  2.1059 ++		: "memory");
  2.1060 + 	return addr;
  2.1061 + }
  2.1062 + 
  2.1063 +diff --git a/include/linux/if_shaper.h b/include/linux/if_shaper.h
  2.1064 +--- a/include/linux/if_shaper.h
  2.1065 ++++ b/include/linux/if_shaper.h
  2.1066 +@@ -23,7 +23,7 @@ struct shaper
  2.1067 + 	__u32 shapeclock;
  2.1068 + 	unsigned long recovery;	/* Time we can next clock a packet out on
  2.1069 + 				   an empty queue */
  2.1070 +-	struct semaphore sem;
  2.1071 ++	spinlock_t lock;
  2.1072 +         struct net_device_stats stats;
  2.1073 + 	struct net_device *dev;
  2.1074 + 	int  (*hard_start_xmit) (struct sk_buff *skb,
  2.1075 +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
  2.1076 +--- a/include/linux/skbuff.h
  2.1077 ++++ b/include/linux/skbuff.h
  2.1078 +@@ -1192,7 +1192,7 @@ static inline void *skb_header_pointer(c
  2.1079 + {
  2.1080 + 	int hlen = skb_headlen(skb);
  2.1081 + 
  2.1082 +-	if (offset + len <= hlen)
  2.1083 ++	if (hlen - offset >= len)
  2.1084 + 		return skb->data + offset;
  2.1085 + 
  2.1086 + 	if (skb_copy_bits(skb, offset, buffer, len) < 0)
  2.1087 +diff --git a/mm/memory.c b/mm/memory.c
  2.1088 +--- a/mm/memory.c
  2.1089 ++++ b/mm/memory.c
  2.1090 +@@ -1164,7 +1164,7 @@ int remap_pfn_range(struct vm_area_struc
  2.1091 + {
  2.1092 + 	pgd_t *pgd;
  2.1093 + 	unsigned long next;
  2.1094 +-	unsigned long end = addr + size;
  2.1095 ++	unsigned long end = addr + PAGE_ALIGN(size);
  2.1096 + 	struct mm_struct *mm = vma->vm_mm;
  2.1097 + 	int err;
  2.1098 + 
  2.1099 +diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
  2.1100 +--- a/net/8021q/vlan.c
  2.1101 ++++ b/net/8021q/vlan.c
  2.1102 +@@ -578,6 +578,14 @@ static int vlan_device_event(struct noti
  2.1103 + 			if (!vlandev)
  2.1104 + 				continue;
  2.1105 + 
  2.1106 ++			if (netif_carrier_ok(dev)) {
  2.1107 ++				if (!netif_carrier_ok(vlandev))
  2.1108 ++					netif_carrier_on(vlandev);
  2.1109 ++			} else {
  2.1110 ++				if (netif_carrier_ok(vlandev))
  2.1111 ++					netif_carrier_off(vlandev);
  2.1112 ++			}
  2.1113 ++
  2.1114 + 			if ((vlandev->state & VLAN_LINK_STATE_MASK) != flgs) {
  2.1115 + 				vlandev->state = (vlandev->state &~ VLAN_LINK_STATE_MASK) 
  2.1116 + 					| flgs;
  2.1117 +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
  2.1118 +--- a/net/ipv4/ip_output.c
  2.1119 ++++ b/net/ipv4/ip_output.c
  2.1120 +@@ -111,7 +111,6 @@ static int ip_dev_loopback_xmit(struct s
  2.1121 + #ifdef CONFIG_NETFILTER_DEBUG
  2.1122 + 	nf_debug_ip_loopback_xmit(newskb);
  2.1123 + #endif
  2.1124 +-	nf_reset(newskb);
  2.1125 + 	netif_rx(newskb);
  2.1126 + 	return 0;
  2.1127 + }
  2.1128 +@@ -196,8 +195,6 @@ static inline int ip_finish_output2(stru
  2.1129 + 	nf_debug_ip_finish_output2(skb);
  2.1130 + #endif /*CONFIG_NETFILTER_DEBUG*/
  2.1131 + 
  2.1132 +-	nf_reset(skb);
  2.1133 +-
  2.1134 + 	if (hh) {
  2.1135 + 		int hh_alen;
  2.1136 + 
  2.1137 +diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
  2.1138 +--- a/net/ipv4/netfilter/ip_conntrack_core.c
  2.1139 ++++ b/net/ipv4/netfilter/ip_conntrack_core.c
  2.1140 +@@ -1124,6 +1124,9 @@ void ip_conntrack_cleanup(void)
  2.1141 + 		schedule();
  2.1142 + 		goto i_see_dead_people;
  2.1143 + 	}
  2.1144 ++	/* wait until all references to ip_conntrack_untracked are dropped */
  2.1145 ++	while (atomic_read(&ip_conntrack_untracked.ct_general.use) > 1)
  2.1146 ++		schedule();
  2.1147 + 
  2.1148 + 	kmem_cache_destroy(ip_conntrack_cachep);
  2.1149 + 	kmem_cache_destroy(ip_conntrack_expect_cachep);
  2.1150 +diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
  2.1151 +--- a/net/ipv4/netfilter/ip_conntrack_standalone.c
  2.1152 ++++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
  2.1153 +@@ -432,6 +432,13 @@ static unsigned int ip_conntrack_defrag(
  2.1154 + 				        const struct net_device *out,
  2.1155 + 				        int (*okfn)(struct sk_buff *))
  2.1156 + {
  2.1157 ++#if !defined(CONFIG_IP_NF_NAT) && !defined(CONFIG_IP_NF_NAT_MODULE)
  2.1158 ++	/* Previously seen (loopback)?  Ignore.  Do this before
  2.1159 ++           fragment check. */
  2.1160 ++	if ((*pskb)->nfct)
  2.1161 ++		return NF_ACCEPT;
  2.1162 ++#endif
  2.1163 ++
  2.1164 + 	/* Gather fragments. */
  2.1165 + 	if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
  2.1166 + 		*pskb = ip_ct_gather_frags(*pskb,
  2.1167 +diff --git a/net/ipv4/netfilter/ip_nat_proto_tcp.c b/net/ipv4/netfilter/ip_nat_proto_tcp.c
  2.1168 +--- a/net/ipv4/netfilter/ip_nat_proto_tcp.c
  2.1169 ++++ b/net/ipv4/netfilter/ip_nat_proto_tcp.c
  2.1170 +@@ -40,7 +40,8 @@ tcp_unique_tuple(struct ip_conntrack_tup
  2.1171 + 		 enum ip_nat_manip_type maniptype,
  2.1172 + 		 const struct ip_conntrack *conntrack)
  2.1173 + {
  2.1174 +-	static u_int16_t port, *portptr;
  2.1175 ++	static u_int16_t port;
  2.1176 ++	u_int16_t *portptr;
  2.1177 + 	unsigned int range_size, min, i;
  2.1178 + 
  2.1179 + 	if (maniptype == IP_NAT_MANIP_SRC)
  2.1180 +diff --git a/net/ipv4/netfilter/ip_nat_proto_udp.c b/net/ipv4/netfilter/ip_nat_proto_udp.c
  2.1181 +--- a/net/ipv4/netfilter/ip_nat_proto_udp.c
  2.1182 ++++ b/net/ipv4/netfilter/ip_nat_proto_udp.c
  2.1183 +@@ -41,7 +41,8 @@ udp_unique_tuple(struct ip_conntrack_tup
  2.1184 + 		 enum ip_nat_manip_type maniptype,
  2.1185 + 		 const struct ip_conntrack *conntrack)
  2.1186 + {
  2.1187 +-	static u_int16_t port, *portptr;
  2.1188 ++	static u_int16_t port;
  2.1189 ++	u_int16_t *portptr;
  2.1190 + 	unsigned int range_size, min, i;
  2.1191 + 
  2.1192 + 	if (maniptype == IP_NAT_MANIP_SRC)
  2.1193 +diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
  2.1194 +--- a/net/ipv6/netfilter/ip6_queue.c
  2.1195 ++++ b/net/ipv6/netfilter/ip6_queue.c
  2.1196 +@@ -76,7 +76,9 @@ static DECLARE_MUTEX(ipqnl_sem);
  2.1197 + static void
  2.1198 + ipq_issue_verdict(struct ipq_queue_entry *entry, int verdict)
  2.1199 + {
  2.1200 ++	local_bh_disable();
  2.1201 + 	nf_reinject(entry->skb, entry->info, verdict);
  2.1202 ++	local_bh_enable();
  2.1203 + 	kfree(entry);
  2.1204 + }
  2.1205 + 
  2.1206 +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
  2.1207 +--- a/net/netlink/af_netlink.c
  2.1208 ++++ b/net/netlink/af_netlink.c
  2.1209 +@@ -315,8 +315,8 @@ err:
  2.1210 + static void netlink_remove(struct sock *sk)
  2.1211 + {
  2.1212 + 	netlink_table_grab();
  2.1213 +-	nl_table[sk->sk_protocol].hash.entries--;
  2.1214 +-	sk_del_node_init(sk);
  2.1215 ++	if (sk_del_node_init(sk))
  2.1216 ++		nl_table[sk->sk_protocol].hash.entries--;
  2.1217 + 	if (nlk_sk(sk)->groups)
  2.1218 + 		__sk_del_bind_node(sk);
  2.1219 + 	netlink_table_ungrab();
  2.1220 +@@ -429,7 +429,12 @@ retry:
  2.1221 + 	err = netlink_insert(sk, pid);
  2.1222 + 	if (err == -EADDRINUSE)
  2.1223 + 		goto retry;
  2.1224 +-	return 0;
  2.1225 ++
  2.1226 ++	/* If 2 threads race to autobind, that is fine.  */
  2.1227 ++	if (err == -EBUSY)
  2.1228 ++		err = 0;
  2.1229 ++
  2.1230 ++	return err;
  2.1231 + }
  2.1232 + 
  2.1233 + static inline int netlink_capable(struct socket *sock, unsigned int flag) 
  2.1234 +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
  2.1235 +--- a/net/packet/af_packet.c
  2.1236 ++++ b/net/packet/af_packet.c
  2.1237 +@@ -274,6 +274,9 @@ static int packet_rcv_spkt(struct sk_buf
  2.1238 + 	dst_release(skb->dst);
  2.1239 + 	skb->dst = NULL;
  2.1240 + 
  2.1241 ++	/* drop conntrack reference */
  2.1242 ++	nf_reset(skb);
  2.1243 ++
  2.1244 + 	spkt = (struct sockaddr_pkt*)skb->cb;
  2.1245 + 
  2.1246 + 	skb_push(skb, skb->data-skb->mac.raw);
  2.1247 +@@ -517,6 +520,9 @@ static int packet_rcv(struct sk_buff *sk
  2.1248 + 	dst_release(skb->dst);
  2.1249 + 	skb->dst = NULL;
  2.1250 + 
  2.1251 ++	/* drop conntrack reference */
  2.1252 ++	nf_reset(skb);
  2.1253 ++
  2.1254 + 	spin_lock(&sk->sk_receive_queue.lock);
  2.1255 + 	po->stats.tp_packets++;
  2.1256 + 	__skb_queue_tail(&sk->sk_receive_queue, skb);
  2.1257 +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
  2.1258 +--- a/net/xfrm/xfrm_user.c
  2.1259 ++++ b/net/xfrm/xfrm_user.c
  2.1260 +@@ -1180,6 +1180,9 @@ static struct xfrm_policy *xfrm_compile_
  2.1261 + 	if (nr > XFRM_MAX_DEPTH)
  2.1262 + 		return NULL;
  2.1263 + 
  2.1264 ++	if (p->dir > XFRM_POLICY_OUT)
  2.1265 ++		return NULL;
  2.1266 ++
  2.1267 + 	xp = xfrm_policy_alloc(GFP_KERNEL);
  2.1268 + 	if (xp == NULL) {
  2.1269 + 		*dir = -ENOBUFS;