25 files changed, 237 insertions, 123 deletions

diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 9d3a0775a11d..87851efb0228 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -258,3 +258,19 @@ Why:	These drivers never compiled since they were added to the kernel
 Who:    Jean Delvare <khali@linux-fr.org>
 
 ---------------------------
+
+What:   Bridge netfilter deferred IPv4/IPv6 output hook calling
+When:   January 2007
+Why:    The deferred output hooks are a layering violation causing unusual
+        and broken behaviour on bridge devices. Examples of things they
+        break include QoS classifation using the MARK or CLASSIFY targets,
+        the IPsec policy match and connection tracking with VLANs on a
+        bridge. Their only use is to enable bridge output port filtering
+        within iptables with the physdev match, which can also be done by
+        combining iptables and ebtables using netfilter marks. Until it
+        will get removed the hook deferral is disabled by default and is
+        only enabled when needed.
+
+Who:    Patrick McHardy <kaber@trash.net>
+
+---------------------------
diff --git a/block/blktrace.c b/block/blktrace.c
index b8c0702777ff..265f7a830619 100644
--- a/block/blktrace.c
+++ b/block/blktrace.c
@@ -80,7 +80,7 @@ static u32 bio_act[5] __read_mostly = { 0, BLK_TC_ACT(BLK_TC_BARRIER), BLK_TC_AC
 #define trace_sync_bit(rw)      \
         (((rw) & (1 << BIO_RW_SYNC)) >> (BIO_RW_SYNC - 1))
 #define trace_ahead_bit(rw)     \
-        (((rw) & (1 << BIO_RW_AHEAD)) << (BIO_RW_AHEAD - 0))
+        (((rw) & (1 << BIO_RW_AHEAD)) << (2 - BIO_RW_AHEAD))
 
 /*
  * The worker for the various blk_add_trace*() types. Fills out a
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 102ebc2c5c34..aae3123bf3ee 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -936,7 +936,7 @@ static int cfq_arm_slice_timer(struct cfq_data *cfqd, struct cfq_queue *cfqq)
          * seeks. so allow a little bit of time for him to submit a new rq
          */
         if (sample_valid(cic->seek_samples) && CIC_SEEKY(cic))
-                sl = 2;
+                sl = min(sl, msecs_to_jiffies(2));
 
         mod_timer(&cfqd->idle_slice_timer, jiffies + sl);
         return 1;
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 1c4df22dfd2a..7b0eca703a67 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1233,6 +1233,50 @@ static inline void complete_buffers(struct bio *bio, int status)
         }
 }
 
+static void cciss_check_queues(ctlr_info_t *h)
+{
+        int start_queue = h->next_to_run;
+        int i;
+
+        /* check to see if we have maxed out the number of commands that can
+         * be placed on the queue.  If so then exit.  We do this check here
+         * in case the interrupt we serviced was from an ioctl and did not
+         * free any new commands.
+         */
+        if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS)
+                return;
+
+        /* We have room on the queue for more commands.  Now we need to queue
+         * them up.  We will also keep track of the next queue to run so
+         * that every queue gets a chance to be started first.
+         */
+        for (i = 0; i < h->highest_lun + 1; i++) {
+                int curr_queue = (start_queue + i) % (h->highest_lun + 1);
+                /* make sure the disk has been added and the drive is real
+                 * because this can be called from the middle of init_one.
+                 */
+                if (!(h->drv[curr_queue].queue) || !(h->drv[curr_queue].heads))
+                        continue;
+                blk_start_queue(h->gendisk[curr_queue]->queue);
+
+                /* check to see if we have maxed out the number of commands
+                 * that can be placed on the queue.
+                 */
+                if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS) {
+                        if (curr_queue == start_queue) {
+                                h->next_to_run =
+                                    (start_queue + 1) % (h->highest_lun + 1);
+                                break;
+                        } else {
+                                h->next_to_run = curr_queue;
+                                break;
+                        }
+                } else {
+                        curr_queue = (curr_queue + 1) % (h->highest_lun + 1);
+                }
+        }
+}
+
 static void cciss_softirq_done(struct request *rq)
 {
         CommandList_struct *cmd = rq->completion_data;
@@ -1264,6 +1308,7 @@ static void cciss_softirq_done(struct request *rq)
         spin_lock_irqsave(&h->lock, flags);
         end_that_request_last(rq, rq->errors);
         cmd_free(h, cmd, 1);
+        cciss_check_queues(h);
         spin_unlock_irqrestore(&h->lock, flags);
 }
 
@@ -2528,8 +2573,6 @@ static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs)
         CommandList_struct *c;
         unsigned long flags;
         __u32 a, a1, a2;
-        int j;
-        int start_queue = h->next_to_run;
 
         if (interrupt_not_for_us(h))
                 return IRQ_NONE;
@@ -2588,45 +2631,6 @@ static irqreturn_t do_cciss_intr(int irq, void *dev_id, struct pt_regs *regs)
                 }
         }
 
-        /* check to see if we have maxed out the number of commands that can
-         * be placed on the queue.  If so then exit.  We do this check here
-         * in case the interrupt we serviced was from an ioctl and did not
-         * free any new commands.
-         */
-        if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS)
-                goto cleanup;
-
-        /* We have room on the queue for more commands.  Now we need to queue
-         * them up.  We will also keep track of the next queue to run so
-         * that every queue gets a chance to be started first.
-         */
-        for (j = 0; j < h->highest_lun + 1; j++) {
-                int curr_queue = (start_queue + j) % (h->highest_lun + 1);
-                /* make sure the disk has been added and the drive is real
-                 * because this can be called from the middle of init_one.
-                 */
-                if (!(h->drv[curr_queue].queue) || !(h->drv[curr_queue].heads))
-                        continue;
-                blk_start_queue(h->gendisk[curr_queue]->queue);
-
-                /* check to see if we have maxed out the number of commands
-                 * that can be placed on the queue.
-                 */
-                if ((find_first_zero_bit(h->cmd_pool_bits, NR_CMDS)) == NR_CMDS) {
-                        if (curr_queue == start_queue) {
-                                h->next_to_run =
-                                    (start_queue + 1) % (h->highest_lun + 1);
-                                goto cleanup;
-                        } else {
-                                h->next_to_run = curr_queue;
-                                goto cleanup;
-                        }
-                } else {
-                        curr_queue = (curr_queue + 1) % (h->highest_lun + 1);
-                }
-        }
-
-      cleanup:
         spin_unlock_irqrestore(CCISS_LOCK(h->ctlr), flags);
         return IRQ_HANDLED;
 }
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 8d328186f774..bc1088d9b379 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -364,10 +364,12 @@ static ssize_t store_##file_name					\
         if (ret != 1)                                                   \
                 return -EINVAL;                                         \
                                                                         \
+        lock_cpu_hotplug();                                             \
         mutex_lock(&policy->lock);                                      \
         ret = __cpufreq_set_policy(policy, &new_policy);                \
         policy->user_policy.object = policy->object;                    \
         mutex_unlock(&policy->lock);                                    \
+        unlock_cpu_hotplug();                                           \
                                                                         \
         return ret ? ret : count;                                       \
 }
@@ -1197,20 +1199,18 @@ EXPORT_SYMBOL(cpufreq_unregister_notifier);
  *********************************************************************/
 
 
+/* Must be called with lock_cpu_hotplug held */
 int __cpufreq_driver_target(struct cpufreq_policy *policy,
                             unsigned int target_freq,
                             unsigned int relation)
 {
         int retval = -EINVAL;
 
-        lock_cpu_hotplug();
         dprintk("target for CPU %u: %u kHz, relation %u\n", policy->cpu,
                 target_freq, relation);
         if (cpu_online(policy->cpu) && cpufreq_driver->target)
                 retval = cpufreq_driver->target(policy, target_freq, relation);
 
-        unlock_cpu_hotplug();
-
         return retval;
 }
 EXPORT_SYMBOL_GPL(__cpufreq_driver_target);
@@ -1225,17 +1225,23 @@ int cpufreq_driver_target(struct cpufreq_policy *policy,
         if (!policy)
                 return -EINVAL;
 
+        lock_cpu_hotplug();
         mutex_lock(&policy->lock);
 
         ret = __cpufreq_driver_target(policy, target_freq, relation);
 
         mutex_unlock(&policy->lock);
+        unlock_cpu_hotplug();
 
         cpufreq_cpu_put(policy);
         return ret;
 }
 EXPORT_SYMBOL_GPL(cpufreq_driver_target);
 
+/*
+ * Locking: Must be called with the lock_cpu_hotplug() lock held
+ * when "event" is CPUFREQ_GOV_LIMITS
+ */
 
 static int __cpufreq_governor(struct cpufreq_policy *policy, unsigned int event)
 {
@@ -1257,24 +1263,6 @@ static int __cpufreq_governor(struct cpufreq_policy *policy, unsigned int event)
 }
 
 
-int cpufreq_governor(unsigned int cpu, unsigned int event)
-{
-        int ret = 0;
-        struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
-
-        if (!policy)
-                return -EINVAL;
-
-        mutex_lock(&policy->lock);
-        ret = __cpufreq_governor(policy, event);
-        mutex_unlock(&policy->lock);
-
-        cpufreq_cpu_put(policy);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(cpufreq_governor);
-
-
 int cpufreq_register_governor(struct cpufreq_governor *governor)
 {
         struct cpufreq_governor *t;
@@ -1342,6 +1330,9 @@ int cpufreq_get_policy(struct cpufreq_policy *policy, unsigned int cpu)
 EXPORT_SYMBOL(cpufreq_get_policy);
 
 
+/*
+ * Locking: Must be called with the lock_cpu_hotplug() lock held
+ */
 static int __cpufreq_set_policy(struct cpufreq_policy *data, struct cpufreq_policy *policy)
 {
         int ret = 0;
@@ -1436,6 +1427,8 @@ int cpufreq_set_policy(struct cpufreq_policy *policy)
         if (!data)
                 return -EINVAL;
 
+        lock_cpu_hotplug();
+
         /* lock this CPU */
         mutex_lock(&data->lock);
 
@@ -1446,6 +1439,8 @@ int cpufreq_set_policy(struct cpufreq_policy *policy)
         data->user_policy.governor = data->governor;
 
         mutex_unlock(&data->lock);
+
+        unlock_cpu_hotplug();
         cpufreq_cpu_put(data);
 
         return ret;
@@ -1469,6 +1464,7 @@ int cpufreq_update_policy(unsigned int cpu)
         if (!data)
                 return -ENODEV;
 
+        lock_cpu_hotplug();
         mutex_lock(&data->lock);
 
         dprintk("updating policy for CPU %u\n", cpu);
@@ -1494,7 +1490,7 @@ int cpufreq_update_policy(unsigned int cpu)
         ret = __cpufreq_set_policy(data, &policy);
 
         mutex_unlock(&data->lock);
-
+        unlock_cpu_hotplug();
         cpufreq_cpu_put(data);
         return ret;
 }
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index b3ebc8f01975..c4c578defabf 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -525,7 +525,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                 break;
 
         case CPUFREQ_GOV_LIMITS:
-                lock_cpu_hotplug();
                 mutex_lock(&dbs_mutex);
                 if (policy->max < this_dbs_info->cur_policy->cur)
                         __cpufreq_driver_target(
@@ -536,7 +535,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                                         this_dbs_info->cur_policy,
                                         policy->min, CPUFREQ_RELATION_L);
                 mutex_unlock(&dbs_mutex);
-                unlock_cpu_hotplug();
                 break;
         }
         return 0;
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 178f0c547eb7..52cf1f021825 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -309,7 +309,9 @@ static void do_dbs_timer(void *data)
         if (!dbs_info->enable)
                 return;
 
+        lock_cpu_hotplug();
         dbs_check_cpu(dbs_info);
+        unlock_cpu_hotplug();
         queue_delayed_work_on(cpu, kondemand_wq, &dbs_info->work,
                         usecs_to_jiffies(dbs_tuners_ins.sampling_rate));
 }
@@ -412,7 +414,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                 break;
 
         case CPUFREQ_GOV_LIMITS:
-                lock_cpu_hotplug();
                 mutex_lock(&dbs_mutex);
                 if (policy->max < this_dbs_info->cur_policy->cur)
                         __cpufreq_driver_target(this_dbs_info->cur_policy,
@@ -423,7 +424,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                                                 policy->min,
                                                 CPUFREQ_RELATION_L);
                 mutex_unlock(&dbs_mutex);
-                unlock_cpu_hotplug();
                 break;
         }
         return 0;
diff --git a/drivers/cpufreq/cpufreq_userspace.c b/drivers/cpufreq/cpufreq_userspace.c
index 44ae5e5b94cf..a06c204589cd 100644
--- a/drivers/cpufreq/cpufreq_userspace.c
+++ b/drivers/cpufreq/cpufreq_userspace.c
@@ -18,6 +18,7 @@
 #include <linux/spinlock.h>
 #include <linux/interrupt.h>
 #include <linux/cpufreq.h>
+#include <linux/cpu.h>
 #include <linux/types.h>
 #include <linux/fs.h>
 #include <linux/sysfs.h>
@@ -70,6 +71,7 @@ static int cpufreq_set(unsigned int freq, struct cpufreq_policy *policy)
 
         dprintk("cpufreq_set for cpu %u, freq %u kHz\n", policy->cpu, freq);
 
+        lock_cpu_hotplug();
         mutex_lock(&userspace_mutex);
         if (!cpu_is_managed[policy->cpu])
                 goto err;
@@ -92,6 +94,7 @@ static int cpufreq_set(unsigned int freq, struct cpufreq_policy *policy)
 
  err:
         mutex_unlock(&userspace_mutex);
+        unlock_cpu_hotplug();
         return ret;
 }
 
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index ce6f3be86da0..1b8138f641e3 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -68,8 +68,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.62"
-#define DRV_MODULE_RELDATE      "June 30, 2006"
+#define DRV_MODULE_VERSION      "3.63"
+#define DRV_MODULE_RELDATE      "July 25, 2006"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -3590,6 +3590,28 @@ static irqreturn_t tg3_test_isr(int irq, void *dev_id,
 static int tg3_init_hw(struct tg3 *, int);
 static int tg3_halt(struct tg3 *, int, int);
 
+/* Restart hardware after configuration changes, self-test, etc.
+ * Invoked with tp->lock held.
+ */
+static int tg3_restart_hw(struct tg3 *tp, int reset_phy)
+{
+        int err;
+
+        err = tg3_init_hw(tp, reset_phy);
+        if (err) {
+                printk(KERN_ERR PFX "%s: Failed to re-initialize device, "
+                       "aborting.\n", tp->dev->name);
+                tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
+                tg3_full_unlock(tp);
+                del_timer_sync(&tp->timer);
+                tp->irq_sync = 0;
+                netif_poll_enable(tp->dev);
+                dev_close(tp->dev);
+                tg3_full_lock(tp, 0);
+        }
+        return err;
+}
+
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void tg3_poll_controller(struct net_device *dev)
 {
@@ -3630,13 +3652,15 @@ static void tg3_reset_task(void *_data)
         }
 
         tg3_halt(tp, RESET_KIND_SHUTDOWN, 0);
-        tg3_init_hw(tp, 1);
+        if (tg3_init_hw(tp, 1))
+                goto out;
 
         tg3_netif_start(tp);
 
         if (restart_timer)
                 mod_timer(&tp->timer, jiffies + 1);
 
+out:
         tp->tg3_flags &= ~TG3_FLAG_IN_RESET_TASK;
 
         tg3_full_unlock(tp);
@@ -4124,6 +4148,7 @@ static inline void tg3_set_mtu(struct net_device *dev, struct tg3 *tp,
 static int tg3_change_mtu(struct net_device *dev, int new_mtu)
 {
         struct tg3 *tp = netdev_priv(dev);
+        int err;
 
         if (new_mtu < TG3_MIN_MTU || new_mtu > TG3_MAX_MTU(tp))
                 return -EINVAL;
@@ -4144,13 +4169,14 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu)
 
         tg3_set_mtu(dev, tp, new_mtu);
 
-        tg3_init_hw(tp, 0);
+        err = tg3_restart_hw(tp, 0);
 
-        tg3_netif_start(tp);
+        if (!err)
+                tg3_netif_start(tp);
 
         tg3_full_unlock(tp);
 
-        return 0;
+        return err;
 }
 
 /* Free up pending packets in all rx/tx rings.
@@ -4232,7 +4258,7 @@ static void tg3_free_rings(struct tg3 *tp)
  * end up in the driver.  tp->{tx,}lock are held and thus
  * we may not sleep.
  */
-static void tg3_init_rings(struct tg3 *tp)
+static int tg3_init_rings(struct tg3 *tp)
 {
         u32 i;
 
@@ -4281,18 +4307,38 @@ static void tg3_init_rings(struct tg3 *tp)
 
         /* Now allocate fresh SKBs for each rx ring. */
         for (i = 0; i < tp->rx_pending; i++) {
-                if (tg3_alloc_rx_skb(tp, RXD_OPAQUE_RING_STD,
-                                     -1, i) < 0)
+                if (tg3_alloc_rx_skb(tp, RXD_OPAQUE_RING_STD, -1, i) < 0) {
+                        printk(KERN_WARNING PFX
+                               "%s: Using a smaller RX standard ring, "
+                               "only %d out of %d buffers were allocated "
+                               "successfully.\n",
+                               tp->dev->name, i, tp->rx_pending);
+                        if (i == 0)
+                                return -ENOMEM;
+                        tp->rx_pending = i;
                         break;
+                }
         }
 
         if (tp->tg3_flags & TG3_FLAG_JUMBO_RING_ENABLE) {
                 for (i = 0; i < tp->rx_jumbo_pending; i++) {
                         if (tg3_alloc_rx_skb(tp, RXD_OPAQUE_RING_JUMBO,
-                                             -1, i) < 0)
+                                             -1, i) < 0) {
+                                printk(KERN_WARNING PFX
+                                       "%s: Using a smaller RX jumbo ring, "
+                                       "only %d out of %d buffers were "
+                                       "allocated successfully.\n",
+                                       tp->dev->name, i, tp->rx_jumbo_pending);
+                                if (i == 0) {
+                                        tg3_free_rings(tp);
+                                        return -ENOMEM;
+                                }
+                                tp->rx_jumbo_pending = i;
                                 break;
+                        }
                 }
         }
+        return 0;
 }
 
 /*
@@ -5815,6 +5861,7 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p)
 {
         struct tg3 *tp = netdev_priv(dev);
         struct sockaddr *addr = p;
+        int err = 0;
 
         if (!is_valid_ether_addr(addr->sa_data))
                 return -EINVAL;
@@ -5832,9 +5879,9 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p)
                 tg3_full_lock(tp, 1);
 
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp, 0);
-
-                tg3_netif_start(tp);
+                err = tg3_restart_hw(tp, 0);
+                if (!err)
+                        tg3_netif_start(tp);
                 tg3_full_unlock(tp);
         } else {
                 spin_lock_bh(&tp->lock);
@@ -5842,7 +5889,7 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p)
                 spin_unlock_bh(&tp->lock);
         }
 
-        return 0;
+        return err;
 }
 
 /* tp->lock is held. */
@@ -5942,7 +5989,9 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
          * can only do this after the hardware has been
          * successfully reset.
          */
-        tg3_init_rings(tp);
+        err = tg3_init_rings(tp);
+        if (err)
+                return err;
 
         /* This value is determined during the probe time DMA
          * engine test, tg3_test_dma.
@@ -7956,7 +8005,7 @@ static void tg3_get_ringparam(struct net_device *dev, struct ethtool_ringparam *
 static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ering)
 {
         struct tg3 *tp = netdev_priv(dev);
-        int irq_sync = 0;
+        int irq_sync = 0, err = 0;
   
         if ((ering->rx_pending > TG3_RX_RING_SIZE - 1) ||
             (ering->rx_jumbo_pending > TG3_RX_JUMBO_RING_SIZE - 1) ||
@@ -7980,13 +8029,14 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
 
         if (netif_running(dev)) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp, 1);
-                tg3_netif_start(tp);
+                err = tg3_restart_hw(tp, 1);
+                if (!err)
+                        tg3_netif_start(tp);
         }
 
         tg3_full_unlock(tp);
   
-        return 0;
+        return err;
 }
   
 static void tg3_get_pauseparam(struct net_device *dev, struct ethtool_pauseparam *epause)
@@ -8001,7 +8051,7 @@ static void tg3_get_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam *epause)
 {
         struct tg3 *tp = netdev_priv(dev);
-        int irq_sync = 0;
+        int irq_sync = 0, err = 0;
   
         if (netif_running(dev)) {
                 tg3_netif_stop(tp);
@@ -8025,13 +8075,14 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 
         if (netif_running(dev)) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp, 1);
-                tg3_netif_start(tp);
+                err = tg3_restart_hw(tp, 1);
+                if (!err)
+                        tg3_netif_start(tp);
         }
 
         tg3_full_unlock(tp);
   
-        return 0;
+        return err;
 }
   
 static u32 tg3_get_rx_csum(struct net_device *dev)
@@ -8666,7 +8717,9 @@ static int tg3_test_loopback(struct tg3 *tp)
         if (!netif_running(tp->dev))
                 return TG3_LOOPBACK_FAILED;
 
-        tg3_reset_hw(tp, 1);
+        err = tg3_reset_hw(tp, 1);
+        if (err)
+                return TG3_LOOPBACK_FAILED;
 
         if (tg3_run_loopback(tp, TG3_MAC_LOOPBACK))
                 err |= TG3_MAC_LOOPBACK_FAILED;
@@ -8740,8 +8793,8 @@ static void tg3_self_test(struct net_device *dev, struct ethtool_test *etest,
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
                 if (netif_running(dev)) {
                         tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-                        tg3_init_hw(tp, 1);
-                        tg3_netif_start(tp);
+                        if (!tg3_restart_hw(tp, 1))
+                                tg3_netif_start(tp);
                 }
 
                 tg3_full_unlock(tp);
@@ -11699,7 +11752,8 @@ static int tg3_suspend(struct pci_dev *pdev, pm_message_t state)
                 tg3_full_lock(tp, 0);
 
                 tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-                tg3_init_hw(tp, 1);
+                if (tg3_restart_hw(tp, 1))
+                        goto out;
 
                 tp->timer.expires = jiffies + tp->timer_offset;
                 add_timer(&tp->timer);
@@ -11707,6 +11761,7 @@ static int tg3_suspend(struct pci_dev *pdev, pm_message_t state)
                 netif_device_attach(dev);
                 tg3_netif_start(tp);
 
+out:
                 tg3_full_unlock(tp);
         }
 
@@ -11733,16 +11788,19 @@ static int tg3_resume(struct pci_dev *pdev)
         tg3_full_lock(tp, 0);
 
         tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-        tg3_init_hw(tp, 1);
+        err = tg3_restart_hw(tp, 1);
+        if (err)
+                goto out;
 
         tp->timer.expires = jiffies + tp->timer_offset;
         add_timer(&tp->timer);
 
         tg3_netif_start(tp);
 
+out:
         tg3_full_unlock(tp);
 
-        return 0;
+        return err;
 }
 
 static struct pci_driver tg3_driver = {
diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
index 35e137636b0b..4ea39fee99c7 100644
--- a/include/linux/cpufreq.h
+++ b/include/linux/cpufreq.h
@@ -172,9 +172,6 @@ extern int __cpufreq_driver_target(struct cpufreq_policy *policy,
                                    unsigned int relation);
 
 
-/* pass an event to the cpufreq governor */
-int cpufreq_governor(unsigned int cpu, unsigned int event);
-
 int cpufreq_register_governor(struct cpufreq_governor *governor);
 void cpufreq_unregister_governor(struct cpufreq_governor *governor);
 
diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
index 87764022cc67..31f02ba036ce 100644
--- a/include/linux/netfilter_bridge.h
+++ b/include/linux/netfilter_bridge.h
@@ -79,6 +79,8 @@ struct bridge_skb_cb {
                 __u32 ipv4;
         } daddr;
 };
+
+extern int brnf_deferred_hooks;
 #endif /* CONFIG_BRIDGE_NETFILTER */
 
 #endif /* __KERNEL__ */
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index cbc8a389a0a8..05b3de888243 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -61,6 +61,9 @@ static int brnf_filter_vlan_tagged = 1;
 #define brnf_filter_vlan_tagged 1
 #endif
 
+int brnf_deferred_hooks;
+EXPORT_SYMBOL_GPL(brnf_deferred_hooks);
+
 static __be16 inline vlan_proto(const struct sk_buff *skb)
 {
         return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
@@ -890,6 +893,8 @@ static unsigned int ip_sabotage_out(unsigned int hook, struct sk_buff **pskb,
                                 return NF_ACCEPT;
                         else if (ip->version == 6 && !brnf_call_ip6tables)
                                 return NF_ACCEPT;
+                        else if (!brnf_deferred_hooks)
+                                return NF_ACCEPT;
 #endif
                         if (hook == NF_IP_POST_ROUTING)
                                 return NF_ACCEPT;
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 184c78ca79e6..212734ca238f 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -429,7 +429,7 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
         }
 
         /* Remove any debris in the socket control block */
-        memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
+        memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
 
         return NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, dev, NULL,
                        ip_rcv_finish);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 9ccacf57f08b..85893eef6b16 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1578,6 +1578,7 @@ int ipmr_get_route(struct sk_buff *skb, struct rtmsg *rtm, int nowait)
         cache = ipmr_cache_find(rt->rt_src, rt->rt_dst);
 
         if (cache==NULL) {
+                struct sk_buff *skb2;
                 struct net_device *dev;
                 int vif;
 
@@ -1591,12 +1592,18 @@ int ipmr_get_route(struct sk_buff *skb, struct rtmsg *rtm, int nowait)
                         read_unlock(&mrt_lock);
                         return -ENODEV;
                 }
-                skb->nh.raw = skb_push(skb, sizeof(struct iphdr));
-                skb->nh.iph->ihl = sizeof(struct iphdr)>>2;
-                skb->nh.iph->saddr = rt->rt_src;
-                skb->nh.iph->daddr = rt->rt_dst;
-                skb->nh.iph->version = 0;
-                err = ipmr_cache_unresolved(vif, skb);
+                skb2 = skb_clone(skb, GFP_ATOMIC);
+                if (!skb2) {
+                        read_unlock(&mrt_lock);
+                        return -ENOMEM;
+                }
+
+                skb2->nh.raw = skb_push(skb2, sizeof(struct iphdr));
+                skb2->nh.iph->ihl = sizeof(struct iphdr)>>2;
+                skb2->nh.iph->saddr = rt->rt_src;
+                skb2->nh.iph->daddr = rt->rt_dst;
+                skb2->nh.iph->version = 0;
+                err = ipmr_cache_unresolved(vif, skb2);
                 read_unlock(&mrt_lock);
                 return err;
         }
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323.c b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
index af35235672d5..9a39e2969712 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
@@ -1200,7 +1200,7 @@ static struct ip_conntrack_expect *find_expect(struct ip_conntrack *ct,
         tuple.dst.protonum = IPPROTO_TCP;
 
         exp = __ip_conntrack_expect_find(&tuple);
-        if (exp->master == ct)
+        if (exp && exp->master == ct)
                 return exp;
         return NULL;
 }
diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
index 7bd3c22003a2..7a9fa04a467a 100644
--- a/net/ipv4/netfilter/ip_conntrack_standalone.c
+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
@@ -534,6 +534,8 @@ static struct nf_hook_ops ip_conntrack_ops[] = {
 
 /* Sysctl support */
 
+int ip_conntrack_checksum = 1;
+
 #ifdef CONFIG_SYSCTL
 
 /* From ip_conntrack_core.c */
@@ -568,8 +570,6 @@ extern unsigned int ip_ct_generic_timeout;
 static int log_invalid_proto_min = 0;
 static int log_invalid_proto_max = 255;
 
-int ip_conntrack_checksum = 1;
-
 static struct ctl_table_header *ip_ct_sysctl_header;
 
 static ctl_table ip_ct_sysctl_table[] = {
diff --git a/net/ipv4/netfilter/ip_nat_snmp_basic.c b/net/ipv4/netfilter/ip_nat_snmp_basic.c
index 0b1b416759cc..18b7fbdccb61 100644
--- a/net/ipv4/netfilter/ip_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/ip_nat_snmp_basic.c
@@ -1255,9 +1255,9 @@ static int help(struct sk_buff **pskb,
         struct udphdr *udph = (struct udphdr *)((u_int32_t *)iph + iph->ihl);
 
         /* SNMP replies and originating SNMP traps get mangled */
-        if (udph->source == ntohs(SNMP_PORT) && dir != IP_CT_DIR_REPLY)
+        if (udph->source == htons(SNMP_PORT) && dir != IP_CT_DIR_REPLY)
                 return NF_ACCEPT;
-        if (udph->dest == ntohs(SNMP_TRAP_PORT) && dir != IP_CT_DIR_ORIGINAL)
+        if (udph->dest == htons(SNMP_TRAP_PORT) && dir != IP_CT_DIR_ORIGINAL)
                 return NF_ACCEPT;
 
         /* No NAT? */
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index bd221ec3f81e..62b2762a2420 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -609,6 +609,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (sin) {
                 sin->sin_family = AF_INET;
                 sin->sin_addr.s_addr = skb->nh.iph->saddr;
+                sin->sin_port = 0;
                 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
         }
         if (inet->cmsg_flags)
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index df8f051c0fce..25c2a9e03895 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -71,6 +71,8 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
                 goto out;
         }
 
+        memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
+
         /*
          * Store incoming device index. When the packet will
          * be queued, we cannot refer to skb->dev anymore.
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index fa1ce0ae123e..d57e61ce4a7d 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -411,6 +411,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         /* Copy the address. */
         if (sin6) {
                 sin6->sin6_family = AF_INET6;
+                sin6->sin6_port = 0;
                 ipv6_addr_copy(&sin6->sin6_addr, &skb->nh.ipv6h->saddr);
                 sin6->sin6_flowinfo = 0;
                 sin6->sin6_scope_id = 0;
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 42a178aa30f9..a9894ddfd72a 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -386,8 +386,8 @@ config NETFILTER_XT_MATCH_REALM
           <file:Documentation/modules.txt>.  If unsure, say `N'.
 
 config NETFILTER_XT_MATCH_SCTP
-        tristate  '"sctp" protocol match support'
-        depends on NETFILTER_XTABLES
+        tristate  '"sctp" protocol match support (EXPERIMENTAL)'
+        depends on NETFILTER_XTABLES && EXPERIMENTAL
         help
           With this option enabled, you will be able to use the 
           `sctp' match in order to match on SCTP source/destination ports
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 5fcab2ef231f..4ef836699962 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -428,6 +428,8 @@ static struct file_operations ct_cpu_seq_fops = {
 
 /* Sysctl support */
 
+int nf_conntrack_checksum = 1;
+
 #ifdef CONFIG_SYSCTL
 
 /* From nf_conntrack_core.c */
@@ -459,8 +461,6 @@ extern unsigned int nf_ct_generic_timeout;
 static int log_invalid_proto_min = 0;
 static int log_invalid_proto_max = 255;
 
-int nf_conntrack_checksum = 1;
-
 static struct ctl_table_header *nf_ct_sysctl_header;
 
 static ctl_table nf_ct_sysctl_table[] = {
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index bb6fcee452ca..662a869593bf 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -219,21 +219,20 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
 
         switch (verdict & NF_VERDICT_MASK) {
         case NF_ACCEPT:
+        case NF_STOP:
                 info->okfn(skb);
+        case NF_STOLEN:
                 break;
-
         case NF_QUEUE:
                 if (!nf_queue(&skb, elem, info->pf, info->hook, 
                               info->indev, info->outdev, info->okfn,
                               verdict >> NF_VERDICT_BITS))
                         goto next_hook;
                 break;
+        default:
+                kfree_skb(skb);
         }
         rcu_read_unlock();
-
-        if (verdict == NF_DROP)
-                kfree_skb(skb);
-
         kfree(info);
         return;
 }
diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index 5fe4c9df17f5..a9f4f6f3c628 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -113,6 +113,21 @@ checkentry(const char *tablename,
         if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
             info->bitmask & ~XT_PHYSDEV_OP_MASK)
                 return 0;
+        if (brnf_deferred_hooks == 0 &&
+            info->bitmask & XT_PHYSDEV_OP_OUT &&
+            (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
+             info->invert & XT_PHYSDEV_OP_BRIDGED) &&
+            hook_mask & ((1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_FORWARD) |
+                         (1 << NF_IP_POST_ROUTING))) {
+                printk(KERN_WARNING "physdev match: using --physdev-out in the "
+                       "OUTPUT, FORWARD and POSTROUTING chains for non-bridged "
+                       "traffic is deprecated and breaks other things, it will "
+                       "be removed in January 2007. See Documentation/"
+                       "feature-removal-schedule.txt for details. This doesn't "
+                       "affect you in case you're using it for purely bridged "
+                       "traffic.\n");
+                brnf_deferred_hooks = 1;
+        }
         return 1;
 }
 
diff --git a/net/netfilter/xt_pkttype.c b/net/netfilter/xt_pkttype.c
index 3ac703b5cb8f..d2f5320a80bf 100644
--- a/net/netfilter/xt_pkttype.c
+++ b/net/netfilter/xt_pkttype.c
@@ -9,6 +9,8 @@
 #include <linux/skbuff.h>
 #include <linux/if_ether.h>
 #include <linux/if_packet.h>
+#include <linux/in.h>
+#include <linux/ip.h>
 
 #include <linux/netfilter/xt_pkttype.h>
 #include <linux/netfilter/x_tables.h>
@@ -28,9 +30,17 @@ static int match(const struct sk_buff *skb,
       unsigned int protoff,
       int *hotdrop)
 {
+        u_int8_t type;
         const struct xt_pkttype_info *info = matchinfo;
 
-        return (skb->pkt_type == info->pkttype) ^ info->invert;
+        if (skb->pkt_type == PACKET_LOOPBACK)
+                type = (MULTICAST(skb->nh.iph->daddr)
+                        ? PACKET_MULTICAST
+                        : PACKET_BROADCAST);
+        else
+                type = skb->pkt_type;
+
+        return (type == info->pkttype) ^ info->invert;
 }
 
 static struct xt_match pkttype_match = {