Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-alx/patches-2.6.17-r5/0105-2.6.17.12-all-fixes.patch

    Contents of /trunk/kernel26-alx/patches-2.6.17-r5/0105-2.6.17.12-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 199 - (show annotations) (download)
    Fri May 18 11:04:36 2007 UTC (17 years, 5 months ago) by niro
    File size: 51157 byte(s) 
    -import
    1 diff --git a/arch/ia64/sn/kernel/xpc_channel.c b/arch/ia64/sn/kernel/xpc_channel.c
    2 index 8255a9b..7e8a4d1 100644
    3 --- a/arch/ia64/sn/kernel/xpc_channel.c
    4 +++ b/arch/ia64/sn/kernel/xpc_channel.c
    5 @@ -279,8 +279,8 @@ xpc_pull_remote_cachelines(struct xpc_pa
    6 return part->reason;
    7 }
    8
    9 - bte_ret = xp_bte_copy((u64) src, (u64) ia64_tpa((u64) dst),
    10 - (u64) cnt, (BTE_NORMAL | BTE_WACQUIRE), NULL);
    11 + bte_ret = xp_bte_copy((u64) src, (u64) dst, (u64) cnt,
    12 + (BTE_NORMAL | BTE_WACQUIRE), NULL);
    13 if (bte_ret == BTE_SUCCESS) {
    14 return xpcSuccess;
    15 }
    16 diff --git a/arch/ia64/sn/kernel/xpc_main.c b/arch/ia64/sn/kernel/xpc_main.c
    17 index 99b123a..440039f 100644
    18 --- a/arch/ia64/sn/kernel/xpc_main.c
    19 +++ b/arch/ia64/sn/kernel/xpc_main.c
    20 @@ -1052,6 +1052,8 @@ xpc_do_exit(enum xpc_retval reason)
    21 if (xpc_sysctl) {
    22 unregister_sysctl_table(xpc_sysctl);
    23 }
    24 +
    25 + kfree(xpc_remote_copy_buffer_base);
    26 }
    27
    28
    29 @@ -1212,24 +1214,20 @@ xpc_init(void)
    30 partid_t partid;
    31 struct xpc_partition *part;
    32 pid_t pid;
    33 + size_t buf_size;
    34
    35
    36 if (!ia64_platform_is("sn2")) {
    37 return -ENODEV;
    38 }
    39
    40 - /*
    41 - * xpc_remote_copy_buffer is used as a temporary buffer for bte_copy'ng
    42 - * various portions of a partition's reserved page. Its size is based
    43 - * on the size of the reserved page header and part_nasids mask. So we
    44 - * need to ensure that the other items will fit as well.
    45 - */
    46 - if (XPC_RP_VARS_SIZE > XPC_RP_HEADER_SIZE + XP_NASID_MASK_BYTES) {
    47 - dev_err(xpc_part, "xpc_remote_copy_buffer is not big enough\n");
    48 - return -EPERM;
    49 - }
    50 - DBUG_ON((u64) xpc_remote_copy_buffer !=
    51 - L1_CACHE_ALIGN((u64) xpc_remote_copy_buffer));
    52 +
    53 + buf_size = max(XPC_RP_VARS_SIZE,
    54 + XPC_RP_HEADER_SIZE + XP_NASID_MASK_BYTES);
    55 + xpc_remote_copy_buffer = xpc_kmalloc_cacheline_aligned(buf_size,
    56 + GFP_KERNEL, &xpc_remote_copy_buffer_base);
    57 + if (xpc_remote_copy_buffer == NULL)
    58 + return -ENOMEM;
    59
    60 snprintf(xpc_part->bus_id, BUS_ID_SIZE, "part");
    61 snprintf(xpc_chan->bus_id, BUS_ID_SIZE, "chan");
    62 @@ -1293,6 +1291,8 @@ xpc_init(void)
    63 if (xpc_sysctl) {
    64 unregister_sysctl_table(xpc_sysctl);
    65 }
    66 +
    67 + kfree(xpc_remote_copy_buffer_base);
    68 return -EBUSY;
    69 }
    70
    71 @@ -1311,6 +1311,8 @@ xpc_init(void)
    72 if (xpc_sysctl) {
    73 unregister_sysctl_table(xpc_sysctl);
    74 }
    75 +
    76 + kfree(xpc_remote_copy_buffer_base);
    77 return -EBUSY;
    78 }
    79
    80 @@ -1362,6 +1364,8 @@ xpc_init(void)
    81 if (xpc_sysctl) {
    82 unregister_sysctl_table(xpc_sysctl);
    83 }
    84 +
    85 + kfree(xpc_remote_copy_buffer_base);
    86 return -EBUSY;
    87 }
    88
    89 diff --git a/arch/ia64/sn/kernel/xpc_partition.c b/arch/ia64/sn/kernel/xpc_partition.c
    90 index 2a89cfc..57c723f 100644
    91 --- a/arch/ia64/sn/kernel/xpc_partition.c
    92 +++ b/arch/ia64/sn/kernel/xpc_partition.c
    93 @@ -71,19 +71,15 @@ struct xpc_partition xpc_partitions[XP_M
    94 * Generic buffer used to store a local copy of portions of a remote
    95 * partition's reserved page (either its header and part_nasids mask,
    96 * or its vars).
    97 - *
    98 - * xpc_discovery runs only once and is a seperate thread that is
    99 - * very likely going to be processing in parallel with receiving
    100 - * interrupts.
    101 */
    102 -char ____cacheline_aligned xpc_remote_copy_buffer[XPC_RP_HEADER_SIZE +
    103 - XP_NASID_MASK_BYTES];
    104 +char *xpc_remote_copy_buffer;
    105 +void *xpc_remote_copy_buffer_base;
    106
    107
    108 /*
    109 * Guarantee that the kmalloc'd memory is cacheline aligned.
    110 */
    111 -static void *
    112 +void *
    113 xpc_kmalloc_cacheline_aligned(size_t size, gfp_t flags, void **base)
    114 {
    115 /* see if kmalloc will give us cachline aligned memory by default */
    116 @@ -148,7 +144,7 @@ xpc_get_rsvd_page_pa(int nasid)
    117 }
    118 }
    119
    120 - bte_res = xp_bte_copy(rp_pa, ia64_tpa(buf), buf_len,
    121 + bte_res = xp_bte_copy(rp_pa, buf, buf_len,
    122 (BTE_NOTIFY | BTE_WACQUIRE), NULL);
    123 if (bte_res != BTE_SUCCESS) {
    124 dev_dbg(xpc_part, "xp_bte_copy failed %i\n", bte_res);
    125 @@ -447,7 +443,7 @@ xpc_check_remote_hb(void)
    126
    127 /* pull the remote_hb cache line */
    128 bres = xp_bte_copy(part->remote_vars_pa,
    129 - ia64_tpa((u64) remote_vars),
    130 + (u64) remote_vars,
    131 XPC_RP_VARS_SIZE,
    132 (BTE_NOTIFY | BTE_WACQUIRE), NULL);
    133 if (bres != BTE_SUCCESS) {
    134 @@ -498,8 +494,7 @@ xpc_get_remote_rp(int nasid, u64 *discov
    135
    136
    137 /* pull over the reserved page header and part_nasids mask */
    138 -
    139 - bres = xp_bte_copy(*remote_rp_pa, ia64_tpa((u64) remote_rp),
    140 + bres = xp_bte_copy(*remote_rp_pa, (u64) remote_rp,
    141 XPC_RP_HEADER_SIZE + xp_nasid_mask_bytes,
    142 (BTE_NOTIFY | BTE_WACQUIRE), NULL);
    143 if (bres != BTE_SUCCESS) {
    144 @@ -554,11 +549,8 @@ xpc_get_remote_vars(u64 remote_vars_pa,
    145 return xpcVarsNotSet;
    146 }
    147
    148 -
    149 /* pull over the cross partition variables */
    150 -
    151 - bres = xp_bte_copy(remote_vars_pa, ia64_tpa((u64) remote_vars),
    152 - XPC_RP_VARS_SIZE,
    153 + bres = xp_bte_copy(remote_vars_pa, (u64) remote_vars, XPC_RP_VARS_SIZE,
    154 (BTE_NOTIFY | BTE_WACQUIRE), NULL);
    155 if (bres != BTE_SUCCESS) {
    156 return xpc_map_bte_errors(bres);
    157 @@ -1239,7 +1231,7 @@ xpc_initiate_partid_to_nasids(partid_t p
    158
    159 part_nasid_pa = (u64) XPC_RP_PART_NASIDS(part->remote_rp_pa);
    160
    161 - bte_res = xp_bte_copy(part_nasid_pa, ia64_tpa((u64) nasid_mask),
    162 + bte_res = xp_bte_copy(part_nasid_pa, (u64) nasid_mask,
    163 xp_nasid_mask_bytes, (BTE_NOTIFY | BTE_WACQUIRE), NULL);
    164
    165 return xpc_map_bte_errors(bte_res);
    166 diff --git a/arch/sparc64/mm/generic.c b/arch/sparc64/mm/generic.c
    167 index 8cb0620..af9d81d 100644
    168 --- a/arch/sparc64/mm/generic.c
    169 +++ b/arch/sparc64/mm/generic.c
    170 @@ -69,6 +69,8 @@ static inline void io_remap_pte_range(st
    171 } else
    172 offset += PAGE_SIZE;
    173
    174 + if (pte_write(entry))
    175 + entry = pte_mkdirty(entry);
    176 do {
    177 BUG_ON(!pte_none(*pte));
    178 set_pte_at(mm, address, pte, entry);
    179 diff --git a/drivers/ide/pci/via82cxxx.c b/drivers/ide/pci/via82cxxx.c
    180 index 3e677c4..9914a78 100644
    181 --- a/drivers/ide/pci/via82cxxx.c
    182 +++ b/drivers/ide/pci/via82cxxx.c
    183 @@ -6,7 +6,7 @@
    184 *
    185 * vt82c576, vt82c586, vt82c586a, vt82c586b, vt82c596a, vt82c596b,
    186 * vt82c686, vt82c686a, vt82c686b, vt8231, vt8233, vt8233c, vt8233a,
    187 - * vt8235, vt8237
    188 + * vt8235, vt8237, vt8237a
    189 *
    190 * Copyright (c) 2000-2002 Vojtech Pavlik
    191 *
    192 @@ -82,6 +82,7 @@ static struct via_isa_bridge {
    193 { "vt6410", PCI_DEVICE_ID_VIA_6410, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
    194 { "vt8251", PCI_DEVICE_ID_VIA_8251, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
    195 { "vt8237", PCI_DEVICE_ID_VIA_8237, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
    196 + { "vt8237a", PCI_DEVICE_ID_VIA_8237A, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
    197 { "vt8235", PCI_DEVICE_ID_VIA_8235, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
    198 { "vt8233a", PCI_DEVICE_ID_VIA_8233A, 0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
    199 { "vt8233c", PCI_DEVICE_ID_VIA_8233C_0, 0x00, 0x2f, VIA_UDMA_100 },
    200 diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
    201 index cc07bbe..34a7593 100644
    202 --- a/drivers/md/dm-exception-store.c
    203 +++ b/drivers/md/dm-exception-store.c
    204 @@ -91,7 +91,6 @@ struct pstore {
    205 struct dm_snapshot *snap; /* up pointer to my snapshot */
    206 int version;
    207 int valid;
    208 - uint32_t chunk_size;
    209 uint32_t exceptions_per_area;
    210
    211 /*
    212 @@ -133,7 +132,7 @@ static int alloc_area(struct pstore *ps)
    213 int r = -ENOMEM;
    214 size_t len;
    215
    216 - len = ps->chunk_size << SECTOR_SHIFT;
    217 + len = ps->snap->chunk_size << SECTOR_SHIFT;
    218
    219 /*
    220 * Allocate the chunk_size block of memory that will hold
    221 @@ -160,8 +159,8 @@ static int chunk_io(struct pstore *ps, u
    222 unsigned long bits;
    223
    224 where.bdev = ps->snap->cow->bdev;
    225 - where.sector = ps->chunk_size * chunk;
    226 - where.count = ps->chunk_size;
    227 + where.sector = ps->snap->chunk_size * chunk;
    228 + where.count = ps->snap->chunk_size;
    229
    230 return dm_io_sync_vm(1, &where, rw, ps->area, &bits);
    231 }
    232 @@ -188,7 +187,7 @@ static int area_io(struct pstore *ps, ui
    233
    234 static int zero_area(struct pstore *ps, uint32_t area)
    235 {
    236 - memset(ps->area, 0, ps->chunk_size << SECTOR_SHIFT);
    237 + memset(ps->area, 0, ps->snap->chunk_size << SECTOR_SHIFT);
    238 return area_io(ps, area, WRITE);
    239 }
    240
    241 @@ -196,6 +195,7 @@ static int read_header(struct pstore *ps
    242 {
    243 int r;
    244 struct disk_header *dh;
    245 + chunk_t chunk_size;
    246
    247 r = chunk_io(ps, 0, READ);
    248 if (r)
    249 @@ -210,8 +210,29 @@ static int read_header(struct pstore *ps
    250 *new_snapshot = 0;
    251 ps->valid = le32_to_cpu(dh->valid);
    252 ps->version = le32_to_cpu(dh->version);
    253 - ps->chunk_size = le32_to_cpu(dh->chunk_size);
    254 -
    255 + chunk_size = le32_to_cpu(dh->chunk_size);
    256 + if (ps->snap->chunk_size != chunk_size) {
    257 + DMWARN("chunk size %llu in device metadata overrides "
    258 + "table chunk size of %llu.",
    259 + (unsigned long long)chunk_size,
    260 + (unsigned long long)ps->snap->chunk_size);
    261 +
    262 + /* We had a bogus chunk_size. Fix stuff up. */
    263 + dm_io_put(sectors_to_pages(ps->snap->chunk_size));
    264 + free_area(ps);
    265 +
    266 + ps->snap->chunk_size = chunk_size;
    267 + ps->snap->chunk_mask = chunk_size - 1;
    268 + ps->snap->chunk_shift = ffs(chunk_size) - 1;
    269 +
    270 + r = alloc_area(ps);
    271 + if (r)
    272 + return r;
    273 +
    274 + r = dm_io_get(sectors_to_pages(chunk_size));
    275 + if (r)
    276 + return r;
    277 + }
    278 } else {
    279 DMWARN("Invalid/corrupt snapshot");
    280 r = -ENXIO;
    281 @@ -224,13 +245,13 @@ static int write_header(struct pstore *p
    282 {
    283 struct disk_header *dh;
    284
    285 - memset(ps->area, 0, ps->chunk_size << SECTOR_SHIFT);
    286 + memset(ps->area, 0, ps->snap->chunk_size << SECTOR_SHIFT);
    287
    288 dh = (struct disk_header *) ps->area;
    289 dh->magic = cpu_to_le32(SNAP_MAGIC);
    290 dh->valid = cpu_to_le32(ps->valid);
    291 dh->version = cpu_to_le32(ps->version);
    292 - dh->chunk_size = cpu_to_le32(ps->chunk_size);
    293 + dh->chunk_size = cpu_to_le32(ps->snap->chunk_size);
    294
    295 return chunk_io(ps, 0, WRITE);
    296 }
    297 @@ -365,7 +386,7 @@ static void persistent_destroy(struct ex
    298 {
    299 struct pstore *ps = get_info(store);
    300
    301 - dm_io_put(sectors_to_pages(ps->chunk_size));
    302 + dm_io_put(sectors_to_pages(ps->snap->chunk_size));
    303 vfree(ps->callbacks);
    304 free_area(ps);
    305 kfree(ps);
    306 @@ -384,6 +405,16 @@ static int persistent_read_metadata(stru
    307 return r;
    308
    309 /*
    310 + * Now we know correct chunk_size, complete the initialisation.
    311 + */
    312 + ps->exceptions_per_area = (ps->snap->chunk_size << SECTOR_SHIFT) /
    313 + sizeof(struct disk_exception);
    314 + ps->callbacks = dm_vcalloc(ps->exceptions_per_area,
    315 + sizeof(*ps->callbacks));
    316 + if (!ps->callbacks)
    317 + return -ENOMEM;
    318 +
    319 + /*
    320 * Do we need to setup a new snapshot ?
    321 */
    322 if (new_snapshot) {
    323 @@ -533,9 +564,6 @@ int dm_create_persistent(struct exceptio
    324 ps->snap = store->snap;
    325 ps->valid = 1;
    326 ps->version = SNAPSHOT_DISK_VERSION;
    327 - ps->chunk_size = chunk_size;
    328 - ps->exceptions_per_area = (chunk_size << SECTOR_SHIFT) /
    329 - sizeof(struct disk_exception);
    330 ps->next_free = 2; /* skipping the header and first area */
    331 ps->current_committed = 0;
    332
    333 @@ -543,18 +571,9 @@ int dm_create_persistent(struct exceptio
    334 if (r)
    335 goto bad;
    336
    337 - /*
    338 - * Allocate space for all the callbacks.
    339 - */
    340 ps->callback_count = 0;
    341 atomic_set(&ps->pending_count, 0);
    342 - ps->callbacks = dm_vcalloc(ps->exceptions_per_area,
    343 - sizeof(*ps->callbacks));
    344 -
    345 - if (!ps->callbacks) {
    346 - r = -ENOMEM;
    347 - goto bad;
    348 - }
    349 + ps->callbacks = NULL;
    350
    351 store->destroy = persistent_destroy;
    352 store->read_metadata = persistent_read_metadata;
    353 diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
    354 index 8edd643..f7e7436 100644
    355 --- a/drivers/md/dm-ioctl.c
    356 +++ b/drivers/md/dm-ioctl.c
    357 @@ -102,8 +102,10 @@ static struct hash_cell *__get_name_cell
    358 unsigned int h = hash_str(str);
    359
    360 list_for_each_entry (hc, _name_buckets + h, name_list)
    361 - if (!strcmp(hc->name, str))
    362 + if (!strcmp(hc->name, str)) {
    363 + dm_get(hc->md);
    364 return hc;
    365 + }
    366
    367 return NULL;
    368 }
    369 @@ -114,8 +116,10 @@ static struct hash_cell *__get_uuid_cell
    370 unsigned int h = hash_str(str);
    371
    372 list_for_each_entry (hc, _uuid_buckets + h, uuid_list)
    373 - if (!strcmp(hc->uuid, str))
    374 + if (!strcmp(hc->uuid, str)) {
    375 + dm_get(hc->md);
    376 return hc;
    377 + }
    378
    379 return NULL;
    380 }
    381 @@ -191,7 +195,7 @@ static int unregister_with_devfs(struct
    382 */
    383 static int dm_hash_insert(const char *name, const char *uuid, struct mapped_device *md)
    384 {
    385 - struct hash_cell *cell;
    386 + struct hash_cell *cell, *hc;
    387
    388 /*
    389 * Allocate the new cells.
    390 @@ -204,14 +208,19 @@ static int dm_hash_insert(const char *na
    391 * Insert the cell into both hash tables.
    392 */
    393 down_write(&_hash_lock);
    394 - if (__get_name_cell(name))
    395 + hc = __get_name_cell(name);
    396 + if (hc) {
    397 + dm_put(hc->md);
    398 goto bad;
    399 + }
    400
    401 list_add(&cell->name_list, _name_buckets + hash_str(name));
    402
    403 if (uuid) {
    404 - if (__get_uuid_cell(uuid)) {
    405 + hc = __get_uuid_cell(uuid);
    406 + if (hc) {
    407 list_del(&cell->name_list);
    408 + dm_put(hc->md);
    409 goto bad;
    410 }
    411 list_add(&cell->uuid_list, _uuid_buckets + hash_str(uuid));
    412 @@ -289,6 +298,7 @@ static int dm_hash_rename(const char *ol
    413 if (hc) {
    414 DMWARN("asked to rename to an already existing name %s -> %s",
    415 old, new);
    416 + dm_put(hc->md);
    417 up_write(&_hash_lock);
    418 kfree(new_name);
    419 return -EBUSY;
    420 @@ -328,6 +338,7 @@ static int dm_hash_rename(const char *ol
    421 dm_table_put(table);
    422 }
    423
    424 + dm_put(hc->md);
    425 up_write(&_hash_lock);
    426 kfree(old_name);
    427 return 0;
    428 @@ -611,10 +622,8 @@ static struct hash_cell *__find_device_h
    429 return __get_name_cell(param->name);
    430
    431 md = dm_get_md(huge_decode_dev(param->dev));
    432 - if (md) {
    433 + if (md)
    434 mdptr = dm_get_mdptr(md);
    435 - dm_put(md);
    436 - }
    437
    438 return mdptr;
    439 }
    440 @@ -628,7 +637,6 @@ static struct mapped_device *find_device
    441 hc = __find_device_hash_cell(param);
    442 if (hc) {
    443 md = hc->md;
    444 - dm_get(md);
    445
    446 /*
    447 * Sneakily write in both the name and the uuid
    448 @@ -653,6 +661,7 @@ static struct mapped_device *find_device
    449 static int dev_remove(struct dm_ioctl *param, size_t param_size)
    450 {
    451 struct hash_cell *hc;
    452 + struct mapped_device *md;
    453
    454 down_write(&_hash_lock);
    455 hc = __find_device_hash_cell(param);
    456 @@ -663,8 +672,11 @@ static int dev_remove(struct dm_ioctl *p
    457 return -ENXIO;
    458 }
    459
    460 + md = hc->md;
    461 +
    462 __hash_remove(hc);
    463 up_write(&_hash_lock);
    464 + dm_put(md);
    465 param->data_size = 0;
    466 return 0;
    467 }
    468 @@ -790,7 +802,6 @@ static int do_resume(struct dm_ioctl *pa
    469 }
    470
    471 md = hc->md;
    472 - dm_get(md);
    473
    474 new_map = hc->new_map;
    475 hc->new_map = NULL;
    476 @@ -1078,6 +1089,7 @@ static int table_clear(struct dm_ioctl *
    477 {
    478 int r;
    479 struct hash_cell *hc;
    480 + struct mapped_device *md;
    481
    482 down_write(&_hash_lock);
    483
    484 @@ -1096,7 +1108,9 @@ static int table_clear(struct dm_ioctl *
    485 param->flags &= ~DM_INACTIVE_PRESENT_FLAG;
    486
    487 r = __dev_status(hc->md, param);
    488 + md = hc->md;
    489 up_write(&_hash_lock);
    490 + dm_put(md);
    491 return r;
    492 }
    493
    494 diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
    495 index d12cf3e..2cab46e 100644
    496 --- a/drivers/md/dm-raid1.c
    497 +++ b/drivers/md/dm-raid1.c
    498 @@ -106,12 +106,42 @@ struct region {
    499 struct bio_list delayed_bios;
    500 };
    501
    502 +
    503 +/*-----------------------------------------------------------------
    504 + * Mirror set structures.
    505 + *---------------------------------------------------------------*/
    506 +struct mirror {
    507 + atomic_t error_count;
    508 + struct dm_dev *dev;
    509 + sector_t offset;
    510 +};
    511 +
    512 +struct mirror_set {
    513 + struct dm_target *ti;
    514 + struct list_head list;
    515 + struct region_hash rh;
    516 + struct kcopyd_client *kcopyd_client;
    517 +
    518 + spinlock_t lock; /* protects the next two lists */
    519 + struct bio_list reads;
    520 + struct bio_list writes;
    521 +
    522 + /* recovery */
    523 + region_t nr_regions;
    524 + int in_sync;
    525 +
    526 + struct mirror *default_mirror; /* Default mirror */
    527 +
    528 + unsigned int nr_mirrors;
    529 + struct mirror mirror[0];
    530 +};
    531 +
    532 /*
    533 * Conversion fns
    534 */
    535 static inline region_t bio_to_region(struct region_hash *rh, struct bio *bio)
    536 {
    537 - return bio->bi_sector >> rh->region_shift;
    538 + return (bio->bi_sector - rh->ms->ti->begin) >> rh->region_shift;
    539 }
    540
    541 static inline sector_t region_to_sector(struct region_hash *rh, region_t region)
    542 @@ -223,7 +253,9 @@ static struct region *__rh_alloc(struct
    543 struct region *reg, *nreg;
    544
    545 read_unlock(&rh->hash_lock);
    546 - nreg = mempool_alloc(rh->region_pool, GFP_NOIO);
    547 + nreg = mempool_alloc(rh->region_pool, GFP_ATOMIC);
    548 + if (unlikely(!nreg))
    549 + nreg = kmalloc(sizeof(struct region), GFP_NOIO);
    550 nreg->state = rh->log->type->in_sync(rh->log, region, 1) ?
    551 RH_CLEAN : RH_NOSYNC;
    552 nreg->rh = rh;
    553 @@ -541,35 +573,6 @@ static void rh_start_recovery(struct reg
    554 wake();
    555 }
    556
    557 -/*-----------------------------------------------------------------
    558 - * Mirror set structures.
    559 - *---------------------------------------------------------------*/
    560 -struct mirror {
    561 - atomic_t error_count;
    562 - struct dm_dev *dev;
    563 - sector_t offset;
    564 -};
    565 -
    566 -struct mirror_set {
    567 - struct dm_target *ti;
    568 - struct list_head list;
    569 - struct region_hash rh;
    570 - struct kcopyd_client *kcopyd_client;
    571 -
    572 - spinlock_t lock; /* protects the next two lists */
    573 - struct bio_list reads;
    574 - struct bio_list writes;
    575 -
    576 - /* recovery */
    577 - region_t nr_regions;
    578 - int in_sync;
    579 -
    580 - struct mirror *default_mirror; /* Default mirror */
    581 -
    582 - unsigned int nr_mirrors;
    583 - struct mirror mirror[0];
    584 -};
    585 -
    586 /*
    587 * Every mirror should look like this one.
    588 */
    589 @@ -1115,7 +1118,7 @@ static int mirror_map(struct dm_target *
    590 struct mirror *m;
    591 struct mirror_set *ms = ti->private;
    592
    593 - map_context->ll = bio->bi_sector >> ms->rh.region_shift;
    594 + map_context->ll = bio_to_region(&ms->rh, bio);
    595
    596 if (rw == WRITE) {
    597 queue_bio(ms, bio, rw);
    598 diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
    599 index 08312b4..b84bc1a 100644
    600 --- a/drivers/md/dm-snap.c
    601 +++ b/drivers/md/dm-snap.c
    602 @@ -530,7 +530,7 @@ static int snapshot_ctr(struct dm_target
    603 }
    604
    605 ti->private = s;
    606 - ti->split_io = chunk_size;
    607 + ti->split_io = s->chunk_size;
    608
    609 return 0;
    610
    611 @@ -1204,7 +1204,7 @@ static int origin_status(struct dm_targe
    612
    613 static struct target_type origin_target = {
    614 .name = "snapshot-origin",
    615 - .version = {1, 1, 0},
    616 + .version = {1, 4, 0},
    617 .module = THIS_MODULE,
    618 .ctr = origin_ctr,
    619 .dtr = origin_dtr,
    620 @@ -1215,7 +1215,7 @@ static struct target_type origin_target
    621
    622 static struct target_type snapshot_target = {
    623 .name = "snapshot",
    624 - .version = {1, 1, 0},
    625 + .version = {1, 4, 0},
    626 .module = THIS_MODULE,
    627 .ctr = snapshot_ctr,
    628 .dtr = snapshot_dtr,
    629 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
    630 index 4d710b7..dfd0378 100644
    631 --- a/drivers/md/dm.c
    632 +++ b/drivers/md/dm.c
    633 @@ -26,6 +26,7 @@ static const char *_name = DM_NAME;
    634 static unsigned int major = 0;
    635 static unsigned int _major = 0;
    636
    637 +static DEFINE_SPINLOCK(_minor_lock);
    638 /*
    639 * One of these is allocated per bio.
    640 */
    641 @@ -54,12 +55,15 @@ union map_info *dm_get_mapinfo(struct bi
    642 return NULL;
    643 }
    644
    645 +#define MINOR_ALLOCED ((void *)-1)
    646 +
    647 /*
    648 * Bits for the md->flags field.
    649 */
    650 #define DMF_BLOCK_IO 0
    651 #define DMF_SUSPENDED 1
    652 #define DMF_FROZEN 2
    653 +#define DMF_FREEING 3
    654
    655 struct mapped_device {
    656 struct rw_semaphore io_lock;
    657 @@ -218,9 +222,23 @@ static int dm_blk_open(struct inode *ino
    658 {
    659 struct mapped_device *md;
    660
    661 + spin_lock(&_minor_lock);
    662 +
    663 md = inode->i_bdev->bd_disk->private_data;
    664 + if (!md)
    665 + goto out;
    666 +
    667 + if (test_bit(DMF_FREEING, &md->flags)) {
    668 + md = NULL;
    669 + goto out;
    670 + }
    671 +
    672 dm_get(md);
    673 - return 0;
    674 +
    675 +out:
    676 + spin_unlock(&_minor_lock);
    677 +
    678 + return md ? 0 : -ENXIO;
    679 }
    680
    681 static int dm_blk_close(struct inode *inode, struct file *file)
    682 @@ -744,14 +762,13 @@ static int dm_any_congested(void *conges
    683 /*-----------------------------------------------------------------
    684 * An IDR is used to keep track of allocated minor numbers.
    685 *---------------------------------------------------------------*/
    686 -static DEFINE_MUTEX(_minor_lock);
    687 static DEFINE_IDR(_minor_idr);
    688
    689 static void free_minor(unsigned int minor)
    690 {
    691 - mutex_lock(&_minor_lock);
    692 + spin_lock(&_minor_lock);
    693 idr_remove(&_minor_idr, minor);
    694 - mutex_unlock(&_minor_lock);
    695 + spin_unlock(&_minor_lock);
    696 }
    697
    698 /*
    699 @@ -764,23 +781,20 @@ static int specific_minor(struct mapped_
    700 if (minor >= (1 << MINORBITS))
    701 return -EINVAL;
    702
    703 - mutex_lock(&_minor_lock);
    704 + r = idr_pre_get(&_minor_idr, GFP_KERNEL);
    705 + if (!r)
    706 + return -ENOMEM;
    707 +
    708 + spin_lock(&_minor_lock);
    709
    710 if (idr_find(&_minor_idr, minor)) {
    711 r = -EBUSY;
    712 goto out;
    713 }
    714
    715 - r = idr_pre_get(&_minor_idr, GFP_KERNEL);
    716 - if (!r) {
    717 - r = -ENOMEM;
    718 - goto out;
    719 - }
    720 -
    721 - r = idr_get_new_above(&_minor_idr, md, minor, &m);
    722 - if (r) {
    723 + r = idr_get_new_above(&_minor_idr, MINOR_ALLOCED, minor, &m);
    724 + if (r)
    725 goto out;
    726 - }
    727
    728 if (m != minor) {
    729 idr_remove(&_minor_idr, m);
    730 @@ -789,7 +803,7 @@ static int specific_minor(struct mapped_
    731 }
    732
    733 out:
    734 - mutex_unlock(&_minor_lock);
    735 + spin_unlock(&_minor_lock);
    736 return r;
    737 }
    738
    739 @@ -798,15 +812,13 @@ static int next_free_minor(struct mapped
    740 int r;
    741 unsigned int m;
    742
    743 - mutex_lock(&_minor_lock);
    744 -
    745 r = idr_pre_get(&_minor_idr, GFP_KERNEL);
    746 - if (!r) {
    747 - r = -ENOMEM;
    748 - goto out;
    749 - }
    750 + if (!r)
    751 + return -ENOMEM;
    752
    753 - r = idr_get_new(&_minor_idr, md, &m);
    754 + spin_lock(&_minor_lock);
    755 +
    756 + r = idr_get_new(&_minor_idr, MINOR_ALLOCED, &m);
    757 if (r) {
    758 goto out;
    759 }
    760 @@ -820,7 +832,7 @@ static int next_free_minor(struct mapped
    761 *minor = m;
    762
    763 out:
    764 - mutex_unlock(&_minor_lock);
    765 + spin_unlock(&_minor_lock);
    766 return r;
    767 }
    768
    769 @@ -833,12 +845,16 @@ static struct mapped_device *alloc_dev(u
    770 {
    771 int r;
    772 struct mapped_device *md = kmalloc(sizeof(*md), GFP_KERNEL);
    773 + void *old_md;
    774
    775 if (!md) {
    776 DMWARN("unable to allocate device, out of memory.");
    777 return NULL;
    778 }
    779
    780 + if (!try_module_get(THIS_MODULE))
    781 + goto bad0;
    782 +
    783 /* get a minor number for the dev */
    784 r = persistent ? specific_minor(md, minor) : next_free_minor(md, &minor);
    785 if (r < 0)
    786 @@ -875,6 +891,10 @@ static struct mapped_device *alloc_dev(u
    787 if (!md->disk)
    788 goto bad4;
    789
    790 + atomic_set(&md->pending, 0);
    791 + init_waitqueue_head(&md->wait);
    792 + init_waitqueue_head(&md->eventq);
    793 +
    794 md->disk->major = _major;
    795 md->disk->first_minor = minor;
    796 md->disk->fops = &dm_blk_dops;
    797 @@ -884,9 +904,12 @@ static struct mapped_device *alloc_dev(u
    798 add_disk(md->disk);
    799 format_dev_t(md->name, MKDEV(_major, minor));
    800
    801 - atomic_set(&md->pending, 0);
    802 - init_waitqueue_head(&md->wait);
    803 - init_waitqueue_head(&md->eventq);
    804 + /* Populate the mapping, nobody knows we exist yet */
    805 + spin_lock(&_minor_lock);
    806 + old_md = idr_replace(&_minor_idr, md, minor);
    807 + spin_unlock(&_minor_lock);
    808 +
    809 + BUG_ON(old_md != MINOR_ALLOCED);
    810
    811 return md;
    812
    813 @@ -898,6 +921,8 @@ static struct mapped_device *alloc_dev(u
    814 blk_cleanup_queue(md->queue);
    815 free_minor(minor);
    816 bad1:
    817 + module_put(THIS_MODULE);
    818 + bad0:
    819 kfree(md);
    820 return NULL;
    821 }
    822 @@ -914,8 +939,14 @@ static void free_dev(struct mapped_devic
    823 mempool_destroy(md->io_pool);
    824 del_gendisk(md->disk);
    825 free_minor(minor);
    826 +
    827 + spin_lock(&_minor_lock);
    828 + md->disk->private_data = NULL;
    829 + spin_unlock(&_minor_lock);
    830 +
    831 put_disk(md->disk);
    832 blk_cleanup_queue(md->queue);
    833 + module_put(THIS_MODULE);
    834 kfree(md);
    835 }
    836
    837 @@ -1015,13 +1046,18 @@ static struct mapped_device *dm_find_md(
    838 if (MAJOR(dev) != _major || minor >= (1 << MINORBITS))
    839 return NULL;
    840
    841 - mutex_lock(&_minor_lock);
    842 + spin_lock(&_minor_lock);
    843
    844 md = idr_find(&_minor_idr, minor);
    845 - if (!md || (dm_disk(md)->first_minor != minor))
    846 + if (md && (md == MINOR_ALLOCED ||
    847 + (dm_disk(md)->first_minor != minor) ||
    848 + test_bit(DMF_FREEING, &md->flags))) {
    849 md = NULL;
    850 + goto out;
    851 + }
    852
    853 - mutex_unlock(&_minor_lock);
    854 +out:
    855 + spin_unlock(&_minor_lock);
    856
    857 return md;
    858 }
    859 @@ -1055,8 +1091,13 @@ void dm_put(struct mapped_device *md)
    860 {
    861 struct dm_table *map;
    862
    863 - if (atomic_dec_and_test(&md->holders)) {
    864 + BUG_ON(test_bit(DMF_FREEING, &md->flags));
    865 +
    866 + if (atomic_dec_and_lock(&md->holders, &_minor_lock)) {
    867 map = dm_get_table(md);
    868 + idr_replace(&_minor_idr, MINOR_ALLOCED, dm_disk(md)->first_minor);
    869 + set_bit(DMF_FREEING, &md->flags);
    870 + spin_unlock(&_minor_lock);
    871 if (!dm_suspended(md)) {
    872 dm_table_presuspend_targets(map);
    873 dm_table_postsuspend_targets(map);
    874 diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
    875 index 72ca553..cc66193 100644
    876 --- a/drivers/net/sky2.c
    877 +++ b/drivers/net/sky2.c
    878 @@ -51,7 +51,7 @@ #endif
    879 #include "sky2.h"
    880
    881 #define DRV_NAME "sky2"
    882 -#define DRV_VERSION "1.4"
    883 +#define DRV_VERSION "1.6.1"
    884 #define PFX DRV_NAME " "
    885
    886 /*
    887 @@ -321,7 +321,7 @@ static void sky2_phy_init(struct sky2_hw
    888 }
    889
    890 ctrl = gm_phy_read(hw, port, PHY_MARV_PHY_CTRL);
    891 - if (hw->copper) {
    892 + if (sky2_is_copper(hw)) {
    893 if (hw->chip_id == CHIP_ID_YUKON_FE) {
    894 /* enable automatic crossover */
    895 ctrl |= PHY_M_PC_MDI_XMODE(PHY_M_PC_ENA_AUTO) >> 1;
    896 @@ -338,25 +338,37 @@ static void sky2_phy_init(struct sky2_hw
    897 ctrl |= PHY_M_PC_DSC(2) | PHY_M_PC_DOWN_S_ENA;
    898 }
    899 }
    900 - gm_phy_write(hw, port, PHY_MARV_PHY_CTRL, ctrl);
    901 } else {
    902 /* workaround for deviation #4.88 (CRC errors) */
    903 /* disable Automatic Crossover */
    904
    905 ctrl &= ~PHY_M_PC_MDIX_MSK;
    906 - gm_phy_write(hw, port, PHY_MARV_PHY_CTRL, ctrl);
    907 + }
    908
    909 - if (hw->chip_id == CHIP_ID_YUKON_XL) {
    910 - /* Fiber: select 1000BASE-X only mode MAC Specific Ctrl Reg. */
    911 - gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 2);
    912 - ctrl = gm_phy_read(hw, port, PHY_MARV_PHY_CTRL);
    913 - ctrl &= ~PHY_M_MAC_MD_MSK;
    914 - ctrl |= PHY_M_MAC_MODE_SEL(PHY_M_MAC_MD_1000BX);
    915 - gm_phy_write(hw, port, PHY_MARV_PHY_CTRL, ctrl);
    916 + gm_phy_write(hw, port, PHY_MARV_PHY_CTRL, ctrl);
    917 +
    918 + /* special setup for PHY 88E1112 Fiber */
    919 + if (hw->chip_id == CHIP_ID_YUKON_XL && !sky2_is_copper(hw)) {
    920 + pg = gm_phy_read(hw, port, PHY_MARV_EXT_ADR);
    921 +
    922 + /* Fiber: select 1000BASE-X only mode MAC Specific Ctrl Reg. */
    923 + gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 2);
    924 + ctrl = gm_phy_read(hw, port, PHY_MARV_PHY_CTRL);
    925 + ctrl &= ~PHY_M_MAC_MD_MSK;
    926 + ctrl |= PHY_M_MAC_MODE_SEL(PHY_M_MAC_MD_1000BX);
    927 + gm_phy_write(hw, port, PHY_MARV_PHY_CTRL, ctrl);
    928
    929 + if (hw->pmd_type == 'P') {
    930 /* select page 1 to access Fiber registers */
    931 gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 1);
    932 +
    933 + /* for SFP-module set SIGDET polarity to low */
    934 + ctrl = gm_phy_read(hw, port, PHY_MARV_PHY_CTRL);
    935 + ctrl |= PHY_M_FIB_SIGD_POL;
    936 + gm_phy_write(hw, port, PHY_MARV_CTRL, ctrl);
    937 }
    938 +
    939 + gm_phy_write(hw, port, PHY_MARV_EXT_ADR, pg);
    940 }
    941
    942 ctrl = gm_phy_read(hw, port, PHY_MARV_CTRL);
    943 @@ -373,7 +385,7 @@ static void sky2_phy_init(struct sky2_hw
    944 adv = PHY_AN_CSMA;
    945
    946 if (sky2->autoneg == AUTONEG_ENABLE) {
    947 - if (hw->copper) {
    948 + if (sky2_is_copper(hw)) {
    949 if (sky2->advertising & ADVERTISED_1000baseT_Full)
    950 ct1000 |= PHY_M_1000C_AFD;
    951 if (sky2->advertising & ADVERTISED_1000baseT_Half)
    952 @@ -386,8 +398,12 @@ static void sky2_phy_init(struct sky2_hw
    953 adv |= PHY_M_AN_10_FD;
    954 if (sky2->advertising & ADVERTISED_10baseT_Half)
    955 adv |= PHY_M_AN_10_HD;
    956 - } else /* special defines for FIBER (88E1011S only) */
    957 - adv |= PHY_M_AN_1000X_AHD | PHY_M_AN_1000X_AFD;
    958 + } else { /* special defines for FIBER (88E1040S only) */
    959 + if (sky2->advertising & ADVERTISED_1000baseT_Full)
    960 + adv |= PHY_M_AN_1000X_AFD;
    961 + if (sky2->advertising & ADVERTISED_1000baseT_Half)
    962 + adv |= PHY_M_AN_1000X_AHD;
    963 + }
    964
    965 /* Set Flow-control capabilities */
    966 if (sky2->tx_pause && sky2->rx_pause)
    967 @@ -949,14 +965,14 @@ #endif
    968 /*
    969 * It appears the hardware has a bug in the FIFO logic that
    970 * cause it to hang if the FIFO gets overrun and the receive buffer
    971 - * is not aligned. ALso alloc_skb() won't align properly if slab
    972 + * is not aligned. Also dev_alloc_skb() won't align properly if slab
    973 * debugging is enabled.
    974 */
    975 static inline struct sk_buff *sky2_alloc_skb(unsigned int size, gfp_t gfp_mask)
    976 {
    977 struct sk_buff *skb;
    978
    979 - skb = alloc_skb(size + RX_SKB_ALIGN, gfp_mask);
    980 + skb = __dev_alloc_skb(size + RX_SKB_ALIGN, gfp_mask);
    981 if (likely(skb)) {
    982 unsigned long p = (unsigned long) skb->data;
    983 skb_reserve(skb, ALIGN(p, RX_SKB_ALIGN) - p);
    984 @@ -1497,7 +1513,7 @@ static int sky2_down(struct net_device *
    985
    986 static u16 sky2_phy_speed(const struct sky2_hw *hw, u16 aux)
    987 {
    988 - if (!hw->copper)
    989 + if (!sky2_is_copper(hw))
    990 return SPEED_1000;
    991
    992 if (hw->chip_id == CHIP_ID_YUKON_FE)
    993 @@ -1855,7 +1871,7 @@ static struct sk_buff *sky2_receive(stru
    994 goto oversize;
    995
    996 if (length < copybreak) {
    997 - skb = alloc_skb(length + 2, GFP_ATOMIC);
    998 + skb = dev_alloc_skb(length + 2);
    999 if (!skb)
    1000 goto resubmit;
    1001
    1002 @@ -2016,6 +2032,9 @@ #endif
    1003 }
    1004 }
    1005
    1006 + /* Fully processed status ring so clear irq */
    1007 + sky2_write32(hw, STAT_CTRL, SC_STAT_CLR_IRQ);
    1008 +
    1009 exit_loop:
    1010 return work_done;
    1011 }
    1012 @@ -2218,9 +2237,6 @@ static int sky2_poll(struct net_device *
    1013 *budget -= work_done;
    1014 dev0->quota -= work_done;
    1015
    1016 - if (status & Y2_IS_STAT_BMU)
    1017 - sky2_write32(hw, STAT_CTRL, SC_STAT_CLR_IRQ);
    1018 -
    1019 if (sky2_more_work(hw))
    1020 return 1;
    1021
    1022 @@ -2287,7 +2303,7 @@ static inline u32 sky2_clk2us(const stru
    1023 static int __devinit sky2_reset(struct sky2_hw *hw)
    1024 {
    1025 u16 status;
    1026 - u8 t8, pmd_type;
    1027 + u8 t8;
    1028 int i;
    1029
    1030 sky2_write8(hw, B0_CTST, CS_RST_CLR);
    1031 @@ -2333,9 +2349,7 @@ static int __devinit sky2_reset(struct s
    1032 sky2_pci_write32(hw, PEX_UNC_ERR_STAT, 0xffffffffUL);
    1033
    1034
    1035 - pmd_type = sky2_read8(hw, B2_PMD_TYP);
    1036 - hw->copper = !(pmd_type == 'L' || pmd_type == 'S');
    1037 -
    1038 + hw->pmd_type = sky2_read8(hw, B2_PMD_TYP);
    1039 hw->ports = 1;
    1040 t8 = sky2_read8(hw, B2_Y2_HW_RES);
    1041 if ((t8 & CFG_DUAL_MAC_MSK) == CFG_DUAL_MAC_MSK) {
    1042 @@ -2432,21 +2446,22 @@ static int __devinit sky2_reset(struct s
    1043
    1044 static u32 sky2_supported_modes(const struct sky2_hw *hw)
    1045 {
    1046 - u32 modes;
    1047 - if (hw->copper) {
    1048 - modes = SUPPORTED_10baseT_Half
    1049 - | SUPPORTED_10baseT_Full
    1050 - | SUPPORTED_100baseT_Half
    1051 - | SUPPORTED_100baseT_Full
    1052 - | SUPPORTED_Autoneg | SUPPORTED_TP;
    1053 + if (sky2_is_copper(hw)) {
    1054 + u32 modes = SUPPORTED_10baseT_Half
    1055 + | SUPPORTED_10baseT_Full
    1056 + | SUPPORTED_100baseT_Half
    1057 + | SUPPORTED_100baseT_Full
    1058 + | SUPPORTED_Autoneg | SUPPORTED_TP;
    1059
    1060 if (hw->chip_id != CHIP_ID_YUKON_FE)
    1061 modes |= SUPPORTED_1000baseT_Half
    1062 - | SUPPORTED_1000baseT_Full;
    1063 + | SUPPORTED_1000baseT_Full;
    1064 + return modes;
    1065 } else
    1066 - modes = SUPPORTED_1000baseT_Full | SUPPORTED_FIBRE
    1067 - | SUPPORTED_Autoneg;
    1068 - return modes;
    1069 + return SUPPORTED_1000baseT_Half
    1070 + | SUPPORTED_1000baseT_Full
    1071 + | SUPPORTED_Autoneg
    1072 + | SUPPORTED_FIBRE;
    1073 }
    1074
    1075 static int sky2_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
    1076 @@ -2457,7 +2472,7 @@ static int sky2_get_settings(struct net_
    1077 ecmd->transceiver = XCVR_INTERNAL;
    1078 ecmd->supported = sky2_supported_modes(hw);
    1079 ecmd->phy_address = PHY_ADDR_MARV;
    1080 - if (hw->copper) {
    1081 + if (sky2_is_copper(hw)) {
    1082 ecmd->supported = SUPPORTED_10baseT_Half
    1083 | SUPPORTED_10baseT_Full
    1084 | SUPPORTED_100baseT_Half
    1085 @@ -2466,12 +2481,14 @@ static int sky2_get_settings(struct net_
    1086 | SUPPORTED_1000baseT_Full
    1087 | SUPPORTED_Autoneg | SUPPORTED_TP;
    1088 ecmd->port = PORT_TP;
    1089 - } else
    1090 + ecmd->speed = sky2->speed;
    1091 + } else {
    1092 + ecmd->speed = SPEED_1000;
    1093 ecmd->port = PORT_FIBRE;
    1094 + }
    1095
    1096 ecmd->advertising = sky2->advertising;
    1097 ecmd->autoneg = sky2->autoneg;
    1098 - ecmd->speed = sky2->speed;
    1099 ecmd->duplex = sky2->duplex;
    1100 return 0;
    1101 }
    1102 @@ -3184,6 +3201,8 @@ static int __devinit sky2_test_msi(struc
    1103 struct pci_dev *pdev = hw->pdev;
    1104 int err;
    1105
    1106 + init_waitqueue_head (&hw->msi_wait);
    1107 +
    1108 sky2_write32(hw, B0_IMSK, Y2_IS_IRQ_SW);
    1109
    1110 err = request_irq(pdev->irq, sky2_test_intr, SA_SHIRQ, DRV_NAME, hw);
    1111 @@ -3193,10 +3212,8 @@ static int __devinit sky2_test_msi(struc
    1112 return err;
    1113 }
    1114
    1115 - init_waitqueue_head (&hw->msi_wait);
    1116 -
    1117 sky2_write8(hw, B0_CTST, CS_ST_SW_IRQ);
    1118 - wmb();
    1119 + sky2_read8(hw, B0_CTST);
    1120
    1121 wait_event_timeout(hw->msi_wait, hw->msi_detected, HZ/10);
    1122
    1123 diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
    1124 index 8a0bc55..9516c1f 100644
    1125 --- a/drivers/net/sky2.h
    1126 +++ b/drivers/net/sky2.h
    1127 @@ -1318,6 +1318,14 @@ enum {
    1128 };
    1129
    1130 /* for Yukon-2 Gigabit Ethernet PHY (88E1112 only) */
    1131 +/***** PHY_MARV_PHY_CTRL (page 1) 16 bit r/w Fiber Specific Ctrl *****/
    1132 +enum {
    1133 + PHY_M_FIB_FORCE_LNK = 1<<10,/* Force Link Good */
    1134 + PHY_M_FIB_SIGD_POL = 1<<9, /* SIGDET Polarity */
    1135 + PHY_M_FIB_TX_DIS = 1<<3, /* Transmitter Disable */
    1136 +};
    1137 +
    1138 +/* for Yukon-2 Gigabit Ethernet PHY (88E1112 only) */
    1139 /***** PHY_MARV_PHY_CTRL (page 2) 16 bit r/w MAC Specific Ctrl *****/
    1140 enum {
    1141 PHY_M_MAC_MD_MSK = 7<<7, /* Bit 9.. 7: Mode Select Mask */
    1142 @@ -1566,7 +1574,7 @@ enum {
    1143
    1144 GMR_FS_ANY_ERR = GMR_FS_RX_FF_OV | GMR_FS_CRC_ERR |
    1145 GMR_FS_FRAGMENT | GMR_FS_LONG_ERR |
    1146 - GMR_FS_MII_ERR | GMR_FS_BAD_FC | GMR_FS_GOOD_FC |
    1147 + GMR_FS_MII_ERR | GMR_FS_BAD_FC |
    1148 GMR_FS_UN_SIZE | GMR_FS_JABBER,
    1149 };
    1150
    1151 @@ -1879,7 +1887,7 @@ struct sky2_hw {
    1152 int pm_cap;
    1153 u8 chip_id;
    1154 u8 chip_rev;
    1155 - u8 copper;
    1156 + u8 pmd_type;
    1157 u8 ports;
    1158
    1159 struct sky2_status_le *st_le;
    1160 @@ -1891,6 +1899,11 @@ struct sky2_hw {
    1161 wait_queue_head_t msi_wait;
    1162 };
    1163
    1164 +static inline int sky2_is_copper(const struct sky2_hw *hw)
    1165 +{
    1166 + return !(hw->pmd_type == 'L' || hw->pmd_type == 'S' || hw->pmd_type == 'P');
    1167 +}
    1168 +
    1169 /* Register accessor for memory mapped device */
    1170 static inline u32 sky2_read32(const struct sky2_hw *hw, unsigned reg)
    1171 {
    1172 diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
    1173 index 862c226..38b605d 100644
    1174 --- a/drivers/net/tg3.c
    1175 +++ b/drivers/net/tg3.c
    1176 @@ -69,8 +69,8 @@ #include "tg3.h"
    1177
    1178 #define DRV_MODULE_NAME "tg3"
    1179 #define PFX DRV_MODULE_NAME ": "
    1180 -#define DRV_MODULE_VERSION "3.59"
    1181 -#define DRV_MODULE_RELDATE "June 8, 2006"
    1182 +#define DRV_MODULE_VERSION "3.59.1"
    1183 +#define DRV_MODULE_RELDATE "August 25, 2006"
    1184
    1185 #define TG3_DEF_MAC_MODE 0
    1186 #define TG3_DEF_RX_MODE 0
    1187 @@ -11381,11 +11381,15 @@ #if TG3_TSO_SUPPORT != 0
    1188 tp->tg3_flags2 |= TG3_FLG2_TSO_CAPABLE;
    1189 }
    1190
    1191 - /* TSO is on by default on chips that support hardware TSO.
    1192 + /* TSO is on by default on chips that support HW_TSO_2.
    1193 + * Some HW_TSO_1 capable chips have bugs that can lead to
    1194 + * tx timeouts in some cases when TSO is enabled.
    1195 * Firmware TSO on older chips gives lower performance, so it
    1196 * is off by default, but can be enabled using ethtool.
    1197 */
    1198 - if (tp->tg3_flags2 & TG3_FLG2_HW_TSO)
    1199 + if ((tp->tg3_flags2 & TG3_FLG2_HW_TSO_2) ||
    1200 + (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5750 &&
    1201 + tp->pci_chip_rev_id >= CHIPREV_ID_5750_C2))
    1202 dev->features |= NETIF_F_TSO;
    1203
    1204 #endif
    1205 diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
    1206 index ff0faab..cd68f46 100644
    1207 --- a/drivers/net/tg3.h
    1208 +++ b/drivers/net/tg3.h
    1209 @@ -125,6 +125,7 @@ #define CHIPREV_ID_5705_A3 0x3003
    1210 #define CHIPREV_ID_5750_A0 0x4000
    1211 #define CHIPREV_ID_5750_A1 0x4001
    1212 #define CHIPREV_ID_5750_A3 0x4003
    1213 +#define CHIPREV_ID_5750_C2 0x4202
    1214 #define CHIPREV_ID_5752_A0_HW 0x5000
    1215 #define CHIPREV_ID_5752_A0 0x6000
    1216 #define CHIPREV_ID_5752_A1 0x6001
    1217 diff --git a/drivers/net/wireless/spectrum_cs.c b/drivers/net/wireless/spectrum_cs.c
    1218 index f7b77ce..54fe4e4 100644
    1219 --- a/drivers/net/wireless/spectrum_cs.c
    1220 +++ b/drivers/net/wireless/spectrum_cs.c
    1221 @@ -245,7 +245,7 @@ spectrum_reset(struct pcmcia_device *lin
    1222 u_int save_cor;
    1223
    1224 /* Doing it if hardware is gone is guaranteed crash */
    1225 - if (pcmcia_dev_present(link))
    1226 + if (!pcmcia_dev_present(link))
    1227 return -ENODEV;
    1228
    1229 /* Save original COR value */
    1230 diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
    1231 index 27909bc..5f44354 100644
    1232 --- a/drivers/usb/host/uhci-q.c
    1233 +++ b/drivers/usb/host/uhci-q.c
    1234 @@ -264,7 +264,7 @@ static void uhci_fixup_toggles(struct uh
    1235 * need to change any toggles in this URB */
    1236 td = list_entry(urbp->td_list.next, struct uhci_td, list);
    1237 if (toggle > 1 || uhci_toggle(td_token(td)) == toggle) {
    1238 - td = list_entry(urbp->td_list.next, struct uhci_td,
    1239 + td = list_entry(urbp->td_list.prev, struct uhci_td,
    1240 list);
    1241 toggle = uhci_toggle(td_token(td)) ^ 1;
    1242
    1243 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
    1244 index 537893a..997a202 100644
    1245 --- a/fs/binfmt_elf.c
    1246 +++ b/fs/binfmt_elf.c
    1247 @@ -86,7 +86,7 @@ static struct linux_binfmt elf_format =
    1248 .min_coredump = ELF_EXEC_PAGESIZE
    1249 };
    1250
    1251 -#define BAD_ADDR(x) ((unsigned long)(x) > TASK_SIZE)
    1252 +#define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
    1253
    1254 static int set_brk(unsigned long start, unsigned long end)
    1255 {
    1256 @@ -389,7 +389,7 @@ static unsigned long load_elf_interp(str
    1257 * <= p_memsize so it is only necessary to check p_memsz.
    1258 */
    1259 k = load_addr + eppnt->p_vaddr;
    1260 - if (k > TASK_SIZE || eppnt->p_filesz > eppnt->p_memsz ||
    1261 + if (BAD_ADDR(k) || eppnt->p_filesz > eppnt->p_memsz ||
    1262 eppnt->p_memsz > TASK_SIZE || TASK_SIZE - eppnt->p_memsz < k) {
    1263 error = -ENOMEM;
    1264 goto out_close;
    1265 @@ -876,7 +876,7 @@ static int load_elf_binary(struct linux_
    1266 * allowed task size. Note that p_filesz must always be
    1267 * <= p_memsz so it is only necessary to check p_memsz.
    1268 */
    1269 - if (k > TASK_SIZE || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
    1270 + if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
    1271 elf_ppnt->p_memsz > TASK_SIZE ||
    1272 TASK_SIZE - elf_ppnt->p_memsz < k) {
    1273 /* set_brk can never work. Avoid overflows. */
    1274 @@ -930,10 +930,9 @@ static int load_elf_binary(struct linux_
    1275 interpreter,
    1276 &interp_load_addr);
    1277 if (BAD_ADDR(elf_entry)) {
    1278 - printk(KERN_ERR "Unable to load interpreter %.128s\n",
    1279 - elf_interpreter);
    1280 force_sig(SIGSEGV, current);
    1281 - retval = -ENOEXEC; /* Nobody gets to see this, but.. */
    1282 + retval = IS_ERR((void *)elf_entry) ?
    1283 + (int)elf_entry : -EINVAL;
    1284 goto out_free_dentry;
    1285 }
    1286 reloc_func_desc = interp_load_addr;
    1287 @@ -944,8 +943,8 @@ static int load_elf_binary(struct linux_
    1288 } else {
    1289 elf_entry = loc->elf_ex.e_entry;
    1290 if (BAD_ADDR(elf_entry)) {
    1291 - send_sig(SIGSEGV, current, 0);
    1292 - retval = -ENOEXEC; /* Nobody gets to see this, but.. */
    1293 + force_sig(SIGSEGV, current);
    1294 + retval = -EINVAL;
    1295 goto out_free_dentry;
    1296 }
    1297 }
    1298 diff --git a/fs/ext2/super.c b/fs/ext2/super.c
    1299 index 7e30bae..e51d1a8 100644
    1300 --- a/fs/ext2/super.c
    1301 +++ b/fs/ext2/super.c
    1302 @@ -252,6 +252,46 @@ #ifdef CONFIG_QUOTA
    1303 #endif
    1304 };
    1305
    1306 +static struct dentry *ext2_get_dentry(struct super_block *sb, void *vobjp)
    1307 +{
    1308 + __u32 *objp = vobjp;
    1309 + unsigned long ino = objp[0];
    1310 + __u32 generation = objp[1];
    1311 + struct inode *inode;
    1312 + struct dentry *result;
    1313 +
    1314 + if (ino != EXT2_ROOT_INO && ino < EXT2_FIRST_INO(sb))
    1315 + return ERR_PTR(-ESTALE);
    1316 + if (ino > le32_to_cpu(EXT2_SB(sb)->s_es->s_inodes_count))
    1317 + return ERR_PTR(-ESTALE);
    1318 +
    1319 + /* iget isn't really right if the inode is currently unallocated!!
    1320 + * ext2_read_inode currently does appropriate checks, but
    1321 + * it might be "neater" to call ext2_get_inode first and check
    1322 + * if the inode is valid.....
    1323 + */
    1324 + inode = iget(sb, ino);
    1325 + if (inode == NULL)
    1326 + return ERR_PTR(-ENOMEM);
    1327 + if (is_bad_inode(inode)
    1328 + || (generation && inode->i_generation != generation)
    1329 + ) {
    1330 + /* we didn't find the right inode.. */
    1331 + iput(inode);
    1332 + return ERR_PTR(-ESTALE);
    1333 + }
    1334 + /* now to find a dentry.
    1335 + * If possible, get a well-connected one
    1336 + */
    1337 + result = d_alloc_anon(inode);
    1338 + if (!result) {
    1339 + iput(inode);
    1340 + return ERR_PTR(-ENOMEM);
    1341 + }
    1342 + return result;
    1343 +}
    1344 +
    1345 +
    1346 /* Yes, most of these are left as NULL!!
    1347 * A NULL value implies the default, which works with ext2-like file
    1348 * systems, but can be improved upon.
    1349 @@ -259,6 +299,7 @@ #endif
    1350 */
    1351 static struct export_operations ext2_export_ops = {
    1352 .get_parent = ext2_get_parent,
    1353 + .get_dentry = ext2_get_dentry,
    1354 };
    1355
    1356 static unsigned long get_sb_block(void **data)
    1357 diff --git a/fs/locks.c b/fs/locks.c
    1358 index ab61a8b..529a0ed 100644
    1359 --- a/fs/locks.c
    1360 +++ b/fs/locks.c
    1361 @@ -1389,8 +1389,9 @@ static int __setlease(struct file *filp,
    1362 if (!leases_enable)
    1363 goto out;
    1364
    1365 - error = lease_alloc(filp, arg, &fl);
    1366 - if (error)
    1367 + error = -ENOMEM;
    1368 + fl = locks_alloc_lock();
    1369 + if (fl == NULL)
    1370 goto out;
    1371
    1372 locks_copy_lock(fl, lease);
    1373 @@ -1398,6 +1399,7 @@ static int __setlease(struct file *filp,
    1374 locks_insert_lock(before, fl);
    1375
    1376 *flp = fl;
    1377 + error = 0;
    1378 out:
    1379 return error;
    1380 }
    1381 diff --git a/include/asm-ia64/mman.h b/include/asm-ia64/mman.h
    1382 index df1b20e..b242f95 100644
    1383 --- a/include/asm-ia64/mman.h
    1384 +++ b/include/asm-ia64/mman.h
    1385 @@ -9,10 +9,12 @@ #define _ASM_IA64_MMAN_H
    1386 */
    1387
    1388 #ifdef __KERNEL__
    1389 +#ifndef __ASSEMBLY__
    1390 #define arch_mmap_check ia64_map_check_rgn
    1391 int ia64_map_check_rgn(unsigned long addr, unsigned long len,
    1392 unsigned long flags);
    1393 #endif
    1394 +#endif
    1395
    1396 #include <asm-generic/mman.h>
    1397
    1398 diff --git a/include/asm-ia64/sn/xp.h b/include/asm-ia64/sn/xp.h
    1399 index 9bd2f9b..6f807e0 100644
    1400 --- a/include/asm-ia64/sn/xp.h
    1401 +++ b/include/asm-ia64/sn/xp.h
    1402 @@ -60,23 +60,37 @@ #define XP_NASID_MASK_WORDS ((XP_MAX_PHY
    1403 * the bte_copy() once in the hope that the failure was due to a temporary
    1404 * aberration (i.e., the link going down temporarily).
    1405 *
    1406 - * See bte_copy for definition of the input parameters.
    1407 + * src - physical address of the source of the transfer.
    1408 + * vdst - virtual address of the destination of the transfer.
    1409 + * len - number of bytes to transfer from source to destination.
    1410 + * mode - see bte_copy() for definition.
    1411 + * notification - see bte_copy() for definition.
    1412 *
    1413 * Note: xp_bte_copy() should never be called while holding a spinlock.
    1414 */
    1415 static inline bte_result_t
    1416 -xp_bte_copy(u64 src, u64 dest, u64 len, u64 mode, void *notification)
    1417 +xp_bte_copy(u64 src, u64 vdst, u64 len, u64 mode, void *notification)
    1418 {
    1419 bte_result_t ret;
    1420 + u64 pdst = ia64_tpa(vdst);
    1421
    1422
    1423 - ret = bte_copy(src, dest, len, mode, notification);
    1424 + /*
    1425 + * Ensure that the physically mapped memory is contiguous.
    1426 + *
    1427 + * We do this by ensuring that the memory is from region 7 only.
    1428 + * If the need should arise to use memory from one of the other
    1429 + * regions, then modify the BUG_ON() statement to ensure that the
    1430 + * memory from that region is always physically contiguous.
    1431 + */
    1432 + BUG_ON(REGION_NUMBER(vdst) != RGN_KERNEL);
    1433
    1434 + ret = bte_copy(src, pdst, len, mode, notification);
    1435 if (ret != BTE_SUCCESS) {
    1436 if (!in_interrupt()) {
    1437 cond_resched();
    1438 }
    1439 - ret = bte_copy(src, dest, len, mode, notification);
    1440 + ret = bte_copy(src, pdst, len, mode, notification);
    1441 }
    1442
    1443 return ret;
    1444 diff --git a/include/asm-ia64/sn/xpc.h b/include/asm-ia64/sn/xpc.h
    1445 index aa3b8ac..b454ad4 100644
    1446 --- a/include/asm-ia64/sn/xpc.h
    1447 +++ b/include/asm-ia64/sn/xpc.h
    1448 @@ -684,7 +684,9 @@ extern struct xpc_vars *xpc_vars;
    1449 extern struct xpc_rsvd_page *xpc_rsvd_page;
    1450 extern struct xpc_vars_part *xpc_vars_part;
    1451 extern struct xpc_partition xpc_partitions[XP_MAX_PARTITIONS + 1];
    1452 -extern char xpc_remote_copy_buffer[];
    1453 +extern char *xpc_remote_copy_buffer;
    1454 +extern void *xpc_remote_copy_buffer_base;
    1455 +extern void *xpc_kmalloc_cacheline_aligned(size_t, gfp_t, void **);
    1456 extern struct xpc_rsvd_page *xpc_rsvd_page_init(void);
    1457 extern void xpc_allow_IPI_ops(void);
    1458 extern void xpc_restrict_IPI_ops(void);
    1459 diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
    1460 index a75b84b..178a97e 100644
    1461 --- a/include/linux/netfilter_bridge.h
    1462 +++ b/include/linux/netfilter_bridge.h
    1463 @@ -47,18 +47,26 @@ #define BRNF_DONT_TAKE_PARENT 0x04
    1464 #define BRNF_BRIDGED 0x08
    1465 #define BRNF_NF_BRIDGE_PREROUTING 0x10
    1466
    1467 -
    1468 /* Only used in br_forward.c */
    1469 -static inline
    1470 -void nf_bridge_maybe_copy_header(struct sk_buff *skb)
    1471 +static inline int nf_bridge_maybe_copy_header(struct sk_buff *skb)
    1472 {
    1473 + int err;
    1474 +
    1475 if (skb->nf_bridge) {
    1476 if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
    1477 + err = skb_cow(skb, 18);
    1478 + if (err)
    1479 + return err;
    1480 memcpy(skb->data - 18, skb->nf_bridge->data, 18);
    1481 skb_push(skb, 4);
    1482 - } else
    1483 + } else {
    1484 + err = skb_cow(skb, 16);
    1485 + if (err)
    1486 + return err;
    1487 memcpy(skb->data - 16, skb->nf_bridge->data, 16);
    1488 + }
    1489 }
    1490 + return 0;
    1491 }
    1492
    1493 /* This is called by the IP fragmenting code and it ensures there is
    1494 diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
    1495 index 2c31bb0..a1ce843 100644
    1496 --- a/include/linux/skbuff.h
    1497 +++ b/include/linux/skbuff.h
    1498 @@ -1009,6 +1009,21 @@ static inline int pskb_trim(struct sk_bu
    1499 }
    1500
    1501 /**
    1502 + * pskb_trim_unique - remove end from a paged unique (not cloned) buffer
    1503 + * @skb: buffer to alter
    1504 + * @len: new length
    1505 + *
    1506 + * This is identical to pskb_trim except that the caller knows that
    1507 + * the skb is not cloned so we should never get an error due to out-
    1508 + * of-memory.
    1509 + */
    1510 +static inline void pskb_trim_unique(struct sk_buff *skb, unsigned int len)
    1511 +{
    1512 + int err = pskb_trim(skb, len);
    1513 + BUG_ON(err);
    1514 +}
    1515 +
    1516 +/**
    1517 * skb_orphan - orphan a buffer
    1518 * @skb: buffer to orphan
    1519 *
    1520 diff --git a/kernel/futex.c b/kernel/futex.c
    1521 index 5699c51..225af28 100644
    1522 --- a/kernel/futex.c
    1523 +++ b/kernel/futex.c
    1524 @@ -593,6 +593,7 @@ static int unqueue_me(struct futex_q *q)
    1525 /* In the common case we don't take the spinlock, which is nice. */
    1526 retry:
    1527 lock_ptr = q->lock_ptr;
    1528 + barrier();
    1529 if (lock_ptr != 0) {
    1530 spin_lock(lock_ptr);
    1531 /*
    1532 diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
    1533 index dcfb5d7..51cacd1 100644
    1534 --- a/kernel/stop_machine.c
    1535 +++ b/kernel/stop_machine.c
    1536 @@ -111,7 +111,6 @@ static int stop_machine(void)
    1537 /* If some failed, kill them all. */
    1538 if (ret < 0) {
    1539 stopmachine_set_state(STOPMACHINE_EXIT);
    1540 - up(&stopmachine_mutex);
    1541 return ret;
    1542 }
    1543
    1544 diff --git a/lib/ts_bm.c b/lib/ts_bm.c
    1545 index c4c1ac5..7917265 100644
    1546 --- a/lib/ts_bm.c
    1547 +++ b/lib/ts_bm.c
    1548 @@ -112,15 +112,14 @@ static int subpattern(u8 *pattern, int i
    1549 return ret;
    1550 }
    1551
    1552 -static void compute_prefix_tbl(struct ts_bm *bm, const u8 *pattern,
    1553 - unsigned int len)
    1554 +static void compute_prefix_tbl(struct ts_bm *bm)
    1555 {
    1556 int i, j, g;
    1557
    1558 for (i = 0; i < ASIZE; i++)
    1559 - bm->bad_shift[i] = len;
    1560 - for (i = 0; i < len - 1; i++)
    1561 - bm->bad_shift[pattern[i]] = len - 1 - i;
    1562 + bm->bad_shift[i] = bm->patlen;
    1563 + for (i = 0; i < bm->patlen - 1; i++)
    1564 + bm->bad_shift[bm->pattern[i]] = bm->patlen - 1 - i;
    1565
    1566 /* Compute the good shift array, used to match reocurrences
    1567 * of a subpattern */
    1568 @@ -151,8 +150,8 @@ static struct ts_config *bm_init(const v
    1569 bm = ts_config_priv(conf);
    1570 bm->patlen = len;
    1571 bm->pattern = (u8 *) bm->good_shift + prefix_tbl_len;
    1572 - compute_prefix_tbl(bm, pattern, len);
    1573 memcpy(bm->pattern, pattern, len);
    1574 + compute_prefix_tbl(bm);
    1575
    1576 return conf;
    1577 }
    1578 diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
    1579 index 56f3aa4..ddb7e1c 100644
    1580 --- a/net/bridge/br_forward.c
    1581 +++ b/net/bridge/br_forward.c
    1582 @@ -43,11 +43,15 @@ int br_dev_queue_push_xmit(struct sk_buf
    1583 else {
    1584 #ifdef CONFIG_BRIDGE_NETFILTER
    1585 /* ip_refrag calls ip_fragment, doesn't copy the MAC header. */
    1586 - nf_bridge_maybe_copy_header(skb);
    1587 + if (nf_bridge_maybe_copy_header(skb))
    1588 + kfree_skb(skb);
    1589 + else
    1590 #endif
    1591 - skb_push(skb, ETH_HLEN);
    1592 + {
    1593 + skb_push(skb, ETH_HLEN);
    1594
    1595 - dev_queue_xmit(skb);
    1596 + dev_queue_xmit(skb);
    1597 + }
    1598 }
    1599
    1600 return 0;
    1601 diff --git a/net/core/pktgen.c b/net/core/pktgen.c
    1602 index c23e9c0..b916b7f 100644
    1603 --- a/net/core/pktgen.c
    1604 +++ b/net/core/pktgen.c
    1605 @@ -2149,6 +2149,8 @@ static struct sk_buff *fill_packet_ipv4(
    1606 skb->mac.raw = ((u8 *) iph) - 14 - pkt_dev->nr_labels*sizeof(u32);
    1607 skb->dev = odev;
    1608 skb->pkt_type = PACKET_HOST;
    1609 + skb->nh.iph = iph;
    1610 + skb->h.uh = udph;
    1611
    1612 if (pkt_dev->nfrags <= 0)
    1613 pgh = (struct pktgen_hdr *)skb_put(skb, datalen);
    1614 @@ -2460,6 +2462,8 @@ static struct sk_buff *fill_packet_ipv6(
    1615 skb->protocol = protocol;
    1616 skb->dev = odev;
    1617 skb->pkt_type = PACKET_HOST;
    1618 + skb->nh.ipv6h = iph;
    1619 + skb->h.uh = udph;
    1620
    1621 if (pkt_dev->nfrags <= 0)
    1622 pgh = (struct pktgen_hdr *)skb_put(skb, datalen);
    1623 diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
    1624 index cff9c3a..d987a27 100644
    1625 --- a/net/ipv4/ip_output.c
    1626 +++ b/net/ipv4/ip_output.c
    1627 @@ -946,7 +946,7 @@ alloc_new_skb:
    1628 skb_prev->csum = csum_sub(skb_prev->csum,
    1629 skb->csum);
    1630 data += fraggap;
    1631 - skb_trim(skb_prev, maxfraglen);
    1632 + pskb_trim_unique(skb_prev, maxfraglen);
    1633 }
    1634
    1635 copy = datalen - transhdrlen - fraggap;
    1636 @@ -1139,7 +1139,7 @@ ssize_t ip_append_page(struct sock *sk,
    1637 data, fraggap, 0);
    1638 skb_prev->csum = csum_sub(skb_prev->csum,
    1639 skb->csum);
    1640 - skb_trim(skb_prev, maxfraglen);
    1641 + pskb_trim_unique(skb_prev, maxfraglen);
    1642 }
    1643
    1644 /*
    1645 diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    1646 index f33c9dd..e0657b9 100644
    1647 --- a/net/ipv4/tcp_output.c
    1648 +++ b/net/ipv4/tcp_output.c
    1649 @@ -197,6 +197,7 @@ void tcp_select_initial_window(int __spa
    1650 * See RFC1323 for an explanation of the limit to 14
    1651 */
    1652 space = max_t(u32, sysctl_tcp_rmem[2], sysctl_rmem_max);
    1653 + space = min_t(u32, space, *window_clamp);
    1654 while (space > 65535 && (*rcv_wscale) < 14) {
    1655 space >>= 1;
    1656 (*rcv_wscale)++;
    1657 diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
    1658 index a18d425..9ca783d 100644
    1659 --- a/net/ipv6/exthdrs.c
    1660 +++ b/net/ipv6/exthdrs.c
    1661 @@ -635,14 +635,17 @@ ipv6_renew_options(struct sock *sk, stru
    1662 struct ipv6_txoptions *opt2;
    1663 int err;
    1664
    1665 - if (newtype != IPV6_HOPOPTS && opt->hopopt)
    1666 - tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
    1667 - if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
    1668 - tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
    1669 - if (newtype != IPV6_RTHDR && opt->srcrt)
    1670 - tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
    1671 - if (newtype != IPV6_DSTOPTS && opt->dst1opt)
    1672 - tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
    1673 + if (opt) {
    1674 + if (newtype != IPV6_HOPOPTS && opt->hopopt)
    1675 + tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
    1676 + if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
    1677 + tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
    1678 + if (newtype != IPV6_RTHDR && opt->srcrt)
    1679 + tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
    1680 + if (newtype != IPV6_DSTOPTS && opt->dst1opt)
    1681 + tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
    1682 + }
    1683 +
    1684 if (newopt && newoptlen)
    1685 tot_len += CMSG_ALIGN(newoptlen);
    1686
    1687 @@ -659,25 +662,25 @@ ipv6_renew_options(struct sock *sk, stru
    1688 opt2->tot_len = tot_len;
    1689 p = (char *)(opt2 + 1);
    1690
    1691 - err = ipv6_renew_option(opt->hopopt, newopt, newoptlen,
    1692 + err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
    1693 newtype != IPV6_HOPOPTS,
    1694 &opt2->hopopt, &p);
    1695 if (err)
    1696 goto out;
    1697
    1698 - err = ipv6_renew_option(opt->dst0opt, newopt, newoptlen,
    1699 + err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
    1700 newtype != IPV6_RTHDRDSTOPTS,
    1701 &opt2->dst0opt, &p);
    1702 if (err)
    1703 goto out;
    1704
    1705 - err = ipv6_renew_option(opt->srcrt, newopt, newoptlen,
    1706 + err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
    1707 newtype != IPV6_RTHDR,
    1708 - (struct ipv6_opt_hdr **)opt2->srcrt, &p);
    1709 + (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
    1710 if (err)
    1711 goto out;
    1712
    1713 - err = ipv6_renew_option(opt->dst1opt, newopt, newoptlen,
    1714 + err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
    1715 newtype != IPV6_DSTOPTS,
    1716 &opt2->dst1opt, &p);
    1717 if (err)
    1718 diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
    1719 index e460489..56eddb3 100644
    1720 --- a/net/ipv6/ip6_output.c
    1721 +++ b/net/ipv6/ip6_output.c
    1722 @@ -1047,7 +1047,7 @@ alloc_new_skb:
    1723 skb_prev->csum = csum_sub(skb_prev->csum,
    1724 skb->csum);
    1725 data += fraggap;
    1726 - skb_trim(skb_prev, maxfraglen);
    1727 + pskb_trim_unique(skb_prev, maxfraglen);
    1728 }
    1729 copy = datalen - transhdrlen - fraggap;
    1730 if (copy < 0) {
    1731 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
    1732 index 600eb59..5b1c837 100644
    1733 --- a/net/sctp/socket.c
    1734 +++ b/net/sctp/socket.c
    1735 @@ -1246,9 +1246,13 @@ SCTP_STATIC void sctp_close(struct sock
    1736 }
    1737 }
    1738
    1739 - if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime)
    1740 - sctp_primitive_ABORT(asoc, NULL);
    1741 - else
    1742 + if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
    1743 + struct sctp_chunk *chunk;
    1744 +
    1745 + chunk = sctp_make_abort_user(asoc, NULL, 0);
    1746 + if (chunk)
    1747 + sctp_primitive_ABORT(asoc, chunk);
    1748 + } else
    1749 sctp_primitive_SHUTDOWN(asoc, NULL);
    1750 }
    1751