# This is a BitKeeper generated patch for the following project:
# Project Name: Linux kernel tree
# This patch format is intended for GNU patch command version 2.5 or higher.
# This patch includes the following deltas:
#	           ChangeSet	v2.6.0-test9 -> 1.1386 
#	drivers/net/8139too.c	1.74    -> 1.75   
#	arch/sparc64/kernel/entry.S	1.29    -> 1.30   
#	include/asm-x86_64/irq.h	1.3     -> 1.4    
#	include/asm-x86_64/smp.h	1.12    -> 1.13   
#	    net/llc/af_llc.c	1.51    -> 1.52   
#	Documentation/networking/irda.txt	1.1     -> 1.2    
#	         net/Kconfig	1.26    -> 1.28   
#	net/ipv6/ip6_output.c	1.44    -> 1.46   
#	include/asm-sparc/unistd.h	1.26    -> 1.27   
#	include/asm-sparc/namei.h	1.1     -> 1.2    
#	include/linux/sched.h	1.173   -> 1.174  
#	drivers/net/wireless/airo.c	1.77    -> 1.79   
#	drivers/media/video/bttv-if.c	1.16    -> 1.17   
#	   include/net/tcp.h	1.51    -> 1.52   
#	arch/x86_64/kernel/x8664_ksyms.c	1.18    -> 1.20   
#	      net/ipv4/udp.c	1.53    -> 1.55   
#	include/asm-sparc64/unistd.h	1.25    -> 1.26   
#	arch/alpha/kernel/setup.c	1.38    -> 1.39   
#	include/asm-sparc64/spinlock.h	1.7     -> 1.8    
#	include/linux/serial.h	1.9     -> 1.10   
#	arch/x86_64/kernel/acpi/boot.c	1.6     -> 1.7    
#	net/ipv6/xfrm6_policy.c	1.13    -> 1.14   
#	drivers/input/mouse/psmouse-base.c	1.34    -> 1.35   
#	 include/linux/udp.h	1.7     -> 1.8    
#	drivers/serial/serial_core.c	1.72    -> 1.74   
#	drivers/net/ethertap.c	1.10    -> 1.11   
#	include/asm-sparc64/namei.h	1.1     -> 1.2    
#	drivers/net/starfire.c	1.31    -> 1.33   
#	arch/x86_64/kernel/smp.c	1.17    -> 1.18   
#	include/linux/preempt.h	1.6     -> 1.7    
#	fs/jfs/jfs_metapage.c	1.24    -> 1.25   
#	      net/ipv4/tcp.c	1.49    -> 1.50   
#	arch/x86_64/kernel/setup64.c	1.17    -> 1.18   
#	  include/linux/ip.h	1.10    -> 1.11   
#	fs/jbd/transaction.c	1.76    -> 1.77   
#	arch/h8300/kernel/time.c	1.3     -> 1.4    
#	 net/ipv4/tcp_ipv4.c	1.72    -> 1.75   
#	net/ipv4/netfilter/ipt_REDIRECT.c	1.6     -> 1.7    
#	        mm/filemap.c	1.211   -> 1.212  
#	arch/x86_64/kernel/entry.S	1.13    -> 1.14   
#	    fs/binfmt_misc.c	1.22    -> 1.23   
#	include/asm-x86_64/pci.h	1.11    -> 1.12   
#	         lib/div64.c	1.2     -> 1.3    
#	drivers/media/video/tuner-3036.c	1.10    -> 1.11   
#	arch/sparc64/kernel/systbls.S	1.48    -> 1.49   
#	drivers/net/sis900.c	1.46    -> 1.47   
#	arch/sparc64/lib/rwlock.S	1.1     -> 1.2    
#	      fs/fat/inode.c	1.80    -> 1.81   
#	drivers/usb/serial/digi_acceleport.c	1.40    -> 1.41   
#	arch/sparc/kernel/entry.S	1.16    -> 1.17   
#	arch/sparc64/kernel/rtrap.S	1.16    -> 1.17   
#	drivers/media/video/bttv-cards.c	1.22    -> 1.23   
#	     net/ipv4/ipmr.c	1.32    -> 1.34   
#	arch/sparc64/lib/dec_and_lock.S	1.4     -> 1.5    
#	arch/sparc/kernel/systbls.S	1.24    -> 1.25   
#	      net/core/dev.c	1.120   -> 1.121  
#	arch/x86_64/kernel/io_apic.c	1.16    -> 1.17   
#	net/xfrm/xfrm_policy.c	1.41    -> 1.43   
#	 drivers/net/r8169.c	1.15    -> 1.16   
#	drivers/net/pcmcia/ibmtr_cs.c	1.19    -> 1.20   
#	drivers/media/video/meye.h	1.10    -> 1.11   
#	   drivers/acpi/ec.c	1.26    -> 1.27   
#	drivers/pnp/isapnp/core.c	1.43    -> 1.44   
#	 drivers/net/3c527.c	1.16    -> 1.17   
#	      fs/direct-io.c	1.34    -> 1.35   
#	drivers/char/sonypi.h	1.18    -> 1.19   
#	drivers/net/arm/ether1.c	1.15    -> 1.16   
#	drivers/pcmcia/yenta_socket.c	1.49    -> 1.50   
#	drivers/net/tokenring/ibmtr.c	1.18    -> 1.19   
#	drivers/net/pcmcia/fmvj18x_cs.c	1.26    -> 1.27   
#	arch/x86_64/kernel/time.c	1.25    -> 1.26   
#	include/asm-x86_64/topology.h	1.5     -> 1.6    
#	include/linux/ipv6.h	1.12    -> 1.14   
#	include/asm-sparc64/hardirq.h	1.16    -> 1.17   
#	     kernel/module.c	1.94    -> 1.95   
#	net/xfrm/xfrm_state.c	1.35    -> 1.36   
#	drivers/usb/serial/Kconfig	1.10    -> 1.11   
#	arch/ia64/kernel/perfmon_mckinley.h	1.9     -> 1.10   
#	     net/core/sock.c	1.28    -> 1.29   
#	drivers/media/video/bt832.c	1.3     -> 1.4    
#	   net/ipv4/ip_gre.c	1.33    -> 1.34   
#	net/ipv4/tcp_input.c	1.46    -> 1.47   
#	Documentation/video4linux/meye.txt	1.7     -> 1.8    
#	drivers/media/video/saa5249.c	1.19    -> 1.20   
#	net/ipv4/tcp_minisocks.c	1.42    -> 1.43   
#	include/linux/socket.h	1.9     -> 1.10   
#	      kernel/sched.c	1.222   -> 1.223  
#	net/ipv4/netfilter/ip_fw_compat_masq.c	1.11    -> 1.12   
#	drivers/input/keyboard/atkbd.c	1.38    -> 1.39   
#	 net/llc/llc_input.c	1.33    -> 1.34   
#	      net/ipv6/udp.c	1.50    -> 1.53   
#	net/ipv4/netfilter/Kconfig	1.16    -> 1.17   
#	arch/x86_64/mm/numa.c	1.6     -> 1.7    
#	arch/sparc64/kernel/sparc64_ksyms.c	1.59    -> 1.60   
#	drivers/acpi/dispatcher/dsopcode.c	1.21    -> 1.22   
#	    net/ipv6/mcast.c	1.39    -> 1.40   
#	drivers/net/arm/etherh.c	1.17    -> 1.18   
#	arch/sparc64/Kconfig	1.38    -> 1.39   
#	       kernel/exit.c	1.117   -> 1.119  
#	include/asm-h8300/smplock.h	1.1     ->         (deleted)      
#	arch/x86_64/mm/extable.c	1.5     -> 1.6    
#	drivers/net/bonding/bond_main.c	1.46    -> 1.47   
#	arch/ia64/kernel/perfmon.c	1.65    -> 1.67   
#	 net/ipv6/addrconf.c	1.71    -> 1.74   
#	include/net/if_inet6.h	1.9     -> 1.10   
#	include/asm-x86_64/hw_irq.h	1.6     -> 1.7    
#	drivers/pci/setup-bus.c	1.22    -> 1.23   
#	include/asm-x86_64/processor.h	1.24    -> 1.25   
#	drivers/net/arm/ether3.c	1.18    -> 1.19   
#	drivers/md/dm-table.c	1.24    -> 1.25   
#	arch/x86_64/mm/k8topology.c	1.5     -> 1.6    
#	  include/linux/in.h	1.7     -> 1.8    
#
# The following is the BitKeeper ChangeSet Log
# --------------------------------------------
# 03/10/25	torvalds@home.osdl.org	1.1350.1.2
# Linux 2.6.0-test9
# --------------------------------------------
# 03/10/26	Andries.Brouwer@cwi.nl	1.1350.1.3
# [PATCH] atkbd: 0xfa is ACK
# 
# The 0xfa code can be a key scancode or it can be a protocol scancode.
# 
# Only few keyboards use it as a key scancode, and if we always interpret
# it as a protocol scancode then these rare keyboards will have a dead
# key.  If we interpret it as a key scancode then we have a dead keyboard
# in case it was protocol.
# 
# Clearly it is safer to prefer to interpret it as a protocol scancode.
# 
# This moves the test for ACK and NAK up, so that they are always seen as
# protocol.
# 
# This is just a minimal patch.  What I did in 1.1.54 was to keep track of
# commands sent with a flag reply_expected, so that 0xfa could be taken as
# ACK when a reply is expected and as key scancode otherwise.  That is the
# better solution, but requires larger surgery.
# --------------------------------------------
# 03/10/26	Andries.Brouwer@cwi.nl	1.1350.1.4
# [PATCH] Relax FATFS validity tests
# 
# The first FAT entry should have the media byte (0xf0,0xf8,...,0xff)
# extended with all 1 bits in the first FAT entry.
# 
# Checking this is a good idea, it prevents us from mounting garbage
# as FAT - there is no good magic for FAT.
# 
# Unfortunately, Windows does not enforce this, and 2.4 doesn't either.
# It turns out that there are filesystems around (two reports so far) that
# have a zero first FAT entry, and work under Windows and 2.4 but fail to
# mount under 2.6.
# 
# So, this weakens the test.
# --------------------------------------------
# 03/10/26	stelian@popies.net	1.1350.1.5
# [PATCH] sonypi: fix Zoom/Thumbphrase button events
# 
# This corrects the Zoom and Thumbphrase button events.
# --------------------------------------------
# 03/10/26	stelian@popies.net	1.1350.1.6
# [PATCH] meye: documentation
# 
# This documents the existence of a forth 'motioneye' camera plugged into
# the USB bus, of course unsupported by the meye driver.
# --------------------------------------------
# 03/10/26	ak@muc.de	1.1350.1.7
# [PATCH] Essential x86-64 updates
# 
# The most important part is that it makes x86-64 compile again.
# Without that 2.6 users won't be very happy.
# 
# It also works around a bug that allowed every user program to reboot the
# system on B stepping K8.
# 
# Also update to match some recent i386 fixes.
# 
# Full ChangeLog:
#  - Add acpi_pic_set_level_irq to make ACPI compile again
#  - Work around compat mode K8 bug in IRET exception handling
#  - Increase exception stack. The old 1k stack was too easy
#    to overflow (from Jim Paradis, changed by me)
#  - Replace safe_smp_processor_id with cpuid (needed for above)
#  - When there is only one node always enable fake_node mode
#  - Merge with i386 (NTP gettimeofday monoticity fix, irq nr_vectors change)
#  - Fix compile problem for UP kernels in time/cpufreq
#  - Set all nodes online at bootup
#  - Define node_to_cpumask correctly
# --------------------------------------------
# 03/10/26	ysato@users.sourceforge.jp	1.1350.1.8
# [PATCH] fix h8/300 support
# 
#  - add 'sched_clock'
#  - delete smplock.h
# --------------------------------------------
# 03/10/26	tausq@debian.org	1.1350.1.9
# [PATCH] fix __div64_32 to do division properly
# 
# This fixes the generic __div64_32() to correctly handle divisions by
# large 32-bit values (as used by nanosleep() and friends, for example).
# 
# It's a simple bit-at-a-time implementation with a reduction of the high
# 32-bits handled manually.  Architectures that can do 64/32-bit divisions
# in hardware should implement their own more efficient versions.
# --------------------------------------------
# 03/10/26	torvalds@home.osdl.org	1.1350.1.10
# Add a sticky "PF_DEAD" task flag to keep track of dead processes.
# 
# Use this to simplify 'finish_task_switch', but perhaps more
# importantly we can use this to track down why some processes
# seem to sometimes not die properly even after having been
# marked as ZOMBIE. The "task->state" flags are too fluid to 
# allow that well.
# --------------------------------------------
# 03/10/27	matthias.andree@gmx.de	1.1350.2.1
# Properly terminate /proc/tty/driver/serial output lines of known UARTS
# when the caller has no CAP_SYS_ADMIN capability.
# --------------------------------------------
# 03/10/26	davem@nuts.ninka.net	1.1353
# Merge nuts.ninka.net:/disk1/davem/BK/network-2.5
# into nuts.ninka.net:/disk1/davem/BK/net-2.5
# --------------------------------------------
# 03/10/26	davem@nuts.ninka.net	1.1350.1.11
# Merge nuts.ninka.net:/disk1/davem/BK/sparcwork-2.5
# into nuts.ninka.net:/disk1/davem/BK/sparc-2.5
# --------------------------------------------
# 03/10/26	levon@movementarian.org	1.1354
# [NETFILTER]: Fix modular iptables build.
# --------------------------------------------
# 03/10/26	ak@muc.de	1.1355
# [NET]: Fix oops in ethertap_rx().
# --------------------------------------------
# 03/10/26	yoshfuji@linux-ipv6.org	1.1356
# [IPV6]: Typo in address comparison.
# --------------------------------------------
# 03/10/26	yoshfuji@linux-ipv6.org	1.1357
# [IPV6]: Use real storage for cork'd packets, else MSG_MORE corrupts UDP packets.
# --------------------------------------------
# 03/10/26	yoshfuji@linux-ipv6.org	1.1358
# [IPV4,6]: Use common storage for cork'd flow, needed to handle mapped-ipv4 ipv6 addresses properly.
# --------------------------------------------
# 03/10/27	yoshfuji@linux-ipv6.org	1.1359
# [IPV6]: Process ipv4-mapped addresses properly on UDPv6 sockets.
# --------------------------------------------
# 03/10/27	rusty@rustcorp.com.au	1.1360
# [NETFILTER]: Fix ipchains oops in NAT
# 
# We updated ip_nat_setup_info to set the initialized flag and call
# place_in_hashes, but *didn't* change the call in ip_fw_compat_masq.c
# which also calls place_in_hashes() itself (again!).  Result: corrupt
# list, and next thing which lands in the same hash bucket goes boom.
# 
# Thanks to Andy Polyakov for chasing this down.
# --------------------------------------------
# 03/10/27	yoshfuji@linux-ipv6.org	1.1361
# [IPV6]: Fix bogus semicolon typo in mcast.c
# --------------------------------------------
# 03/10/27	bdschuym@pandora.be	1.1362
# [NETFILTER]: Fix potential OOPS in ipt_REDIRECT.
# --------------------------------------------
# 03/10/27	davem@nuts.ninka.net	1.1363
# Revert signal handling changes in tcp.c - they break SIGURG.
# 
# Cset exclude: kuznet@ms2.inr.ac.ru|ChangeSet|20031021052951|52463
# --------------------------------------------
# 03/10/27	davem@nuts.ninka.net	1.1364
# Revert "Zero initial timestamps are valid" changeset.
# 
# I am still not sure that this change all by itself is enough
# to make us accept zero initial timestamps properly. 
# 
# Cset exclude: davem@nuts.ninka.net|ChangeSet|20031025060257|60993
# --------------------------------------------
# 03/10/27	davem@nuts.ninka.net	1.1365
# [IPV6]: Do not virt_to_page() on stack addresses, fixes OOPS.
# --------------------------------------------
# 03/10/27	herbert@gondor.apana.org.au	1.1366
# [IPSEC]: Fix accidental too many ref drops on policies.
# --------------------------------------------
# 03/10/27	matthias.andree@gmx.de	1.1350.3.1
# Merge bk://linux.bkbits.net/linux-2.5/
# into gmx.de:/suse/kernel/BK/linux-2.5
# --------------------------------------------
# 03/10/27	torvalds@home.osdl.org	1.1350.4.1
# Put the compiler barrier() on the right side of the preemption
# enable on UP-PREEMPT.
# 
# Without this, the enable could "migrate" up into the critical
# region (on SMP, the actual spinlock would act as an additional
# barrier and PREEMPT was ok).
# --------------------------------------------
# 03/10/27	kevcorry@us.ibm.com	1.1350.4.2
# [PATCH] Fix DM on top of raid
# 
# Force Device-Mapper to use PAGE_SIZE or smaller I/O when the underlying
# device has a bvec_merge_fn routine registered.  This will fix the
# situation of Device-Mapper submitting I/Os to RAID-0 that span the
# RAID-0 chunk boundaries.
# 
# Joe is working on a better solution that actually honors the MD
# merge_bvec_fn routine.  But this minimal change will fix the problem for
# the time being.
# --------------------------------------------
# 03/10/27	torvalds@home.osdl.org	1.1367
# Merge bk://kernel.bkbits.net/davem/net-2.5
# into home.osdl.org:/home/torvalds/v2.5/linux
# --------------------------------------------
# 03/10/27	torvalds@home.osdl.org	1.1368
# Merge bk://kernel.bkbits.net/davem/sparc-2.5
# into home.osdl.org:/home/torvalds/v2.5/linux
# --------------------------------------------
# 03/10/27	eranian@hpl.hp.com	1.1337.43.18
# [PATCH] ia64: fix perfmon UP breakage
# 
# --------------------------------------------
# 03/10/27	davidm@tiger.hpl.hp.com	1.1350.5.1
# Merge tiger.hpl.hp.com:/data1/bk/vanilla/linux-2.6.0-test9
# into tiger.hpl.hp.com:/data1/bk/lia64/to-linus-2.5
# --------------------------------------------
# 03/10/27	torvalds@home.osdl.org	1.1369
# Fix ZOMBIE race with self-reaping threads.
# 
# exit_notify() used to leave a window open when a thread
# died that made the thread visible as a ZOMBIE even though
# the thread reaped itself. This closes that window by marking
# the thread DEAD within the tasklist_lock.
# --------------------------------------------
# 03/10/27	torvalds@home.osdl.org	1.1370
# Don't force PS/2 mouse rate or resolution by default.
# 
# Only set the rate/resolution if the user actually asked
# for it. Some mice and KVM switches don't like to have
# their rate forced.
# --------------------------------------------
# 03/10/27	akpm@osdl.org	1.1371
# [PATCH] Fix binfmt_misc locking
# 
# This fixes a sleep-in-spinlock bug for binfmt_misc registration.
# 
# That lock is purely for the list, not for the dentry.
# --------------------------------------------
# 03/10/27	rmk@flint.arm.linux.org.uk	1.1350.6.1
# [PCMCIA] Fix card detection.
# 
# Idea from David Hinds.
# 
# Some PCMCIA/Cardbus controllers seem to get upset when we ask
# them to re-do card interrogation - they miss the next insertion
# event.
# 
# We therefore avoid forcing needless card interrogations if a
# card has already been succesfully detected and interrogated.
# --------------------------------------------
# 03/10/27	eranian@hpl.hp.com	1.1350.5.2
# [PATCH] ia64: fix 2 more perfmon2 bugs
# 
# Here is the minimal patch that fixes things that do not work and that
# can be noticed fairly easily:
# 
#         - remove a typo in pfm_check_task_state() which causes
#           PFM_READ_PMDS to fail when context is in  PFM_MASKED state.
# 
#         - fix a typo in perfmon_mcklinley.h when checking the value
#           combinations for when writing to PMC14. This could reject a
#           valid request to program PMC14.
# --------------------------------------------
# 03/10/28	acme@conectiva.com.br	1.1372
# [LLC]: Fix array indexing in llc_add_pack().
# --------------------------------------------
# 03/10/28	acme@conectiva.com.br	1.1373
# [LLC]: In llc_ui_connect(), return error properly when device not found.
# --------------------------------------------
# 03/10/28	pee@erkkila.org	1.1374
# [IPV4]: Make sure ipgre_tunnel_init() gets the correct ioctl settings.
# --------------------------------------------
# 03/10/28	andrew@com.rmk.(none)	1.1350.7.1
# [SERIAL PATCH] 1672/1: Restore sizeof(struct serial_struct)
# 
# Patch from SAN People
# 
# Patch 2.4.21-rmk1 added a "iomap_base" field to the serial_struct
# structure (include/linux/serial.h).
# 
# Since that structure is exported to user-space it should be
# consistent between revisions of the stable 2.4 kernels.
# 
# This patch removes 4 bytes (were "reserved") to restore the size
# of the structure.
# 
# Without this patch, ioctl(TIOCGSERIAL) will copy_to_user() 4
# bytes more than expected and possibly corrupt the application's
# stack/heap.
# --------------------------------------------
# 03/10/28	davem@nuts.ninka.net	1.1371.1.1
# [SPARC]: Add AIO syscalls, 32-bit compat handling will come later.
# --------------------------------------------
# 03/10/28	davem@nuts.ninka.net	1.1371.1.2
# [SPARC64]: Fix preempt handling in dec_and_lock.S
# --------------------------------------------
# 03/10/28	yoshfuji@linux-ipv6.org	1.1375
# [IPV6]: Fix inappropriate usage of inet{,6}_sk().
# --------------------------------------------
# 03/10/28	yoshfuji@linux-ipv6.org	1.1376
# [IPV4]: Remove out-of-date info CONFIG_INET help text.
# --------------------------------------------
# 03/10/28	matthias.andree@gmx.de	1.1371.2.1
# Merge bk://linux.bkbits.net/linux-2.5/
# into gmx.de:/suse/kernel/BK/linux-2.5
# --------------------------------------------
# 03/10/28	yoshfuji@linux-ipv6.org	1.1377
# [IPV6]: Fix outdated and inaccurate information in Kconfig help.
# --------------------------------------------
# 03/10/28	davem@nuts.ninka.net	1.1371.1.3
# [SPARC64]: Get preempt building and working again.
# 
# - HAVE_DEC_LOCK depends on SMP
# - Trap return preemption check needs interrupt disabled check
# - Implement write_trylock
# - Fix in_atomic() definition when PREEMPT enabled
# --------------------------------------------
# 03/10/28	kml@patheticgeek.net	1.1378
# [TCP]: When SYN is set, the window is not scaled.
# --------------------------------------------
# 03/10/28	Jay.Estabrook@hp.com	1.1371.3.1
# [PATCH] Fix alpha "white box" boot
# 
# Here's a show-stopper patch for Alpha; missing it prevents several of
# our platforms ("white box" 3000 and 5000 series) from booting.
# --------------------------------------------
# 03/10/28	len.brown@intel.com	1.1371.4.1
# [ACPI] REVERT acpi_ec_gpe_query(ec) fix that crashed non-T40 boxes
# http://bugme.osdl.org/show_bug.cgi?id=1171
# --------------------------------------------
# 03/10/29	matthias.andree@gmx.de	1.1371.2.2
# Merge bk://linux.bkbits.net/linux-2.5/
# into gmx.de:/suse/kernel/BK/linux-2.5
# --------------------------------------------
# 03/10/28	len.brown@intel.com	1.1371.4.2
# [ACPI] REVERT ACPICA-20030918 CONFIG_ACPI_DEBUG printk that caused crash
# http://bugzilla.kernel.org/show_bug.cgi?id=1341
# --------------------------------------------
# 03/10/28	torvalds@home.osdl.org	1.1371.1.4
# Merge bk://kernel.bkbits.net/davem/sparc-2.5
# into home.osdl.org:/home/torvalds/v2.5/linux
# --------------------------------------------
# 03/10/28	torvalds@home.osdl.org	1.1379
# Merge bk://kernel.bkbits.net/davem/net-2.5
# into home.osdl.org:/home/torvalds/v2.5/linux
# --------------------------------------------
# 03/10/28	torvalds@home.osdl.org	1.1380
# Merge http://lia64.bkbits.net/to-linus-2.5
# into home.osdl.org:/home/torvalds/v2.5/linux
# --------------------------------------------
# 03/10/29	rmk@flint.arm.linux.org.uk	1.1381
# Merge flint.arm.linux.org.uk:/usr/src/bk/linux-2.6
# into flint.arm.linux.org.uk:/usr/src/bk/linux-2.6-serial
# --------------------------------------------
# 03/10/29	rmk@flint.arm.linux.org.uk	1.1382
# Merge bk://129.217.163.1/linux-2.5/
# into flint.arm.linux.org.uk:/usr/src/bk/linux-2.6-serial
# --------------------------------------------
# 03/10/29	phillim2@comcast.net	1.1380.1.1
# [PATCH] ibmtr_cs/ibmtr - get working again
# 
# Patch to get ibmtr_cs / ibmtr working again.  A change went in a while back
# I missed that killed it.  Also fixed the timer to eliminate the
# uninitialized timer error on close.
# --------------------------------------------
# 03/10/29	akpm@osdl.org	1.1380.1.2
# [PATCH] digi_accelport warning fix
# 
# Use the correct type for the workqueue callback.
# --------------------------------------------
# 03/10/29	akpm@osdl.org	1.1380.1.3
# [PATCH] JBD: use-after-free fix
# 
# The wait_event() in there can touch the memory at *transaction after
# kjournald has freed it.
# 
# Rework the code to not wait until the transaction enters T_FLUSH state: just
# loop back and try against after the wakeup.
# --------------------------------------------
# 03/10/29	akpm@osdl.org	1.1380.1.4
# [PATCH] WinTV-D patch to make tuner functional
# 
# From: "Brad House" <brad_mssw@gentoo.org>
# 
# Quick patch to enable the Philips tuner on the WinTV-D boards.  Tested and
# works fine.  (acked by Gerd)
# --------------------------------------------
# 03/10/29	akpm@osdl.org	1.1380.1.5
# [PATCH] bttv jiffies warning fix
# 
# Use unsigned long for time_after(), not an int.
# --------------------------------------------
# 03/10/29	akpm@osdl.org	1.1380.1.6
# [PATCH] Export some symbols on x86-64
# 
# From: Andi Kleen <ak@muc.de>
# 
# Export two symbols on x86-64.  This is needed for the sk98lin driver and ipv6.
# --------------------------------------------
# 03/10/29	akpm@osdl.org	1.1380.1.7
# [PATCH] /proc/tty/driver/serial formatting fix
# 
# From: Matthias Andree <matthias.andree@gmx.de>
# 
# Properly terminate /proc/tty/driver/serial output lines of known UARTS
# when the caller has no CAP_SYS_ADMIN capability.
# --------------------------------------------
# 03/10/29	akpm@osdl.org	1.1380.1.8
# [PATCH] direct-io typo fix
# 
# From: Klaas de Waal <klaas.de.waal@hccnet.nl>
# 
# Bug in parameter of ZERO_PAGE macro in line 679 of fb/direct-io.c Parameter
# dio->cur_user_address has to be dio->curr_user_address.  This bug shows
# when compling for MIPS little endian as target, not when compiling for X86.
# --------------------------------------------
# 03/10/29	torvalds@home.osdl.org	1.1380.1.9
# Merge http://linux-acpi.bkbits.net/linux-acpi-release-2.6.0
# into home.osdl.org:/home/torvalds/v2.5/linux
# --------------------------------------------
# 03/10/29	akpm@osdl.org	1.1380.1.10
# [PATCH] sis900 skb free fix
# 
# This driver is freeing skb's from timer context, with local irq's disabled.
# 
# It generates warnings from local_bh_enable() because local_bh_enable()
# reenables interrupts, exposing the machine to deadlocks.
# 
# So use the deferred dev_kfree_skb_irq() instead.
# --------------------------------------------
# 03/10/29	akpm@osdl.org	1.1380.1.11
# [PATCH] initcall ordering fix for PNP NICs
# 
# From: "M.H.VanLeeuwen" <vanl@megsinet.net>
# 
# The level of isapnp_init was moved to after apci sometime ago.  Since it is
# now after net_dev_init, ISA PNP NICs fail to initialized at boot.  This is
# particularily problematic for NFS root filesystems like mine, or none
# modular systems.
# 
# This fix allows ISA PNP NIC cards to work during net_dev_init, and still
# leaves isapnp_init after apci_init.
# --------------------------------------------
# 03/10/29	arjanv@redhat.com	1.1380.1.12
# [PATCH] r8169 module license tag
# --------------------------------------------
# 03/10/29	tsk@ibakou.com	1.1380.1.13
# [netdrvr 8139too] add pci id
# --------------------------------------------
# 03/10/29	riel@surriel.com	1.1380.1.14
# [netdrvr starfire] include asm/io.h
# 
# Fixes build on some platforms.
# --------------------------------------------
# 03/10/29	achirica@telefonica.net	1.1380.1.15
# [PATCH] Fix compatibily issue with some APs
# --------------------------------------------
# 03/10/29	rmk@arm.linux.org.uk	1.1380.1.16
# [PATCH] 2.6.0-test8: fix ARM ether driver naming
# 
# Ensure that arm ether drivers print the correct ether device name rather
# than "eth%d".
# --------------------------------------------
# 03/10/29	komujun@nifty.com	1.1380.1.17
# [pcmcia fmvj18x_cs] share interrupts properly for TDK multifunction cards.
# --------------------------------------------
# 03/10/29	amir.noam@intel.com	1.1380.1.18
# [netdrvr bonding] fix monitoring functions
# 
# This fix got missed in the bonding patchset applied a while ago.
# --------------------------------------------
# 03/10/29	arjanv@redhat.com	1.1380.1.19
# [PATCH] fix starfire 64-bit b0rkage
# 
# (x >> 32) is undefined on a 32 bit integral variable in C; In contrast
# (x >>16 >> 16) is fine (and gets optimized out to 0, while (x >> 32)
# gets optimized out to a nop). 
# 
# Fix for starfire below
# --------------------------------------------
# 03/10/29	achirica@telefonica.net	1.1380.1.20
# [PATCH] Fix wireless stats locking
# --------------------------------------------
# 03/10/29	akpm@osdl.org	1.1380.1.21
# [netdrvr 3c527] add MODULE_LICENSE tag
# --------------------------------------------
# 03/10/29	torvalds@home.osdl.org	1.1380.1.22
# Merge bk://bk.arm.linux.org.uk/linux-2.6-pcmcia
# into home.osdl.org:/home/torvalds/v2.5/linux
# --------------------------------------------
# 03/10/29	torvalds@home.osdl.org	1.1383
# Merge bk://bk.arm.linux.org.uk/linux-2.6-serial
# into home.osdl.org:/home/torvalds/v2.5/linux
# --------------------------------------------
# 03/10/29	shaggy@shaggy.austin.ibm.com	1.1380.2.1
# JFS: remove racy, redundant call to block_invalidatepage
# 
# __invalidate_metapages references mp->page after after releasing the
# meta_lock spinlock, without increasing the use count.  This is racy and
# unnecessary since setting the META_discard flag is sufficient.
# block_invalidatepage() will be called when the metapage is released.
# --------------------------------------------
# 03/10/29	torvalds@home.osdl.org	1.1384
# Merge http://jfs.bkbits.net/linux-2.5
# into home.osdl.org:/home/torvalds/v2.5/linux
# --------------------------------------------
# 03/10/29	ink@jurassic.park.msu.ru	1.1383.1.1
# [PATCH] PCI: fix bug in pci_setup_bridge()
# 
# This bug prevents Alphas with older firmware from booting if there
# is a card with PCI-PCI bridge that supports 32-bit IO.
# This has happened on AS2100 with a quad-tulip card, for example:
#  - initially, the I/O window of 21152 bridge was 0x10000-0x10fff,
#    as set up by firmware;
#  - pci_setup_bridge() is going to change this, say, to 0xa000-0xafff:
#    first, it updates PCI_IO_BASE_UPPER16 and PCI_IO_LIMIT_UPPER16
#    registers, so that IO window temporarily is at 0x0000-0x0fff,
#    which effectively blocks up all legacy IO ports in the lower
#    4K range, such as serial, floppy, RTC an so on;
#    does debugging printk - machine dies here with recursive
#    machine checks as the serial console has gone.
# 
# Moving (or disabling) the debugging printk is not a solution -
# there is possibility that timer interrupt (which might access RTC
# ports) occurs between writes to lower and upper parts of the
# base/limit registers.
# 
# The patch temporarily disables the IO window of the bridge by
# setting PCI_IO_BASE_UPPER16 > PCI_IO_LIMIT_UPPER16 before doing
# an update. It's safe, as we don't have any active IO behind
# the bridge at this point. Also, it's a NOP for bridges with
# 16-bit-only IO.
# Similar (but simpler, as we always clear upper 32 bits) fix
# for 64-bit prefetchable MMIO range.
# --------------------------------------------
# 03/10/29	greg@kroah.com	1.1383.1.2
# [PATCH] I2C: remove some MOD_INC and MOD_DEC usages that are not needed anymore.
# --------------------------------------------
# 03/10/29	greg@kroah.com	1.1383.1.3
# [PATCH] USB: don't build the whiteheat driver if on SMP as the locking is all messed up.
# --------------------------------------------
# 03/10/29	torvalds@home.osdl.org	1.1385
# Merge bk://kernel.bkbits.net/gregkh/linux/pci-2.6
# into home.osdl.org:/home/torvalds/v2.5/linux
# --------------------------------------------
# 03/10/29	rusty@rustcorp.com.au	1.1386
# [PATCH] Fix for module initialization failure
# 
# Bug reported by Paul Mackerras: if a module parameter fails, we didn't
# call module_arch_cleanup().
# 
# On x86 this was harmless (module_arch_cleanup() is a no-op), but on
# other architectures like PPC this causes inconsistent data structures
# and subsequent oopses.
# --------------------------------------------
#
diff -Nru a/Documentation/networking/irda.txt b/Documentation/networking/irda.txt
--- a/Documentation/networking/irda.txt	Wed Oct 29 19:10:35 2003
+++ b/Documentation/networking/irda.txt	Wed Oct 29 19:10:35 2003
@@ -3,12 +3,12 @@
 programs can be found on http://irda.sourceforge.net/
 
 For more information about how to use the IrDA protocol stack, see the
-IR-HOWTO (http://www.mobilix.org/Infrared-HOWTO/Infrared-HOWTO.html) written by Werner Heuser
-<wehe@mobilix.org>
+Linux Infared HOWTO (http://www.tuxmobil.org/Infrared-HOWTO/Infrared-HOWTO.html)
+by Werner Heuser <wehe@tuxmobil.org>
 
 There is an active mailing list for discussing Linux-IrDA matters called
-linux-irda. To subscribe to it, visit:
+    irda-users@lists.sourceforge.net
+
+
 
-	http://www.pasta.cs.uit.no/mailman/listinfo/linux-irda
 
-Dag Brattli <dagb@cs.uit.no>
diff -Nru a/Documentation/video4linux/meye.txt b/Documentation/video4linux/meye.txt
--- a/Documentation/video4linux/meye.txt	Wed Oct 29 19:10:36 2003
+++ b/Documentation/video4linux/meye.txt	Wed Oct 29 19:10:36 2003
@@ -33,6 +33,11 @@
 driver however), but things are not moving very fast (see
 http://r-engine.sourceforge.net/) (PCI vendor/device is 0x10cf/0x2011).
 
+There is a forth model connected on the USB bus in TR1* Vaio laptops.
+This camera is not supported at all by the current driver, in fact
+little information if any is available for this camera
+(USB vendor/device is 0x054c/0x0107).
+
 Driver options:
 ---------------
 
diff -Nru a/arch/alpha/kernel/setup.c b/arch/alpha/kernel/setup.c
--- a/arch/alpha/kernel/setup.c	Wed Oct 29 19:10:35 2003
+++ b/arch/alpha/kernel/setup.c	Wed Oct 29 19:10:35 2003
@@ -486,6 +486,21 @@
 	hwrpb = (struct hwrpb_struct*) __va(INIT_HWRPB->phys_addr);
 	boot_cpuid = hard_smp_processor_id();
 
+        /*
+	 * Pre-process the system type to make sure it will be valid.
+	 *
+	 * This may restore real CABRIO and EB66+ family names, ie
+	 * EB64+ and EB66.
+	 *
+	 * Oh, and "white box" AS800 (aka DIGITAL Server 3000 series)
+	 * and AS1200 (DIGITAL Server 5000 series) have the type as
+	 * the negative of the real one.
+	 */
+        if ((long)hwrpb->sys_type < 0) {
+		hwrpb->sys_type = -((long)hwrpb->sys_type);
+		hwrpb_update_checksum(hwrpb);
+	}
+
 	/* Register a call for panic conditions. */
 	notifier_chain_register(&panic_notifier_list, &alpha_panic_block);
 
diff -Nru a/arch/h8300/kernel/time.c b/arch/h8300/kernel/time.c
--- a/arch/h8300/kernel/time.c	Wed Oct 29 19:10:36 2003
+++ b/arch/h8300/kernel/time.c	Wed Oct 29 19:10:36 2003
@@ -143,3 +143,9 @@
 }
 
 EXPORT_SYMBOL(do_settimeofday);
+
+unsigned long long sched_clock(void)
+{
+	return (unsigned long long)jiffies * (1000000000 / HZ);
+
+}
diff -Nru a/arch/ia64/kernel/perfmon.c b/arch/ia64/kernel/perfmon.c
--- a/arch/ia64/kernel/perfmon.c	Wed Oct 29 19:10:36 2003
+++ b/arch/ia64/kernel/perfmon.c	Wed Oct 29 19:10:36 2003
@@ -4717,7 +4717,7 @@
 	/*
 	 * context is UNLOADED, MASKED, TERMINATED we are safe to go
 	 */
-	if (state != PFM_CTX_LOADED == 0) return 0;
+	if (state != PFM_CTX_LOADED) return 0;
 
 	if (state == PFM_CTX_ZOMBIE) return -EINVAL;
 
@@ -5787,7 +5787,7 @@
 	 */
 	psr = pfm_get_psr();
 
-	BUG_ON(foo & (IA64_PSR_I));
+	BUG_ON(psr & (IA64_PSR_I));
 
 	/*
 	 * stop monitoring:
diff -Nru a/arch/ia64/kernel/perfmon_mckinley.h b/arch/ia64/kernel/perfmon_mckinley.h
--- a/arch/ia64/kernel/perfmon_mckinley.h	Wed Oct 29 19:10:36 2003
+++ b/arch/ia64/kernel/perfmon_mckinley.h	Wed Oct 29 19:10:36 2003
@@ -167,7 +167,7 @@
 			 val14 = ctx->ctx_pmcs[14];
 			 check_case1 = 1;
 			 break;
-		case 14: val8  = ctx->ctx_pmcs[13];
+		case 14: val8  = ctx->ctx_pmcs[8];
 			 val13 = ctx->ctx_pmcs[13];
 			 val14 = *val;
 			 check_case1 = 1;
diff -Nru a/arch/sparc/kernel/entry.S b/arch/sparc/kernel/entry.S
--- a/arch/sparc/kernel/entry.S	Wed Oct 29 19:10:36 2003
+++ b/arch/sparc/kernel/entry.S	Wed Oct 29 19:10:36 2003
@@ -38,7 +38,7 @@
 
 #define curptr      g6
 
-#define NR_SYSCALLS 268      /* Each OS is different... */
+#define NR_SYSCALLS 272      /* Each OS is different... */
 
 /* These are just handy. */
 #define _SV	save	%sp, -STACKFRAME_SZ, %sp
diff -Nru a/arch/sparc/kernel/systbls.S b/arch/sparc/kernel/systbls.S
--- a/arch/sparc/kernel/systbls.S	Wed Oct 29 19:10:36 2003
+++ b/arch/sparc/kernel/systbls.S	Wed Oct 29 19:10:36 2003
@@ -72,7 +72,8 @@
 /*250*/	.long sparc_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
 /*255*/	.long sys_nis_syscall, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
 /*260*/	.long sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun
-/*265*/	.long sys_timer_delete, sys_timer_create, sys_nis_syscall, sys_nis_syscall
+/*265*/	.long sys_timer_delete, sys_timer_create, sys_nis_syscall, sys_io_setup, sys_io_destroy
+/*270*/	.long sys_io_submit, sys_io_cancel, sys_io_getevents, sys_nis_syscall
 
 #ifdef CONFIG_SUNOS_EMUL
 	/* Now the SunOS syscall table. */
@@ -172,5 +173,8 @@
 /*260*/	.long sunos_nosys, sunos_nosys, sunos_nosys
 	.long sunos_nosys, sunos_nosys, sunos_nosys
 	.long sunos_nosys, sunos_nosys, sunos_nosys
+	.long sunos_nosys
+/*270*/	.long sunos_nosys, sunos_nosys, sunos_nosys
+	.long sunos_nosys
 
 #endif
diff -Nru a/arch/sparc64/Kconfig b/arch/sparc64/Kconfig
--- a/arch/sparc64/Kconfig	Wed Oct 29 19:10:36 2003
+++ b/arch/sparc64/Kconfig	Wed Oct 29 19:10:36 2003
@@ -813,7 +813,7 @@
 # the generic version in that case.
 config HAVE_DEC_LOCK
 	bool
-	depends on !DEBUG_SPINLOCK
+	depends on SMP && !DEBUG_SPINLOCK
 	default y
 
 config DEBUG_SPINLOCK_SLEEP
diff -Nru a/arch/sparc64/kernel/entry.S b/arch/sparc64/kernel/entry.S
--- a/arch/sparc64/kernel/entry.S	Wed Oct 29 19:10:35 2003
+++ b/arch/sparc64/kernel/entry.S	Wed Oct 29 19:10:35 2003
@@ -26,7 +26,7 @@
 
 #define curptr      g6
 
-#define NR_SYSCALLS 268      /* Each OS is different... */
+#define NR_SYSCALLS 272      /* Each OS is different... */
 
 	.text
 	.align		32
diff -Nru a/arch/sparc64/kernel/rtrap.S b/arch/sparc64/kernel/rtrap.S
--- a/arch/sparc64/kernel/rtrap.S	Wed Oct 29 19:10:36 2003
+++ b/arch/sparc64/kernel/rtrap.S	Wed Oct 29 19:10:36 2003
@@ -270,9 +270,14 @@
 #ifdef CONFIG_PREEMPT
 		ldsw			[%g6 + TI_PRE_COUNT], %l5
 		brnz			%l5, kern_fpucheck
+		 ldx			[%g6 + TI_FLAGS], %l5
+		andcc			%l5, _TIF_NEED_RESCHED, %g0
+		be,pt			%xcc, kern_fpucheck
+		 srl			%l4, 20, %l5
+		cmp			%l5, 0
+		bne,pn			%xcc, kern_fpucheck
 		 sethi			%hi(PREEMPT_ACTIVE), %l6
 		stw			%l6, [%g6 + TI_PRE_COUNT]
-		wrpr			0, %pil
 		call			schedule
 		 nop
 		ba,pt			%xcc, rtrap
diff -Nru a/arch/sparc64/kernel/sparc64_ksyms.c b/arch/sparc64/kernel/sparc64_ksyms.c
--- a/arch/sparc64/kernel/sparc64_ksyms.c	Wed Oct 29 19:10:36 2003
+++ b/arch/sparc64/kernel/sparc64_ksyms.c	Wed Oct 29 19:10:36 2003
@@ -136,6 +136,7 @@
 EXPORT_SYMBOL(__read_unlock);
 EXPORT_SYMBOL(__write_lock);
 EXPORT_SYMBOL(__write_unlock);
+EXPORT_SYMBOL(__write_trylock);
 #endif
 
 /* Hard IRQ locking */
diff -Nru a/arch/sparc64/kernel/systbls.S b/arch/sparc64/kernel/systbls.S
--- a/arch/sparc64/kernel/systbls.S	Wed Oct 29 19:10:36 2003
+++ b/arch/sparc64/kernel/systbls.S	Wed Oct 29 19:10:36 2003
@@ -72,7 +72,8 @@
 /*250*/	.word sys32_mremap, sys32_sysctl, sys_getsid, sys_fdatasync, sys32_nfsservctl
 	.word sys_ni_syscall, compat_clock_settime, compat_clock_gettime, compat_clock_getres, compat_clock_nanosleep
 /*260*/	.word compat_sys_sched_getaffinity, compat_sys_sched_setaffinity, compat_timer_settime, compat_timer_gettime, sys_timer_getoverrun
-	.word sys_timer_delete, sys32_timer_create, sys_ni_syscall, sys_ni_syscall
+	.word sys_timer_delete, sys32_timer_create, sys_ni_syscall, sys_ni_syscall, sys_ni_syscall
+/*270*/	.word sys_ni_syscall, sys_ni_syscall, sys_ni_syscall, sys_ni_syscall
 
 	/* Now the 64-bit native Linux syscall table. */
 
@@ -133,7 +134,8 @@
 /*250*/	.word sys64_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
 	.word sys_ni_syscall, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
 /*260*/	.word sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun
-	.word sys_timer_delete, sys_timer_create, sys_ni_syscall, sys_ni_syscall
+	.word sys_timer_delete, sys_timer_create, sys_ni_syscall, sys_io_setup, sys_io_destroy
+/*270*/	.word sys_io_submit, sys_io_cancel, sys_io_getevents, sys_ni_syscall
 
 #if defined(CONFIG_SUNOS_EMUL) || defined(CONFIG_SOLARIS_EMUL) || \
     defined(CONFIG_SOLARIS_EMUL_MODULE)
@@ -233,6 +235,7 @@
 	.word sunos_nosys, sunos_nosys, sunos_nosys
 	.word sunos_nosys, sunos_nosys, sunos_nosys
 	.word sunos_nosys, sunos_nosys, sunos_nosys
-	.word sunos_nosys
+	.word sunos_nosys, sunos_nosys, sunos_nosys
+	.word sunos_nosys, sunos_nosys, sunos_nosys
 
 #endif
diff -Nru a/arch/sparc64/lib/dec_and_lock.S b/arch/sparc64/lib/dec_and_lock.S
--- a/arch/sparc64/lib/dec_and_lock.S	Wed Oct 29 19:10:36 2003
+++ b/arch/sparc64/lib/dec_and_lock.S	Wed Oct 29 19:10:36 2003
@@ -29,7 +29,7 @@
 atomic_dec_and_lock:	/* %o0 = counter, %o1 = lock */
 loop1:	lduw	[%o0], %g5
 	subcc	%g5, 1, %g7
-	be,pn	%icc, to_zero
+	be,pn	%icc, start_to_zero
 	 nop
 nzero:	cas	[%o0], %g5, %g7
 	cmp	%g5, %g7
@@ -40,6 +40,7 @@
 	membar	#StoreLoad | #StoreStore
 	retl
 	 mov	%g1, %o0
+start_to_zero:
 #ifdef CONFIG_PREEMPT
 	ldsw	[%g6 + TI_PRE_COUNT], %g3
 	add	%g3, 1, %g3
diff -Nru a/arch/sparc64/lib/rwlock.S b/arch/sparc64/lib/rwlock.S
--- a/arch/sparc64/lib/rwlock.S	Wed Oct 29 19:10:36 2003
+++ b/arch/sparc64/lib/rwlock.S	Wed Oct 29 19:10:36 2003
@@ -63,5 +63,27 @@
 	be,pt		%icc, 99b
 	 membar		#StoreLoad | #StoreStore
 	ba,a,pt		%xcc, 1b
+
+	.globl		__write_trylock
+__write_trylock: /* %o0 = lock_ptr */
+	sethi		%hi(0x80000000), %g2
+1:	lduw		[%o0], %g5
+	brnz,pn		%g5, __write_trylock_fail
+4:	 or		%g5, %g2, %g7
+
+	cas		[%o0], %g5, %g7
+	cmp		%g5, %g7
+	be,pt		%icc, __write_trylock_succeed
+	 membar		#StoreLoad | #StoreStore
+
+	ba,pt		%xcc, 1b
+	 nop
+__write_trylock_succeed:
+	retl
+	 mov		1, %o0
+
+__write_trylock_fail:
+	retl
+	 mov		0, %o0
 rwlock_impl_end:
 
diff -Nru a/arch/x86_64/kernel/acpi/boot.c b/arch/x86_64/kernel/acpi/boot.c
--- a/arch/x86_64/kernel/acpi/boot.c	Wed Oct 29 19:10:35 2003
+++ b/arch/x86_64/kernel/acpi/boot.c	Wed Oct 29 19:10:35 2003
@@ -251,6 +251,33 @@
 } 
 #endif
 
+#ifdef CONFIG_ACPI_BUS
+/*
+ * Set specified PIC IRQ to level triggered mode.
+ *
+ * Port 0x4d0-4d1 are ECLR1 and ECLR2, the Edge/Level Control Registers
+ * for the 8259 PIC.  bit[n] = 1 means irq[n] is Level, otherwise Edge.
+ * ECLR1 is IRQ's 0-7 (IRQ 0, 1, 2 must be 0)
+ * ECLR2 is IRQ's 8-15 (IRQ 8, 13 must be 0)
+ *
+ * As the BIOS should have done this for us,
+ * print a warning if the IRQ wasn't already set to level.
+ */
+
+void acpi_pic_set_level_irq(unsigned int irq)
+{
+	unsigned char mask = 1 << (irq & 7);
+	unsigned int port = 0x4d0 + (irq >> 3);
+	unsigned char val = inb(port);
+
+	if (!(val & mask)) {
+		printk(KERN_WARNING PREFIX "IRQ %d was Edge Triggered, "
+			"setting to Level Triggerd\n", irq);
+		outb(val | mask, port);
+	}
+}
+#endif /* CONFIG_ACPI_BUS */
+
 static unsigned long __init
 acpi_scan_rsdp (
 	unsigned long		start,
diff -Nru a/arch/x86_64/kernel/entry.S b/arch/x86_64/kernel/entry.S
--- a/arch/x86_64/kernel/entry.S	Wed Oct 29 19:10:36 2003
+++ b/arch/x86_64/kernel/entry.S	Wed Oct 29 19:10:36 2003
@@ -566,8 +566,14 @@
 	incl %ebx
        /* There are two places in the kernel that can potentially fault with
           usergs. Handle them here. The exception handlers after
-	  iret run with kernel gs again, so don't set the user space flag. */
-	cmpq $iret_label,RIP(%rsp) 
+	   iret run with kernel gs again, so don't set the user space flag.
+	   B stepping K8s sometimes report an truncated RIP for IRET 
+	   exceptions returning to compat mode. Check for these here too. */
+	leaq iret_label(%rip),%rbp
+	cmpq %rbp,RIP(%rsp) 
+	je   error_swapgs
+	movl %ebp,%ebp	/* zero extend */
+	cmpq %rbp,RIP(%rsp) 
 	je   error_swapgs
 	cmpq $gs_change,RIP(%rsp)
         je   error_swapgs
diff -Nru a/arch/x86_64/kernel/io_apic.c b/arch/x86_64/kernel/io_apic.c
--- a/arch/x86_64/kernel/io_apic.c	Wed Oct 29 19:10:36 2003
+++ b/arch/x86_64/kernel/io_apic.c	Wed Oct 29 19:10:36 2003
@@ -622,11 +622,13 @@
 	return 0;
 }
 
-int irq_vector[NR_IRQS] = { FIRST_DEVICE_VECTOR , 0 };
+/* irq_vectors is indexed by the sum of all RTEs in all I/O APICs. */
+u8 irq_vector[NR_IRQ_VECTORS] = { FIRST_DEVICE_VECTOR , 0 };
 
 static int __init assign_irq_vector(int irq)
 {
 	static int current_vector = FIRST_DEVICE_VECTOR, offset = 0;
+	BUG_ON(irq >= NR_IRQ_VECTORS);
 	if (IO_APIC_VECTOR(irq) > 0)
 		return IO_APIC_VECTOR(irq);
 next:
diff -Nru a/arch/x86_64/kernel/setup64.c b/arch/x86_64/kernel/setup64.c
--- a/arch/x86_64/kernel/setup64.c	Wed Oct 29 19:10:36 2003
+++ b/arch/x86_64/kernel/setup64.c	Wed Oct 29 19:10:36 2003
@@ -189,8 +189,7 @@
 	pda->irqstackptr += IRQSTACKSIZE-64;
 } 
 
-#define EXCEPTION_STK_ORDER 0 /* >= N_EXCEPTION_STACKS*EXCEPTION_STKSZ */
-char boot_exception_stacks[N_EXCEPTION_STACKS*EXCEPTION_STKSZ];
+char boot_exception_stacks[N_EXCEPTION_STACKS * EXCEPTION_STKSZ];
 
 void syscall_init(void)
 {
@@ -226,15 +225,12 @@
 #endif
 	struct tss_struct * t = &init_tss[cpu];
 	unsigned long v, efer; 
-	char *estacks; 
+	char *estacks = NULL; 
 	struct task_struct *me;
 
 	/* CPU 0 is initialised in head64.c */
 	if (cpu != 0) {
 		pda_init(cpu);
-		estacks = (char *)__get_free_pages(GFP_ATOMIC, 0); 
-		if (!estacks)
-			panic("Can't allocate exception stacks for CPU %d\n",cpu);
 	} else 
 		estacks = boot_exception_stacks; 
 
@@ -282,10 +278,15 @@
 	/*
 	 * set up and load the per-CPU TSS
 	 */
-	estacks += EXCEPTION_STKSZ;
 	for (v = 0; v < N_EXCEPTION_STACKS; v++) {
-		t->ist[v] = (unsigned long)estacks;
+		if (cpu) {
+			estacks = (char *)__get_free_pages(GFP_ATOMIC, 0);
+			if (!estacks)
+				panic("Cannot allocate exception stack %ld %d\n",
+				      v, cpu); 
+		}
 		estacks += EXCEPTION_STKSZ;
+		t->ist[v] = (unsigned long)estacks;
 	}
 
 	t->io_bitmap_base = INVALID_IO_BITMAP_OFFSET;
diff -Nru a/arch/x86_64/kernel/smp.c b/arch/x86_64/kernel/smp.c
--- a/arch/x86_64/kernel/smp.c	Wed Oct 29 19:10:35 2003
+++ b/arch/x86_64/kernel/smp.c	Wed Oct 29 19:10:35 2003
@@ -487,25 +487,3 @@
 		atomic_inc(&call_data->finished);
 	}
 }
-
-/* Slow. Should be only used for debugging. */
-int slow_smp_processor_id(void)
-{ 
-	int stack_location;
-	unsigned long sp = (unsigned long)&stack_location; 
-	int offset = 0, cpu;
-
-	for (offset = 0; next_cpu(offset, cpu_online_map) < NR_CPUS; offset = cpu + 1) {
-		cpu = next_cpu(offset, cpu_online_map);
-
-		if (sp >= (u64)cpu_pda[cpu].irqstackptr - IRQSTACKSIZE && 
-		    sp <= (u64)cpu_pda[cpu].irqstackptr)
-			return cpu;
-
-		unsigned long estack = init_tss[cpu].ist[0] - EXCEPTION_STKSZ;
-		if (sp >= estack && sp <= estack+(1<<(PAGE_SHIFT+EXCEPTION_STK_ORDER)))
-			return cpu;			
-	}
-
-	return stack_smp_processor_id();
-} 
diff -Nru a/arch/x86_64/kernel/time.c b/arch/x86_64/kernel/time.c
--- a/arch/x86_64/kernel/time.c	Wed Oct 29 19:10:36 2003
+++ b/arch/x86_64/kernel/time.c	Wed Oct 29 19:10:36 2003
@@ -111,6 +111,14 @@
 		sec = xtime.tv_sec;
 		usec = xtime.tv_nsec / 1000;
 
+		/*
+		 * If time_adjust is negative then NTP is slowing the clock
+		 * so make sure not to go into next possible interval.
+		 * Better to lose some accuracy than have time go backwards..
+		 */
+		if (unlikely(time_adjust < 0) && usec > tickadj)
+			usec = tickadj;
+
 		t = (jiffies - wall_jiffies) * (1000000L / HZ) +
 			do_gettimeoffset();
 		usec += t;
@@ -477,22 +485,28 @@
 static unsigned int  ref_freq = 0;
 static unsigned long loops_per_jiffy_ref = 0;
 
-//static unsigned long fast_gettimeoffset_ref = 0;
 static unsigned long cpu_khz_ref = 0;
 
 static int time_cpufreq_notifier(struct notifier_block *nb, unsigned long val,
 				 void *data)
 {
         struct cpufreq_freqs *freq = data;
+	unsigned long *lpj;
+
+#ifdef CONFIG_SMP
+	lpj = &cpu_data[freq->cpu].loops_per_jiffy;
+#else
+	lpj = &boot_cpu_data.loops_per_jiffy;
+#endif
 
 	if (!ref_freq) {
 		ref_freq = freq->old;
-		loops_per_jiffy_ref = cpu_data[freq->cpu].loops_per_jiffy;
+		loops_per_jiffy_ref = *lpj;
 		cpu_khz_ref = cpu_khz;
 	}
         if ((val == CPUFREQ_PRECHANGE  && freq->old < freq->new) ||
             (val == CPUFREQ_POSTCHANGE && freq->old > freq->new)) {
-                cpu_data[freq->cpu].loops_per_jiffy =
+                *lpj =
 		cpufreq_scale(loops_per_jiffy_ref, ref_freq, freq->new);
 
 		cpu_khz = cpufreq_scale(cpu_khz_ref, ref_freq, freq->new);
diff -Nru a/arch/x86_64/kernel/x8664_ksyms.c b/arch/x86_64/kernel/x8664_ksyms.c
--- a/arch/x86_64/kernel/x8664_ksyms.c	Wed Oct 29 19:10:35 2003
+++ b/arch/x86_64/kernel/x8664_ksyms.c	Wed Oct 29 19:10:35 2003
@@ -71,6 +71,7 @@
 EXPORT_SYMBOL_NOVERS(__up_wakeup);
 /* Networking helper routines. */
 EXPORT_SYMBOL(csum_partial_copy_nocheck);
+EXPORT_SYMBOL(ip_compute_csum);
 /* Delay loops */
 EXPORT_SYMBOL(__udelay);
 EXPORT_SYMBOL(__ndelay);
@@ -113,6 +114,7 @@
 EXPORT_SYMBOL(mmx_copy_page);
 #endif
 
+EXPORT_SYMBOL(cpu_pda);
 #ifdef CONFIG_SMP
 EXPORT_SYMBOL(cpu_data);
 EXPORT_SYMBOL(cpu_online_map);
@@ -153,7 +155,7 @@
 
 extern void * memset(void *,int,__kernel_size_t);
 extern size_t strlen(const char *);
-extern char * bcopy(const char * src, char * dest, int count);
+extern void bcopy(const char * src, char * dest, int count);
 extern void * memmove(void * dest,const void *src,size_t count);
 extern char * strcpy(char * dest,const char *src);
 extern int strcmp(const char * cs,const char * ct);
diff -Nru a/arch/x86_64/mm/extable.c b/arch/x86_64/mm/extable.c
--- a/arch/x86_64/mm/extable.c	Wed Oct 29 19:10:36 2003
+++ b/arch/x86_64/mm/extable.c	Wed Oct 29 19:10:36 2003
@@ -14,6 +14,10 @@
 	       const struct exception_table_entry *last,
 	       unsigned long value)
 {
+	/* Work around a B stepping K8 bug */
+	if ((value >> 32) == 0)
+		value |= 0xffffffffUL << 32; 
+
         while (first <= last) {
 		const struct exception_table_entry *mid;
 		long diff;
diff -Nru a/arch/x86_64/mm/k8topology.c b/arch/x86_64/mm/k8topology.c
--- a/arch/x86_64/mm/k8topology.c	Wed Oct 29 19:10:36 2003
+++ b/arch/x86_64/mm/k8topology.c	Wed Oct 29 19:10:36 2003
@@ -164,5 +164,8 @@
 		rr++; 
 	}
 
+	if (found == 1) 
+		fake_node = 1;
+
 	return 0;
 } 
diff -Nru a/arch/x86_64/mm/numa.c b/arch/x86_64/mm/numa.c
--- a/arch/x86_64/mm/numa.c	Wed Oct 29 19:10:36 2003
+++ b/arch/x86_64/mm/numa.c	Wed Oct 29 19:10:36 2003
@@ -104,6 +104,7 @@
 	if (nodeid + 1 > numnodes)
 		numnodes = nodeid + 1;
 	nodes_present |= (1UL << nodeid); 
+	node_set_online(nodeid);
 } 
 
 /* Initialize final allocator for a zone */
diff -Nru a/drivers/acpi/dispatcher/dsopcode.c b/drivers/acpi/dispatcher/dsopcode.c
--- a/drivers/acpi/dispatcher/dsopcode.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/acpi/dispatcher/dsopcode.c	Wed Oct 29 19:10:36 2003
@@ -514,16 +514,14 @@
 		goto cleanup;
 	}
 
+
 	/* Entire field must fit within the current length of the buffer */
 
 	if ((bit_offset + bit_count) >
 		(8 * (u32) buffer_desc->buffer.length)) {
 		ACPI_DEBUG_PRINT ((ACPI_DB_ERROR,
-			"Field [%4.4s] size %d exceeds Buffer [%4.4s] size %d (bits)\n",
-			((struct acpi_namespace_node *) result_desc)->name.ascii,
-			 bit_offset + bit_count,
-			 buffer_desc->buffer.node->name.ascii,
-			 8 * (u32) buffer_desc->buffer.length));
+			"Field size %d exceeds Buffer size %d (bits)\n",
+			 bit_offset + bit_count, 8 * (u32) buffer_desc->buffer.length));
 		status = AE_AML_BUFFER_LIMIT;
 		goto cleanup;
 	}
diff -Nru a/drivers/acpi/ec.c b/drivers/acpi/ec.c
--- a/drivers/acpi/ec.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/acpi/ec.c	Wed Oct 29 19:10:36 2003
@@ -94,13 +94,6 @@
 /* External interfaces use first EC only, so remember */
 static struct acpi_device *first_ec;
 
-/*
- * We use kernel thread to handle ec's gpe query, so the query may defer.
- * The query need a context, which can be freed when we replace ec_ecdt
- * with EC device. So defered query may have a wrong context.
- * We use an indication to avoid it
- */
-static int ec_device_init = 0;
 /* --------------------------------------------------------------------------
                              Transaction Management
    -------------------------------------------------------------------------- */
@@ -400,11 +393,8 @@
 
 	acpi_disable_gpe(NULL, ec->gpe_bit, ACPI_ISR);
 
-	if (!ec_device_init)
-		acpi_ec_gpe_query(ec); /* directly query when device didn't init */
-	else
-		status = acpi_os_queue_for_execution(OSD_PRIORITY_GPE,
-			acpi_ec_gpe_query, ec);
+	status = acpi_os_queue_for_execution(OSD_PRIORITY_GPE,
+		acpi_ec_gpe_query, ec);
 }
 
 /* --------------------------------------------------------------------------
@@ -599,8 +589,6 @@
 	   we now have the *real* EC info, so kill the makeshift one.*/
 	acpi_evaluate_integer(ec->handle, "_UID", NULL, &uid);
 	if (ec_ecdt && ec_ecdt->uid == uid) {
-		acpi_disable_gpe(NULL, ec_ecdt->gpe_bit, ACPI_NOT_ISR);
-		ec_device_init = 1;
 		acpi_remove_address_space_handler(ACPI_ROOT_OBJECT,
 			ACPI_ADR_SPACE_EC, &acpi_ec_space_handler);
 	
diff -Nru a/drivers/char/sonypi.h b/drivers/char/sonypi.h
--- a/drivers/char/sonypi.h	Wed Oct 29 19:10:36 2003
+++ b/drivers/char/sonypi.h	Wed Oct 29 19:10:36 2003
@@ -37,7 +37,7 @@
 #ifdef __KERNEL__
 
 #define SONYPI_DRIVER_MAJORVERSION	 1
-#define SONYPI_DRIVER_MINORVERSION	20
+#define SONYPI_DRIVER_MINORVERSION	21
 
 #define SONYPI_DEVICE_MODEL_TYPE1	1
 #define SONYPI_DEVICE_MODEL_TYPE2	2
@@ -329,8 +329,8 @@
 	{ SONYPI_DEVICE_MODEL_TYPE2, 0x08, SONYPI_PKEY_MASK, sonypi_pkeyev },
 	{ SONYPI_DEVICE_MODEL_TYPE2, 0x11, SONYPI_BACK_MASK, sonypi_backev },
 	{ SONYPI_DEVICE_MODEL_TYPE2, 0x08, SONYPI_HELP_MASK, sonypi_helpev },
-	{ SONYPI_DEVICE_MODEL_TYPE2, 0x08, SONYPI_ZOOM_MASK, sonypi_zoomev },
-	{ SONYPI_DEVICE_MODEL_TYPE2, 0x08, SONYPI_THUMBPHRASE_MASK, sonypi_thumbphraseev },
+	{ SONYPI_DEVICE_MODEL_TYPE2, 0x21, SONYPI_ZOOM_MASK, sonypi_zoomev },
+	{ SONYPI_DEVICE_MODEL_TYPE2, 0x20, SONYPI_THUMBPHRASE_MASK, sonypi_thumbphraseev },
 	{ SONYPI_DEVICE_MODEL_TYPE2, 0x31, SONYPI_MEMORYSTICK_MASK, sonypi_memorystickev },
 	{ SONYPI_DEVICE_MODEL_TYPE2, 0x41, SONYPI_BATTERY_MASK, sonypi_batteryev },
 
diff -Nru a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
--- a/drivers/input/keyboard/atkbd.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/input/keyboard/atkbd.c	Wed Oct 29 19:10:36 2003
@@ -184,11 +184,19 @@
 		atkbd->resend = 0;
 #endif
 
+	switch (code) {
+		case ATKBD_RET_ACK:
+			atkbd->ack = 1;
+			goto out;
+		case ATKBD_RET_NAK:
+			atkbd->ack = -1;
+			goto out;
+	}
+
 	if (atkbd->translated) do {
 
 		if (atkbd->emul != 1) {
-			if (code == ATKBD_RET_EMUL0 || code == ATKBD_RET_EMUL1 ||
-			    code == ATKBD_RET_ACK || code == ATKBD_RET_NAK)
+			if (code == ATKBD_RET_EMUL0 || code == ATKBD_RET_EMUL1)
 				break;
 			if (code == ATKBD_RET_BAT) {
 				if (!atkbd->bat_xl)
@@ -211,15 +219,6 @@
 		atkbd->release = 1;
 
 	} while (0);
-
-	switch (code) {
-		case ATKBD_RET_ACK:
-			atkbd->ack = 1;
-			goto out;
-		case ATKBD_RET_NAK:
-			atkbd->ack = -1;
-			goto out;
-	}
 
 	if (atkbd->cmdcnt) {
 		atkbd->cmdbuf[--atkbd->cmdcnt] = code;
diff -Nru a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
--- a/drivers/input/mouse/psmouse-base.c	Wed Oct 29 19:10:35 2003
+++ b/drivers/input/mouse/psmouse-base.c	Wed Oct 29 19:10:35 2003
@@ -40,7 +40,7 @@
 
 static int psmouse_noext;
 int psmouse_resolution;
-unsigned int psmouse_rate = 60;
+unsigned int psmouse_rate;
 int psmouse_smartscroll = PSMOUSE_LOGITECH_SMARTSCROLL;
 unsigned int psmouse_resetafter;
 
@@ -471,13 +471,16 @@
  * We set the mouse report rate.
  */
 
-	psmouse_set_rate(psmouse);
+	if (psmouse_rate)
+		psmouse_set_rate(psmouse);
 
 /*
  * We also set the resolution and scaling.
  */
 
-	psmouse_set_resolution(psmouse);
+	if (psmouse_resolution)
+		psmouse_set_resolution(psmouse);
+
 	psmouse_command(psmouse,  NULL, PSMOUSE_CMD_SETSCALE11);
 
 /*
@@ -651,10 +654,17 @@
 	return 1;
 }
 
+static int __init psmouse_rate_setup(char *str)
+{
+	get_option(&str, &psmouse_rate);
+	return 1;
+}
+
 __setup("psmouse_noext", psmouse_noext_setup);
 __setup("psmouse_resolution=", psmouse_resolution_setup);
 __setup("psmouse_smartscroll=", psmouse_smartscroll_setup);
 __setup("psmouse_resetafter=", psmouse_resetafter_setup);
+__setup("psmouse_rate=", psmouse_rate_setup);
 
 #endif
 
diff -Nru a/drivers/md/dm-table.c b/drivers/md/dm-table.c
--- a/drivers/md/dm-table.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/md/dm-table.c	Wed Oct 29 19:10:36 2003
@@ -489,6 +489,18 @@
 		rs->max_sectors =
 			min_not_zero(rs->max_sectors, q->max_sectors);
 
+		/* FIXME: Device-Mapper on top of RAID-0 breaks because DM
+		 *        currently doesn't honor MD's merge_bvec_fn routine.
+		 *        In this case, we'll force DM to use PAGE_SIZE or
+		 *        smaller I/O, just to be safe. A better fix is in the
+		 *        works, but add this for the time being so it will at
+		 *        least operate correctly.
+		 */
+		if (q->merge_bvec_fn)
+			rs->max_sectors =
+				min_not_zero(rs->max_sectors,
+					     (unsigned short)(PAGE_SIZE >> 9));
+
 		rs->max_phys_segments =
 			min_not_zero(rs->max_phys_segments,
 				     q->max_phys_segments);
diff -Nru a/drivers/media/video/bt832.c b/drivers/media/video/bt832.c
--- a/drivers/media/video/bt832.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/media/video/bt832.c	Wed Oct 29 19:10:36 2003
@@ -187,7 +187,6 @@
         t->client.data = t;
         i2c_attach_client(&t->client);
 
-	MOD_INC_USE_COUNT;
 	if(! bt832_init(&t->client)) {
 		bt832_detach(&t->client);
 		return -1;
@@ -210,7 +209,6 @@
 	printk("bt832: detach.\n");
 	i2c_detach_client(client);
 	kfree(t);
-	MOD_DEC_USE_COUNT;
 	return 0;
 }
 
diff -Nru a/drivers/media/video/bttv-cards.c b/drivers/media/video/bttv-cards.c
--- a/drivers/media/video/bttv-cards.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/media/video/bttv-cards.c	Wed Oct 29 19:10:36 2003
@@ -2439,8 +2439,8 @@
         { TUNER_TEMIC_4039FR5_NTSC, "Temic 4039FR5" },
         { TUNER_PHILIPS_FQ1216ME,   "Philips FQ1216 ME" },
         { TUNER_TEMIC_4066FY5_PAL_I, "Temic 4066FY5" },
-        { TUNER_ABSENT,        "Philips TD1536" },
-        { TUNER_ABSENT,        "Philips TD1536D" },
+        { TUNER_PHILIPS_NTSC,        "Philips TD1536" },
+        { TUNER_PHILIPS_NTSC,        "Philips TD1536D" },
 	{ TUNER_PHILIPS_NTSC,  "Philips FMR1236" }, /* mono radio */
         { TUNER_ABSENT,        "Philips FI1256MP" },
         { TUNER_ABSENT,        "Samsung TCPQ9091P" },
diff -Nru a/drivers/media/video/bttv-if.c b/drivers/media/video/bttv-if.c
--- a/drivers/media/video/bttv-if.c	Wed Oct 29 19:10:35 2003
+++ b/drivers/media/video/bttv-if.c	Wed Oct 29 19:10:35 2003
@@ -247,7 +247,7 @@
 bttv_i2c_wait_done(struct bttv *btv)
 {
 	u32 stat;
-	int timeout;
+	unsigned long timeout;
 
 	timeout = jiffies + HZ/100 + 1; /* 10ms */
 	for (;;) {
diff -Nru a/drivers/media/video/meye.h b/drivers/media/video/meye.h
--- a/drivers/media/video/meye.h	Wed Oct 29 19:10:36 2003
+++ b/drivers/media/video/meye.h	Wed Oct 29 19:10:36 2003
@@ -31,7 +31,7 @@
 #define _MEYE_PRIV_H_
 
 #define MEYE_DRIVER_MAJORVERSION	1
-#define MEYE_DRIVER_MINORVERSION	7
+#define MEYE_DRIVER_MINORVERSION	8
 
 #include <linux/config.h>
 #include <linux/types.h>
diff -Nru a/drivers/media/video/saa5249.c b/drivers/media/video/saa5249.c
--- a/drivers/media/video/saa5249.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/media/video/saa5249.c	Wed Oct 29 19:10:36 2003
@@ -214,7 +214,6 @@
 	}
 	t->client = client;
 	i2c_attach_client(client);
-	MOD_INC_USE_COUNT;
 	return 0;
 }
 
@@ -237,7 +236,6 @@
 	kfree(vd->priv);
 	kfree(vd);
 	kfree(client);
-	MOD_DEC_USE_COUNT;
 	return 0;
 }
 
diff -Nru a/drivers/media/video/tuner-3036.c b/drivers/media/video/tuner-3036.c
--- a/drivers/media/video/tuner-3036.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/media/video/tuner-3036.c	Wed Oct 29 19:10:36 2003
@@ -134,7 +134,6 @@
 	printk("tuner: SAB3036 found, status %02x\n", tuner_getstatus(client));
 
         i2c_attach_client(client);
-	MOD_INC_USE_COUNT;
 
 	if (i2c_master_send(client, buffer, 2) != 2)
 		printk("tuner: i2c i/o error 1\n");
@@ -148,7 +147,6 @@
 static int 
 tuner_detach(struct i2c_client *c)
 {
-	MOD_DEC_USE_COUNT;
 	return 0;
 }
 
diff -Nru a/drivers/net/3c527.c b/drivers/net/3c527.c
--- a/drivers/net/3c527.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/net/3c527.c	Wed Oct 29 19:10:36 2003
@@ -109,6 +109,8 @@
 
 #include "3c527.h"
 
+MODULE_LICENSE("GPL");
+
 /*
  * The name of the card. Is used for messages and in the requests for
  * io regions, irqs and dma channels
diff -Nru a/drivers/net/8139too.c b/drivers/net/8139too.c
--- a/drivers/net/8139too.c	Wed Oct 29 19:10:35 2003
+++ b/drivers/net/8139too.c	Wed Oct 29 19:10:35 2003
@@ -245,6 +245,7 @@
 	{0x1186, 0x1340, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RTL8139 },
 	{0x13d1, 0xab06, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RTL8139 },
 	{0x1259, 0xa117, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RTL8139 },
+	{0x1259, 0xa11e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RTL8139 },
 	{0x14ea, 0xab06, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RTL8139 },
 	{0x14ea, 0xab07, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RTL8139 },
 	{0x11db, 0x1234, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RTL8139 },
diff -Nru a/drivers/net/arm/ether1.c b/drivers/net/arm/ether1.c
--- a/drivers/net/arm/ether1.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/net/arm/ether1.c	Wed Oct 29 19:10:36 2003
@@ -1036,13 +1036,8 @@
 		goto release;
 	}
 
-	printk(KERN_INFO "%s: ether1 in slot %d, ",
-		dev->name, ec->slot_no);
-    
-	for (i = 0; i < 6; i++) {
+	for (i = 0; i < 6; i++)
 		dev->dev_addr[i] = inb(IDPROM_ADDRESS + i);
-		printk ("%2.2x%c", dev->dev_addr[i], i == 5 ? '\n' : ':');
-	}
 
 	if (ether1_init_2(dev)) {
 		ret = -ENODEV;
@@ -1060,6 +1055,12 @@
 	ret = register_netdev(dev);
 	if (ret)
 		goto release;
+
+	printk(KERN_INFO "%s: ether1 in slot %d, ",
+		dev->name, ec->slot_no);
+    
+	for (i = 0; i < 6; i++)
+		printk ("%2.2x%c", dev->dev_addr[i], i == 5 ? '\n' : ':');
 
 	ecard_set_drvdata(ec, dev);
 	return 0;
diff -Nru a/drivers/net/arm/ether3.c b/drivers/net/arm/ether3.c
--- a/drivers/net/arm/ether3.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/net/arm/ether3.c	Wed Oct 29 19:10:36 2003
@@ -881,10 +881,6 @@
 		break;
 	}
 
-	printk("%s: %s in slot %d, ", dev->name, name, ec->slot_no);
-	for (i = 0; i < 6; i++)
-		printk("%2.2x%c", dev->dev_addr[i], i == 5 ? '\n' : ':');
-
 	if (ether3_init_2(dev)) {
 		ret = -ENODEV;
 		goto failed;
@@ -901,6 +897,10 @@
 	ret = register_netdev(dev);
 	if (ret)
 		goto failed;
+
+	printk("%s: %s in slot %d, ", dev->name, name, ec->slot_no);
+	for (i = 0; i < 6; i++)
+		printk("%2.2x%c", dev->dev_addr[i], i == 5 ? '\n' : ':');
 
 	ecard_set_drvdata(ec, dev);
 	return 0;
diff -Nru a/drivers/net/arm/etherh.c b/drivers/net/arm/etherh.c
--- a/drivers/net/arm/etherh.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/net/arm/etherh.c	Wed Oct 29 19:10:36 2003
@@ -665,12 +665,6 @@
 		break;
 	}
 
-	printk(KERN_INFO "%s: %s in slot %d, ",
-		dev->name, dev_type, ec->slot_no);
-
-	for (i = 0; i < 6; i++)
-		printk("%2.2x%c", dev->dev_addr[i], i == 5 ? '\n' : ':');
-
 	ei_local = (struct ei_device *) dev->priv;
 	if (ec->cid.product == PROD_ANT_ETHERM) {
 		ei_local->tx_start_page = ETHERM_TX_START_PAGE;
@@ -697,6 +691,12 @@
 	ret = register_netdev(dev);
 	if (ret)
 		goto release;
+
+	printk(KERN_INFO "%s: %s in slot %d, ",
+		dev->name, dev_type, ec->slot_no);
+
+	for (i = 0; i < 6; i++)
+		printk("%2.2x%c", dev->dev_addr[i], i == 5 ? '\n' : ':');
 
 	ecard_set_drvdata(ec, dev);
 
diff -Nru a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
--- a/drivers/net/bonding/bond_main.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/net/bonding/bond_main.c	Wed Oct 29 19:10:36 2003
@@ -2238,8 +2238,9 @@
 static void bond_mii_monitor(struct net_device *master)
 {
 	bonding_t *bond = (struct bonding *) master->priv;
-	slave_t *slave, *bestslave, *oldcurrent;
+	slave_t *slave, *oldcurrent;
 	int slave_died = 0;
+	int do_failover = 0;
 
 	read_lock(&bond->lock);
 
@@ -2249,7 +2250,6 @@
 	 * program could monitor the link itself if needed.
 	 */
 
-	bestslave = NULL;
 	slave = (slave_t *)bond;
 
 	read_lock(&bond->ptrlock);
@@ -2257,8 +2257,6 @@
 	read_unlock(&bond->ptrlock);
 
 	while ((slave = slave->prev) != (slave_t *)bond) {
-		/* use updelay+1 to match an UP slave even when updelay is 0 */
-		int mindelay = updelay + 1;
 		struct net_device *dev = slave->dev;
 		int link_state;
 		u16 old_speed = slave->speed;
@@ -2269,14 +2267,7 @@
 		switch (slave->link) {
 		case BOND_LINK_UP:	/* the link was up */
 			if (link_state == BMSR_LSTATUS) {
-				/* link stays up, tell that this one
-				   is immediately available */
-				if (IS_UP(dev) && (mindelay > -2)) {
-					/* -2 is the best case :
-					   this slave was already up */
-					mindelay = -2;
-					bestslave = slave;
-				}
+				/* link stays up, nothing more to do */
 				break;
 			}
 			else { /* link going down */
@@ -2316,6 +2307,7 @@
 					    (bond_mode == BOND_MODE_8023AD)) {
 						bond_set_slave_inactive_flags(slave);
 					}
+
 					printk(KERN_INFO
 						"%s: link status definitely down "
 						"for interface %s, disabling it",
@@ -2332,12 +2324,10 @@
 						bond_alb_handle_link_change(bond, slave, BOND_LINK_DOWN);
 					}
 
-					write_lock(&bond->ptrlock);
-					if (slave == bond->current_slave) {
-						/* find a new interface and be verbose */
-						reselect_active_interface(bond);
+					if (slave == oldcurrent) {
+						do_failover = 1;
 					}
-					write_unlock(&bond->ptrlock);
+
 					slave_died = 1;
 				} else {
 					slave->delay--;
@@ -2352,13 +2342,6 @@
 					master->name,
 					(downdelay - slave->delay) * miimon,
 					dev->name);
-
-				if (IS_UP(dev) && (mindelay > -1)) {
-					/* -1 is a good case : this slave went
-					   down only for a short time */
-					mindelay = -1;
-					bestslave = slave;
-				}
 			}
 			break;
 		case BOND_LINK_DOWN:	/* the link was down */
@@ -2428,26 +2411,12 @@
 						bond_alb_handle_link_change(bond, slave, BOND_LINK_UP);
 					}
 
-					write_lock(&bond->ptrlock);
-					if ( (bond->primary_slave != NULL)
-					  && (slave == bond->primary_slave) )
-						reselect_active_interface(bond); 
-					write_unlock(&bond->ptrlock);
-				}
-				else
+					if ((oldcurrent == NULL) ||
+					    (slave == bond->primary_slave)) {
+						do_failover = 1;
+					}
+				} else {
 					slave->delay--;
-
-				/* we'll also look for the mostly eligible slave */
-				if (bond->primary_slave == NULL)  {
-				    if (IS_UP(dev) && (slave->delay < mindelay)) {
-					mindelay = slave->delay;
-					bestslave = slave;
-				    } 
-				} else if ( (IS_UP(bond->primary_slave->dev))  || 
-				          ( (!IS_UP(bond->primary_slave->dev))  && 
-				          (IS_UP(dev) && (slave->delay < mindelay)) ) ) {
-					mindelay = slave->delay;
-					bestslave = slave;
 				}
 			}
 			break;
@@ -2466,26 +2435,17 @@
 
 	} /* end of while */
 
-	/* 
-	 * if there's no active interface and we discovered that one
-	 * of the slaves could be activated earlier, so we do it.
-	 */
-	read_lock(&bond->ptrlock);
-	oldcurrent = bond->current_slave;
-	read_unlock(&bond->ptrlock);
+	if (do_failover) {
+		write_lock(&bond->ptrlock);
 
-	/* no active interface at the moment or need to bring up the primary */
-	if (oldcurrent == NULL)  { /* no active interface at the moment */
-		if (bestslave != NULL) { /* last chance to find one ? */
-			write_lock(&bond->ptrlock);
-			change_active_interface(bond, bestslave);
-			write_unlock(&bond->ptrlock);
-		} else if (slave_died) {
-			/* print this message only once a slave has just died */
+		reselect_active_interface(bond);
+		if (oldcurrent && !bond->current_slave) {
 			printk(KERN_INFO
 				"%s: now running without any active interface !\n",
 				master->name);
 		}
+
+		write_unlock(&bond->ptrlock);
 	}
 
 	read_unlock(&bond->lock);
@@ -2503,9 +2463,10 @@
 static void loadbalance_arp_monitor(struct net_device *master)
 {
 	bonding_t *bond;
-	slave_t *slave;
+	slave_t *slave, *oldcurrent;
 	int the_delta_in_ticks =  arp_interval * HZ / 1000;
 	int next_timer = jiffies + (arp_interval * HZ / 1000);
+	int do_failover = 0;
 
 	bond = (struct bonding *) master->priv; 
 	if (master->priv == NULL) {
@@ -2529,6 +2490,10 @@
 
 	read_lock(&bond->lock);
 
+	read_lock(&bond->ptrlock);
+	oldcurrent = bond->current_slave;
+	read_unlock(&bond->ptrlock);
+
 	/* see if any of the previous devices are up now (i.e. they have
 	 * xmt and rcv traffic). the current_slave does not come into
 	 * the picture unless it is null. also, slave->jiffies is not needed
@@ -2555,21 +2520,19 @@
 				 * current_slave being null after enslaving
 				 * is closed.
 				 */
-				write_lock(&bond->ptrlock);
-				if (bond->current_slave == NULL) {
+				if (oldcurrent == NULL) {
 					printk(KERN_INFO
 						"%s: link status definitely up "
 						"for interface %s, ",
 						master->name,
 						slave->dev->name);
-					reselect_active_interface(bond); 
+					do_failover = 1;
 				} else {
 					printk(KERN_INFO
 						"%s: interface %s is now up\n",
 						master->name,
 						slave->dev->name);
 				}
-				write_unlock(&bond->ptrlock);
 			} 
 		} else {
 			/* slave->link == BOND_LINK_UP */
@@ -2592,11 +2555,9 @@
 				       master->name,
 				       slave->dev->name);
 
-				write_lock(&bond->ptrlock);
-				if (slave == bond->current_slave) {
-					reselect_active_interface(bond);
+				if (slave == oldcurrent) {
+					do_failover = 1;
 				}
-				write_unlock(&bond->ptrlock);
 			}
 		} 
 
@@ -2610,6 +2571,19 @@
 		if (IS_UP(slave->dev)) {
 			arp_send_all(slave);
 		}
+	}
+
+	if (do_failover) {
+		write_lock(&bond->ptrlock);
+
+		reselect_active_interface(bond);
+		if (oldcurrent && !bond->current_slave) {
+			printk(KERN_INFO
+				"%s: now running without any active interface !\n",
+				master->name);
+		}
+
+		write_unlock(&bond->ptrlock);
 	}
 
 	read_unlock(&bond->lock);
diff -Nru a/drivers/net/ethertap.c b/drivers/net/ethertap.c
--- a/drivers/net/ethertap.c	Wed Oct 29 19:10:35 2003
+++ b/drivers/net/ethertap.c	Wed Oct 29 19:10:35 2003
@@ -302,11 +302,12 @@
 
 static void ethertap_rx(struct sock *sk, int len)
 {
-	struct net_device *dev = tap_map[sk->sk_protocol];
+	unsigned unit = sk->sk_protocol - NETLINK_TAPBASE; 
+	struct net_device *dev;
 	struct sk_buff *skb;
 
-	if (dev==NULL) {
-		printk(KERN_CRIT "ethertap: bad unit!\n");
+	if (unit >= max_taps || (dev = tap_map[unit]) == NULL) { 
+		printk(KERN_CRIT "ethertap: bad unit %u!\n", unit);
 		skb_queue_purge(&sk->sk_receive_queue);
 		return;
 	}
diff -Nru a/drivers/net/pcmcia/fmvj18x_cs.c b/drivers/net/pcmcia/fmvj18x_cs.c
--- a/drivers/net/pcmcia/fmvj18x_cs.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/net/pcmcia/fmvj18x_cs.c	Wed Oct 29 19:10:36 2003
@@ -502,6 +502,8 @@
     }
 
     if (link->io.NumPorts2 != 0) {
+    	link->irq.Attributes =
+		IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED|IRQ_HANDLE_PRESENT;
 	ret = mfc_try_io_port(link);
 	if (ret != CS_SUCCESS) goto cs_failed;
     } else if (cardtype == UNGERMANN) {
diff -Nru a/drivers/net/pcmcia/ibmtr_cs.c b/drivers/net/pcmcia/ibmtr_cs.c
--- a/drivers/net/pcmcia/ibmtr_cs.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/net/pcmcia/ibmtr_cs.c	Wed Oct 29 19:10:36 2003
@@ -136,7 +136,7 @@
     struct net_device	*dev;
     dev_node_t          node;
     window_handle_t     sram_win_handle;
-    struct tok_info	ti;
+    struct tok_info	*ti;
 } ibmtr_dev_t;
 
 static void netdev_get_drvinfo(struct net_device *dev,
@@ -168,13 +168,18 @@
     DEBUG(0, "ibmtr_attach()\n");
 
     /* Create new token-ring device */
-    dev = alloc_trdev(sizeof(*info));
-    if (!dev)
-	    return NULL;
-    info = dev->priv;
+    info = kmalloc(sizeof(*info), GFP_KERNEL); 
+    if (!info) return NULL;
+    memset(info,0,sizeof(*info));
+    dev = alloc_trdev(sizeof(struct tok_info));
+    if (!dev) { 
+	kfree(info); 
+	return NULL;
+    } 
 
     link = &info->link;
     link->priv = info;
+    info->ti = dev->priv; 
 
     link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
     link->io.NumPorts1 = 4;
@@ -265,6 +270,7 @@
     *linkp = link->next;
     unregister_netdev(dev);
     free_netdev(dev);
+    kfree(info); 
 } /* ibmtr_detach */
 
 /*======================================================================
diff -Nru a/drivers/net/r8169.c b/drivers/net/r8169.c
--- a/drivers/net/r8169.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/net/r8169.c	Wed Oct 29 19:10:36 2003
@@ -292,6 +292,7 @@
 MODULE_AUTHOR("Realtek");
 MODULE_DESCRIPTION("RealTek RTL-8169 Gigabit Ethernet driver");
 MODULE_PARM(media, "1-" __MODULE_STRING(MAX_UNITS) "i");
+MODULE_LICENSE("GPL");
 
 static int rtl8169_open(struct net_device *dev);
 static int rtl8169_start_xmit(struct sk_buff *skb, struct net_device *dev);
diff -Nru a/drivers/net/sis900.c b/drivers/net/sis900.c
--- a/drivers/net/sis900.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/net/sis900.c	Wed Oct 29 19:10:36 2003
@@ -1438,7 +1438,7 @@
 			pci_unmap_single(sis_priv->pci_dev, 
 				sis_priv->tx_ring[i].bufptr, skb->len,
 				PCI_DMA_TODEVICE);
-			dev_kfree_skb(skb);
+			dev_kfree_skb_irq(skb);
 			sis_priv->tx_skbuff[i] = 0;
 			sis_priv->tx_ring[i].cmdsts = 0;
 			sis_priv->tx_ring[i].bufptr = 0;
diff -Nru a/drivers/net/starfire.c b/drivers/net/starfire.c
--- a/drivers/net/starfire.c	Wed Oct 29 19:10:35 2003
+++ b/drivers/net/starfire.c	Wed Oct 29 19:10:35 2003
@@ -139,6 +139,7 @@
 #include <linux/config.h>
 #include <linux/version.h>
 #include <linux/module.h>
+#include <asm/io.h>
 #include <linux/kernel.h>
 #include <linux/pci.h>
 #include <linux/netdevice.h>
@@ -1174,15 +1175,9 @@
 	       TX_DESC_SPACING | TX_DESC_TYPE,
 	       ioaddr + TxDescCtrl);
 
-#if defined(ADDR_64BITS)
-	writel(np->queue_mem_dma >> 32, ioaddr + RxDescQHiAddr);
-	writel(np->queue_mem_dma >> 32, ioaddr + TxRingHiAddr);
-	writel(np->queue_mem_dma >> 32, ioaddr + CompletionHiAddr);
-#else
-	writel(0, ioaddr + RxDescQHiAddr);
-	writel(0, ioaddr + TxRingHiAddr);
-	writel(0, ioaddr + CompletionHiAddr);
-#endif
+	writel( (np->queue_mem_dma >> 16) >> 16, ioaddr + RxDescQHiAddr);
+	writel( (np->queue_mem_dma >> 16) >> 16, ioaddr + TxRingHiAddr);
+	writel( (np->queue_mem_dma >> 16) >> 16, ioaddr + CompletionHiAddr);
 	writel(np->rx_ring_dma, ioaddr + RxDescQAddr);
 	writel(np->tx_ring_dma, ioaddr + TxRingPtr);
 
diff -Nru a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
--- a/drivers/net/tokenring/ibmtr.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/net/tokenring/ibmtr.c	Wed Oct 29 19:10:36 2003
@@ -152,7 +152,7 @@
 
 /* this allows displaying full adapter information */
 
-char *channel_def[] __initdata = { "ISA", "MCA", "ISA P&P" };
+char *channel_def[] __devinitdata = { "ISA", "MCA", "ISA P&P" };
 
 static char pcchannelid[] __devinitdata = {
 	0x05, 0x00, 0x04, 0x09,
@@ -864,7 +864,8 @@
 	ti->sram_virt &= ~1; /* to reverse what we do in tok_close */
 	/* init the spinlock */
 	ti->lock = (spinlock_t) SPIN_LOCK_UNLOCKED;
-
+	init_timer(&ti->tr_timer);
+	
 	i = tok_init_card(dev);
 	if (i) return i;
 
@@ -1033,7 +1034,7 @@
 
 	/* Important for PCMCIA hot unplug, otherwise, we'll pull the card, */
 	/* unloading the module from memory, and then if a timer pops, ouch */
-	del_timer(&ti->tr_timer);
+	del_timer_sync(&ti->tr_timer);
 	outb(0, dev->base_addr + ADAPTRESET);
 	ti->sram_virt |= 1;
 	ti->open_status = CLOSED;
diff -Nru a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
--- a/drivers/net/wireless/airo.c	Wed Oct 29 19:10:35 2003
+++ b/drivers/net/wireless/airo.c	Wed Oct 29 19:10:35 2003
@@ -982,6 +982,7 @@
 static int airo_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 #ifdef WIRELESS_EXT
 struct iw_statistics *airo_get_wireless_stats (struct net_device *dev);
+static void airo_read_wireless_stats (struct airo_info *local);
 #endif /* WIRELESS_EXT */
 #ifdef CISCO_EXT
 static int readrids(struct net_device *dev, aironet_ioctl *comp);
@@ -1027,7 +1028,7 @@
 #define FLAG_PENDING_XMIT 9
 #define FLAG_PENDING_XMIT11 10
 #define FLAG_PCI	11
-#define JOB_MASK	0xff0000
+#define JOB_MASK	0x1ff0000
 #define JOB_DIE		16
 #define JOB_XMIT	17
 #define JOB_XMIT11	18
@@ -1036,6 +1037,7 @@
 #define JOB_MIC		21
 #define JOB_EVENT	22
 #define JOB_AUTOWEP	23
+#define JOB_WSTATS	24
 	int (*bap_read)(struct airo_info*, u16 *pu16Dst, int bytelen,
 			int whichbap);
 	unsigned short *flash;
@@ -1692,8 +1694,8 @@
 
 	return PC4500_writerid( ai, RID_CONFIG, &cfgr, sizeof(cfgr), lock);
 }
-static int readStatusRid(struct airo_info*ai, StatusRid *statr) {
-	int rc = PC4500_readrid(ai, RID_STATUS, statr, sizeof(*statr), 1);
+static int readStatusRid(struct airo_info*ai, StatusRid *statr, int lock) {
+	int rc = PC4500_readrid(ai, RID_STATUS, statr, sizeof(*statr), lock);
 	u16 *s;
 
 	statr->len = le16_to_cpu(statr->len);
@@ -2415,6 +2417,8 @@
 			airo_end_xmit11(dev);
 		else if (test_bit(JOB_STATS, &ai->flags))
 			airo_read_stats(ai);
+		else if (test_bit(JOB_WSTATS, &ai->flags))
+			airo_read_wireless_stats(ai);
 		else if (test_bit(JOB_PROMISC, &ai->flags))
 			airo_set_promisc(ai);
 #ifdef MICSUPPORT
@@ -2944,7 +2948,6 @@
 		ai->config.opmode = adhoc ? MODE_STA_IBSS : MODE_STA_ESS;
 		ai->config.authType = AUTH_OPEN;
 		ai->config.modulation = MOD_CCK;
-		ai->config._reserved1a[0] = 2; /* ??? */
 
 #ifdef MICSUPPORT
 		if ((cap_rid.len>=sizeof(cap_rid)) && (cap_rid.extSoftCap&1) &&
@@ -3723,7 +3726,7 @@
 		return -ENOMEM;
 	}
 
-	readStatusRid(apriv, &status_rid);
+	readStatusRid(apriv, &status_rid, 1);
 	readCapabilityRid(apriv, &cap_rid);
 
         i = sprintf(data->rbuffer, "Status: %s%s%s%s%s%s%s%s%s\n",
@@ -4767,7 +4770,7 @@
 	if ((local->config.opmode & 0xFF) == MODE_STA_ESS)
 		status_rid.channel = local->config.channelSet;
 	else
-		readStatusRid(local, &status_rid);
+		readStatusRid(local, &status_rid, 1);
 
 #ifdef WEXT_USECHANNELS
 	fwrq->m = ((int)status_rid.channel) + 1;
@@ -4842,7 +4845,7 @@
 	struct airo_info *local = dev->priv;
 	StatusRid status_rid;		/* Card status info */
 
-	readStatusRid(local, &status_rid);
+	readStatusRid(local, &status_rid, 1);
 
 	/* Note : if dwrq->flags != 0, we should
 	 * get the relevant SSID from the SSID list... */
@@ -4906,7 +4909,7 @@
 	struct airo_info *local = dev->priv;
 	StatusRid status_rid;		/* Card status info */
 
-	readStatusRid(local, &status_rid);
+	readStatusRid(local, &status_rid, 1);
 
 	/* Tentative. This seems to work, wow, I'm lucky !!! */
 	memcpy(awrq->sa_data, status_rid.bssid[0], ETH_ALEN);
@@ -5039,7 +5042,7 @@
 	struct airo_info *local = dev->priv;
 	StatusRid status_rid;		/* Card status info */
 
-	readStatusRid(local, &status_rid);
+	readStatusRid(local, &status_rid, 1);
 
 	vwrq->value = status_rid.currentXmitRate * 500000;
 	/* If more than one rate, set auto */
@@ -5755,7 +5758,7 @@
 	}
 	if (!i) {
 		StatusRid status_rid;		/* Card status info */
-		readStatusRid(local, &status_rid);
+		readStatusRid(local, &status_rid, 1);
 		for (i = 0;
 		     i < min(IW_MAX_AP, 4) &&
 			     (status_rid.bssid[i][0]
@@ -6562,16 +6565,17 @@
  *
  * Jean
  */
-struct iw_statistics *airo_get_wireless_stats(struct net_device *dev)
+static void airo_read_wireless_stats(struct airo_info *local)
 {
-	struct airo_info *local = dev->priv;
 	StatusRid status_rid;
 	StatsRid stats_rid;
 	u32 *vals = stats_rid.vals;
 
 	/* Get stats out of the card */
-	readStatusRid(local, &status_rid);
-	readStatsRid(local, &stats_rid, RID_STATS, 1);
+	clear_bit(JOB_WSTATS, &local->flags);
+	readStatusRid(local, &status_rid, 0);
+	readStatsRid(local, &stats_rid, RID_STATS, 0);
+	up(&local->sem);
 
 	/* The status */
 	local->wstats.status = status_rid.mode;
@@ -6598,6 +6602,19 @@
 	local->wstats.discard.retries = vals[10];
 	local->wstats.discard.misc = vals[1] + vals[32];
 	local->wstats.miss.beacon = vals[34];
+}
+
+struct iw_statistics *airo_get_wireless_stats(struct net_device *dev)
+{
+	struct airo_info *local =  dev->priv;
+
+	/* Get stats out of the card if available */
+	if (down_trylock(&local->sem) != 0) {
+		set_bit(JOB_WSTATS, &local->flags);
+		wake_up_interruptible(&local->thr_wait);
+	} else
+		airo_read_wireless_stats(local);
+
 	return &local->wstats;
 }
 #endif /* WIRELESS_EXT */
diff -Nru a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
--- a/drivers/pci/setup-bus.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/pci/setup-bus.c	Wed Oct 29 19:10:36 2003
@@ -132,13 +132,19 @@
    PCI-to-PCI Bridge Architecture Specification rev. 1.1 (1998)
    requires that if there is no I/O ports or memory behind the
    bridge, corresponding range must be turned off by writing base
-   value greater than limit to the bridge's base/limit registers.  */
+   value greater than limit to the bridge's base/limit registers.
+
+   Note: care must be taken when updating I/O base/limit registers
+   of bridges which support 32-bit I/O. This update requires two
+   config space writes, so it's quite possible that an I/O window of
+   the bridge will have some undesirable address (e.g. 0) after the
+   first write. Ditto 64-bit prefetchable MMIO.  */
 static void __devinit
 pci_setup_bridge(struct pci_bus *bus)
 {
 	struct pci_dev *bridge = bus->self;
 	struct pci_bus_region region;
-	u32 l;
+	u32 l, io_upper16;
 
 	DBGC((KERN_INFO "PCI: Bus %d, bridge: %s\n",
 			bus->number, pci_name(bridge)));
@@ -151,20 +157,22 @@
 		l |= (region.start >> 8) & 0x00f0;
 		l |= region.end & 0xf000;
 		/* Set up upper 16 bits of I/O base/limit. */
-		pci_write_config_word(bridge, PCI_IO_BASE_UPPER16,
-				      region.start >> 16);
-		pci_write_config_word(bridge, PCI_IO_LIMIT_UPPER16,
-				      region.end >> 16);
+		io_upper16 = (region.end & 0xffff0000) | (region.start >> 16);
 		DBGC((KERN_INFO "  IO window: %04lx-%04lx\n",
 				region.start, region.end));
 	}
 	else {
 		/* Clear upper 16 bits of I/O base/limit. */
-		pci_write_config_dword(bridge, PCI_IO_BASE_UPPER16, 0);
+		io_upper16 = 0;
 		l = 0x00f0;
 		DBGC((KERN_INFO "  IO window: disabled.\n"));
 	}
+	/* Temporarily disable the I/O range before updating PCI_IO_BASE. */
+	pci_write_config_dword(bridge, PCI_IO_BASE_UPPER16, 0x0000ffff);
+	/* Update lower 16 bits of I/O base/limit. */
 	pci_write_config_dword(bridge, PCI_IO_BASE, l);
+	/* Update upper 16 bits of I/O base/limit. */
+	pci_write_config_dword(bridge, PCI_IO_BASE_UPPER16, io_upper16);
 
 	/* Set up the top and bottom of the PCI Memory segment
 	   for this bus. */
@@ -181,8 +189,9 @@
 	}
 	pci_write_config_dword(bridge, PCI_MEMORY_BASE, l);
 
-	/* Clear out the upper 32 bits of PREF base/limit. */
-	pci_write_config_dword(bridge, PCI_PREF_BASE_UPPER32, 0);
+	/* Clear out the upper 32 bits of PREF limit.
+	   If PCI_PREF_BASE_UPPER32 was non-zero, this temporarily
+	   disables PREF range, which is ok. */
 	pci_write_config_dword(bridge, PCI_PREF_LIMIT_UPPER32, 0);
 
 	/* Set up PREF base/limit. */
@@ -198,6 +207,9 @@
 		DBGC((KERN_INFO "  PREFETCH window: disabled.\n"));
 	}
 	pci_write_config_dword(bridge, PCI_PREF_MEMORY_BASE, l);
+
+	/* Clear out the upper 32 bits of PREF base. */
+	pci_write_config_dword(bridge, PCI_PREF_BASE_UPPER32, 0);
 
 	/* Check if we have VGA behind the bridge.
 	   Enable ISA in either case (FIXME!). */
diff -Nru a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
--- a/drivers/pcmcia/yenta_socket.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/pcmcia/yenta_socket.c	Wed Oct 29 19:10:36 2003
@@ -461,6 +461,7 @@
 static int yenta_sock_init(struct pcmcia_socket *sock)
 {
 	struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket);
+	u32 state;
 	u16 bridge;
 
 	bridge = config_readw(socket, CB_BRIDGE_CONTROL) & ~CB_BRIDGE_INTR;
@@ -472,7 +473,10 @@
 	exca_writeb(socket, I365_GENCTL, 0x00);
 
 	/* Redo card voltage interrogation */
-	cb_writel(socket, CB_SOCKET_FORCE, CB_CVSTEST);
+	state = cb_readl(socket, CB_SOCKET_STATE);
+	if (!(state & (CB_CDETECT1 | CB_CDETECT2 | CB_5VCARD |
+	               CB_3VCARD | CB_XVCARD | CB_YVCARD)))
+		cb_writel(socket, CB_SOCKET_FORCE, CB_CVSTEST);
 
 	yenta_clear_maps(socket);
 
diff -Nru a/drivers/pnp/isapnp/core.c b/drivers/pnp/isapnp/core.c
--- a/drivers/pnp/isapnp/core.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/pnp/isapnp/core.c	Wed Oct 29 19:10:36 2003
@@ -1160,7 +1160,7 @@
 	return 0;
 }
 
-device_initcall(isapnp_init);
+fs_initcall(isapnp_init);
 
 /* format is: noisapnp */
 
diff -Nru a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
--- a/drivers/serial/serial_core.c	Wed Oct 29 19:10:35 2003
+++ b/drivers/serial/serial_core.c	Wed Oct 29 19:10:35 2003
@@ -1707,6 +1707,9 @@
 		strcat(stat_buf, "\n");
 	
 		ret += sprintf(buf + ret, stat_buf);
+	} else {
+		strcat(buf, "\n");
+		ret++;
 	}
 #undef STATBIT
 #undef INFOBIT
diff -Nru a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
--- a/drivers/usb/serial/Kconfig	Wed Oct 29 19:10:36 2003
+++ b/drivers/usb/serial/Kconfig	Wed Oct 29 19:10:36 2003
@@ -73,7 +73,7 @@
 
 config USB_SERIAL_WHITEHEAT
 	tristate "USB ConnectTech WhiteHEAT Serial Driver"
-	depends on USB_SERIAL
+	depends on USB_SERIAL && BROKEN_ON_SMP
 	help
 	  Say Y here if you want to use a ConnectTech WhiteHEAT 4 port
 	  USB to serial converter device.
diff -Nru a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
--- a/drivers/usb/serial/digi_acceleport.c	Wed Oct 29 19:10:36 2003
+++ b/drivers/usb/serial/digi_acceleport.c	Wed Oct 29 19:10:36 2003
@@ -444,7 +444,7 @@
 /* Local Function Declarations */
 
 static void digi_wakeup_write( struct usb_serial_port *port );
-static void digi_wakeup_write_lock( struct usb_serial_port *port );
+static void digi_wakeup_write_lock(void *);
 static int digi_write_oob_command( struct usb_serial_port *port,
 	unsigned char *buf, int count, int interruptible );
 static int digi_write_inb_command( struct usb_serial_port *port,
@@ -608,9 +608,9 @@
 *  on writes.
 */
 
-static void digi_wakeup_write_lock( struct usb_serial_port *port )
+static void digi_wakeup_write_lock(void *arg)
 {
-
+	struct usb_serial_port *port = arg;
 	unsigned long flags;
 	struct digi_port *priv = usb_get_serial_port_data(port);
 
diff -Nru a/fs/binfmt_misc.c b/fs/binfmt_misc.c
--- a/fs/binfmt_misc.c	Wed Oct 29 19:10:36 2003
+++ b/fs/binfmt_misc.c	Wed Oct 29 19:10:36 2003
@@ -529,8 +529,8 @@
 	inode->u.generic_ip = e;
 	inode->i_fop = &bm_entry_operations;
 
-	write_lock(&entries_lock);
 	d_instantiate(dentry, inode);
+	write_lock(&entries_lock);
 	list_add(&e->list, &entries);
 	write_unlock(&entries_lock);
 
diff -Nru a/fs/direct-io.c b/fs/direct-io.c
--- a/fs/direct-io.c	Wed Oct 29 19:10:36 2003
+++ b/fs/direct-io.c	Wed Oct 29 19:10:36 2003
@@ -677,7 +677,7 @@
 
 	this_chunk_bytes = this_chunk_blocks << dio->blkbits;
 
-	page = ZERO_PAGE(dio->cur_user_address);
+	page = ZERO_PAGE(dio->curr_user_address);
 	if (submit_page_section(dio, page, 0, this_chunk_bytes, 
 				dio->next_block_for_io))
 		return;
diff -Nru a/fs/fat/inode.c b/fs/fat/inode.c
--- a/fs/fat/inode.c	Wed Oct 29 19:10:36 2003
+++ b/fs/fat/inode.c	Wed Oct 29 19:10:36 2003
@@ -964,13 +964,17 @@
 		error = first;
 		goto out_fail;
 	}
-	if (FAT_FIRST_ENT(sb, media) != first
-	    && (media != 0xf8 || FAT_FIRST_ENT(sb, 0xfe) != first)) {
-		if (!silent) {
+	if (FAT_FIRST_ENT(sb, media) == first) {
+		/* all is as it should be */
+	} else if (media == 0xf8 && FAT_FIRST_ENT(sb, 0xfe) == first) {
+		/* bad, reported on pc9800 */
+	} else if (first == 0) {
+		/* bad, reported with a SmartMedia card */
+	} else {
+		if (!silent)
 			printk(KERN_ERR "FAT: invalid first entry of FAT "
 			       "(0x%x != 0x%x)\n",
 			       FAT_FIRST_ENT(sb, media), first);
-		}
 		goto out_invalid;
 	}
 
diff -Nru a/fs/jbd/transaction.c b/fs/jbd/transaction.c
--- a/fs/jbd/transaction.c	Wed Oct 29 19:10:36 2003
+++ b/fs/jbd/transaction.c	Wed Oct 29 19:10:36 2003
@@ -147,10 +147,13 @@
 	 * lock to be released.
 	 */
 	if (transaction->t_state == T_LOCKED) {
+		DEFINE_WAIT(wait);
+
+		prepare_to_wait(&journal->j_wait_transaction_locked,
+					&wait, TASK_UNINTERRUPTIBLE);
 		spin_unlock(&journal->j_state_lock);
-		jbd_debug(3, "Handle %p stalling...\n", handle);
-		wait_event(journal->j_wait_transaction_locked,
-				transaction->t_state != T_LOCKED);
+		schedule();
+		finish_wait(&journal->j_wait_transaction_locked, &wait);
 		goto repeat;
 	}
 
diff -Nru a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
--- a/fs/jfs/jfs_metapage.c	Wed Oct 29 19:10:35 2003
+++ b/fs/jfs/jfs_metapage.c	Wed Oct 29 19:10:35 2003
@@ -511,9 +511,6 @@
 		if (mp) {
 			set_bit(META_discard, &mp->flag);
 			spin_unlock(&meta_lock);
-			lock_page(mp->page);
-			block_invalidatepage(mp->page, 0);
-			unlock_page(mp->page);
 		} else {
 			spin_unlock(&meta_lock);
 			page = find_lock_page(mapping, lblock>>l2BlocksPerPage);
diff -Nru a/include/asm-h8300/smplock.h b/include/asm-h8300/smplock.h
--- a/include/asm-h8300/smplock.h	Wed Oct 29 19:10:36 2003
+++ /dev/null	Wed Dec 31 16:00:00 1969
@@ -1,51 +0,0 @@
-/*
- * <asm/smplock.h>
- *
- * Default SMP lock implementation
- */
-#include <linux/interrupt.h>
-#include <linux/spinlock.h>
-
-extern spinlock_t kernel_flag;
-
-#define kernel_locked()		spin_is_locked(&kernel_flag)
-
-/*
- * Release global kernel lock and global interrupt lock
- */
-#define release_kernel_lock(task, cpu) \
-do { \
-	if (task->lock_depth >= 0) \
-		spin_unlock(&kernel_flag); \
-	release_irqlock(cpu); \
-	__sti(); \
-} while (0)
-
-/*
- * Re-acquire the kernel lock
- */
-#define reacquire_kernel_lock(task) \
-do { \
-	if (task->lock_depth >= 0) \
-		spin_lock(&kernel_flag); \
-} while (0)
-
-
-/*
- * Getting the big kernel lock.
- *
- * This cannot happen asynchronously,
- * so we only need to worry about other
- * CPU's.
- */
-extern __inline__ void lock_kernel(void)
-{
-	if (!++current->lock_depth)
-		spin_lock(&kernel_flag);
-}
-
-extern __inline__ void unlock_kernel(void)
-{
-	if (--current->lock_depth < 0)
-		spin_unlock(&kernel_flag);
-}
diff -Nru a/include/asm-sparc/namei.h b/include/asm-sparc/namei.h
--- a/include/asm-sparc/namei.h	Wed Oct 29 19:10:35 2003
+++ b/include/asm-sparc/namei.h	Wed Oct 29 19:10:35 2003
@@ -8,8 +8,8 @@
 #ifndef __SPARC_NAMEI_H
 #define __SPARC_NAMEI_H
 
-#define SPARC_BSD_EMUL "usr/gnemul/sunos/"
-#define SPARC_SOL_EMUL "usr/gnemul/solaris/"
+#define SPARC_BSD_EMUL "/usr/gnemul/sunos/"
+#define SPARC_SOL_EMUL "/usr/gnemul/solaris/"
 
 static inline char * __emul_prefix(void)
 {
diff -Nru a/include/asm-sparc/unistd.h b/include/asm-sparc/unistd.h
--- a/include/asm-sparc/unistd.h	Wed Oct 29 19:10:35 2003
+++ b/include/asm-sparc/unistd.h	Wed Oct 29 19:10:35 2003
@@ -284,10 +284,15 @@
 #define __NR_timer_delete	265
 #define __NR_timer_create	266
 /* #define __NR_vserver		267 Reserved for VSERVER */
-/* WARNING: You MAY NOT add syscall numbers larger than 267, since
+#define __NR_io_setup		268
+#define __NR_io_destroy		268
+#define __NR_io_submit		269
+#define __NR_io_cancel		270
+#define __NR_io_getevents	271
+/* WARNING: You MAY NOT add syscall numbers larger than 271, since
  *          all of the syscall tables in the Sparc kernel are
- *          sized to have 267 entries (starting at zero).  Therefore
- *          find a free slot in the 0-266 range.
+ *          sized to have 272 entries (starting at zero).  Therefore
+ *          find a free slot in the 0-271 range.
  */
 
 #define _syscall0(type,name) \
diff -Nru a/include/asm-sparc64/hardirq.h b/include/asm-sparc64/hardirq.h
--- a/include/asm-sparc64/hardirq.h	Wed Oct 29 19:10:36 2003
+++ b/include/asm-sparc64/hardirq.h	Wed Oct 29 19:10:36 2003
@@ -79,7 +79,8 @@
 #define irq_enter()		(preempt_count() += HARDIRQ_OFFSET)
 
 #ifdef CONFIG_PREEMPT
-# define in_atomic()	(preempt_count() != kernel_locked())
+# include <linux/smp_lock.h>
+# define in_atomic()	((preempt_count() & ~PREEMPT_ACTIVE) != kernel_locked())
 # define IRQ_EXIT_OFFSET (HARDIRQ_OFFSET-1)
 #else
 # define in_atomic()	(preempt_count() != 0)
diff -Nru a/include/asm-sparc64/namei.h b/include/asm-sparc64/namei.h
--- a/include/asm-sparc64/namei.h	Wed Oct 29 19:10:35 2003
+++ b/include/asm-sparc64/namei.h	Wed Oct 29 19:10:35 2003
@@ -8,8 +8,8 @@
 #ifndef __SPARC64_NAMEI_H
 #define __SPARC64_NAMEI_H
 
-#define SPARC_BSD_EMUL "usr/gnemul/sunos/"
-#define SPARC_SOL_EMUL "usr/gnemul/solaris/"
+#define SPARC_BSD_EMUL "/usr/gnemul/sunos/"
+#define SPARC_SOL_EMUL "/usr/gnemul/solaris/"
 
 static inline char * __emul_prefix(void)
 {
diff -Nru a/include/asm-sparc64/spinlock.h b/include/asm-sparc64/spinlock.h
--- a/include/asm-sparc64/spinlock.h	Wed Oct 29 19:10:35 2003
+++ b/include/asm-sparc64/spinlock.h	Wed Oct 29 19:10:35 2003
@@ -118,11 +118,13 @@
 extern void __read_unlock(rwlock_t *);
 extern void __write_lock(rwlock_t *);
 extern void __write_unlock(rwlock_t *);
+extern int __write_trylock(rwlock_t *);
 
 #define _raw_read_lock(p)	__read_lock(p)
 #define _raw_read_unlock(p)	__read_unlock(p)
 #define _raw_write_lock(p)	__write_lock(p)
 #define _raw_write_unlock(p)	__write_unlock(p)
+#define _raw_write_trylock(p)	__write_trylock(p)
 
 #else /* !(CONFIG_DEBUG_SPINLOCK) */
 
diff -Nru a/include/asm-sparc64/unistd.h b/include/asm-sparc64/unistd.h
--- a/include/asm-sparc64/unistd.h	Wed Oct 29 19:10:35 2003
+++ b/include/asm-sparc64/unistd.h	Wed Oct 29 19:10:35 2003
@@ -286,10 +286,15 @@
 #define __NR_timer_delete	265
 #define __NR_timer_create	266
 /* #define __NR_vserver		267 Reserved for VSERVER */
-/* WARNING: You MAY NOT add syscall numbers larger than 267, since
+#define __NR_io_setup		268
+#define __NR_io_destroy		268
+#define __NR_io_submit		269
+#define __NR_io_cancel		270
+#define __NR_io_getevents	271
+/* WARNING: You MAY NOT add syscall numbers larger than 271, since
  *          all of the syscall tables in the Sparc kernel are
- *          sized to have 267 entries (starting at zero).  Therefore
- *          find a free slot in the 0-266 range.
+ *          sized to have 272 entries (starting at zero).  Therefore
+ *          find a free slot in the 0-271 range.
  */
 
 #define _syscall0(type,name) \
diff -Nru a/include/asm-x86_64/hw_irq.h b/include/asm-x86_64/hw_irq.h
--- a/include/asm-x86_64/hw_irq.h	Wed Oct 29 19:10:36 2003
+++ b/include/asm-x86_64/hw_irq.h	Wed Oct 29 19:10:36 2003
@@ -76,8 +76,8 @@
 
 
 #ifndef __ASSEMBLY__
-extern int irq_vector[NR_IRQS];
-#define IO_APIC_VECTOR(irq)	irq_vector[irq]
+extern u8 irq_vector[NR_IRQ_VECTORS];
+#define IO_APIC_VECTOR(irq)	((int)irq_vector[irq])
 
 /*
  * Various low-level irq details needed by irq.c, process.c,
diff -Nru a/include/asm-x86_64/irq.h b/include/asm-x86_64/irq.h
--- a/include/asm-x86_64/irq.h	Wed Oct 29 19:10:35 2003
+++ b/include/asm-x86_64/irq.h	Wed Oct 29 19:10:35 2003
@@ -22,6 +22,7 @@
  * the usable vector space is 0x20-0xff (224 vectors)
  */
 #define NR_IRQS 224
+#define NR_IRQ_VECTORS NR_IRQS
 
 static __inline__ int irq_canonicalize(int irq)
 {
diff -Nru a/include/asm-x86_64/pci.h b/include/asm-x86_64/pci.h
--- a/include/asm-x86_64/pci.h	Wed Oct 29 19:10:36 2003
+++ b/include/asm-x86_64/pci.h	Wed Oct 29 19:10:36 2003
@@ -24,6 +24,8 @@
 #define PCIBIOS_MIN_IO		0x1000
 #define PCIBIOS_MIN_MEM		(pci_mem_start)
 
+#define PCIBIOS_MIN_CARDBUS_IO	0x4000
+
 void pcibios_config_init(void);
 struct pci_bus * pcibios_scan_root(int bus);
 extern int (*pci_config_read)(int seg, int bus, int dev, int fn, int reg, int len, u32 *value);
diff -Nru a/include/asm-x86_64/processor.h b/include/asm-x86_64/processor.h
--- a/include/asm-x86_64/processor.h	Wed Oct 29 19:10:36 2003
+++ b/include/asm-x86_64/processor.h	Wed Oct 29 19:10:36 2003
@@ -263,8 +263,8 @@
 #define DOUBLEFAULT_STACK 2 
 #define NMI_STACK 3 
 #define N_EXCEPTION_STACKS 3  /* hw limit: 7 */
-#define EXCEPTION_STKSZ 1024
-#define EXCEPTION_STK_ORDER 0
+#define EXCEPTION_STKSZ (PAGE_SIZE << EXCEPTION_STACK_ORDER)
+#define EXCEPTION_STACK_ORDER 0 
 
 #define start_thread(regs,new_rip,new_rsp) do { \
 	asm volatile("movl %0,%%fs; movl %0,%%es; movl %0,%%ds": :"r" (0));	 \
diff -Nru a/include/asm-x86_64/smp.h b/include/asm-x86_64/smp.h
--- a/include/asm-x86_64/smp.h	Wed Oct 29 19:10:35 2003
+++ b/include/asm-x86_64/smp.h	Wed Oct 29 19:10:35 2003
@@ -74,15 +74,7 @@
 	return GET_APIC_ID(*(unsigned int *)(APIC_BASE+APIC_ID));
 }
 
-extern int slow_smp_processor_id(void);
-
-extern inline int safe_smp_processor_id(void)
-{ 
-	if (disable_apic)
-		return slow_smp_processor_id(); 
-	else
-		return hard_smp_processor_id();
-} 
+#define safe_smp_processor_id() (cpuid_ebx(1) >> 24) 
 
 #define cpu_online(cpu) cpu_isset(cpu, cpu_online_map)
 #endif /* !ASSEMBLY */
diff -Nru a/include/asm-x86_64/topology.h b/include/asm-x86_64/topology.h
--- a/include/asm-x86_64/topology.h	Wed Oct 29 19:10:36 2003
+++ b/include/asm-x86_64/topology.h	Wed Oct 29 19:10:36 2003
@@ -10,13 +10,15 @@
 /* Map the K8 CPU local memory controllers to a simple 1:1 CPU:NODE topology */
 
 extern int fake_node;
+/* This is actually a cpumask_t, but doesn't matter because we don't have
+   >BITS_PER_LONG CPUs */
 extern unsigned long cpu_online_map;
 
 #define cpu_to_node(cpu)		(fake_node ? 0 : (cpu))
 #define memblk_to_node(memblk) 	(fake_node ? 0 : (memblk))
 #define parent_node(node)		(node)
 #define node_to_first_cpu(node) 	(fake_node ? 0 : (node))
-#define node_to_cpu_mask(node)	(fake_node ? cpu_online_map : (1UL << (node)))
+#define node_to_cpumask(node)	(fake_node ? cpu_online_map : (1UL << (node)))
 #define node_to_memblk(node)		(node)
 
 static inline unsigned long pcibus_to_cpumask(int bus)
diff -Nru a/include/linux/in.h b/include/linux/in.h
--- a/include/linux/in.h	Wed Oct 29 19:10:36 2003
+++ b/include/linux/in.h	Wed Oct 29 19:10:36 2003
@@ -140,29 +140,29 @@
 
 struct group_req
 {
-	__u32			gr_interface;	/* interface index */
-	struct sockaddr_storage	gr_group;	/* group address */
+	__u32				 gr_interface;	/* interface index */
+	struct __kernel_sockaddr_storage gr_group;	/* group address */
 };
 
 struct group_source_req
 {
-	__u32			gsr_interface;	/* interface index */
-	struct sockaddr_storage	gsr_group;	/* group address */
-	struct sockaddr_storage	gsr_source;	/* source address */
+	__u32				 gsr_interface;	/* interface index */
+	struct __kernel_sockaddr_storage gsr_group;	/* group address */
+	struct __kernel_sockaddr_storage gsr_source;	/* source address */
 };
 
 struct group_filter
 {
-	__u32			gf_interface;	/* interface index */
-	struct sockaddr_storage	gf_group;	/* multicast address */
-	__u32			gf_fmode;	/* filter mode */
-	__u32			gf_numsrc;	/* number of sources */
-	struct sockaddr_storage	gf_slist[1];	/* interface index */
+	__u32				 gf_interface;	/* interface index */
+	struct __kernel_sockaddr_storage gf_group;	/* multicast address */
+	__u32				 gf_fmode;	/* filter mode */
+	__u32				 gf_numsrc;	/* number of sources */
+	struct __kernel_sockaddr_storage gf_slist[1];	/* interface index */
 };
 
 #define GROUP_FILTER_SIZE(numsrc) \
-	(sizeof(struct group_filter) - sizeof(struct sockaddr_storage) \
-	+ (numsrc) * sizeof(struct sockaddr_storage))
+	(sizeof(struct group_filter) - sizeof(struct __kernel_sockaddr_storage) \
+	+ (numsrc) * sizeof(struct __kernel_sockaddr_storage))
 
 struct in_pktinfo
 {
diff -Nru a/include/linux/ip.h b/include/linux/ip.h
--- a/include/linux/ip.h	Wed Oct 29 19:10:36 2003
+++ b/include/linux/ip.h	Wed Oct 29 19:10:36 2003
@@ -83,6 +83,7 @@
 #include <linux/types.h>
 #include <net/sock.h>
 #include <linux/igmp.h>
+#include <net/flow.h>
 
 struct ip_options {
   __u32		faddr;				/* Saved first hop address */
@@ -141,6 +142,7 @@
 		struct rtable		*rt;
 		int			length; /* Total length of all frames */
 		u32			addr;
+		struct flowi		fl;
 	} cork;
 };
 
diff -Nru a/include/linux/ipv6.h b/include/linux/ipv6.h
--- a/include/linux/ipv6.h	Wed Oct 29 19:10:36 2003
+++ b/include/linux/ipv6.h	Wed Oct 29 19:10:36 2003
@@ -234,7 +234,6 @@
 	struct {
 		struct ipv6_txoptions *opt;
 		struct rt6_info	*rt;
-		struct flowi *fl;
 		int hop_limit;
 	} cork;
 };
diff -Nru a/include/linux/preempt.h b/include/linux/preempt.h
--- a/include/linux/preempt.h	Wed Oct 29 19:10:35 2003
+++ b/include/linux/preempt.h	Wed Oct 29 19:10:35 2003
@@ -32,8 +32,8 @@
 
 #define preempt_enable_no_resched() \
 do { \
-	dec_preempt_count(); \
 	barrier(); \
+	dec_preempt_count(); \
 } while (0)
 
 #define preempt_check_resched() \
diff -Nru a/include/linux/sched.h b/include/linux/sched.h
--- a/include/linux/sched.h	Wed Oct 29 19:10:35 2003
+++ b/include/linux/sched.h	Wed Oct 29 19:10:35 2003
@@ -483,6 +483,7 @@
 					/* Not implemented yet, only for 486*/
 #define PF_STARTING	0x00000002	/* being created */
 #define PF_EXITING	0x00000004	/* getting shut down */
+#define PF_DEAD		0x00000008	/* Dead */
 #define PF_FORKNOEXEC	0x00000040	/* forked but didn't exec */
 #define PF_SUPERPRIV	0x00000100	/* used super-user privileges */
 #define PF_DUMPCORE	0x00000200	/* dumped core */
diff -Nru a/include/linux/serial.h b/include/linux/serial.h
--- a/include/linux/serial.h	Wed Oct 29 19:10:35 2003
+++ b/include/linux/serial.h	Wed Oct 29 19:10:35 2003
@@ -49,7 +49,6 @@
 	unsigned short	iomem_reg_shift;
 	unsigned int	port_high;
 	unsigned long	iomap_base;	/* cookie passed into ioremap */
-	int	reserved[1];
 };
 
 /*
diff -Nru a/include/linux/socket.h b/include/linux/socket.h
--- a/include/linux/socket.h	Wed Oct 29 19:10:36 2003
+++ b/include/linux/socket.h	Wed Oct 29 19:10:36 2003
@@ -1,6 +1,21 @@
 #ifndef _LINUX_SOCKET_H
 #define _LINUX_SOCKET_H
 
+/*
+ * Desired design of maximum size and alignment (see RFC2553)
+ */
+#define _K_SS_MAXSIZE	128	/* Implementation specific max size */
+#define _K_SS_ALIGNSIZE	(__alignof__ (struct sockaddr *))
+				/* Implementation specific desired alignment */
+
+struct __kernel_sockaddr_storage {
+	unsigned short	ss_family;		/* address family */
+	/* Following field(s) are implementation specific */
+	char		__data[_K_SS_MAXSIZE - sizeof(unsigned short)];
+				/* space to achieve desired size, */
+				/* _SS_MAXSIZE value minus size of ss_family */
+} __attribute__ ((aligned(_K_SS_ALIGNSIZE)));	/* force desired alignment */
+
 #if defined(__KERNEL__) || !defined(__GLIBC__) || (__GLIBC__ < 2)
 
 #include <linux/config.h>		/* for CONFIG_COMPAT */
@@ -27,20 +42,7 @@
 	int		l_linger;	/* How long to linger for	*/
 };
 
-/*
- * Desired design of maximum size and alignment (see RFC2553)
- */
-#define _SS_MAXSIZE	128	/* Implementation specific max size */
-#define _SS_ALIGNSIZE	(__alignof__ (struct sockaddr *))
-				/* Implementation specific desired alignment */
-
-struct sockaddr_storage {
-	sa_family_t	ss_family;		/* address family */
-	/* Following field(s) are implementation specific */
-	char		__data[_SS_MAXSIZE - sizeof(sa_family_t)];
-				/* space to achieve desired size, */
-				/* _SS_MAXSIZE value minus size of ss_family */
-} __attribute__ ((aligned(_SS_ALIGNSIZE)));	/* force desired alignment */
+#define sockaddr_storage __kernel_sockaddr_storage
 
 /*
  *	As we do 4.4BSD message passing we use a 4.4BSD message passing
diff -Nru a/include/linux/udp.h b/include/linux/udp.h
--- a/include/linux/udp.h	Wed Oct 29 19:10:35 2003
+++ b/include/linux/udp.h	Wed Oct 29 19:10:35 2003
@@ -44,13 +44,9 @@
 	unsigned int	corkflag;	/* Cork is required */
   	__u16		encap_type;	/* Is this an Encapsulation socket? */
 	/*
-	 * Following members retains the infomation to create a UDP header
+	 * Following member retains the infomation to create a UDP header
 	 * when the socket is uncorked.
 	 */
-	u32		saddr;		/* source address */
-	u32		daddr;		/* destination address */
-	__u16		sport;		/* source port */
-	__u16		dport;		/* destination port */
 	__u16		len;		/* total length of pending frames */
 };
 
diff -Nru a/include/net/if_inet6.h b/include/net/if_inet6.h
--- a/include/net/if_inet6.h	Wed Oct 29 19:10:36 2003
+++ b/include/net/if_inet6.h	Wed Oct 29 19:10:36 2003
@@ -175,6 +175,8 @@
 	u8			entropy[8];
 	struct timer_list	regen_timer;
 	struct inet6_ifaddr	*tempaddr_list;
+	__u8			work_eui64[8];
+	__u8			work_digest[16];
 #endif
 
 	struct neigh_parms	*nd_parms;
diff -Nru a/include/net/tcp.h b/include/net/tcp.h
--- a/include/net/tcp.h	Wed Oct 29 19:10:35 2003
+++ b/include/net/tcp.h	Wed Oct 29 19:10:35 2003
@@ -219,6 +219,7 @@
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 	struct in6_addr		tw_v6_daddr;
 	struct in6_addr		tw_v6_rcv_saddr;
+	int			tw_v6_ipv6only;
 #endif
 };
 
@@ -266,6 +267,38 @@
 	hlist_for_each_entry_safe(tw, node, safe, jail, tw_death_node)
 
 #define tcptw_sk(__sk)	((struct tcp_tw_bucket *)(__sk))
+
+static inline const u32 tcp_v4_rcv_saddr(const struct sock *sk)
+{
+	return likely(sk->sk_state != TCP_TIME_WAIT) ?
+		inet_sk(sk)->rcv_saddr : tcptw_sk(sk)->tw_rcv_saddr;
+}
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static inline const struct in6_addr *__tcp_v6_rcv_saddr(const struct sock *sk)
+{
+	return likely(sk->sk_state != TCP_TIME_WAIT) ?
+		&inet6_sk(sk)->rcv_saddr : &tcptw_sk(sk)->tw_v6_rcv_saddr;
+}
+
+static inline const struct in6_addr *tcp_v6_rcv_saddr(const struct sock *sk)
+{
+	return sk->sk_family == AF_INET6 ? __tcp_v6_rcv_saddr(sk) : NULL;
+}
+
+#define tcptw_sk_ipv6only(__sk)	(tcptw_sk(__sk)->tw_v6_ipv6only)
+
+static inline int tcp_v6_ipv6only(const struct sock *sk)
+{
+	return likely(sk->sk_state != TCP_TIME_WAIT) ?
+		ipv6_only_sock(sk) : tcptw_sk_ipv6only(sk);
+}
+#else
+# define __tcp_v6_rcv_saddr(__sk)	NULL
+# define tcp_v6_rcv_saddr(__sk)		NULL
+# define tcptw_sk_ipv6only(__sk)	0
+# define tcp_v6_ipv6only(__sk)		0
+#endif
 
 extern kmem_cache_t *tcp_timewait_cachep;
 
diff -Nru a/kernel/exit.c b/kernel/exit.c
--- a/kernel/exit.c	Wed Oct 29 19:10:36 2003
+++ b/kernel/exit.c	Wed Oct 29 19:10:36 2003
@@ -594,6 +594,7 @@
  */
 static void exit_notify(struct task_struct *tsk)
 {
+	int state;
 	struct task_struct *t;
 
 	if (signal_pending(tsk) && !tsk->signal->group_exit
@@ -687,7 +688,12 @@
 		do_notify_parent(tsk, SIGCHLD);
 	}
 
-	tsk->state = TASK_ZOMBIE;
+	state = TASK_ZOMBIE;
+	if (tsk->exit_signal == -1 && tsk->ptrace == 0)
+		state = TASK_DEAD;
+	tsk->state = state;
+	tsk->flags |= PF_DEAD;
+
 	/*
 	 * In the preemption case it must be impossible for the task
 	 * to get runnable again, so use "_raw_" unlock to keep
@@ -702,6 +708,11 @@
 	 */
 	_raw_write_unlock(&tasklist_lock);
 	local_irq_enable();
+
+	/* If the process is dead, release it - nobody will wait for it */
+	if (state == TASK_DEAD)
+		release_task(tsk);
+
 }
 
 NORET_TYPE void do_exit(long code)
@@ -750,10 +761,6 @@
 
 	tsk->exit_code = code;
 	exit_notify(tsk);
-
-	if (tsk->exit_signal == -1 && tsk->ptrace == 0)
-		release_task(tsk);
-
 	schedule();
 	BUG();
 	/* Avoid "noreturn function does return".  */
diff -Nru a/kernel/module.c b/kernel/module.c
--- a/kernel/module.c	Wed Oct 29 19:10:36 2003
+++ b/kernel/module.c	Wed Oct 29 19:10:36 2003
@@ -1658,7 +1658,7 @@
 				 NULL);
 	}
 	if (err < 0)
-		goto cleanup;
+		goto arch_cleanup;
 
 	/* Get rid of temporary copy */
 	vfree(hdr);
@@ -1666,6 +1666,8 @@
 	/* Done! */
 	return mod;
 
+ arch_cleanup:
+	module_arch_cleanup(mod);
  cleanup:
 	module_unload_free(mod);
 	module_free(mod, mod->module_init);
diff -Nru a/kernel/sched.c b/kernel/sched.c
--- a/kernel/sched.c	Wed Oct 29 19:10:36 2003
+++ b/kernel/sched.c	Wed Oct 29 19:10:36 2003
@@ -742,7 +742,7 @@
 {
 	runqueue_t *rq = this_rq();
 	struct mm_struct *mm = rq->prev_mm;
-	int drop_task_ref;
+	unsigned long prev_task_flags;
 
 	rq->prev_mm = NULL;
 
@@ -757,14 +757,11 @@
 	 * be dropped twice.
 	 * 		Manfred Spraul <manfred@colorfullife.com>
 	 */
-	drop_task_ref = 0;
-	if (unlikely(prev->state & (TASK_DEAD | TASK_ZOMBIE)))
-		drop_task_ref = 1;
-
+	prev_task_flags = prev->flags;
 	finish_arch_switch(rq, prev);
 	if (mm)
 		mmdrop(mm);
-	if (drop_task_ref)
+	if (unlikely(prev_task_flags & PF_DEAD))
 		put_task_struct(prev);
 }
 
diff -Nru a/lib/div64.c b/lib/div64.c
--- a/lib/div64.c	Wed Oct 29 19:10:36 2003
+++ b/lib/div64.c	Wed Oct 29 19:10:36 2003
@@ -25,25 +25,34 @@
 
 uint32_t __div64_32(uint64_t *n, uint32_t base)
 {
-	uint32_t low, low2, high, rem;
+	uint64_t rem = *n;
+	uint64_t b = base;
+	uint64_t res, d = 1;
+	uint32_t high = rem >> 32;
 
-	low   = *n   & 0xffffffff;
-	high  = *n  >> 32;
-	rem   = high % (uint32_t)base;
-	high  = high / (uint32_t)base;
-	low2  = low >> 16;
-	low2 += rem << 16;
-	rem   = low2 % (uint32_t)base;
-	low2  = low2 / (uint32_t)base;
-	low   = low  & 0xffff;
-	low  += rem << 16;
-	rem   = low  % (uint32_t)base;
-	low   = low  / (uint32_t)base;
+	/* Reduce the thing a bit first */
+	res = 0;
+	if (high >= base) {
+		high /= base;
+		res = (uint64_t) high << 32;
+		rem -= (uint64_t) (high*base) << 32;
+	}
 
-	*n = low +
-		((uint64_t)low2 << 16) +
-		((uint64_t)high << 32);
+	while ((int64_t)b > 0 && b < rem) {
+		b = b+b;
+		d = d+d;
+	}
 
+	do {
+		if (rem >= b) {
+			rem -= b;
+			res += d;
+		}
+		b >>= 1;
+		d >>= 1;
+	} while (d);
+
+	*n = res;
 	return rem;
 }
 
diff -Nru a/mm/filemap.c b/mm/filemap.c
--- a/mm/filemap.c	Wed Oct 29 19:10:36 2003
+++ b/mm/filemap.c	Wed Oct 29 19:10:36 2003
@@ -82,6 +82,9 @@
  *    ->private_lock		(try_to_unmap_one)
  *    ->page_lock		(try_to_unmap_one)
  *    ->zone.lru_lock		(follow_page->mark_page_accessed)
+ *
+ *  ->task->proc_lock
+ *    ->dcache_lock		(proc_pid_lookup)
  */
 
 /*
diff -Nru a/net/Kconfig b/net/Kconfig
--- a/net/Kconfig	Wed Oct 29 19:10:35 2003
+++ b/net/Kconfig	Wed Oct 29 19:10:35 2003
@@ -96,15 +96,9 @@
 	  allows you to ping yourself (great fun, that!).
 
 	  For an excellent introduction to Linux networking, please read the
-	  NET-3-HOWTO, available from
+	  Linux Networking HOWTO, available from
 	  <http://www.tldp.org/docs.html#howto>.
 
-	  This option is also necessary if you want to use the full power of
-	  term (term is a program which gives you almost full Internet
-	  connectivity if you have a regular dial up shell account on some
-	  Internet connected Unix computer; for more information, read
-	  <http://www.bart.nl/~patrickr/term-howto/Term-HOWTO.html>).
-
 	  If you say Y here and also to "/proc file system support" and
 	  "Sysctl support" below, you can change various aspects of the
 	  behavior of the TCP/IP code by writing to the (virtual) files in
@@ -120,8 +114,10 @@
 	tristate "The IPv6 protocol (EXPERIMENTAL)"
 	depends on INET && EXPERIMENTAL
 	---help---
-	  This is experimental support for the next version of the Internet
-	  Protocol: IP version 6 (also called IPng "IP next generation").
+	  This is experimental support for the IP version 6 (formerly called
+	  IPng "IP next generation").  You will still be able to do
+	  regular IPv4 networking as well.
+
 	  Features of this new protocol include: expanded address space,
 	  authentication and privacy, and seamless interoperability with the
 	  current version of IP (IP version 4). For general information about
@@ -130,12 +126,10 @@
 	  <http://www.bieringer.de/linux/IPv6/> and the file net/ipv6/README
 	  in the kernel source.
 
-	  If you want to use IPv6, please upgrade to the newest net-tools as
-	  given in <file:Documentation/Changes>. You will still be able to do
-	  regular IPv4 networking as well.
-
-	  To compile this protocol support as a module, choose M here: the
-	  module will be called ipv6.
+	  To compile this protocol support as a module, choose M here: the 
+	  module will be called ipv6.  If you try building this as a module 
+	  and you have said Y to "Kernel module loader support" above, 
+	  be sure to add 'alias net-pf-10 ipv6' to your /etc/modules.conf file.
 
 	  It is safe to say N here for now.
 
diff -Nru a/net/core/dev.c b/net/core/dev.c
--- a/net/core/dev.c	Wed Oct 29 19:10:36 2003
+++ b/net/core/dev.c	Wed Oct 29 19:10:36 2003
@@ -3023,7 +3023,7 @@
 	return rc;
 }
 
-subsys_initcall(net_dev_init);
+fs_initcall(net_dev_init);
 
 EXPORT_SYMBOL(__dev_get);
 EXPORT_SYMBOL(__dev_get_by_flags);
diff -Nru a/net/core/sock.c b/net/core/sock.c
--- a/net/core/sock.c	Wed Oct 29 19:10:36 2003
+++ b/net/core/sock.c	Wed Oct 29 19:10:36 2003
@@ -154,8 +154,14 @@
 
 static void sock_warn_obsolete_bsdism(const char *name)
 {
-	printk(KERN_WARNING "process `%s' is using obsolete "
-	       "%s SO_BSDCOMPAT\n", current->comm, name);
+	static int warned;
+	static char warncomm[16];
+	if (strcmp(warncomm, current->comm) && warned < 5) { 
+		strcpy(warncomm,  current->comm); 
+		printk(KERN_WARNING "process `%s' is using obsolete "
+		       "%s SO_BSDCOMPAT\n", warncomm, name);
+		warned++;
+	}
 }
 
 /*
diff -Nru a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
--- a/net/ipv4/ip_gre.c	Wed Oct 29 19:10:36 2003
+++ b/net/ipv4/ip_gre.c	Wed Oct 29 19:10:36 2003
@@ -276,6 +276,8 @@
 	  return NULL;
 
 	dev->init = ipgre_tunnel_init;
+	nt = dev->priv;
+	nt->parms = *parms;
 
 	if (register_netdevice(dev) < 0) {
 		kfree(dev);
diff -Nru a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
--- a/net/ipv4/ipmr.c	Wed Oct 29 19:10:36 2003
+++ b/net/ipv4/ipmr.c	Wed Oct 29 19:10:36 2003
@@ -1124,18 +1124,16 @@
  *	Processing handlers for ipmr_forward
  */
 
-static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c,
-			   int vifi, int last)
+static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c, int vifi)
 {
 	struct iphdr *iph = skb->nh.iph;
 	struct vif_device *vif = &vif_table[vifi];
 	struct net_device *dev;
 	struct rtable *rt;
 	int    encap = 0;
-	struct sk_buff *skb2;
 
 	if (vif->dev == NULL)
-		return;
+		goto out_free;
 
 #ifdef CONFIG_IP_PIMSM
 	if (vif->flags & VIFF_REGISTER) {
@@ -1144,6 +1142,7 @@
 		((struct net_device_stats*)vif->dev->priv)->tx_bytes += skb->len;
 		((struct net_device_stats*)vif->dev->priv)->tx_packets++;
 		ipmr_cache_report(skb, vifi, IGMPMSG_WHOLEPKT);
+		kfree_skb(skb);
 		return;
 	}
 #endif
@@ -1156,7 +1155,7 @@
 						.tos = RT_TOS(iph->tos) } },
 				    .proto = IPPROTO_IPIP };
 		if (ip_route_output_key(&rt, &fl))
-			return;
+			goto out_free;
 		encap = sizeof(struct iphdr);
 	} else {
 		struct flowi fl = { .oif = vif->link,
@@ -1165,7 +1164,7 @@
 						.tos = RT_TOS(iph->tos) } },
 				    .proto = IPPROTO_IPIP };
 		if (ip_route_output_key(&rt, &fl))
-			return;
+			goto out_free;
 	}
 
 	dev = rt->u.dst.dev;
@@ -1178,43 +1177,34 @@
 
 		IP_INC_STATS_BH(IpFragFails);
 		ip_rt_put(rt);
-		return;
+		goto out_free;
 	}
 
-	encap += LL_RESERVED_SPACE(dev);
+	encap += LL_RESERVED_SPACE(dev) + rt->u.dst.header_len;
 
-	if (skb_headroom(skb) < encap || skb_cloned(skb) || !last)
-		skb2 = skb_realloc_headroom(skb, (encap + 15)&~15);
-	else if (atomic_read(&skb->users) != 1)
-		skb2 = skb_clone(skb, GFP_ATOMIC);
-	else {
-		atomic_inc(&skb->users);
-		skb2 = skb;
-	}
-
-	if (skb2 == NULL) {
-		ip_rt_put(rt);
-		return;
+	if (skb_cow(skb, encap)) {
+ 		ip_rt_put(rt);
+		goto out_free;
 	}
 
 	vif->pkt_out++;
 	vif->bytes_out+=skb->len;
 
-	dst_release(skb2->dst);
-	skb2->dst = &rt->u.dst;
-	iph = skb2->nh.iph;
+	dst_release(skb->dst);
+	skb->dst = &rt->u.dst;
+	iph = skb->nh.iph;
 	ip_decrease_ttl(iph);
 
 	/* FIXME: forward and output firewalls used to be called here.
 	 * What do we do with netfilter? -- RR */
 	if (vif->flags & VIFF_TUNNEL) {
-		ip_encap(skb2, vif->local, vif->remote);
+		ip_encap(skb, vif->local, vif->remote);
 		/* FIXME: extra output firewall step used to be here. --RR */
 		((struct ip_tunnel *)vif->dev->priv)->stat.tx_packets++;
-		((struct ip_tunnel *)vif->dev->priv)->stat.tx_bytes+=skb2->len;
+		((struct ip_tunnel *)vif->dev->priv)->stat.tx_bytes+=skb->len;
 	}
 
-	IPCB(skb2)->flags |= IPSKB_FORWARDED;
+	IPCB(skb)->flags |= IPSKB_FORWARDED;
 
 	/*
 	 * RFC1584 teaches, that DVMRP/PIM router must deliver packets locally
@@ -1227,8 +1217,13 @@
 	 * not mrouter) cannot join to more than one interface - it will
 	 * result in receiving multiple packets.
 	 */
-	NF_HOOK(PF_INET, NF_IP_FORWARD, skb2, skb->dev, dev, 
+	NF_HOOK(PF_INET, NF_IP_FORWARD, skb, skb->dev, dev, 
 		ipmr_forward_finish);
+	return;
+
+out_free:
+	kfree_skb(skb);
+	return;
 }
 
 static int ipmr_find_vif(struct net_device *dev)
@@ -1299,13 +1294,24 @@
 	 */
 	for (ct = cache->mfc_un.res.maxvif-1; ct >= cache->mfc_un.res.minvif; ct--) {
 		if (skb->nh.iph->ttl > cache->mfc_un.res.ttls[ct]) {
-			if (psend != -1)
-				ipmr_queue_xmit(skb, cache, psend, 0);
+			if (psend != -1) {
+				struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
+				if (skb2)
+					ipmr_queue_xmit(skb2, cache, psend);
+			}
 			psend=ct;
 		}
 	}
-	if (psend != -1)
-		ipmr_queue_xmit(skb, cache, psend, !local);
+	if (psend != -1) {
+		if (local) {
+			struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
+			if (skb2)
+				ipmr_queue_xmit(skb2, cache, psend);
+		} else {
+			ipmr_queue_xmit(skb, cache, psend);
+			return 0;
+		}
+	}
 
 dont_forward:
 	if (!local)
diff -Nru a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
--- a/net/ipv4/netfilter/Kconfig	Wed Oct 29 19:10:36 2003
+++ b/net/ipv4/netfilter/Kconfig	Wed Oct 29 19:10:36 2003
@@ -267,7 +267,7 @@
 
 config IP_NF_MATCH_PHYSDEV
 	tristate "Physdev match support"
-	depends on IP_NF_IPTABLES!=n && BRIDGE_NETFILTER
+	depends on IP_NF_IPTABLES && BRIDGE_NETFILTER
 	help
 	  Physdev packet matching matches against the physical bridge ports
 	  the IP packet arrived on or will leave by.
diff -Nru a/net/ipv4/netfilter/ip_fw_compat_masq.c b/net/ipv4/netfilter/ip_fw_compat_masq.c
--- a/net/ipv4/netfilter/ip_fw_compat_masq.c	Wed Oct 29 19:10:36 2003
+++ b/net/ipv4/netfilter/ip_fw_compat_masq.c	Wed Oct 29 19:10:36 2003
@@ -91,9 +91,6 @@
 			WRITE_UNLOCK(&ip_nat_lock);
 			return ret;
 		}
-
-		place_in_hashes(ct, info);
-		info->initialized = 1;
 	} else
 		DEBUGP("Masquerading already done on this conn.\n");
 	WRITE_UNLOCK(&ip_nat_lock);
diff -Nru a/net/ipv4/netfilter/ipt_REDIRECT.c b/net/ipv4/netfilter/ipt_REDIRECT.c
--- a/net/ipv4/netfilter/ipt_REDIRECT.c	Wed Oct 29 19:10:36 2003
+++ b/net/ipv4/netfilter/ipt_REDIRECT.c	Wed Oct 29 19:10:36 2003
@@ -83,7 +83,7 @@
 
 		/* Device might not have an associated in_device. */
 		indev = (struct in_device *)(*pskb)->dev->ip_ptr;
-		if (indev == NULL)
+		if (indev == NULL || indev->ifa_list == NULL)
 			return NF_DROP;
 
 		/* Grab first address on interface. */
diff -Nru a/net/ipv4/tcp.c b/net/ipv4/tcp.c
--- a/net/ipv4/tcp.c	Wed Oct 29 19:10:36 2003
+++ b/net/ipv4/tcp.c	Wed Oct 29 19:10:36 2003
@@ -1540,6 +1540,17 @@
 		if (copied && tp->urg_data && tp->urg_seq == *seq)
 			break;
 
+		/* We need to check signals first, to get correct SIGURG
+		 * handling. FIXME: Need to check this doesn't impact 1003.1g
+		 * and move it down to the bottom of the loop
+		 */
+		if (signal_pending(current)) {
+			if (copied)
+				break;
+			copied = timeo ? sock_intr_errno(timeo) : -EAGAIN;
+			break;
+		}
+
 		/* Next get a buffer. */
 
 		skb = skb_peek(&sk->sk_receive_queue);
@@ -1576,7 +1587,6 @@
 			    sk->sk_state == TCP_CLOSE ||
 			    (sk->sk_shutdown & RCV_SHUTDOWN) ||
 			    !timeo ||
-			    signal_pending(current) ||
 			    (flags & MSG_PEEK))
 				break;
 		} else {
@@ -1604,11 +1614,6 @@
 
 			if (!timeo) {
 				copied = -EAGAIN;
-				break;
-			}
-
-			if (signal_pending(current)) {
-				copied = sock_intr_errno(timeo);
 				break;
 			}
 		}
diff -Nru a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
--- a/net/ipv4/tcp_input.c	Wed Oct 29 19:10:36 2003
+++ b/net/ipv4/tcp_input.c	Wed Oct 29 19:10:36 2003
@@ -1967,7 +1967,10 @@
 				 struct sk_buff *skb, u32 ack, u32 ack_seq)
 {
 	int flag = 0;
-	u32 nwin = ntohs(skb->h.th->window) << tp->snd_wscale;
+	u32 nwin = ntohs(skb->h.th->window);
+
+	if (likely(!skb->h.th->syn))
+		nwin <<= tp->snd_wscale;
 
 	if (tcp_may_update_window(tp, ack, ack_seq, nwin)) {
 		flag |= FLAG_WIN_UPDATE;
diff -Nru a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
--- a/net/ipv4/tcp_ipv4.c	Wed Oct 29 19:10:36 2003
+++ b/net/ipv4/tcp_ipv4.c	Wed Oct 29 19:10:36 2003
@@ -178,12 +178,6 @@
 	tcp_sk(sk)->bind_hash = tb;
 }
 
-static inline const u32 tcp_v4_rcv_saddr(const struct sock *sk)
-{
-	return likely(sk->sk_state != TCP_TIME_WAIT) ?
-		inet_sk(sk)->rcv_saddr : tcptw_sk(sk)->tw_rcv_saddr;
-}
-
 static inline int tcp_bind_conflict(struct sock *sk, struct tcp_bind_bucket *tb)
 {
 	const u32 sk_rcv_saddr = tcp_v4_rcv_saddr(sk);
diff -Nru a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
--- a/net/ipv4/tcp_minisocks.c	Wed Oct 29 19:10:36 2003
+++ b/net/ipv4/tcp_minisocks.c	Wed Oct 29 19:10:36 2003
@@ -368,6 +368,11 @@
 
 			ipv6_addr_copy(&tw->tw_v6_daddr, &np->daddr);
 			ipv6_addr_copy(&tw->tw_v6_rcv_saddr, &np->rcv_saddr);
+			tw->tw_v6_ipv6only = np->ipv6only;
+		} else {
+			memset(&tw->tw_v6_daddr, 0, sizeof(tw->tw_v6_daddr));
+			memset(&tw->tw_v6_rcv_saddr, 0, sizeof(tw->tw_v6_rcv_saddr));
+			tw->tw_v6_ipv6only = 0;
 		}
 #endif
 		/* Linkage updates. */
diff -Nru a/net/ipv4/udp.c b/net/ipv4/udp.c
--- a/net/ipv4/udp.c	Wed Oct 29 19:10:35 2003
+++ b/net/ipv4/udp.c	Wed Oct 29 19:10:35 2003
@@ -398,6 +398,8 @@
  */
 static int udp_push_pending_frames(struct sock *sk, struct udp_opt *up)
 {
+	struct inet_opt *inet = inet_sk(sk);
+	struct flowi *fl = &inet->cork.fl;
 	struct sk_buff *skb;
 	struct udphdr *uh;
 	int err = 0;
@@ -410,8 +412,8 @@
 	 * Create a UDP header
 	 */
 	uh = skb->h.uh;
-	uh->source = up->sport;
-	uh->dest = up->dport;
+	uh->source = fl->fl_ip_sport;
+	uh->dest = fl->fl_ip_dport;
 	uh->len = htons(up->len);
 	uh->check = 0;
 
@@ -426,12 +428,12 @@
 		 */
 		if (skb->ip_summed == CHECKSUM_HW) {
 			skb->csum = offsetof(struct udphdr, check);
-			uh->check = ~csum_tcpudp_magic(up->saddr, up->daddr,
+			uh->check = ~csum_tcpudp_magic(fl->fl4_src, fl->fl4_dst,
 					up->len, IPPROTO_UDP, 0);
 		} else {
 			skb->csum = csum_partial((char *)uh,
 					sizeof(struct udphdr), skb->csum);
-			uh->check = csum_tcpudp_magic(up->saddr, up->daddr,
+			uh->check = csum_tcpudp_magic(fl->fl4_src, fl->fl4_dst,
 					up->len, IPPROTO_UDP, skb->csum);
 			if (uh->check == 0)
 				uh->check = -1;
@@ -456,7 +458,7 @@
 		skb_queue_walk(&sk->sk_write_queue, skb) {
 			csum = csum_add(csum, skb->csum);
 		}
-		uh->check = csum_tcpudp_magic(up->saddr, up->daddr,
+		uh->check = csum_tcpudp_magic(fl->fl4_src, fl->fl4_dst,
 				up->len, IPPROTO_UDP, csum);
 		if (uh->check == 0)
 			uh->check = -1;
@@ -520,8 +522,13 @@
 	 	 * The socket lock must be held while it's corked.
 		 */
 		lock_sock(sk);
-		if (likely(up->pending))
+		if (likely(up->pending)) {
+			if (unlikely(up->pending != AF_INET)) {
+				release_sock(sk);
+				return -EINVAL;
+			}
  			goto do_append_data;
+		}
 		release_sock(sk);
 	}
 	ulen += sizeof(struct udphdr);
@@ -636,11 +643,11 @@
 	/*
 	 *	Now cork the socket to pend data.
 	 */
-	up->daddr = daddr;
-	up->dport = dport;
-	up->saddr = saddr;
-	up->sport = inet->sport;
-	up->pending = 1;
+	inet->cork.fl.fl4_dst = daddr;
+	inet->cork.fl.fl_ip_dport = dport;
+	inet->cork.fl.fl4_src = saddr;
+	inet->cork.fl.fl_ip_sport = inet->sport;
+	up->pending = AF_INET;
 
 do_append_data:
 	up->len += ulen;
diff -Nru a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
--- a/net/ipv6/addrconf.c	Wed Oct 29 19:10:36 2003
+++ b/net/ipv6/addrconf.c	Wed Oct 29 19:10:36 2003
@@ -970,36 +970,33 @@
 
 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
 {
-	struct ipv6_pinfo *np = inet6_sk(sk);
-	int addr_type = ipv6_addr_type(&np->rcv_saddr);
+	const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
+	const struct in6_addr *sk2_rcv_saddr6 = tcp_v6_rcv_saddr(sk2);
+	u32 sk_rcv_saddr = inet_sk(sk)->rcv_saddr;
+	u32 sk2_rcv_saddr = tcp_v4_rcv_saddr(sk2);
+	int sk_ipv6only = ipv6_only_sock(sk);
+	int sk2_ipv6only = tcp_v6_ipv6only(sk2);
+	int addr_type = ipv6_addr_type(sk_rcv_saddr6);
+	int addr_type2 = sk2_rcv_saddr6 ? ipv6_addr_type(sk2_rcv_saddr6) : IPV6_ADDR_MAPPED;
 
-	if (!inet_sk(sk2)->rcv_saddr && !ipv6_only_sock(sk))
+	if (!sk2_rcv_saddr && !sk_ipv6only)
 		return 1;
 
-	if (sk2->sk_family == AF_INET6 &&
-	    ipv6_addr_any(&inet6_sk(sk2)->rcv_saddr) &&
-	    !(ipv6_only_sock(sk2) && addr_type == IPV6_ADDR_MAPPED))
+	if (addr_type2 == IPV6_ADDR_ANY &&
+	    !(sk2_ipv6only && addr_type == IPV6_ADDR_MAPPED))
 		return 1;
 
 	if (addr_type == IPV6_ADDR_ANY &&
-	    (!ipv6_only_sock(sk) ||
-	     !(sk2->sk_family == AF_INET6 ?
-	       (ipv6_addr_type(&inet6_sk(sk2)->rcv_saddr) == IPV6_ADDR_MAPPED) :
-	        1)))
+	    !(sk_ipv6only && addr_type2 == IPV6_ADDR_MAPPED))
 		return 1;
 
-	if (sk2->sk_family == AF_INET6 &&
-	    !ipv6_addr_cmp(&np->rcv_saddr,
-			   (sk2->sk_state != TCP_TIME_WAIT ?
-			    &inet6_sk(sk2)->rcv_saddr :
-			    &tcptw_sk(sk)->tw_v6_rcv_saddr)))
+	if (sk2_rcv_saddr6 &&
+	    !ipv6_addr_cmp(sk_rcv_saddr6, sk2_rcv_saddr6))
 		return 1;
 
 	if (addr_type == IPV6_ADDR_MAPPED &&
-	    !ipv6_only_sock(sk2) &&
-	    (!inet_sk(sk2)->rcv_saddr ||
-	     !inet_sk(sk)->rcv_saddr ||
-	     inet_sk(sk)->rcv_saddr == inet_sk(sk2)->rcv_saddr))
+	    !sk2_ipv6only &&
+	    (!sk2_rcv_saddr || !sk_rcv_saddr || sk_rcv_saddr == sk2_rcv_saddr))
 		return 1;
 
 	return 0;
@@ -1109,24 +1106,22 @@
 static int __ipv6_regen_rndid(struct inet6_dev *idev)
 {
 	struct net_device *dev;
-	u8 eui64[8];
-	u8 digest[16];
 	struct scatterlist sg[2];
 
 	sg[0].page = virt_to_page(idev->entropy);
 	sg[0].offset = offset_in_page(idev->entropy);
 	sg[0].length = 8;
-	sg[1].page = virt_to_page(eui64);
-	sg[1].offset = offset_in_page(eui64);
+	sg[1].page = virt_to_page(idev->work_eui64);
+	sg[1].offset = offset_in_page(idev->work_eui64);
 	sg[1].length = 8;
 
 	dev = idev->dev;
 
-	if (ipv6_generate_eui64(eui64, dev)) {
+	if (ipv6_generate_eui64(idev->work_eui64, dev)) {
 		printk(KERN_INFO
 			"__ipv6_regen_rndid(idev=%p): cannot get EUI64 identifier; use random bytes.\n",
 			idev);
-		get_random_bytes(eui64, sizeof(eui64));
+		get_random_bytes(idev->work_eui64, sizeof(idev->work_eui64));
 	}
 regen:
 	spin_lock(&md5_tfm_lock);
@@ -1136,12 +1131,12 @@
 	}
 	crypto_digest_init(md5_tfm);
 	crypto_digest_update(md5_tfm, sg, 2);
-	crypto_digest_final(md5_tfm, digest);
+	crypto_digest_final(md5_tfm, idev->work_digest);
 	spin_unlock(&md5_tfm_lock);
 
-	memcpy(idev->rndid, &digest[0], 8);
+	memcpy(idev->rndid, &idev->work_digest[0], 8);
 	idev->rndid[0] &= ~0x02;
-	memcpy(idev->entropy, &digest[8], 8);
+	memcpy(idev->entropy, &idev->work_digest[8], 8);
 
 	/*
 	 * <draft-ietf-ipngwg-temp-addresses-v2-00.txt>:
diff -Nru a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
--- a/net/ipv6/ip6_output.c	Wed Oct 29 19:10:35 2003
+++ b/net/ipv6/ip6_output.c	Wed Oct 29 19:10:35 2003
@@ -1239,7 +1239,7 @@
 		}
 		dst_hold(&rt->u.dst);
 		np->cork.rt = rt;
-		np->cork.fl = fl;
+		inet->cork.fl = *fl;
 		np->cork.hop_limit = hlimit;
 		inet->cork.fragsize = mtu = dst_pmtu(&rt->u.dst);
 		inet->cork.length = 0;
@@ -1250,6 +1250,7 @@
 		transhdrlen += exthdrlen;
 	} else {
 		rt = np->cork.rt;
+		fl = &inet->cork.fl;
 		if (inet->cork.flags & IPCORK_OPT)
 			opt = np->cork.opt;
 		transhdrlen = 0;
@@ -1423,7 +1424,7 @@
 	struct ipv6hdr *hdr;
 	struct ipv6_txoptions *opt = np->cork.opt;
 	struct rt6_info *rt = np->cork.rt;
-	struct flowi *fl = np->cork.fl;
+	struct flowi *fl = &inet->cork.fl;
 	unsigned char proto = fl->proto;
 	int err = 0;
 
@@ -1487,9 +1488,7 @@
 		dst_release(&np->cork.rt->u.dst);
 		np->cork.rt = NULL;
 	}
-	if (np->cork.fl) {
-		np->cork.fl = NULL;
-	}
+	memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
 	return err;
 error:
 	goto out;
@@ -1514,7 +1513,5 @@
 		dst_release(&np->cork.rt->u.dst);
 		np->cork.rt = NULL;
 	}
-	if (np->cork.fl) {
-		np->cork.fl = NULL;
-	}
+	memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
 }
diff -Nru a/net/ipv6/mcast.c b/net/ipv6/mcast.c
--- a/net/ipv6/mcast.c	Wed Oct 29 19:10:36 2003
+++ b/net/ipv6/mcast.c	Wed Oct 29 19:10:36 2003
@@ -604,9 +604,9 @@
 			if (ipv6_addr_cmp(&psl->sl_addr[i], src_addr) == 0)
 				break;
 		}
-		if (mc->sfmode == MCAST_INCLUDE && i >= psl->sl_count);
+		if (mc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
 			rv = 0;
-		if (mc->sfmode == MCAST_EXCLUDE && i < psl->sl_count);
+		if (mc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
 			rv = 0;
 	}
 	read_unlock(&ipv6_sk_mc_lock);
diff -Nru a/net/ipv6/udp.c b/net/ipv6/udp.c
--- a/net/ipv6/udp.c	Wed Oct 29 19:10:36 2003
+++ b/net/ipv6/udp.c	Wed Oct 29 19:10:36 2003
@@ -720,8 +720,8 @@
 {
 	struct sk_buff *skb;
 	struct udphdr *uh;
-	struct ipv6_pinfo *np = inet6_sk(sk);
-	struct flowi *fl = np->cork.fl;
+	struct inet_opt *inet = inet_sk(sk);
+	struct flowi *fl = &inet->cork.fl;
 	int err = 0;
 
 	/* Grab the skbuff where UDP header space exists. */
@@ -783,15 +783,60 @@
 	struct in6_addr *daddr;
 	struct ipv6_txoptions *opt = NULL;
 	struct ip6_flowlabel *flowlabel = NULL;
-	struct flowi fl;
+	struct flowi *fl = &inet->cork.fl;
 	struct dst_entry *dst;
 	int addr_len = msg->msg_namelen;
 	int ulen = len;
-	int addr_type;
 	int hlimit = -1;
 	int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
 	int err;
-	
+
+	/* destination address check */
+	if (sin6) {
+		if (addr_len < offsetof(struct sockaddr, sa_data))
+			return -EINVAL;
+
+		switch (sin6->sin6_family) {
+		case AF_INET6:
+			if (addr_len < SIN6_LEN_RFC2133)
+				return -EINVAL;
+			daddr = &sin6->sin6_addr;
+			break;
+		case AF_INET:
+			goto do_udp_sendmsg;
+		case AF_UNSPEC:
+			msg->msg_name = sin6 = NULL;
+			msg->msg_namelen = addr_len = 0;
+			daddr = NULL;
+			break;
+		default:
+			return -EINVAL;
+		}
+	} else if (!up->pending) {
+		if (sk->sk_state != TCP_ESTABLISHED)
+			return -EDESTADDRREQ;
+		daddr = &np->daddr;
+	} else 
+		daddr = NULL;
+
+	if (daddr) {
+		if (ipv6_addr_type(daddr) == IPV6_ADDR_MAPPED) {
+			struct sockaddr_in sin;
+			sin.sin_family = AF_INET;
+			sin.sin_port = sin6 ? sin6->sin6_port : inet->dport;
+			sin.sin_addr.s_addr = daddr->s6_addr[3];
+			msg->msg_name = &sin;
+			msg->msg_namelen = sizeof(sin);
+do_udp_sendmsg:
+			if (__ipv6_only_sock(sk))
+				return -ENETUNREACH;
+			return udp_sendmsg(iocb, sk, msg, len);
+		}
+	}
+
+	if (up->pending == AF_INET)
+		return udp_sendmsg(iocb, sk, msg, len);
+
 	/* Rough check on arithmetic overflow,
 	   better check is made in ip6_build_xmit
 	   */
@@ -805,6 +850,10 @@
 		 */
 		lock_sock(sk);
 		if (likely(up->pending)) {
+			if (unlikely(up->pending != AF_INET6)) {
+				release_sock(sk);
+				return -EINVAL;
+			}
 			dst = NULL;
 			goto do_append_data;
 		}
@@ -812,31 +861,19 @@
 	}
 	ulen += sizeof(struct udphdr);
 
-	memset(&fl, 0, sizeof(fl));
+	memset(fl, 0, sizeof(*fl));
 
 	if (sin6) {
-		if (sin6->sin6_family == AF_INET) {
-			if (__ipv6_only_sock(sk))
-				return -ENETUNREACH;
-			return udp_sendmsg(iocb, sk, msg, len);
-		}
-
-		if (addr_len < SIN6_LEN_RFC2133)
-			return -EINVAL;
-
-		if (sin6->sin6_family && sin6->sin6_family != AF_INET6)
-			return -EINVAL;
-
 		if (sin6->sin6_port == 0)
 			return -EINVAL;
 
-		up->dport = sin6->sin6_port;
+		fl->fl_ip_dport = sin6->sin6_port;
 		daddr = &sin6->sin6_addr;
 
 		if (np->sndflow) {
-			fl.fl6_flowlabel = sin6->sin6_flowinfo&IPV6_FLOWINFO_MASK;
-			if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
-				flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
+			fl->fl6_flowlabel = sin6->sin6_flowinfo&IPV6_FLOWINFO_MASK;
+			if (fl->fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
+				flowlabel = fl6_sock_lookup(sk, fl->fl6_flowlabel);
 				if (flowlabel == NULL)
 					return -EINVAL;
 				daddr = &flowlabel->dst;
@@ -854,48 +891,30 @@
 		if (addr_len >= sizeof(struct sockaddr_in6) &&
 		    sin6->sin6_scope_id &&
 		    ipv6_addr_type(daddr)&IPV6_ADDR_LINKLOCAL)
-			fl.oif = sin6->sin6_scope_id;
+			fl->oif = sin6->sin6_scope_id;
 	} else {
 		if (sk->sk_state != TCP_ESTABLISHED)
 			return -EDESTADDRREQ;
 
-		up->dport = inet->dport;
+		fl->fl_ip_dport = inet->dport;
 		daddr = &np->daddr;
-		fl.fl6_flowlabel = np->flow_label;
-	}
-
-	addr_type = ipv6_addr_type(daddr);
-
-	if (addr_type == IPV6_ADDR_MAPPED) {
-		struct sockaddr_in sin;
-
-		if (__ipv6_only_sock(sk))
-			return -ENETUNREACH;
-
-		sin.sin_family = AF_INET;
-		sin.sin_addr.s_addr = daddr->s6_addr32[3];
-		sin.sin_port = up->dport;
-		msg->msg_name = (struct sockaddr *)(&sin);
-		msg->msg_namelen = sizeof(sin);
-		fl6_sock_release(flowlabel);
-
-		return udp_sendmsg(iocb, sk, msg, len);
+		fl->fl6_flowlabel = np->flow_label;
 	}
 
-	if (!fl.oif)
-		fl.oif = sk->sk_bound_dev_if;
+	if (!fl->oif)
+		fl->oif = sk->sk_bound_dev_if;
 
 	if (msg->msg_controllen) {
 		opt = &opt_space;
 		memset(opt, 0, sizeof(struct ipv6_txoptions));
 
-		err = datagram_send_ctl(msg, &fl, opt, &hlimit);
+		err = datagram_send_ctl(msg, fl, opt, &hlimit);
 		if (err < 0) {
 			fl6_sock_release(flowlabel);
 			return err;
 		}
-		if ((fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) && !flowlabel) {
-			flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
+		if ((fl->fl6_flowlabel&IPV6_FLOWLABEL_MASK) && !flowlabel) {
+			flowlabel = fl6_sock_lookup(sk, fl->fl6_flowlabel);
 			if (flowlabel == NULL)
 				return -EINVAL;
 		}
@@ -907,28 +926,27 @@
 	if (flowlabel)
 		opt = fl6_merge_options(&opt_space, flowlabel, opt);
 
-	fl.proto = IPPROTO_UDP;
-	ipv6_addr_copy(&fl.fl6_dst, daddr);
-	if (ipv6_addr_any(&fl.fl6_src) && !ipv6_addr_any(&np->saddr))
-		ipv6_addr_copy(&fl.fl6_src, &np->saddr);
-	fl.fl_ip_dport = up->dport;
-	fl.fl_ip_sport = inet->sport;
+	fl->proto = IPPROTO_UDP;
+	ipv6_addr_copy(&fl->fl6_dst, daddr);
+	if (ipv6_addr_any(&fl->fl6_src) && !ipv6_addr_any(&np->saddr))
+		ipv6_addr_copy(&fl->fl6_src, &np->saddr);
+	fl->fl_ip_sport = inet->sport;
 	
 	/* merge ip6_build_xmit from ip6_output */
 	if (opt && opt->srcrt) {
 		struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
-		ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
+		ipv6_addr_copy(&fl->fl6_dst, rt0->addr);
 	}
 
-	if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst))
-		fl.oif = np->mcast_oif;
+	if (!fl->oif && ipv6_addr_is_multicast(&fl->fl6_dst))
+		fl->oif = np->mcast_oif;
 
-	err = ip6_dst_lookup(sk, &dst, &fl);
+	err = ip6_dst_lookup(sk, &dst, fl);
 	if (err)
 		goto out;
 
 	if (hlimit < 0) {
-		if (ipv6_addr_is_multicast(&fl.fl6_dst))
+		if (ipv6_addr_is_multicast(&fl->fl6_dst))
 			hlimit = np->mcast_hops;
 		else
 			hlimit = np->hop_limit;
@@ -951,12 +969,12 @@
 		goto out;
 	}
 
-	up->pending = 1;
+	up->pending = AF_INET6;
 
 do_append_data:
 	up->len += ulen;
 	err = ip6_append_data(sk, ip_generic_getfrag, msg->msg_iov, ulen, sizeof(struct udphdr),
-			      hlimit, opt, &fl, (struct rt6_info*)dst,
+			      hlimit, opt, fl, (struct rt6_info*)dst,
 			      corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags);
 	if (err)
 		udp_v6_flush_pending_frames(sk);
@@ -965,7 +983,7 @@
 
 	if (dst)
 		ip6_dst_store(sk, dst,
-			      !ipv6_addr_cmp(&fl.fl6_dst, &np->daddr) ?
+			      !ipv6_addr_cmp(&fl->fl6_dst, &np->daddr) ?
 			      &np->daddr : NULL);
 	if (err > 0)
 		err = np->recverr ? net_xmit_errno(err) : 0;
diff -Nru a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
--- a/net/ipv6/xfrm6_policy.c	Wed Oct 29 19:10:35 2003
+++ b/net/ipv6/xfrm6_policy.c	Wed Oct 29 19:10:35 2003
@@ -169,7 +169,7 @@
 		dst_prev->output	= dst_prev->xfrm->type->output;
 		/* Sheit... I remember I did this right. Apparently,
 		 * it was magically lost, so this code needs audit */
-		x->u.rt6.rt6i_flags    = rt0->rt6i_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL);
+		x->u.rt6.rt6i_flags    = rt0->rt6i_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL|RTF_NDISC);
 		x->u.rt6.rt6i_metric   = rt0->rt6i_metric;
 		x->u.rt6.rt6i_node     = rt0->rt6i_node;
 		x->u.rt6.rt6i_gateway  = rt0->rt6i_gateway;
diff -Nru a/net/llc/af_llc.c b/net/llc/af_llc.c
--- a/net/llc/af_llc.c	Wed Oct 29 19:10:35 2003
+++ b/net/llc/af_llc.c	Wed Oct 29 19:10:35 2003
@@ -415,6 +415,7 @@
 			goto out;
 	}
 	if (!llc->dev) {
+		rc = -ENODEV;
 		rtnl_lock();
 		dev = dev_getbyhwaddr(addr->sllc_arphrd, addr->sllc_smac);
 		rtnl_unlock();
diff -Nru a/net/llc/llc_input.c b/net/llc/llc_input.c
--- a/net/llc/llc_input.c	Wed Oct 29 19:10:36 2003
+++ b/net/llc/llc_input.c	Wed Oct 29 19:10:36 2003
@@ -40,13 +40,13 @@
 					    struct sk_buff *skb))
 {
 	if (type == LLC_DEST_SAP || type == LLC_DEST_CONN)
-		llc_type_handlers[type] = handler;
+		llc_type_handlers[type - 1] = handler;
 }
 
 void llc_remove_pack(int type)
 {
 	if (type == LLC_DEST_SAP || type == LLC_DEST_CONN)
-		llc_type_handlers[type] = NULL;
+		llc_type_handlers[type - 1] = NULL;
 }
 
 void llc_set_station_handler(void (*handler)(struct sk_buff *skb))
diff -Nru a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
--- a/net/xfrm/xfrm_policy.c	Wed Oct 29 19:10:36 2003
+++ b/net/xfrm/xfrm_policy.c	Wed Oct 29 19:10:36 2003
@@ -519,7 +519,6 @@
 	     *polp != NULL; polp = &(*polp)->next) {
 		if (*polp == pol) {
 			*polp = pol->next;
-			atomic_dec(&pol->refcnt);
 			return pol;
 		}
 	}
@@ -574,6 +573,7 @@
 		write_lock_bh(&xfrm_policy_lock);
 		__xfrm_policy_link(newp, XFRM_POLICY_MAX+dir);
 		write_unlock_bh(&xfrm_policy_lock);
+		xfrm_pol_put(newp);
 	}
 	return newp;
 }
@@ -853,6 +853,8 @@
 xfrm_state_ok(struct xfrm_tmpl *tmpl, struct xfrm_state *x, 
 	      unsigned short family)
 {
+	if (xfrm_state_kern(x))
+		return tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, family);
 	return	x->id.proto == tmpl->id.proto &&
 		(x->id.spi == tmpl->id.spi || !tmpl->id.spi) &&
 		(x->props.reqid == tmpl->reqid || !tmpl->reqid) &&
@@ -862,14 +864,23 @@
 }
 
 static inline int
-xfrm_policy_ok(struct xfrm_tmpl *tmpl, struct sec_path *sp, int idx,
+xfrm_policy_ok(struct xfrm_tmpl *tmpl, struct sec_path *sp, int start,
 	       unsigned short family)
 {
+	int idx = start;
+
+	if (tmpl->optional) {
+		if (!tmpl->mode)
+			return start;
+	} else
+		start = -1;
 	for (; idx < sp->len; idx++) {
 		if (xfrm_state_ok(tmpl, sp->x[idx].xvec, family))
 			return ++idx;
+		if (sp->x[idx].xvec->props.mode)
+			break;
 	}
-	return -1;
+	return start;
 }
 
 static int
@@ -922,32 +933,35 @@
 					xfrm_policy_lookup);
 
 	if (!pol)
-		return 1;
+		return !skb->sp;
 
 	pol->curlft.use_time = (unsigned long)xtime.tv_sec;
 
 	if (pol->action == XFRM_POLICY_ALLOW) {
-		if (pol->xfrm_nr != 0) {
-			struct sec_path *sp;
-			static struct sec_path dummy;
-			int i, k;
-
-			if ((sp = skb->sp) == NULL)
-				sp = &dummy;
-
-			/* For each tmpl search corresponding xfrm.
-			 * Order is _important_. Later we will implement
-			 * some barriers, but at the moment barriers
-			 * are implied between each two transformations.
-			 */
-			for (i = pol->xfrm_nr-1, k = 0; i >= 0; i--) {
-				if (pol->xfrm_vec[i].optional)
-					continue;
-				k = xfrm_policy_ok(pol->xfrm_vec+i, sp, k, family);
-				if (k < 0)
-					goto reject;
-			}
+		struct sec_path *sp;
+		static struct sec_path dummy;
+		int i, k;
+
+		if ((sp = skb->sp) == NULL)
+			sp = &dummy;
+
+		/* For each tunnel xfrm, find the first matching tmpl.
+		 * For each tmpl before that, find corresponding xfrm.
+		 * Order is _important_. Later we will implement
+		 * some barriers, but at the moment barriers
+		 * are implied between each two transformations.
+		 */
+		for (i = pol->xfrm_nr-1, k = 0; i >= 0; i--) {
+			k = xfrm_policy_ok(pol->xfrm_vec+i, sp, k, family);
+			if (k < 0)
+				goto reject;
+		}
+
+		for (; k < sp->len; k++) {
+			if (sp->x[k].xvec->props.mode)
+				goto reject;
 		}
+
 		xfrm_pol_put(pol);
 		return 1;
 	}
diff -Nru a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
--- a/net/xfrm/xfrm_state.c	Wed Oct 29 19:10:36 2003
+++ b/net/xfrm/xfrm_state.c	Wed Oct 29 19:10:36 2003
@@ -831,6 +831,7 @@
 
 	if (err >= 0) {
 		xfrm_sk_policy_insert(sk, err, pol);
+		xfrm_pol_put(pol);
 		err = 0;
 	}