diff --git a/Makefile b/Makefile index 1fa7e53..ea6f2f9 100644 Makefile | 2 arch/i386/kernel/cpu/mtrr/main.c | 8 + arch/ppc64/Kconfig | 11 -- arch/s390/appldata/appldata_base.c | 7 - arch/x86_64/kernel/setup.c | 5 drivers/acpi/scan.c | 2 drivers/acpi/video.c | 2 drivers/block/cciss.c | 7 - drivers/block/cfq-iosched.c | 4 drivers/block/pktcdvd.c | 2 drivers/char/agp/sworks-agp.c | 18 +++ drivers/char/i8k.c | 6 - drivers/char/rtc.c | 65 +++++++----- drivers/char/vt_ioctl.c | 6 + drivers/hwmon/it87.c | 7 + drivers/hwmon/lm78.c | 2 drivers/hwmon/w83627hf.c | 8 + drivers/ide/ide-floppy.c | 6 - drivers/infiniband/core/mad.c | 4 drivers/isdn/hardware/eicon/os_4bri.c | 3 drivers/media/dvb/ttpci/Kconfig | 1 drivers/media/video/cx88/cx88-cards.c | 2 drivers/media/video/saa7134/saa7134-cards.c | 2 drivers/message/i2o/pci.c | 2 drivers/net/bonding/bond_main.c | 32 ++---- drivers/net/bonding/bonding.h | 7 - drivers/net/wan/hdlc_cisco.c | 6 + drivers/net/wan/hdlc_fr.c | 4 drivers/net/wan/hdlc_generic.c | 6 + drivers/net/wireless/airo.c | 2 drivers/net/wireless/airo.h | 9 + drivers/net/wireless/airo_cs.c | 6 - drivers/net/wireless/prism54/islpci_eth.c | 7 - drivers/pcmcia/i82365.c | 1 drivers/scsi/dpt_i2o.c | 34 ++++-- drivers/scsi/libata-core.c | 2 drivers/scsi/libata-scsi.c | 9 + drivers/scsi/scsi_lib.c | 33 ++++-- drivers/scsi/sd.c | 16 --- drivers/scsi/sr.c | 20 --- drivers/scsi/st.c | 19 --- drivers/usb/core/sysfs.c | 33 ++---- drivers/usb/core/usb.c | 63 ++++-------- drivers/usb/image/microtek.c | 31 ++++-- drivers/usb/image/microtek.h | 2 drivers/usb/input/hid-input.c | 1 fs/exec.c | 10 + fs/locks.c | 2 fs/nfsd/nfs2acl.c | 2 fs/nfsd/nfs3acl.c | 2 fs/xattr.c | 2 fs/xfs/Kconfig | 2 include/asm-alpha/barrier.h | 2 include/linux/cciss_ioctl.h | 2 include/linux/proc_fs.h | 1 include/linux/rtnetlink.h | 4 include/linux/sysctl.h | 3 include/net/ipv6.h | 2 include/net/xfrm.h | 1 include/scsi/scsi_cmnd.h | 1 kernel/audit.c | 4 kernel/params.c | 2 kernel/ptrace.c | 5 kernel/signal.c | 4 kernel/sysctl.c | 136 +++++++++++++++++++++------ mm/truncate.c | 6 - net/8021q/vlan_dev.c | 3 net/bridge/br_if.c | 1 net/bridge/br_netfilter.c | 17 +-- net/core/datagram.c | 4 net/ipv4/fib_frontend.c | 8 + net/ipv4/ip_gre.c | 2 net/ipv4/ipvs/ip_vs_core.c | 7 - net/ipv4/netfilter/Makefile | 3 net/ipv4/netfilter/ip_conntrack_ftp.c | 4 net/ipv4/netfilter/ip_conntrack_irc.c | 4 net/ipv4/netfilter/ip_conntrack_netlink.c | 13 +- net/ipv4/netfilter/ip_conntrack_proto_icmp.c | 3 net/ipv4/netfilter/ip_conntrack_proto_tcp.c | 9 + net/ipv4/netfilter/ip_conntrack_tftp.c | 4 net/ipv4/netfilter/ip_nat_core.c | 6 - net/ipv4/netfilter/ip_nat_helper_pptp.c | 28 +++++ net/ipv4/netfilter/ip_nat_proto_gre.c | 4 net/ipv4/netfilter/ip_nat_proto_unknown.c | 2 net/ipv4/tcp_bic.c | 2 net/ipv6/addrconf.c | 16 ++- net/ipv6/datagram.c | 2 net/ipv6/exthdrs.c | 22 ++++ net/ipv6/ip6_flowlabel.c | 12 -- net/ipv6/netfilter/Kconfig | 2 net/ipv6/raw.c | 4 net/ipv6/route.c | 2 net/ipv6/udp.c | 4 net/netfilter/nf_queue.c | 2 net/xfrm/xfrm_policy.c | 19 ++- net/xfrm/xfrm_state.c | 5 sound/pci/nm256/nm256.c | 23 +++- 97 files changed, 602 insertions(+), 353 deletions(-) Index: linux-2.6.14-ck8/Makefile =================================================================== --- linux-2.6.14-ck8.orig/Makefile +++ linux-2.6.14-ck8/Makefile @@ -1,7 +1,7 @@ VERSION = 2 PATCHLEVEL = 6 SUBLEVEL = 14 -EXTRAVERSION = +EXTRAVERSION = .5 NAME=Affluent Albatross # *DOCUMENTATION* Index: linux-2.6.14-ck8/arch/i386/kernel/cpu/mtrr/main.c =================================================================== --- linux-2.6.14-ck8.orig/arch/i386/kernel/cpu/mtrr/main.c +++ linux-2.6.14-ck8/arch/i386/kernel/cpu/mtrr/main.c @@ -626,6 +626,14 @@ void __init mtrr_bp_init(void) if (cpuid_eax(0x80000000) >= 0x80000008) { u32 phys_addr; phys_addr = cpuid_eax(0x80000008) & 0xff; + /* CPUID workaround for Intel 0F33/0F34 CPU */ + if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL && + boot_cpu_data.x86 == 0xF && + boot_cpu_data.x86_model == 0x3 && + (boot_cpu_data.x86_mask == 0x3 || + boot_cpu_data.x86_mask == 0x4)) + phys_addr = 36; + size_or_mask = ~((1 << (phys_addr - PAGE_SHIFT)) - 1); size_and_mask = ~size_or_mask & 0xfff00000; } else if (boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR && Index: linux-2.6.14-ck8/arch/ppc64/Kconfig =================================================================== --- linux-2.6.14-ck8.orig/arch/ppc64/Kconfig +++ linux-2.6.14-ck8/arch/ppc64/Kconfig @@ -234,6 +234,10 @@ config HMT This option enables hardware multithreading on RS64 cpus. pSeries systems p620 and p660 have such a cpu type. +config NUMA + bool "NUMA support" + default y if DISCONTIGMEM || SPARSEMEM + config ARCH_SELECT_MEMORY_MODEL def_bool y @@ -249,9 +253,6 @@ config ARCH_DISCONTIGMEM_DEFAULT def_bool y depends on ARCH_DISCONTIGMEM_ENABLE -config ARCH_FLATMEM_ENABLE - def_bool y - config ARCH_SPARSEMEM_ENABLE def_bool y depends on ARCH_DISCONTIGMEM_ENABLE @@ -274,10 +275,6 @@ config NODES_SPAN_OTHER_NODES def_bool y depends on NEED_MULTIPLE_NODES -config NUMA - bool "NUMA support" - default y if DISCONTIGMEM || SPARSEMEM - config SCHED_SMT bool "SMT (Hyperthreading) scheduler support" depends on SMP Index: linux-2.6.14-ck8/arch/s390/appldata/appldata_base.c =================================================================== --- linux-2.6.14-ck8.orig/arch/s390/appldata/appldata_base.c +++ linux-2.6.14-ck8/arch/s390/appldata/appldata_base.c @@ -592,12 +592,15 @@ int appldata_register_ops(struct appldat */ void appldata_unregister_ops(struct appldata_ops *ops) { + void *table; spin_lock(&appldata_ops_lock); - unregister_sysctl_table(ops->sysctl_header); list_del(&ops->list); - kfree(ops->ctl_table); + /* at that point any incoming access will fail */ + table = ops->ctl_table; ops->ctl_table = NULL; spin_unlock(&appldata_ops_lock); + unregister_sysctl_table(ops->sysctl_header); + kfree(table); P_INFO("%s-ops unregistered!\n", ops->name); } /********************** module-ops management **************************/ Index: linux-2.6.14-ck8/arch/x86_64/kernel/setup.c =================================================================== --- linux-2.6.14-ck8.orig/arch/x86_64/kernel/setup.c +++ linux-2.6.14-ck8/arch/x86_64/kernel/setup.c @@ -993,6 +993,11 @@ static void __cpuinit init_intel(struct unsigned eax = cpuid_eax(0x80000008); c->x86_virt_bits = (eax >> 8) & 0xff; c->x86_phys_bits = eax & 0xff; + /* CPUID workaround for Intel 0F34 CPU */ + if (c->x86_vendor == X86_VENDOR_INTEL && + c->x86 == 0xF && c->x86_model == 0x3 && + c->x86_mask == 0x4) + c->x86_phys_bits = 36; } if (c->x86 == 15) Index: linux-2.6.14-ck8/drivers/acpi/scan.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/acpi/scan.c +++ linux-2.6.14-ck8/drivers/acpi/scan.c @@ -1111,7 +1111,7 @@ acpi_add_single_object(struct acpi_devic * * TBD: Assumes LDM provides driver hot-plug capability. */ - result = acpi_bus_find_driver(device); + acpi_bus_find_driver(device); end: if (!result) Index: linux-2.6.14-ck8/drivers/acpi/video.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/acpi/video.c +++ linux-2.6.14-ck8/drivers/acpi/video.c @@ -813,7 +813,7 @@ acpi_video_device_write_brightness(struc ACPI_FUNCTION_TRACE("acpi_video_device_write_brightness"); - if (!dev || count + 1 > sizeof str) + if (!dev || !dev->brightness || count + 1 > sizeof str) return_VALUE(-EINVAL); if (copy_from_user(str, buffer, count)) Index: linux-2.6.14-ck8/drivers/block/cciss.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/block/cciss.c +++ linux-2.6.14-ck8/drivers/block/cciss.c @@ -1016,10 +1016,11 @@ static int cciss_ioctl(struct inode *ino status = -ENOMEM; goto cleanup1; } - if (ioc->Request.Type.Direction == XFER_WRITE && - copy_from_user(buff[sg_used], data_ptr, sz)) { + if (ioc->Request.Type.Direction == XFER_WRITE) { + if (copy_from_user(buff[sg_used], data_ptr, sz)) { status = -ENOMEM; - goto cleanup1; + goto cleanup1; + } } else { memset(buff[sg_used], 0, sz); } Index: linux-2.6.14-ck8/drivers/block/cfq-iosched.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/block/cfq-iosched.c +++ linux-2.6.14-ck8/drivers/block/cfq-iosched.c @@ -2260,10 +2260,8 @@ static void cfq_put_cfqd(struct cfq_data if (!atomic_dec_and_test(&cfqd->ref)) return; - blk_put_queue(q); - cfq_shutdown_timer_wq(cfqd); - q->elevator->elevator_data = NULL; + blk_put_queue(q); mempool_destroy(cfqd->crq_pool); kfree(cfqd->crq_hash); Index: linux-2.6.14-ck8/drivers/block/pktcdvd.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/block/pktcdvd.c +++ linux-2.6.14-ck8/drivers/block/pktcdvd.c @@ -1191,7 +1191,7 @@ static void pkt_count_states(struct pktc struct packet_data *pkt; int i; - for (i = 0; i <= PACKET_NUM_STATES; i++) + for (i = 0; i < PACKET_NUM_STATES; i++) states[i] = 0; spin_lock(&pd->cdrw.active_list_lock); Index: linux-2.6.14-ck8/drivers/char/agp/sworks-agp.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/char/agp/sworks-agp.c +++ linux-2.6.14-ck8/drivers/char/agp/sworks-agp.c @@ -242,13 +242,27 @@ static int serverworks_fetch_size(void) */ static void serverworks_tlbflush(struct agp_memory *temp) { + unsigned long timeout; + writeb(1, serverworks_private.registers+SVWRKS_POSTFLUSH); - while (readb(serverworks_private.registers+SVWRKS_POSTFLUSH) == 1) + timeout = jiffies + 3*HZ; + while (readb(serverworks_private.registers+SVWRKS_POSTFLUSH) == 1) { cpu_relax(); + if (time_after(jiffies, timeout)) { + printk(KERN_ERR PFX "TLB post flush took more than 3 seconds\n"); + break; + } + } writel(1, serverworks_private.registers+SVWRKS_DIRFLUSH); - while(readl(serverworks_private.registers+SVWRKS_DIRFLUSH) == 1) + timeout = jiffies + 3*HZ; + while (readl(serverworks_private.registers+SVWRKS_DIRFLUSH) == 1) { cpu_relax(); + if (time_after(jiffies, timeout)) { + printk(KERN_ERR PFX "TLB Dir flush took more than 3 seconds\n"); + break; + } + } } static int serverworks_configure(void) Index: linux-2.6.14-ck8/drivers/char/i8k.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/char/i8k.c +++ linux-2.6.14-ck8/drivers/char/i8k.c @@ -99,7 +99,9 @@ struct smm_regs { static inline char *i8k_get_dmi_data(int field) { - return dmi_get_system_info(field) ? : "N/A"; + char *dmi_data = dmi_get_system_info(field); + + return dmi_data && *dmi_data ? dmi_data : "?"; } /* @@ -396,7 +398,7 @@ static int i8k_proc_show(struct seq_file return seq_printf(seq, "%s %s %s %d %d %d %d %d %d %d\n", I8K_PROC_FMT, bios_version, - dmi_get_system_info(DMI_PRODUCT_SERIAL) ? : "N/A", + i8k_get_dmi_data(DMI_PRODUCT_SERIAL), cpu_temp, left_fan, right_fan, left_speed, right_speed, ac_power, fn_key); Index: linux-2.6.14-ck8/drivers/char/rtc.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/char/rtc.c +++ linux-2.6.14-ck8/drivers/char/rtc.c @@ -149,8 +149,22 @@ static void get_rtc_alm_time (struct rtc #ifdef RTC_IRQ static void rtc_dropped_irq(unsigned long data); -static void set_rtc_irq_bit(unsigned char bit); -static void mask_rtc_irq_bit(unsigned char bit); +static void set_rtc_irq_bit_locked(unsigned char bit); +static void mask_rtc_irq_bit_locked(unsigned char bit); + +static inline void set_rtc_irq_bit(unsigned char bit) +{ + spin_lock_irq(&rtc_lock); + set_rtc_irq_bit_locked(bit); + spin_unlock_irq(&rtc_lock); +} + +static void mask_rtc_irq_bit(unsigned char bit) +{ + spin_lock_irq(&rtc_lock); + mask_rtc_irq_bit_locked(bit); + spin_unlock_irq(&rtc_lock); +} #endif static int rtc_proc_open(struct inode *inode, struct file *file); @@ -401,18 +415,19 @@ static int rtc_do_ioctl(unsigned int cmd } case RTC_PIE_OFF: /* Mask periodic int. enab. bit */ { - mask_rtc_irq_bit(RTC_PIE); + unsigned long flags; /* can be called from isr via rtc_control() */ + spin_lock_irqsave (&rtc_lock, flags); + mask_rtc_irq_bit_locked(RTC_PIE); if (rtc_status & RTC_TIMER_ON) { - spin_lock_irq (&rtc_lock); rtc_status &= ~RTC_TIMER_ON; del_timer(&rtc_irq_timer); - spin_unlock_irq (&rtc_lock); } + spin_unlock_irqrestore (&rtc_lock, flags); return 0; } case RTC_PIE_ON: /* Allow periodic ints */ { - + unsigned long flags; /* can be called from isr via rtc_control() */ /* * We don't really want Joe User enabling more * than 64Hz of interrupts on a multi-user machine. @@ -421,14 +436,14 @@ static int rtc_do_ioctl(unsigned int cmd (!capable(CAP_SYS_RESOURCE))) return -EACCES; + spin_lock_irqsave (&rtc_lock, flags); if (!(rtc_status & RTC_TIMER_ON)) { - spin_lock_irq (&rtc_lock); rtc_irq_timer.expires = jiffies + HZ/rtc_freq + 2*HZ/100; add_timer(&rtc_irq_timer); rtc_status |= RTC_TIMER_ON; - spin_unlock_irq (&rtc_lock); } - set_rtc_irq_bit(RTC_PIE); + set_rtc_irq_bit_locked(RTC_PIE); + spin_unlock_irqrestore (&rtc_lock, flags); return 0; } case RTC_UIE_OFF: /* Mask ints from RTC updates. */ @@ -609,6 +624,7 @@ static int rtc_do_ioctl(unsigned int cmd { int tmp = 0; unsigned char val; + unsigned long flags; /* can be called from isr via rtc_control() */ /* * The max we can do is 8192Hz. @@ -631,9 +647,9 @@ static int rtc_do_ioctl(unsigned int cmd if (arg != (1<update_lock); + switch (nr) { + case 0: data->fan_div[nr] = reg & 0x07; break; + case 1: data->fan_div[nr] = (reg >> 3) & 0x07; break; + case 2: data->fan_div[nr] = (reg & 0x40) ? 3 : 1; break; + } + data->fan_min[nr] = FAN_TO_REG(val, DIV_FROM_REG(data->fan_div[nr])); it87_write_value(client, IT87_REG_FAN_MIN(nr), data->fan_min[nr]); up(&data->update_lock); Index: linux-2.6.14-ck8/drivers/hwmon/lm78.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/hwmon/lm78.c +++ linux-2.6.14-ck8/drivers/hwmon/lm78.c @@ -451,7 +451,7 @@ static DEVICE_ATTR(fan3_div, S_IRUGO, sh static ssize_t show_vid(struct device *dev, struct device_attribute *attr, char *buf) { struct lm78_data *data = lm78_update_device(dev); - return sprintf(buf, "%d\n", vid_from_reg(82, data->vid)); + return sprintf(buf, "%d\n", vid_from_reg(data->vid, 82)); } static DEVICE_ATTR(cpu0_vid, S_IRUGO, show_vid, NULL); Index: linux-2.6.14-ck8/drivers/hwmon/w83627hf.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/hwmon/w83627hf.c +++ linux-2.6.14-ck8/drivers/hwmon/w83627hf.c @@ -454,7 +454,9 @@ static ssize_t store_regs_in_min0(struct (w83627thf == data->type || w83637hf == data->type)) /* use VRM9 calculation */ - data->in_min[0] = (u8)(((val * 100) - 70000 + 244) / 488); + data->in_min[0] = + SENSORS_LIMIT(((val * 100) - 70000 + 244) / 488, 0, + 255); else /* use VRM8 (standard) calculation */ data->in_min[0] = IN_TO_REG(val); @@ -479,7 +481,9 @@ static ssize_t store_regs_in_max0(struct (w83627thf == data->type || w83637hf == data->type)) /* use VRM9 calculation */ - data->in_max[0] = (u8)(((val * 100) - 70000 + 244) / 488); + data->in_max[0] = + SENSORS_LIMIT(((val * 100) - 70000 + 244) / 488, 0, + 255); else /* use VRM8 (standard) calculation */ data->in_max[0] = IN_TO_REG(val); Index: linux-2.6.14-ck8/drivers/ide/ide-floppy.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/ide/ide-floppy.c +++ linux-2.6.14-ck8/drivers/ide/ide-floppy.c @@ -2038,11 +2038,9 @@ static int idefloppy_ioctl(struct inode struct ide_floppy_obj *floppy = ide_floppy_g(bdev->bd_disk); ide_drive_t *drive = floppy->drive; void __user *argp = (void __user *)arg; - int err = generic_ide_ioctl(drive, file, bdev, cmd, arg); + int err; int prevent = (arg) ? 1 : 0; idefloppy_pc_t pc; - if (err != -EINVAL) - return err; switch (cmd) { case CDROMEJECT: @@ -2094,7 +2092,7 @@ static int idefloppy_ioctl(struct inode case IDEFLOPPY_IOCTL_FORMAT_GET_PROGRESS: return idefloppy_get_format_progress(drive, argp); } - return -EINVAL; + return generic_ide_ioctl(drive, file, bdev, cmd, arg); } static int idefloppy_media_changed(struct gendisk *disk) Index: linux-2.6.14-ck8/drivers/infiniband/core/mad.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/infiniband/core/mad.c +++ linux-2.6.14-ck8/drivers/infiniband/core/mad.c @@ -356,9 +356,9 @@ error4: spin_unlock_irqrestore(&port_priv->reg_lock, flags); kfree(reg_req); error3: - kfree(mad_agent_priv); -error2: ib_dereg_mr(mad_agent_priv->agent.mr); +error2: + kfree(mad_agent_priv); error1: return ret; } Index: linux-2.6.14-ck8/drivers/isdn/hardware/eicon/os_4bri.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/isdn/hardware/eicon/os_4bri.c +++ linux-2.6.14-ck8/drivers/isdn/hardware/eicon/os_4bri.c @@ -16,6 +16,7 @@ #include "diva_pci.h" #include "mi_pc.h" #include "dsrv4bri.h" +#include "helpers.h" static void *diva_xdiLoadFileFile = NULL; static dword diva_xdiLoadFileLength = 0; @@ -815,7 +816,7 @@ diva_4bri_cmd_card_proc(struct _diva_os_ return (ret); } -void *xdiLoadFile(char *FileName, unsigned long *FileLength, +void *xdiLoadFile(char *FileName, dword *FileLength, unsigned long lim) { void *ret = diva_xdiLoadFileFile; Index: linux-2.6.14-ck8/drivers/media/dvb/ttpci/Kconfig =================================================================== --- linux-2.6.14-ck8.orig/drivers/media/dvb/ttpci/Kconfig +++ linux-2.6.14-ck8/drivers/media/dvb/ttpci/Kconfig @@ -81,6 +81,7 @@ config DVB_BUDGET_CI tristate "Budget cards with onboard CI connector" depends on DVB_CORE && PCI select VIDEO_SAA7146 + select DVB_STV0297 select DVB_STV0299 select DVB_TDA1004X help Index: linux-2.6.14-ck8/drivers/media/video/cx88/cx88-cards.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/media/video/cx88/cx88-cards.c +++ linux-2.6.14-ck8/drivers/media/video/cx88/cx88-cards.c @@ -567,6 +567,7 @@ struct cx88_board cx88_boards[] = { .radio_type = UNSET, .tuner_addr = ADDR_UNSET, .radio_addr = ADDR_UNSET, + .tda9887_conf = TDA9887_PRESENT, .input = {{ .type = CX88_VMUX_TELEVISION, .vmux = 0, @@ -711,6 +712,7 @@ struct cx88_board cx88_boards[] = { .radio_type = UNSET, .tuner_addr = ADDR_UNSET, .radio_addr = ADDR_UNSET, + .tda9887_conf = TDA9887_PRESENT, .input = {{ .type = CX88_VMUX_TELEVISION, .vmux = 0, Index: linux-2.6.14-ck8/drivers/media/video/saa7134/saa7134-cards.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/media/video/saa7134/saa7134-cards.c +++ linux-2.6.14-ck8/drivers/media/video/saa7134/saa7134-cards.c @@ -972,7 +972,7 @@ struct saa7134_board saa7134_boards[] = .radio_type = UNSET, .tuner_addr = ADDR_UNSET, .radio_addr = ADDR_UNSET, - .tda9887_conf = TDA9887_PRESENT | TDA9887_INTERCARRIER, + .tda9887_conf = TDA9887_PRESENT | TDA9887_INTERCARRIER | TDA9887_PORT2_ACTIVE, .inputs = {{ .name = name_tv, .vmux = 3, Index: linux-2.6.14-ck8/drivers/message/i2o/pci.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/message/i2o/pci.c +++ linux-2.6.14-ck8/drivers/message/i2o/pci.c @@ -421,8 +421,8 @@ static int __devinit i2o_pci_probe(struc i2o_pci_free(c); free_controller: - i2o_iop_free(c); put_device(c->device.parent); + i2o_iop_free(c); disable: pci_disable_device(pdev); Index: linux-2.6.14-ck8/drivers/net/bonding/bond_main.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/net/bonding/bond_main.c +++ linux-2.6.14-ck8/drivers/net/bonding/bond_main.c @@ -1604,35 +1604,27 @@ static int bond_sethwaddr(struct net_dev (NETIF_F_SG|NETIF_F_IP_CSUM|NETIF_F_NO_CSUM|NETIF_F_HW_CSUM) /* - * Compute the features available to the bonding device by - * intersection of all of the slave devices' BOND_INTERSECT_FEATURES. - * Call this after attaching or detaching a slave to update the - * bond's features. + * Compute the common dev->feature set available to all slaves. Some + * feature bits are managed elsewhere, so preserve feature bits set on + * master device that are not part of the examined set. */ static int bond_compute_features(struct bonding *bond) { - int i; + unsigned long features = BOND_INTERSECT_FEATURES; struct slave *slave; struct net_device *bond_dev = bond->dev; - int features = bond->bond_features; + int i; - bond_for_each_slave(bond, slave, i) { - struct net_device * slave_dev = slave->dev; - if (i == 0) { - features |= BOND_INTERSECT_FEATURES; - } - features &= - ~(~slave_dev->features & BOND_INTERSECT_FEATURES); - } + bond_for_each_slave(bond, slave, i) + features &= (slave->dev->features & BOND_INTERSECT_FEATURES); - /* turn off NETIF_F_SG if we need a csum and h/w can't do it */ if ((features & NETIF_F_SG) && - !(features & (NETIF_F_IP_CSUM | - NETIF_F_NO_CSUM | - NETIF_F_HW_CSUM))) { + !(features & (NETIF_F_IP_CSUM | + NETIF_F_NO_CSUM | + NETIF_F_HW_CSUM))) features &= ~NETIF_F_SG; - } + features |= (bond_dev->features & ~BOND_INTERSECT_FEATURES); bond_dev->features = features; return 0; @@ -4508,8 +4500,6 @@ static int __init bond_init(struct net_d NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_FILTER); - bond->bond_features = bond_dev->features; - #ifdef CONFIG_PROC_FS bond_create_proc_entry(bond); #endif Index: linux-2.6.14-ck8/drivers/net/bonding/bonding.h =================================================================== --- linux-2.6.14-ck8.orig/drivers/net/bonding/bonding.h +++ linux-2.6.14-ck8/drivers/net/bonding/bonding.h @@ -40,8 +40,8 @@ #include "bond_3ad.h" #include "bond_alb.h" -#define DRV_VERSION "2.6.4" -#define DRV_RELDATE "September 26, 2005" +#define DRV_VERSION "2.6.5" +#define DRV_RELDATE "November 4, 2005" #define DRV_NAME "bonding" #define DRV_DESCRIPTION "Ethernet Channel Bonding Driver" @@ -211,9 +211,6 @@ struct bonding { struct bond_params params; struct list_head vlan_list; struct vlan_group *vlgrp; - /* the features the bonding device supports, independently - * of any slaves */ - int bond_features; }; /** Index: linux-2.6.14-ck8/drivers/net/wan/hdlc_cisco.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/net/wan/hdlc_cisco.c +++ linux-2.6.14-ck8/drivers/net/wan/hdlc_cisco.c @@ -192,7 +192,9 @@ static int cisco_rx(struct sk_buff *skb) "uptime %ud%uh%um%us)\n", dev->name, days, hrs, min, sec); +#if 0 netif_carrier_on(dev); +#endif hdlc->state.cisco.up = 1; } } @@ -225,7 +227,9 @@ static void cisco_timer(unsigned long ar hdlc->state.cisco.settings.timeout * HZ)) { hdlc->state.cisco.up = 0; printk(KERN_INFO "%s: Link down\n", dev->name); +#if 0 netif_carrier_off(dev); +#endif } cisco_keepalive_send(dev, CISCO_KEEPALIVE_REQ, @@ -261,8 +265,10 @@ static void cisco_stop(struct net_device { hdlc_device *hdlc = dev_to_hdlc(dev); del_timer_sync(&hdlc->state.cisco.timer); +#if 0 if (netif_carrier_ok(dev)) netif_carrier_off(dev); +#endif hdlc->state.cisco.up = 0; hdlc->state.cisco.request_sent = 0; } Index: linux-2.6.14-ck8/drivers/net/wan/hdlc_fr.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/net/wan/hdlc_fr.c +++ linux-2.6.14-ck8/drivers/net/wan/hdlc_fr.c @@ -545,8 +545,10 @@ static void fr_set_link_state(int reliab hdlc->state.fr.reliable = reliable; if (reliable) { +#if 0 if (!netif_carrier_ok(dev)) netif_carrier_on(dev); +#endif hdlc->state.fr.n391cnt = 0; /* Request full status */ hdlc->state.fr.dce_changed = 1; @@ -560,8 +562,10 @@ static void fr_set_link_state(int reliab } } } else { +#if 0 if (netif_carrier_ok(dev)) netif_carrier_off(dev); +#endif while (pvc) { /* Deactivate all PVCs */ pvc_carrier(0, pvc); Index: linux-2.6.14-ck8/drivers/net/wan/hdlc_generic.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/net/wan/hdlc_generic.c +++ linux-2.6.14-ck8/drivers/net/wan/hdlc_generic.c @@ -79,11 +79,13 @@ static void __hdlc_set_carrier_on(struct hdlc_device *hdlc = dev_to_hdlc(dev); if (hdlc->proto.start) return hdlc->proto.start(dev); +#if 0 #ifdef DEBUG_LINK if (netif_carrier_ok(dev)) printk(KERN_ERR "hdlc_set_carrier_on(): already on\n"); #endif netif_carrier_on(dev); +#endif } @@ -94,11 +96,13 @@ static void __hdlc_set_carrier_off(struc if (hdlc->proto.stop) return hdlc->proto.stop(dev); +#if 0 #ifdef DEBUG_LINK if (!netif_carrier_ok(dev)) printk(KERN_ERR "hdlc_set_carrier_off(): already off\n"); #endif netif_carrier_off(dev); +#endif } @@ -294,8 +298,10 @@ int register_hdlc_device(struct net_devi if (result != 0) return -EIO; +#if 0 if (netif_carrier_ok(dev)) netif_carrier_off(dev); /* no carrier until DCD goes up */ +#endif return 0; } Index: linux-2.6.14-ck8/drivers/net/wireless/airo.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/net/wireless/airo.c +++ linux-2.6.14-ck8/drivers/net/wireless/airo.c @@ -46,6 +46,8 @@ #include #include +#include "airo.h" + #ifdef CONFIG_PCI static struct pci_device_id card_ids[] = { { 0x14b9, 1, PCI_ANY_ID, PCI_ANY_ID, }, Index: linux-2.6.14-ck8/drivers/net/wireless/airo.h =================================================================== --- /dev/null +++ linux-2.6.14-ck8/drivers/net/wireless/airo.h @@ -0,0 +1,9 @@ +#ifndef _AIRO_H_ +#define _AIRO_H_ + +struct net_device *init_airo_card(unsigned short irq, int port, int is_pcmcia, + struct device *dmdev); +int reset_airo_card(struct net_device *dev); +void stop_airo_card(struct net_device *dev, int freeres); + +#endif /* _AIRO_H_ */ Index: linux-2.6.14-ck8/drivers/net/wireless/airo_cs.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/net/wireless/airo_cs.c +++ linux-2.6.14-ck8/drivers/net/wireless/airo_cs.c @@ -42,6 +42,8 @@ #include #include +#include "airo.h" + /* All the PCMCIA modules use PCMCIA_DEBUG to control debugging. If you do not define PCMCIA_DEBUG at all, all the debug code will be @@ -78,10 +80,6 @@ MODULE_SUPPORTED_DEVICE("Aironet 4500, 4 event handler. */ -struct net_device *init_airo_card( int, int, int, struct device * ); -void stop_airo_card( struct net_device *, int ); -int reset_airo_card( struct net_device * ); - static void airo_config(dev_link_t *link); static void airo_release(dev_link_t *link); static int airo_event(event_t event, int priority, Index: linux-2.6.14-ck8/drivers/net/wireless/prism54/islpci_eth.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/net/wireless/prism54/islpci_eth.c +++ linux-2.6.14-ck8/drivers/net/wireless/prism54/islpci_eth.c @@ -97,12 +97,6 @@ islpci_eth_transmit(struct sk_buff *skb, /* lock the driver code */ spin_lock_irqsave(&priv->slock, flags); - /* determine the amount of fragments needed to store the frame */ - - frame_size = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len; - if (init_wds) - frame_size += 6; - /* check whether the destination queue has enough fragments for the frame */ curr_frag = le32_to_cpu(cb->driver_curr_frag[ISL38XX_CB_TX_DATA_LQ]); if (unlikely(curr_frag - priv->free_data_tx >= ISL38XX_CB_TX_QSIZE)) { @@ -213,6 +207,7 @@ islpci_eth_transmit(struct sk_buff *skb, /* store the skb address for future freeing */ priv->data_low_tx[index] = skb; /* set the proper fragment start address and size information */ + frame_size = skb->len; fragment->size = cpu_to_le16(frame_size); fragment->flags = cpu_to_le16(0); /* set to 1 if more fragments */ fragment->address = cpu_to_le32(pci_map_address); Index: linux-2.6.14-ck8/drivers/pcmcia/i82365.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/pcmcia/i82365.c +++ linux-2.6.14-ck8/drivers/pcmcia/i82365.c @@ -1382,6 +1382,7 @@ static int __init init_i82365(void) if (sockets == 0) { printk("not found.\n"); platform_device_unregister(&i82365_device); + release_region(i365_base, 2); driver_unregister(&i82365_driver); return -ENODEV; } Index: linux-2.6.14-ck8/drivers/scsi/dpt_i2o.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/scsi/dpt_i2o.c +++ linux-2.6.14-ck8/drivers/scsi/dpt_i2o.c @@ -660,7 +660,12 @@ static int adpt_abort(struct scsi_cmnd * msg[2] = 0; msg[3]= 0; msg[4] = (u32)cmd; - if( (rcode = adpt_i2o_post_wait(pHba, msg, sizeof(msg), FOREVER)) != 0){ + if (pHba->host) + spin_lock_irq(pHba->host->host_lock); + rcode = adpt_i2o_post_wait(pHba, msg, sizeof(msg), FOREVER); + if (pHba->host) + spin_unlock_irq(pHba->host->host_lock); + if (rcode != 0) { if(rcode == -EOPNOTSUPP ){ printk(KERN_INFO"%s: Abort cmd not supported\n",pHba->name); return FAILED; @@ -697,10 +702,15 @@ static int adpt_device_reset(struct scsi msg[2] = 0; msg[3] = 0; + if (pHba->host) + spin_lock_irq(pHba->host->host_lock); old_state = d->state; d->state |= DPTI_DEV_RESET; - if( (rcode = adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER)) ){ - d->state = old_state; + rcode = adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER); + d->state = old_state; + if (pHba->host) + spin_unlock_irq(pHba->host->host_lock); + if (rcode != 0) { if(rcode == -EOPNOTSUPP ){ printk(KERN_INFO"%s: Device reset not supported\n",pHba->name); return FAILED; @@ -708,7 +718,6 @@ static int adpt_device_reset(struct scsi printk(KERN_INFO"%s: Device reset failed\n",pHba->name); return FAILED; } else { - d->state = old_state; printk(KERN_INFO"%s: Device reset successful\n",pHba->name); return SUCCESS; } @@ -721,6 +730,7 @@ static int adpt_bus_reset(struct scsi_cm { adpt_hba* pHba; u32 msg[4]; + u32 rcode; pHba = (adpt_hba*)cmd->device->host->hostdata[0]; memset(msg, 0, sizeof(msg)); @@ -729,7 +739,12 @@ static int adpt_bus_reset(struct scsi_cm msg[1] = (I2O_HBA_BUS_RESET<<24|HOST_TID<<12|pHba->channel[cmd->device->channel].tid); msg[2] = 0; msg[3] = 0; - if(adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER) ){ + if (pHba->host) + spin_lock_irq(pHba->host->host_lock); + rcode = adpt_i2o_post_wait(pHba, msg,sizeof(msg), FOREVER); + if (pHba->host) + spin_unlock_irq(pHba->host->host_lock); + if (rcode != 0) { printk(KERN_WARNING"%s: Bus reset failed.\n",pHba->name); return FAILED; } else { @@ -816,7 +831,7 @@ static int adpt_hba_reset(adpt_hba* pHba static void adpt_i2o_sys_shutdown(void) { adpt_hba *pHba, *pNext; - struct adpt_i2o_post_wait_data *p1, *p2; + struct adpt_i2o_post_wait_data *p1, *old; printk(KERN_INFO"Shutting down Adaptec I2O controllers.\n"); printk(KERN_INFO" This could take a few minutes if there are many devices attached\n"); @@ -830,13 +845,14 @@ static void adpt_i2o_sys_shutdown(void) } /* Remove any timedout entries from the wait queue. */ - p2 = NULL; // spin_lock_irqsave(&adpt_post_wait_lock, flags); /* Nothing should be outstanding at this point so just * free them */ - for(p1 = adpt_post_wait_queue; p1; p2 = p1, p1 = p2->next) { - kfree(p1); + for(p1 = adpt_post_wait_queue; p1;) { + old = p1; + p1 = p1->next; + kfree(old); } // spin_unlock_irqrestore(&adpt_post_wait_lock, flags); adpt_post_wait_queue = NULL; Index: linux-2.6.14-ck8/drivers/scsi/libata-core.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/scsi/libata-core.c +++ linux-2.6.14-ck8/drivers/scsi/libata-core.c @@ -3916,8 +3916,6 @@ static void ata_host_init(struct ata_por host->unique_id = ata_unique_id++; host->max_cmd_len = 12; - scsi_assign_lock(host, &host_set->lock); - ap->flags = ATA_FLAG_PORT_DISABLED; ap->id = host->unique_id; ap->host = host; Index: linux-2.6.14-ck8/drivers/scsi/libata-scsi.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/scsi/libata-scsi.c +++ linux-2.6.14-ck8/drivers/scsi/libata-scsi.c @@ -39,6 +39,7 @@ #include #include "scsi.h" #include +#include #include #include @@ -1565,8 +1566,12 @@ int ata_scsi_queuecmd(struct scsi_cmnd * struct ata_port *ap; struct ata_device *dev; struct scsi_device *scsidev = cmd->device; + struct Scsi_Host *shost = scsidev->host; - ap = (struct ata_port *) &scsidev->host->hostdata[0]; + ap = (struct ata_port *) &shost->hostdata[0]; + + spin_unlock(shost->host_lock); + spin_lock(&ap->host_set->lock); ata_scsi_dump_cdb(ap, cmd); @@ -1589,6 +1594,8 @@ int ata_scsi_queuecmd(struct scsi_cmnd * ata_scsi_translate(ap, dev, cmd, done, atapi_xlat); out_unlock: + spin_unlock(&ap->host_set->lock); + spin_lock(shost->host_lock); return 0; } Index: linux-2.6.14-ck8/drivers/scsi/scsi_lib.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/scsi/scsi_lib.c +++ linux-2.6.14-ck8/drivers/scsi/scsi_lib.c @@ -1129,6 +1129,26 @@ static void scsi_generic_done(struct scs scsi_io_completion(cmd, cmd->result == 0 ? cmd->bufflen : 0, 0); } +void scsi_setup_blk_pc_cmnd(struct scsi_cmnd *cmd, int retries) +{ + struct request *req = cmd->request; + + BUG_ON(sizeof(req->cmd) > sizeof(cmd->cmnd)); + memcpy(cmd->cmnd, req->cmd, sizeof(cmd->cmnd)); + cmd->cmd_len = req->cmd_len; + if (!req->data_len) + cmd->sc_data_direction = DMA_NONE; + else if (rq_data_dir(req) == WRITE) + cmd->sc_data_direction = DMA_TO_DEVICE; + else + cmd->sc_data_direction = DMA_FROM_DEVICE; + + cmd->transfersize = req->data_len; + cmd->allowed = retries; + cmd->timeout_per_command = req->timeout; +} +EXPORT_SYMBOL_GPL(scsi_setup_blk_pc_cmnd); + static int scsi_prep_fn(struct request_queue *q, struct request *req) { struct scsi_device *sdev = q->queuedata; @@ -1264,18 +1284,7 @@ static int scsi_prep_fn(struct request_q goto kill; } } else { - memcpy(cmd->cmnd, req->cmd, sizeof(cmd->cmnd)); - cmd->cmd_len = req->cmd_len; - if (rq_data_dir(req) == WRITE) - cmd->sc_data_direction = DMA_TO_DEVICE; - else if (req->data_len) - cmd->sc_data_direction = DMA_FROM_DEVICE; - else - cmd->sc_data_direction = DMA_NONE; - - cmd->transfersize = req->data_len; - cmd->allowed = 3; - cmd->timeout_per_command = req->timeout; + scsi_setup_blk_pc_cmnd(cmd, 3); cmd->done = scsi_generic_done; } } Index: linux-2.6.14-ck8/drivers/scsi/sd.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/scsi/sd.c +++ linux-2.6.14-ck8/drivers/scsi/sd.c @@ -231,24 +231,10 @@ static int sd_init_command(struct scsi_c * SG_IO from block layer already setup, just copy cdb basically */ if (blk_pc_request(rq)) { - if (sizeof(rq->cmd) > sizeof(SCpnt->cmnd)) - return 0; - - memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd)); - SCpnt->cmd_len = rq->cmd_len; - if (rq_data_dir(rq) == WRITE) - SCpnt->sc_data_direction = DMA_TO_DEVICE; - else if (rq->data_len) - SCpnt->sc_data_direction = DMA_FROM_DEVICE; - else - SCpnt->sc_data_direction = DMA_NONE; - - this_count = rq->data_len; + scsi_setup_blk_pc_cmnd(SCpnt, SD_PASSTHROUGH_RETRIES); if (rq->timeout) timeout = rq->timeout; - SCpnt->transfersize = rq->data_len; - SCpnt->allowed = SD_PASSTHROUGH_RETRIES; goto queue; } Index: linux-2.6.14-ck8/drivers/scsi/sr.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/scsi/sr.c +++ linux-2.6.14-ck8/drivers/scsi/sr.c @@ -320,25 +320,11 @@ static int sr_init_command(struct scsi_c * these are already setup, just copy cdb basically */ if (SCpnt->request->flags & REQ_BLOCK_PC) { - struct request *rq = SCpnt->request; + scsi_setup_blk_pc_cmnd(SCpnt, MAX_RETRIES); - if (sizeof(rq->cmd) > sizeof(SCpnt->cmnd)) - return 0; - - memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd)); - SCpnt->cmd_len = rq->cmd_len; - if (!rq->data_len) - SCpnt->sc_data_direction = DMA_NONE; - else if (rq_data_dir(rq) == WRITE) - SCpnt->sc_data_direction = DMA_TO_DEVICE; - else - SCpnt->sc_data_direction = DMA_FROM_DEVICE; - - this_count = rq->data_len; - if (rq->timeout) - timeout = rq->timeout; + if (SCpnt->timeout_per_command) + timeout = SCpnt->timeout_per_command; - SCpnt->transfersize = rq->data_len; goto queue; } Index: linux-2.6.14-ck8/drivers/scsi/st.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/scsi/st.c +++ linux-2.6.14-ck8/drivers/scsi/st.c @@ -4196,27 +4196,10 @@ static void st_intr(struct scsi_cmnd *SC */ static int st_init_command(struct scsi_cmnd *SCpnt) { - struct request *rq; - if (!(SCpnt->request->flags & REQ_BLOCK_PC)) return 0; - rq = SCpnt->request; - if (sizeof(rq->cmd) > sizeof(SCpnt->cmnd)) - return 0; - - memcpy(SCpnt->cmnd, rq->cmd, sizeof(SCpnt->cmnd)); - SCpnt->cmd_len = rq->cmd_len; - - if (rq_data_dir(rq) == WRITE) - SCpnt->sc_data_direction = DMA_TO_DEVICE; - else if (rq->data_len) - SCpnt->sc_data_direction = DMA_FROM_DEVICE; - else - SCpnt->sc_data_direction = DMA_NONE; - - SCpnt->timeout_per_command = rq->timeout; - SCpnt->transfersize = rq->data_len; + scsi_setup_blk_pc_cmnd(SCpnt, 0); SCpnt->done = st_intr; return 1; } Index: linux-2.6.14-ck8/drivers/usb/core/sysfs.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/usb/core/sysfs.c +++ linux-2.6.14-ck8/drivers/usb/core/sysfs.c @@ -292,30 +292,23 @@ static ssize_t show_modalias(struct devi { struct usb_interface *intf; struct usb_device *udev; - int len; + struct usb_host_interface *alt; intf = to_usb_interface(dev); udev = interface_to_usbdev(intf); + alt = intf->cur_altsetting; - len = sprintf(buf, "usb:v%04Xp%04Xd%04Xdc%02Xdsc%02Xdp%02Xic", - le16_to_cpu(udev->descriptor.idVendor), - le16_to_cpu(udev->descriptor.idProduct), - le16_to_cpu(udev->descriptor.bcdDevice), - udev->descriptor.bDeviceClass, - udev->descriptor.bDeviceSubClass, - udev->descriptor.bDeviceProtocol); - buf += len; - - if (udev->descriptor.bDeviceClass == 0) { - struct usb_host_interface *alt = intf->cur_altsetting; - - return len + sprintf(buf, "%02Xisc%02Xip%02X\n", - alt->desc.bInterfaceClass, - alt->desc.bInterfaceSubClass, - alt->desc.bInterfaceProtocol); - } else { - return len + sprintf(buf, "*isc*ip*\n"); - } + return sprintf(buf, "usb:v%04Xp%04Xd%04Xdc%02Xdsc%02Xdp%02X" + "ic%02Xisc%02Xip%02X\n", + le16_to_cpu(udev->descriptor.idVendor), + le16_to_cpu(udev->descriptor.idProduct), + le16_to_cpu(udev->descriptor.bcdDevice), + udev->descriptor.bDeviceClass, + udev->descriptor.bDeviceSubClass, + udev->descriptor.bDeviceProtocol, + alt->desc.bInterfaceClass, + alt->desc.bInterfaceSubClass, + alt->desc.bInterfaceProtocol); } static DEVICE_ATTR(modalias, S_IRUGO, show_modalias, NULL); Index: linux-2.6.14-ck8/drivers/usb/core/usb.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/usb/core/usb.c +++ linux-2.6.14-ck8/drivers/usb/core/usb.c @@ -557,6 +557,7 @@ static int usb_hotplug (struct device *d { struct usb_interface *intf; struct usb_device *usb_dev; + struct usb_host_interface *alt; int i = 0; int length = 0; @@ -573,7 +574,8 @@ static int usb_hotplug (struct device *d intf = to_usb_interface(dev); usb_dev = interface_to_usbdev (intf); - + alt = intf->cur_altsetting; + if (usb_dev->devnum < 0) { pr_debug ("usb %s: already deleted?\n", dev->bus_id); return -ENODEV; @@ -615,46 +617,27 @@ static int usb_hotplug (struct device *d usb_dev->descriptor.bDeviceProtocol)) return -ENOMEM; - if (usb_dev->descriptor.bDeviceClass == 0) { - struct usb_host_interface *alt = intf->cur_altsetting; + if (add_hotplug_env_var(envp, num_envp, &i, + buffer, buffer_size, &length, + "INTERFACE=%d/%d/%d", + alt->desc.bInterfaceClass, + alt->desc.bInterfaceSubClass, + alt->desc.bInterfaceProtocol)) + return -ENOMEM; - /* 2.4 only exposed interface zero. in 2.5, hotplug - * agents are called for all interfaces, and can use - * $DEVPATH/bInterfaceNumber if necessary. - */ - if (add_hotplug_env_var(envp, num_envp, &i, - buffer, buffer_size, &length, - "INTERFACE=%d/%d/%d", - alt->desc.bInterfaceClass, - alt->desc.bInterfaceSubClass, - alt->desc.bInterfaceProtocol)) - return -ENOMEM; - - if (add_hotplug_env_var(envp, num_envp, &i, - buffer, buffer_size, &length, - "MODALIAS=usb:v%04Xp%04Xd%04Xdc%02Xdsc%02Xdp%02Xic%02Xisc%02Xip%02X", - le16_to_cpu(usb_dev->descriptor.idVendor), - le16_to_cpu(usb_dev->descriptor.idProduct), - le16_to_cpu(usb_dev->descriptor.bcdDevice), - usb_dev->descriptor.bDeviceClass, - usb_dev->descriptor.bDeviceSubClass, - usb_dev->descriptor.bDeviceProtocol, - alt->desc.bInterfaceClass, - alt->desc.bInterfaceSubClass, - alt->desc.bInterfaceProtocol)) - return -ENOMEM; - } else { - if (add_hotplug_env_var(envp, num_envp, &i, - buffer, buffer_size, &length, - "MODALIAS=usb:v%04Xp%04Xd%04Xdc%02Xdsc%02Xdp%02Xic*isc*ip*", - le16_to_cpu(usb_dev->descriptor.idVendor), - le16_to_cpu(usb_dev->descriptor.idProduct), - le16_to_cpu(usb_dev->descriptor.bcdDevice), - usb_dev->descriptor.bDeviceClass, - usb_dev->descriptor.bDeviceSubClass, - usb_dev->descriptor.bDeviceProtocol)) - return -ENOMEM; - } + if (add_hotplug_env_var(envp, num_envp, &i, + buffer, buffer_size, &length, + "MODALIAS=usb:v%04Xp%04Xd%04Xdc%02Xdsc%02Xdp%02Xic%02Xisc%02Xip%02X", + le16_to_cpu(usb_dev->descriptor.idVendor), + le16_to_cpu(usb_dev->descriptor.idProduct), + le16_to_cpu(usb_dev->descriptor.bcdDevice), + usb_dev->descriptor.bDeviceClass, + usb_dev->descriptor.bDeviceSubClass, + usb_dev->descriptor.bDeviceProtocol, + alt->desc.bInterfaceClass, + alt->desc.bInterfaceSubClass, + alt->desc.bInterfaceProtocol)) + return -ENOMEM; envp[i] = NULL; Index: linux-2.6.14-ck8/drivers/usb/image/microtek.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/usb/image/microtek.c +++ linux-2.6.14-ck8/drivers/usb/image/microtek.c @@ -327,6 +327,18 @@ static inline void mts_urb_abort(struct usb_kill_urb( desc->urb ); } +static int mts_slave_alloc (struct scsi_device *s) +{ + s->inquiry_len = 0x24; + return 0; +} + +static int mts_slave_configure (struct scsi_device *s) +{ + blk_queue_dma_alignment(s->request_queue, (512 - 1)); + return 0; +} + static int mts_scsi_abort (Scsi_Cmnd *srb) { struct mts_desc* desc = (struct mts_desc*)(srb->device->host->hostdata[0]); @@ -411,7 +423,7 @@ static void mts_transfer_done( struct ur MTS_INT_INIT(); context->srb->result &= MTS_SCSI_ERR_MASK; - context->srb->result |= (unsigned)context->status<<1; + context->srb->result |= (unsigned)(*context->scsi_status)<<1; mts_transfer_cleanup(transfer); @@ -427,7 +439,7 @@ static void mts_get_status( struct urb * mts_int_submit_urb(transfer, usb_rcvbulkpipe(context->instance->usb_dev, context->instance->ep_response), - &context->status, + context->scsi_status, 1, mts_transfer_done ); } @@ -481,7 +493,7 @@ static void mts_command_done( struct urb context->data_pipe, context->data, context->data_length, - context->srb->use_sg ? mts_do_sg : mts_data_done); + context->srb->use_sg > 1 ? mts_do_sg : mts_data_done); } else { mts_get_status(transfer); } @@ -627,7 +639,6 @@ int mts_scsi_queuecommand( Scsi_Cmnd *sr callback(srb); } - out: return err; } @@ -645,6 +656,9 @@ static Scsi_Host_Template mts_scsi_host_ .cmd_per_lun = 1, .use_clustering = 1, .emulated = 1, + .slave_alloc = mts_slave_alloc, + .slave_configure = mts_slave_configure, + .max_sectors= 256, /* 128 K */ }; struct vendor_product @@ -782,6 +796,10 @@ static int mts_usb_probe(struct usb_inte if (!new_desc->urb) goto out_kfree; + new_desc->context.scsi_status = kmalloc(1, GFP_KERNEL); + if (!new_desc->context.scsi_status) + goto out_kfree2; + new_desc->usb_dev = dev; new_desc->usb_intf = intf; init_MUTEX(&new_desc->lock); @@ -818,6 +836,8 @@ static int mts_usb_probe(struct usb_inte usb_set_intfdata(intf, new_desc); return 0; + out_kfree2: + kfree(new_desc->context.scsi_status); out_free_urb: usb_free_urb(new_desc->urb); out_kfree: @@ -837,6 +857,7 @@ static void mts_usb_disconnect (struct u scsi_host_put(desc->host); usb_free_urb(desc->urb); + kfree(desc->context.scsi_status); kfree(desc); } @@ -857,5 +878,3 @@ module_exit(microtek_drv_exit); MODULE_AUTHOR( DRIVER_AUTHOR ); MODULE_DESCRIPTION( DRIVER_DESC ); MODULE_LICENSE("GPL"); - - Index: linux-2.6.14-ck8/drivers/usb/image/microtek.h =================================================================== --- linux-2.6.14-ck8.orig/drivers/usb/image/microtek.h +++ linux-2.6.14-ck8/drivers/usb/image/microtek.h @@ -22,7 +22,7 @@ struct mts_transfer_context int data_pipe; int fragment; - u8 status; /* status returned from ep_response after command completion */ + u8 *scsi_status; /* status returned from ep_response after command completion */ }; Index: linux-2.6.14-ck8/drivers/usb/input/hid-input.c =================================================================== --- linux-2.6.14-ck8.orig/drivers/usb/input/hid-input.c +++ linux-2.6.14-ck8/drivers/usb/input/hid-input.c @@ -137,6 +137,7 @@ static void hidinput_configure_usage(str switch (usage->hid & 0xffff) { case 0xba: map_abs(ABS_RUDDER); break; case 0xbb: map_abs(ABS_THROTTLE); break; + default: goto ignore; } break; Index: linux-2.6.14-ck8/fs/exec.c =================================================================== --- linux-2.6.14-ck8.orig/fs/exec.c +++ linux-2.6.14-ck8/fs/exec.c @@ -593,6 +593,7 @@ static inline int de_thread(struct task_ struct signal_struct *sig = tsk->signal; struct sighand_struct *newsighand, *oldsighand = tsk->sighand; spinlock_t *lock = &oldsighand->siglock; + struct task_struct *leader = NULL; int count; /* @@ -668,7 +669,7 @@ static inline int de_thread(struct task_ * and to assume its PID: */ if (!thread_group_leader(current)) { - struct task_struct *leader = current->group_leader, *parent; + struct task_struct *parent; struct dentry *proc_dentry1, *proc_dentry2; unsigned long exit_state, ptrace; @@ -677,6 +678,7 @@ static inline int de_thread(struct task_ * It should already be zombie at this point, most * of the time. */ + leader = current->group_leader; while (leader->exit_state != EXIT_ZOMBIE) yield(); @@ -736,7 +738,6 @@ static inline int de_thread(struct task_ proc_pid_flush(proc_dentry2); BUG_ON(exit_state != EXIT_ZOMBIE); - release_task(leader); } /* @@ -746,8 +747,11 @@ static inline int de_thread(struct task_ sig->flags = 0; no_thread_group: - BUG_ON(atomic_read(&sig->count) != 1); exit_itimers(sig); + if (leader) + release_task(leader); + + BUG_ON(atomic_read(&sig->count) != 1); if (atomic_read(&oldsighand->count) == 1) { /* Index: linux-2.6.14-ck8/fs/locks.c =================================================================== --- linux-2.6.14-ck8.orig/fs/locks.c +++ linux-2.6.14-ck8/fs/locks.c @@ -1418,7 +1418,7 @@ int fcntl_setlease(unsigned int fd, stru lock_kernel(); error = __setlease(filp, arg, &flp); - if (error) + if (error || arg == F_UNLCK) goto out_unlock; error = fasync_helper(fd, filp, 1, &flp->fl_fasync); Index: linux-2.6.14-ck8/fs/nfsd/nfs2acl.c =================================================================== --- linux-2.6.14-ck8.orig/fs/nfsd/nfs2acl.c +++ linux-2.6.14-ck8/fs/nfsd/nfs2acl.c @@ -107,7 +107,7 @@ static int nfsacld_proc_setacl(struct sv dprintk("nfsd: SETACL(2acl) %s\n", SVCFH_fmt(&argp->fh)); fh = fh_copy(&resp->fh, &argp->fh); - nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP); + nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_SATTR); if (!nfserr) { nfserr = nfserrno( nfsd_set_posix_acl( Index: linux-2.6.14-ck8/fs/nfsd/nfs3acl.c =================================================================== --- linux-2.6.14-ck8.orig/fs/nfsd/nfs3acl.c +++ linux-2.6.14-ck8/fs/nfsd/nfs3acl.c @@ -101,7 +101,7 @@ static int nfsd3_proc_setacl(struct svc_ int nfserr = 0; fh = fh_copy(&resp->fh, &argp->fh); - nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP); + nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_SATTR); if (!nfserr) { nfserr = nfserrno( nfsd_set_posix_acl( Index: linux-2.6.14-ck8/fs/xattr.c =================================================================== --- linux-2.6.14-ck8.orig/fs/xattr.c +++ linux-2.6.14-ck8/fs/xattr.c @@ -243,7 +243,7 @@ listxattr(struct dentry *d, char __user error = d->d_inode->i_op->listxattr(d, klist, size); } else { error = security_inode_listsecurity(d->d_inode, klist, size); - if (size && error >= size) + if (size && error > size) error = -ERANGE; } if (error > 0) { Index: linux-2.6.14-ck8/fs/xfs/Kconfig =================================================================== --- linux-2.6.14-ck8.orig/fs/xfs/Kconfig +++ linux-2.6.14-ck8/fs/xfs/Kconfig @@ -24,7 +24,7 @@ config XFS_EXPORT default y config XFS_QUOTA - tristate "XFS Quota support" + bool "XFS Quota support" depends on XFS_FS help If you say Y here, you will be able to set limits for disk usage on Index: linux-2.6.14-ck8/include/asm-alpha/barrier.h =================================================================== --- linux-2.6.14-ck8.orig/include/asm-alpha/barrier.h +++ linux-2.6.14-ck8/include/asm-alpha/barrier.h @@ -1,6 +1,8 @@ #ifndef __BARRIER_H #define __BARRIER_H +#include + #define mb() \ __asm__ __volatile__("mb": : :"memory") Index: linux-2.6.14-ck8/include/linux/cciss_ioctl.h =================================================================== --- linux-2.6.14-ck8.orig/include/linux/cciss_ioctl.h +++ linux-2.6.14-ck8/include/linux/cciss_ioctl.h @@ -10,8 +10,8 @@ typedef struct _cciss_pci_info_struct { unsigned char bus; - unsigned short domain; unsigned char dev_fn; + unsigned short domain; __u32 board_id; } cciss_pci_info_struct; Index: linux-2.6.14-ck8/include/linux/proc_fs.h =================================================================== --- linux-2.6.14-ck8.orig/include/linux/proc_fs.h +++ linux-2.6.14-ck8/include/linux/proc_fs.h @@ -66,6 +66,7 @@ struct proc_dir_entry { write_proc_t *write_proc; atomic_t count; /* use count */ int deleted; /* delete flag */ + void *set; }; struct kcore_list { Index: linux-2.6.14-ck8/include/linux/rtnetlink.h =================================================================== --- linux-2.6.14-ck8.orig/include/linux/rtnetlink.h +++ linux-2.6.14-ck8/include/linux/rtnetlink.h @@ -866,6 +866,7 @@ enum rtnetlink_groups { #define RTNLGRP_IPV4_MROUTE RTNLGRP_IPV4_MROUTE RTNLGRP_IPV4_ROUTE, #define RTNLGRP_IPV4_ROUTE RTNLGRP_IPV4_ROUTE + RTNLGRP_NOP1, RTNLGRP_IPV6_IFADDR, #define RTNLGRP_IPV6_IFADDR RTNLGRP_IPV6_IFADDR RTNLGRP_IPV6_MROUTE, @@ -876,8 +877,11 @@ enum rtnetlink_groups { #define RTNLGRP_IPV6_IFINFO RTNLGRP_IPV6_IFINFO RTNLGRP_DECnet_IFADDR, #define RTNLGRP_DECnet_IFADDR RTNLGRP_DECnet_IFADDR + RTNLGRP_NOP2, RTNLGRP_DECnet_ROUTE, #define RTNLGRP_DECnet_ROUTE RTNLGRP_DECnet_ROUTE + RTNLGRP_NOP3, + RTNLGRP_NOP4, RTNLGRP_IPV6_PREFIX, #define RTNLGRP_IPV6_PREFIX RTNLGRP_IPV6_PREFIX __RTNLGRP_MAX Index: linux-2.6.14-ck8/include/linux/sysctl.h =================================================================== --- linux-2.6.14-ck8.orig/include/linux/sysctl.h +++ linux-2.6.14-ck8/include/linux/sysctl.h @@ -24,6 +24,7 @@ #include struct file; +struct completion; #define CTL_MAXNAME 10 /* how many path components do we allow in a call to sysctl? In other words, what is @@ -930,6 +931,8 @@ struct ctl_table_header { ctl_table *ctl_table; struct list_head ctl_entry; + int used; + struct completion *unregistering; }; struct ctl_table_header * register_sysctl_table(ctl_table * table, Index: linux-2.6.14-ck8/include/net/ipv6.h =================================================================== --- linux-2.6.14-ck8.orig/include/net/ipv6.h +++ linux-2.6.14-ck8/include/net/ipv6.h @@ -237,6 +237,8 @@ extern struct ipv6_txoptions * ipv6_rene int newtype, struct ipv6_opt_hdr __user *newopt, int newoptlen); +struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space, + struct ipv6_txoptions *opt); extern int ip6_frag_nqueues; extern atomic_t ip6_frag_mem; Index: linux-2.6.14-ck8/include/net/xfrm.h =================================================================== --- linux-2.6.14-ck8.orig/include/net/xfrm.h +++ linux-2.6.14-ck8/include/net/xfrm.h @@ -890,6 +890,7 @@ struct xfrm_state * xfrm_find_acq(u8 mod extern void xfrm_policy_flush(void); extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol); extern int xfrm_flush_bundles(void); +extern void xfrm_flush_all_bundles(void); extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family); extern void xfrm_init_pmtu(struct dst_entry *dst); Index: linux-2.6.14-ck8/include/scsi/scsi_cmnd.h =================================================================== --- linux-2.6.14-ck8.orig/include/scsi/scsi_cmnd.h +++ linux-2.6.14-ck8/include/scsi/scsi_cmnd.h @@ -150,5 +150,6 @@ extern struct scsi_cmnd *scsi_get_comman extern void scsi_put_command(struct scsi_cmnd *); extern void scsi_io_completion(struct scsi_cmnd *, unsigned int, unsigned int); extern void scsi_finish_command(struct scsi_cmnd *cmd); +extern void scsi_setup_blk_pc_cmnd(struct scsi_cmnd *cmd, int retries); #endif /* _SCSI_SCSI_CMND_H */ Index: linux-2.6.14-ck8/kernel/audit.c =================================================================== --- linux-2.6.14-ck8.orig/kernel/audit.c +++ linux-2.6.14-ck8/kernel/audit.c @@ -291,8 +291,10 @@ int kauditd_thread(void *dummy) set_current_state(TASK_INTERRUPTIBLE); add_wait_queue(&kauditd_wait, &wait); - if (!skb_queue_len(&audit_skb_queue)) + if (!skb_queue_len(&audit_skb_queue)) { + try_to_freeze(); schedule(); + } __set_current_state(TASK_RUNNING); remove_wait_queue(&kauditd_wait, &wait); Index: linux-2.6.14-ck8/kernel/params.c =================================================================== --- linux-2.6.14-ck8.orig/kernel/params.c +++ linux-2.6.14-ck8/kernel/params.c @@ -618,7 +618,7 @@ static void __init param_sysfs_builtin(v /* module-related sysfs stuff */ -#ifdef CONFIG_MODULES +#ifdef CONFIG_SYSFS #define to_module_attr(n) container_of(n, struct module_attribute, attr); #define to_module_kobject(n) container_of(n, struct module_kobject, kobj); Index: linux-2.6.14-ck8/kernel/ptrace.c =================================================================== --- linux-2.6.14-ck8.orig/kernel/ptrace.c +++ linux-2.6.14-ck8/kernel/ptrace.c @@ -152,7 +152,7 @@ int ptrace_attach(struct task_struct *ta retval = -EPERM; if (task->pid <= 1) goto bad; - if (task == current) + if (task->tgid == current->tgid) goto bad; /* the same process cannot be attached many times */ if (task->ptrace & PT_PTRACED) @@ -238,7 +238,8 @@ int access_process_vm(struct task_struct if (write) { copy_to_user_page(vma, page, addr, maddr + offset, buf, bytes); - set_page_dirty_lock(page); + if (!PageCompound(page)) + set_page_dirty_lock(page); } else { copy_from_user_page(vma, page, addr, buf, maddr + offset, bytes); Index: linux-2.6.14-ck8/kernel/signal.c =================================================================== --- linux-2.6.14-ck8.orig/kernel/signal.c +++ linux-2.6.14-ck8/kernel/signal.c @@ -406,6 +406,8 @@ void __exit_signal(struct task_struct *t void exit_signal(struct task_struct *tsk) { + atomic_dec(&tsk->signal->live); + write_lock_irq(&tasklist_lock); __exit_signal(tsk); write_unlock_irq(&tasklist_lock); @@ -1522,7 +1524,7 @@ void do_notify_parent(struct task_struct psig = tsk->parent->sighand; spin_lock_irqsave(&psig->siglock, flags); - if (sig == SIGCHLD && + if (!tsk->ptrace && sig == SIGCHLD && (psig->action[SIGCHLD-1].sa.sa_handler == SIG_IGN || (psig->action[SIGCHLD-1].sa.sa_flags & SA_NOCLDWAIT))) { /* Index: linux-2.6.14-ck8/kernel/sysctl.c =================================================================== --- linux-2.6.14-ck8.orig/kernel/sysctl.c +++ linux-2.6.14-ck8/kernel/sysctl.c @@ -169,7 +169,7 @@ struct file_operations proc_sys_file_ope extern struct proc_dir_entry *proc_sys_root; -static void register_proc_table(ctl_table *, struct proc_dir_entry *); +static void register_proc_table(ctl_table *, struct proc_dir_entry *, void *); static void unregister_proc_table(ctl_table *, struct proc_dir_entry *); #endif @@ -1038,10 +1038,51 @@ static ctl_table dev_table[] = { extern void init_irq_proc (void); +static DEFINE_SPINLOCK(sysctl_lock); + +/* called under sysctl_lock */ +static int use_table(struct ctl_table_header *p) +{ + if (unlikely(p->unregistering)) + return 0; + p->used++; + return 1; +} + +/* called under sysctl_lock */ +static void unuse_table(struct ctl_table_header *p) +{ + if (!--p->used) + if (unlikely(p->unregistering)) + complete(p->unregistering); +} + +/* called under sysctl_lock, will reacquire if has to wait */ +static void start_unregistering(struct ctl_table_header *p) +{ + /* + * if p->used is 0, nobody will ever touch that entry again; + * we'll eliminate all paths to it before dropping sysctl_lock + */ + if (unlikely(p->used)) { + struct completion wait; + init_completion(&wait); + p->unregistering = &wait; + spin_unlock(&sysctl_lock); + wait_for_completion(&wait); + spin_lock(&sysctl_lock); + } + /* + * do not remove from the list until nobody holds it; walking the + * list in do_sysctl() relies on that. + */ + list_del_init(&p->ctl_entry); +} + void __init sysctl_init(void) { #ifdef CONFIG_PROC_FS - register_proc_table(root_table, proc_sys_root); + register_proc_table(root_table, proc_sys_root, &root_table_header); init_irq_proc(); #endif } @@ -1050,6 +1091,7 @@ int do_sysctl(int __user *name, int nlen void __user *newval, size_t newlen) { struct list_head *tmp; + int error = -ENOTDIR; if (nlen <= 0 || nlen >= CTL_MAXNAME) return -ENOTDIR; @@ -1058,20 +1100,30 @@ int do_sysctl(int __user *name, int nlen if (!oldlenp || get_user(old_len, oldlenp)) return -EFAULT; } + spin_lock(&sysctl_lock); tmp = &root_table_header.ctl_entry; do { struct ctl_table_header *head = list_entry(tmp, struct ctl_table_header, ctl_entry); void *context = NULL; - int error = parse_table(name, nlen, oldval, oldlenp, + + if (!use_table(head)) + continue; + + spin_unlock(&sysctl_lock); + + error = parse_table(name, nlen, oldval, oldlenp, newval, newlen, head->ctl_table, &context); kfree(context); + + spin_lock(&sysctl_lock); + unuse_table(head); if (error != -ENOTDIR) - return error; - tmp = tmp->next; - } while (tmp != &root_table_header.ctl_entry); - return -ENOTDIR; + break; + } while ((tmp = tmp->next) != &root_table_header.ctl_entry); + spin_unlock(&sysctl_lock); + return error; } asmlinkage long sys_sysctl(struct __sysctl_args __user *args) @@ -1282,12 +1334,16 @@ struct ctl_table_header *register_sysctl return NULL; tmp->ctl_table = table; INIT_LIST_HEAD(&tmp->ctl_entry); + tmp->used = 0; + tmp->unregistering = NULL; + spin_lock(&sysctl_lock); if (insert_at_head) list_add(&tmp->ctl_entry, &root_table_header.ctl_entry); else list_add_tail(&tmp->ctl_entry, &root_table_header.ctl_entry); + spin_unlock(&sysctl_lock); #ifdef CONFIG_PROC_FS - register_proc_table(table, proc_sys_root); + register_proc_table(table, proc_sys_root, tmp); #endif return tmp; } @@ -1301,10 +1357,13 @@ struct ctl_table_header *register_sysctl */ void unregister_sysctl_table(struct ctl_table_header * header) { - list_del(&header->ctl_entry); + might_sleep(); + spin_lock(&sysctl_lock); + start_unregistering(header); #ifdef CONFIG_PROC_FS unregister_proc_table(header->ctl_table, proc_sys_root); #endif + spin_unlock(&sysctl_lock); kfree(header); } @@ -1315,7 +1374,7 @@ void unregister_sysctl_table(struct ctl_ #ifdef CONFIG_PROC_FS /* Scan the sysctl entries in table and add them all into /proc */ -static void register_proc_table(ctl_table * table, struct proc_dir_entry *root) +static void register_proc_table(ctl_table * table, struct proc_dir_entry *root, void *set) { struct proc_dir_entry *de; int len; @@ -1351,13 +1410,14 @@ static void register_proc_table(ctl_tabl de = create_proc_entry(table->procname, mode, root); if (!de) continue; + de->set = set; de->data = (void *) table; if (table->proc_handler) de->proc_fops = &proc_sys_file_operations; } table->de = de; if (de->mode & S_IFDIR) - register_proc_table(table->child, de); + register_proc_table(table->child, de, set); } } @@ -1382,6 +1442,13 @@ static void unregister_proc_table(ctl_ta continue; } + /* + * In any case, mark the entry as goner; we'll keep it + * around if it's busy, but we'll know to do nothing with + * its fields. We are under sysctl_lock here. + */ + de->data = NULL; + /* Don't unregister proc entries that are still being used.. */ if (atomic_read(&de->count)) continue; @@ -1395,27 +1462,38 @@ static ssize_t do_rw_proc(int write, str size_t count, loff_t *ppos) { int op; - struct proc_dir_entry *de; + struct proc_dir_entry *de = PDE(file->f_dentry->d_inode); struct ctl_table *table; size_t res; - ssize_t error; - - de = PDE(file->f_dentry->d_inode); - if (!de || !de->data) - return -ENOTDIR; - table = (struct ctl_table *) de->data; - if (!table || !table->proc_handler) - return -ENOTDIR; - op = (write ? 002 : 004); - if (ctl_perm(table, op)) - return -EPERM; + ssize_t error = -ENOTDIR; - res = count; - - error = (*table->proc_handler) (table, write, file, buf, &res, ppos); - if (error) - return error; - return res; + spin_lock(&sysctl_lock); + if (de && de->data && use_table(de->set)) { + /* + * at that point we know that sysctl was not unregistered + * and won't be until we finish + */ + spin_unlock(&sysctl_lock); + table = (struct ctl_table *) de->data; + if (!table || !table->proc_handler) + goto out; + error = -EPERM; + op = (write ? 002 : 004); + if (ctl_perm(table, op)) + goto out; + + /* careful: calling conventions are nasty here */ + res = count; + error = (*table->proc_handler)(table, write, file, + buf, &res, ppos); + if (!error) + error = res; + out: + spin_lock(&sysctl_lock); + unuse_table(de->set); + } + spin_unlock(&sysctl_lock); + return error; } static int proc_opensys(struct inode *inode, struct file *file) Index: linux-2.6.14-ck8/mm/truncate.c =================================================================== --- linux-2.6.14-ck8.orig/mm/truncate.c +++ linux-2.6.14-ck8/mm/truncate.c @@ -291,8 +291,8 @@ int invalidate_inode_pages2_range(struct * Zap the rest of the file in one hit. */ unmap_mapping_range(mapping, - page_index << PAGE_CACHE_SHIFT, - (end - page_index + 1) + (loff_t)page_index<lock); br_stp_recalculate_bridge_id(br); + br_features_recompute(br); if ((br->dev->flags & IFF_UP) && (dev->flags & IFF_UP) && netif_carrier_ok(dev)) br_stp_enable_port(p); Index: linux-2.6.14-ck8/net/bridge/br_netfilter.c =================================================================== --- linux-2.6.14-ck8.orig/net/bridge/br_netfilter.c +++ linux-2.6.14-ck8/net/bridge/br_netfilter.c @@ -295,7 +295,7 @@ static int check_hbh_len(struct sk_buff len -= 2; while (len > 0) { - int optlen = raw[off+1]+2; + int optlen = skb->nh.raw[off+1]+2; switch (skb->nh.raw[off]) { case IPV6_TLV_PAD0: @@ -308,18 +308,15 @@ static int check_hbh_len(struct sk_buff case IPV6_TLV_JUMBO: if (skb->nh.raw[off+1] != 4 || (off&3) != 2) goto bad; - pkt_len = ntohl(*(u32*)(skb->nh.raw+off+2)); - + if (pkt_len <= IPV6_MAXPLEN || + skb->nh.ipv6h->payload_len) + goto bad; if (pkt_len > skb->len - sizeof(struct ipv6hdr)) goto bad; - if (pkt_len + sizeof(struct ipv6hdr) < skb->len) { - if (__pskb_trim(skb, - pkt_len + sizeof(struct ipv6hdr))) - goto bad; - if (skb->ip_summed == CHECKSUM_HW) - skb->ip_summed = CHECKSUM_NONE; - } + if (pskb_trim_rcsum(skb, + pkt_len+sizeof(struct ipv6hdr))) + goto bad; break; default: if (optlen > len) Index: linux-2.6.14-ck8/net/core/datagram.c =================================================================== --- linux-2.6.14-ck8.orig/net/core/datagram.c +++ linux-2.6.14-ck8/net/core/datagram.c @@ -213,6 +213,10 @@ int skb_copy_datagram_iovec(const struct { int i, err, fraglen, end = 0; struct sk_buff *next = skb_shinfo(skb)->frag_list; + + if (!len) + return 0; + next_skb: fraglen = skb_headlen(skb); i = -1; Index: linux-2.6.14-ck8/net/ipv4/fib_frontend.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv4/fib_frontend.c +++ linux-2.6.14-ck8/net/ipv4/fib_frontend.c @@ -545,12 +545,16 @@ static void nl_fib_input(struct sock *sk struct sk_buff *skb = NULL; struct nlmsghdr *nlh = NULL; struct fib_result_nl *frn; - int err; u32 pid; struct fib_table *tb; - skb = skb_recv_datagram(sk, 0, 0, &err); + skb = skb_dequeue(&sk->sk_receive_queue); nlh = (struct nlmsghdr *)skb->data; + if (skb->len < NLMSG_SPACE(0) || skb->len < nlh->nlmsg_len || + nlh->nlmsg_len < NLMSG_LENGTH(sizeof(*frn))) { + kfree_skb(skb); + return; + } frn = (struct fib_result_nl *) NLMSG_DATA(nlh); tb = fib_get_table(frn->tb_id_in); Index: linux-2.6.14-ck8/net/ipv4/ip_gre.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv4/ip_gre.c +++ linux-2.6.14-ck8/net/ipv4/ip_gre.c @@ -617,7 +617,7 @@ static int ipgre_rcv(struct sk_buff *skb skb->mac.raw = skb->nh.raw; skb->nh.raw = __pskb_pull(skb, offset); - skb_postpull_rcsum(skb, skb->mac.raw, offset); + skb_postpull_rcsum(skb, skb->h.raw, offset); memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options)); skb->pkt_type = PACKET_HOST; #ifdef CONFIG_NET_IPGRE_BROADCAST Index: linux-2.6.14-ck8/net/ipv4/ipvs/ip_vs_core.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv4/ipvs/ip_vs_core.c +++ linux-2.6.14-ck8/net/ipv4/ipvs/ip_vs_core.c @@ -1009,11 +1009,10 @@ ip_vs_in(unsigned int hooknum, struct sk if (sysctl_ip_vs_expire_nodest_conn) { /* try to expire the connection immediately */ ip_vs_conn_expire_now(cp); - } else { - /* don't restart its timer, and silently - drop the packet. */ - __ip_vs_conn_put(cp); } + /* don't restart its timer, and silently + drop the packet. */ + __ip_vs_conn_put(cp); return NF_DROP; } Index: linux-2.6.14-ck8/net/ipv4/netfilter/Makefile =================================================================== --- linux-2.6.14-ck8.orig/net/ipv4/netfilter/Makefile +++ linux-2.6.14-ck8/net/ipv4/netfilter/Makefile @@ -12,6 +12,7 @@ ip_nat_pptp-objs := ip_nat_helper_pptp.o # connection tracking obj-$(CONFIG_IP_NF_CONNTRACK) += ip_conntrack.o +obj-$(CONFIG_IP_NF_NAT) += ip_nat.o # conntrack netlink interface obj-$(CONFIG_IP_NF_CONNTRACK_NETLINK) += ip_conntrack_netlink.o @@ -41,7 +42,7 @@ obj-$(CONFIG_IP_NF_IPTABLES) += ip_table # the three instances of ip_tables obj-$(CONFIG_IP_NF_FILTER) += iptable_filter.o obj-$(CONFIG_IP_NF_MANGLE) += iptable_mangle.o -obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o ip_nat.o +obj-$(CONFIG_IP_NF_NAT) += iptable_nat.o obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o # matches Index: linux-2.6.14-ck8/net/ipv4/netfilter/ip_conntrack_ftp.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv4/netfilter/ip_conntrack_ftp.c +++ linux-2.6.14-ck8/net/ipv4/netfilter/ip_conntrack_ftp.c @@ -29,9 +29,9 @@ static char *ftp_buffer; static DEFINE_SPINLOCK(ip_ftp_lock); #define MAX_PORTS 8 -static short ports[MAX_PORTS]; +static unsigned short ports[MAX_PORTS]; static int ports_c; -module_param_array(ports, short, &ports_c, 0400); +module_param_array(ports, ushort, &ports_c, 0400); static int loose; module_param(loose, int, 0600); Index: linux-2.6.14-ck8/net/ipv4/netfilter/ip_conntrack_irc.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv4/netfilter/ip_conntrack_irc.c +++ linux-2.6.14-ck8/net/ipv4/netfilter/ip_conntrack_irc.c @@ -34,7 +34,7 @@ #include #define MAX_PORTS 8 -static short ports[MAX_PORTS]; +static unsigned short ports[MAX_PORTS]; static int ports_c; static int max_dcc_channels = 8; static unsigned int dcc_timeout = 300; @@ -52,7 +52,7 @@ EXPORT_SYMBOL_GPL(ip_nat_irc_hook); MODULE_AUTHOR("Harald Welte "); MODULE_DESCRIPTION("IRC (DCC) connection tracking helper"); MODULE_LICENSE("GPL"); -module_param_array(ports, short, &ports_c, 0400); +module_param_array(ports, ushort, &ports_c, 0400); MODULE_PARM_DESC(ports, "port numbers of IRC servers"); module_param(max_dcc_channels, int, 0400); MODULE_PARM_DESC(max_dcc_channels, "max number of expected DCC channels per IRC session"); Index: linux-2.6.14-ck8/net/ipv4/netfilter/ip_conntrack_netlink.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv4/netfilter/ip_conntrack_netlink.c +++ linux-2.6.14-ck8/net/ipv4/netfilter/ip_conntrack_netlink.c @@ -58,14 +58,17 @@ ctnetlink_dump_tuples_proto(struct sk_bu const struct ip_conntrack_tuple *tuple) { struct ip_conntrack_protocol *proto; + int ret = 0; NFA_PUT(skb, CTA_PROTO_NUM, sizeof(u_int8_t), &tuple->dst.protonum); proto = ip_conntrack_proto_find_get(tuple->dst.protonum); - if (proto && proto->tuple_to_nfattr) - return proto->tuple_to_nfattr(skb, tuple); + if (likely(proto && proto->tuple_to_nfattr)) { + ret = proto->tuple_to_nfattr(skb, tuple); + ip_conntrack_proto_put(proto); + } - return 0; + return ret; nfattr_failure: return -1; @@ -503,7 +506,7 @@ nfattr_failure: } static const int cta_min_proto[CTA_PROTO_MAX] = { - [CTA_PROTO_NUM-1] = sizeof(u_int16_t), + [CTA_PROTO_NUM-1] = sizeof(u_int8_t), [CTA_PROTO_SRC_PORT-1] = sizeof(u_int16_t), [CTA_PROTO_DST_PORT-1] = sizeof(u_int16_t), [CTA_PROTO_ICMP_TYPE-1] = sizeof(u_int8_t), @@ -529,7 +532,7 @@ ctnetlink_parse_tuple_proto(struct nfatt if (!tb[CTA_PROTO_NUM-1]) return -EINVAL; - tuple->dst.protonum = *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_NUM-1]); + tuple->dst.protonum = *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_NUM-1]); proto = ip_conntrack_proto_find_get(tuple->dst.protonum); Index: linux-2.6.14-ck8/net/ipv4/netfilter/ip_conntrack_proto_icmp.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv4/netfilter/ip_conntrack_proto_icmp.c +++ linux-2.6.14-ck8/net/ipv4/netfilter/ip_conntrack_proto_icmp.c @@ -296,7 +296,8 @@ static int icmp_nfattr_to_tuple(struct n struct ip_conntrack_tuple *tuple) { if (!tb[CTA_PROTO_ICMP_TYPE-1] - || !tb[CTA_PROTO_ICMP_CODE-1]) + || !tb[CTA_PROTO_ICMP_CODE-1] + || !tb[CTA_PROTO_ICMP_ID-1]) return -1; tuple->dst.u.icmp.type = Index: linux-2.6.14-ck8/net/ipv4/netfilter/ip_conntrack_proto_tcp.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv4/netfilter/ip_conntrack_proto_tcp.c +++ linux-2.6.14-ck8/net/ipv4/netfilter/ip_conntrack_proto_tcp.c @@ -341,9 +341,10 @@ static int tcp_print_conntrack(struct se static int tcp_to_nfattr(struct sk_buff *skb, struct nfattr *nfa, const struct ip_conntrack *ct) { - struct nfattr *nest_parms = NFA_NEST(skb, CTA_PROTOINFO_TCP); + struct nfattr *nest_parms; read_lock_bh(&tcp_lock); + nest_parms = NFA_NEST(skb, CTA_PROTOINFO_TCP); NFA_PUT(skb, CTA_PROTOINFO_TCP_STATE, sizeof(u_int8_t), &ct->proto.tcp.state); read_unlock_bh(&tcp_lock); @@ -362,6 +363,11 @@ static int nfattr_to_tcp(struct nfattr * struct nfattr *attr = cda[CTA_PROTOINFO_TCP-1]; struct nfattr *tb[CTA_PROTOINFO_TCP_MAX]; + /* updates could not contain anything about the private + * protocol info, in that case skip the parsing */ + if (!attr) + return 0; + if (nfattr_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, attr) < 0) goto nfattr_failure; @@ -813,6 +819,7 @@ static u8 tcp_valid_flags[(TH_FIN|TH_SYN { [TH_SYN] = 1, [TH_SYN|TH_ACK] = 1, + [TH_SYN|TH_PUSH] = 1, [TH_SYN|TH_ACK|TH_PUSH] = 1, [TH_RST] = 1, [TH_RST|TH_ACK] = 1, Index: linux-2.6.14-ck8/net/ipv4/netfilter/ip_conntrack_tftp.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv4/netfilter/ip_conntrack_tftp.c +++ linux-2.6.14-ck8/net/ipv4/netfilter/ip_conntrack_tftp.c @@ -26,9 +26,9 @@ MODULE_DESCRIPTION("tftp connection trac MODULE_LICENSE("GPL"); #define MAX_PORTS 8 -static short ports[MAX_PORTS]; +static unsigned short ports[MAX_PORTS]; static int ports_c; -module_param_array(ports, short, &ports_c, 0400); +module_param_array(ports, ushort, &ports_c, 0400); MODULE_PARM_DESC(ports, "port numbers of tftp servers"); #if 0 Index: linux-2.6.14-ck8/net/ipv4/netfilter/ip_nat_core.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv4/netfilter/ip_nat_core.c +++ linux-2.6.14-ck8/net/ipv4/netfilter/ip_nat_core.c @@ -66,10 +66,8 @@ ip_nat_proto_find_get(u_int8_t protonum) * removed until we've grabbed the reference */ preempt_disable(); p = __ip_nat_proto_find(protonum); - if (p) { - if (!try_module_get(p->me)) - p = &ip_nat_unknown_protocol; - } + if (!try_module_get(p->me)) + p = &ip_nat_unknown_protocol; preempt_enable(); return p; Index: linux-2.6.14-ck8/net/ipv4/netfilter/ip_nat_helper_pptp.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv4/netfilter/ip_nat_helper_pptp.c +++ linux-2.6.14-ck8/net/ipv4/netfilter/ip_nat_helper_pptp.c @@ -73,6 +73,7 @@ static void pptp_nat_expected(struct ip_ struct ip_conntrack_tuple t; struct ip_ct_pptp_master *ct_pptp_info; struct ip_nat_pptp *nat_pptp_info; + struct ip_nat_range range; ct_pptp_info = &master->help.ct_pptp_info; nat_pptp_info = &master->nat.help.nat_pptp_info; @@ -110,7 +111,30 @@ static void pptp_nat_expected(struct ip_ DEBUGP("not found!\n"); } - ip_nat_follow_master(ct, exp); + /* This must be a fresh one. */ + BUG_ON(ct->status & IPS_NAT_DONE_MASK); + + /* Change src to where master sends to */ + range.flags = IP_NAT_RANGE_MAP_IPS; + range.min_ip = range.max_ip + = ct->master->tuplehash[!exp->dir].tuple.dst.ip; + if (exp->dir == IP_CT_DIR_ORIGINAL) { + range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED; + range.min = range.max = exp->saved_proto; + } + /* hook doesn't matter, but it has to do source manip */ + ip_nat_setup_info(ct, &range, NF_IP_POST_ROUTING); + + /* For DST manip, map port here to where it's expected. */ + range.flags = IP_NAT_RANGE_MAP_IPS; + range.min_ip = range.max_ip + = ct->master->tuplehash[!exp->dir].tuple.src.ip; + if (exp->dir == IP_CT_DIR_REPLY) { + range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED; + range.min = range.max = exp->saved_proto; + } + /* hook doesn't matter, but it has to do destination manip */ + ip_nat_setup_info(ct, &range, NF_IP_PRE_ROUTING); } /* outbound packets == from PNS to PAC */ @@ -213,7 +237,7 @@ pptp_exp_gre(struct ip_conntrack_expect /* alter expectation for PNS->PAC direction */ invert_tuplepr(&inv_t, &expect_orig->tuple); - expect_orig->saved_proto.gre.key = htons(nat_pptp_info->pac_call_id); + expect_orig->saved_proto.gre.key = htons(ct_pptp_info->pns_call_id); expect_orig->tuple.src.u.gre.key = htons(nat_pptp_info->pns_call_id); expect_orig->tuple.dst.u.gre.key = htons(ct_pptp_info->pac_call_id); inv_t.src.ip = reply_t->src.ip; Index: linux-2.6.14-ck8/net/ipv4/netfilter/ip_nat_proto_gre.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv4/netfilter/ip_nat_proto_gre.c +++ linux-2.6.14-ck8/net/ipv4/netfilter/ip_nat_proto_gre.c @@ -139,8 +139,8 @@ gre_manip_pkt(struct sk_buff **pskb, break; case GRE_VERSION_PPTP: DEBUGP("call_id -> 0x%04x\n", - ntohl(tuple->dst.u.gre.key)); - pgreh->call_id = htons(ntohl(tuple->dst.u.gre.key)); + ntohs(tuple->dst.u.gre.key)); + pgreh->call_id = tuple->dst.u.gre.key; break; default: DEBUGP("can't nat unknown GRE version\n"); Index: linux-2.6.14-ck8/net/ipv4/netfilter/ip_nat_proto_unknown.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv4/netfilter/ip_nat_proto_unknown.c +++ linux-2.6.14-ck8/net/ipv4/netfilter/ip_nat_proto_unknown.c @@ -62,7 +62,7 @@ unknown_print_range(char *buffer, const struct ip_nat_protocol ip_nat_unknown_protocol = { .name = "unknown", - .me = THIS_MODULE, + /* .me isn't set: getting a ref to this cannot fail. */ .manip_pkt = unknown_manip_pkt, .in_range = unknown_in_range, .unique_tuple = unknown_unique_tuple, Index: linux-2.6.14-ck8/net/ipv4/tcp_bic.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv4/tcp_bic.c +++ linux-2.6.14-ck8/net/ipv4/tcp_bic.c @@ -27,7 +27,7 @@ */ static int fast_convergence = 1; -static int max_increment = 32; +static int max_increment = 16; static int low_window = 14; static int beta = 819; /* = 819/1024 (BICTCP_BETA_SCALE) */ static int low_utilization_threshold = 153; Index: linux-2.6.14-ck8/net/ipv6/addrconf.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv6/addrconf.c +++ linux-2.6.14-ck8/net/ipv6/addrconf.c @@ -1456,9 +1456,17 @@ void addrconf_prefix_rcv(struct net_devi not good. */ if (valid_lft >= 0x7FFFFFFF/HZ) - rt_expires = 0; + rt_expires = 0x7FFFFFFF - (0x7FFFFFFF % HZ); else - rt_expires = jiffies + valid_lft * HZ; + rt_expires = valid_lft * HZ; + + /* + * We convert this (in jiffies) to clock_t later. + * Avoid arithmetic overflow there as well. + * Overflow can happen only if HZ < USER_HZ. + */ + if (HZ < USER_HZ && rt_expires > 0x7FFFFFFF / USER_HZ) + rt_expires = 0x7FFFFFFF / USER_HZ; if (pinfo->onlink) { struct rt6_info *rt; @@ -1470,12 +1478,12 @@ void addrconf_prefix_rcv(struct net_devi ip6_del_rt(rt, NULL, NULL, NULL); rt = NULL; } else { - rt->rt6i_expires = rt_expires; + rt->rt6i_expires = jiffies + rt_expires; } } } else if (valid_lft) { addrconf_prefix_route(&pinfo->prefix, pinfo->prefix_len, - dev, rt_expires, RTF_ADDRCONF|RTF_EXPIRES|RTF_PREFIX_RT); + dev, jiffies_to_clock_t(rt_expires), RTF_ADDRCONF|RTF_EXPIRES|RTF_PREFIX_RT); } if (rt) dst_release(&rt->u.dst); Index: linux-2.6.14-ck8/net/ipv6/datagram.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv6/datagram.c +++ linux-2.6.14-ck8/net/ipv6/datagram.c @@ -437,7 +437,7 @@ int datagram_recv_ctl(struct sock *sk, s break; case IPPROTO_AH: nexthdr = ptr[0]; - len = (ptr[1] + 1) << 2; + len = (ptr[1] + 2) << 2; break; default: nexthdr = ptr[0]; Index: linux-2.6.14-ck8/net/ipv6/exthdrs.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv6/exthdrs.c +++ linux-2.6.14-ck8/net/ipv6/exthdrs.c @@ -628,6 +628,7 @@ ipv6_renew_options(struct sock *sk, stru if (!tot_len) return NULL; + tot_len += sizeof(*opt2); opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC); if (!opt2) return ERR_PTR(-ENOBUFS); @@ -668,7 +669,26 @@ ipv6_renew_options(struct sock *sk, stru return opt2; out: - sock_kfree_s(sk, p, tot_len); + sock_kfree_s(sk, opt2, opt2->tot_len); return ERR_PTR(err); } +struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space, + struct ipv6_txoptions *opt) +{ + /* + * ignore the dest before srcrt unless srcrt is being included. + * --yoshfuji + */ + if (opt && opt->dst0opt && !opt->srcrt) { + if (opt_space != opt) { + memcpy(opt_space, opt, sizeof(*opt_space)); + opt = opt_space; + } + opt->opt_nflen -= ipv6_optlen(opt->dst0opt); + opt->dst0opt = NULL; + } + + return opt; +} + Index: linux-2.6.14-ck8/net/ipv6/ip6_flowlabel.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv6/ip6_flowlabel.c +++ linux-2.6.14-ck8/net/ipv6/ip6_flowlabel.c @@ -225,20 +225,16 @@ struct ipv6_txoptions *fl6_merge_options struct ip6_flowlabel * fl, struct ipv6_txoptions * fopt) { - struct ipv6_txoptions * fl_opt = fl ? fl->opt : NULL; + struct ipv6_txoptions * fl_opt = fl->opt; - if (fopt == NULL || fopt->opt_flen == 0) { - if (!fl_opt || !fl_opt->dst0opt || fl_opt->srcrt) - return fl_opt; - } + if (fopt == NULL || fopt->opt_flen == 0) + return fl_opt; if (fl_opt != NULL) { opt_space->hopopt = fl_opt->hopopt; - opt_space->dst0opt = fl_opt->srcrt ? fl_opt->dst0opt : NULL; + opt_space->dst0opt = fl_opt->dst0opt; opt_space->srcrt = fl_opt->srcrt; opt_space->opt_nflen = fl_opt->opt_nflen; - if (fl_opt->dst0opt && !fl_opt->srcrt) - opt_space->opt_nflen -= ipv6_optlen(fl_opt->dst0opt); } else { if (fopt->opt_nflen == 0) return fopt; Index: linux-2.6.14-ck8/net/ipv6/netfilter/Kconfig =================================================================== --- linux-2.6.14-ck8.orig/net/ipv6/netfilter/Kconfig +++ linux-2.6.14-ck8/net/ipv6/netfilter/Kconfig @@ -211,7 +211,7 @@ config IP6_NF_TARGET_REJECT config IP6_NF_TARGET_NFQUEUE tristate "NFQUEUE Target Support" - depends on IP_NF_IPTABLES + depends on IP6_NF_IPTABLES help This Target replaced the old obsolete QUEUE target. Index: linux-2.6.14-ck8/net/ipv6/raw.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv6/raw.c +++ linux-2.6.14-ck8/net/ipv6/raw.c @@ -756,7 +756,9 @@ static int rawv6_sendmsg(struct kiocb *i } if (opt == NULL) opt = np->opt; - opt = fl6_merge_options(&opt_space, flowlabel, opt); + if (flowlabel) + opt = fl6_merge_options(&opt_space, flowlabel, opt); + opt = ipv6_fixup_options(&opt_space, opt); fl.proto = proto; rawv6_probe_proto_opt(&fl, msg); Index: linux-2.6.14-ck8/net/ipv6/route.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv6/route.c +++ linux-2.6.14-ck8/net/ipv6/route.c @@ -829,7 +829,7 @@ int ip6_route_add(struct in6_rtmsg *rtms } rt->u.dst.obsolete = -1; - rt->rt6i_expires = clock_t_to_jiffies(rtmsg->rtmsg_info); + rt->rt6i_expires = jiffies + clock_t_to_jiffies(rtmsg->rtmsg_info); if (nlh && (r = NLMSG_DATA(nlh))) { rt->rt6i_protocol = r->rtm_protocol; } else { Index: linux-2.6.14-ck8/net/ipv6/udp.c =================================================================== --- linux-2.6.14-ck8.orig/net/ipv6/udp.c +++ linux-2.6.14-ck8/net/ipv6/udp.c @@ -778,7 +778,9 @@ do_udp_sendmsg: } if (opt == NULL) opt = np->opt; - opt = fl6_merge_options(&opt_space, flowlabel, opt); + if (flowlabel) + opt = fl6_merge_options(&opt_space, flowlabel, opt); + opt = ipv6_fixup_options(&opt_space, opt); fl->proto = IPPROTO_UDP; ipv6_addr_copy(&fl->fl6_dst, daddr); Index: linux-2.6.14-ck8/net/netfilter/nf_queue.c =================================================================== --- linux-2.6.14-ck8.orig/net/netfilter/nf_queue.c +++ linux-2.6.14-ck8/net/netfilter/nf_queue.c @@ -117,7 +117,7 @@ int nf_queue(struct sk_buff **skb, /* QUEUE == DROP if noone is waiting, to be safe. */ read_lock(&queue_handler_lock); - if (!queue_handler[pf]->outfn) { + if (!queue_handler[pf] || !queue_handler[pf]->outfn) { read_unlock(&queue_handler_lock); kfree_skb(*skb); return 1; Index: linux-2.6.14-ck8/net/xfrm/xfrm_policy.c =================================================================== --- linux-2.6.14-ck8.orig/net/xfrm/xfrm_policy.c +++ linux-2.6.14-ck8/net/xfrm/xfrm_policy.c @@ -1014,13 +1014,12 @@ int __xfrm_route_forward(struct sk_buff } EXPORT_SYMBOL(__xfrm_route_forward); -/* Optimize later using cookies and generation ids. */ - static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie) { - if (!stale_bundle(dst)) - return dst; - + /* If it is marked obsolete, which is how we even get here, + * then we have purged it from the policy bundle list and we + * did that for a good reason. + */ return NULL; } @@ -1104,6 +1103,16 @@ int xfrm_flush_bundles(void) return 0; } +static int always_true(struct dst_entry *dst) +{ + return 1; +} + +void xfrm_flush_all_bundles(void) +{ + xfrm_prune_bundles(always_true); +} + void xfrm_init_pmtu(struct dst_entry *dst) { do { Index: linux-2.6.14-ck8/net/xfrm/xfrm_state.c =================================================================== --- linux-2.6.14-ck8.orig/net/xfrm/xfrm_state.c +++ linux-2.6.14-ck8/net/xfrm/xfrm_state.c @@ -435,6 +435,8 @@ void xfrm_state_insert(struct xfrm_state spin_lock_bh(&xfrm_state_lock); __xfrm_state_insert(x); spin_unlock_bh(&xfrm_state_lock); + + xfrm_flush_all_bundles(); } EXPORT_SYMBOL(xfrm_state_insert); @@ -482,6 +484,9 @@ out: spin_unlock_bh(&xfrm_state_lock); xfrm_state_put_afinfo(afinfo); + if (!err) + xfrm_flush_all_bundles(); + if (x1) { xfrm_state_delete(x1); xfrm_state_put(x1); Index: linux-2.6.14-ck8/sound/pci/nm256/nm256.c =================================================================== --- linux-2.6.14-ck8.orig/sound/pci/nm256/nm256.c +++ linux-2.6.14-ck8/sound/pci/nm256/nm256.c @@ -62,6 +62,7 @@ static int buffer_top[SNDRV_CARDS] = {[0 static int use_cache[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = 0}; /* disabled */ static int vaio_hack[SNDRV_CARDS] = {[0 ... (SNDRV_CARDS - 1)] = 0}; /* disabled */ static int reset_workaround[SNDRV_CARDS]; +static int reset_workaround_2[SNDRV_CARDS]; module_param_array(index, int, NULL, 0444); MODULE_PARM_DESC(index, "Index value for " CARD_NAME " soundcard."); @@ -83,6 +84,8 @@ module_param_array(vaio_hack, bool, NULL MODULE_PARM_DESC(vaio_hack, "Enable workaround for Sony VAIO notebooks."); module_param_array(reset_workaround, bool, NULL, 0444); MODULE_PARM_DESC(reset_workaround, "Enable AC97 RESET workaround for some laptops."); +module_param_array(reset_workaround_2, bool, NULL, 0444); +MODULE_PARM_DESC(reset_workaround_2, "Enable extended AC97 RESET workaround for some other laptops."); /* * hw definitions @@ -226,6 +229,7 @@ struct snd_nm256 { unsigned int coeffs_current: 1; /* coeff. table is loaded? */ unsigned int use_cache: 1; /* use one big coef. table */ unsigned int reset_workaround: 1; /* Workaround for some laptops to avoid freeze */ + unsigned int reset_workaround_2: 1; /* Extended workaround for some other laptops to avoid freeze */ int mixer_base; /* register offset of ac97 mixer */ int mixer_status_offset; /* offset of mixer status reg. */ @@ -1199,8 +1203,11 @@ snd_nm256_ac97_reset(ac97_t *ac97) /* Dell latitude LS will lock up by this */ snd_nm256_writeb(chip, 0x6cc, 0x87); } - snd_nm256_writeb(chip, 0x6cc, 0x80); - snd_nm256_writeb(chip, 0x6cc, 0x0); + if (! chip->reset_workaround_2) { + /* Dell latitude CSx will lock up by this */ + snd_nm256_writeb(chip, 0x6cc, 0x80); + snd_nm256_writeb(chip, 0x6cc, 0x0); + } } /* create an ac97 mixer interface */ @@ -1542,7 +1549,7 @@ struct nm256_quirk { int type; }; -enum { NM_BLACKLISTED, NM_RESET_WORKAROUND }; +enum { NM_BLACKLISTED, NM_RESET_WORKAROUND, NM_RESET_WORKAROUND_2 }; static struct nm256_quirk nm256_quirks[] __devinitdata = { /* HP omnibook 4150 has cs4232 codec internally */ @@ -1551,6 +1558,8 @@ static struct nm256_quirk nm256_quirks[] { .vendor = 0x104d, .device = 0x8041, .type = NM_RESET_WORKAROUND }, /* Dell Latitude LS */ { .vendor = 0x1028, .device = 0x0080, .type = NM_RESET_WORKAROUND }, + /* Dell Latitude CSx */ + { .vendor = 0x1028, .device = 0x0091, .type = NM_RESET_WORKAROUND_2 }, { } /* terminator */ }; @@ -1582,6 +1591,9 @@ static int __devinit snd_nm256_probe(str case NM_BLACKLISTED: printk(KERN_INFO "nm256: The device is blacklisted. Loading stopped\n"); return -ENODEV; + case NM_RESET_WORKAROUND_2: + reset_workaround_2[dev] = 1; + /* Fall-through */ case NM_RESET_WORKAROUND: reset_workaround[dev] = 1; break; @@ -1638,6 +1650,11 @@ static int __devinit snd_nm256_probe(str chip->reset_workaround = 1; } + if (reset_workaround_2[dev]) { + snd_printdd(KERN_INFO "nm256: reset_workaround_2 activated\n"); + chip->reset_workaround_2 = 1; + } + if ((err = snd_nm256_pcm(chip, 0)) < 0 || (err = snd_nm256_mixer(chip)) < 0) { snd_card_free(card);