13 files changed, 92 insertions, 73 deletions

diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 06e4f77b0988..1dbdd6bb587b 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -68,8 +68,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.68"
-#define DRV_MODULE_RELDATE      "November 02, 2006"
+#define DRV_MODULE_VERSION      "3.69"
+#define DRV_MODULE_RELDATE      "November 15, 2006"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -4728,10 +4728,11 @@ static int tg3_poll_fw(struct tg3 *tp)
         u32 val;
 
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
-                for (i = 0; i < 400; i++) {
+                /* Wait up to 20ms for init done. */
+                for (i = 0; i < 200; i++) {
                         if (tr32(VCPU_STATUS) & VCPU_STATUS_INIT_DONE)
                                 return 0;
-                        udelay(10);
+                        udelay(100);
                 }
                 return -ENODEV;
         }
@@ -10365,7 +10366,7 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         u32 pci_state_reg, grc_misc_cfg;
         u32 val;
         u16 pci_cmd;
-        int err;
+        int err, pcie_cap;
 
         /* Force memory write invalidate off.  If we leave it on,
          * then on 5700_BX chips we have to enable a workaround.
@@ -10540,8 +10541,19 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
             GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5906)
                 tp->tg3_flags2 |= TG3_FLG2_JUMBO_CAPABLE;
 
-        if (pci_find_capability(tp->pdev, PCI_CAP_ID_EXP) != 0)
+        pcie_cap = pci_find_capability(tp->pdev, PCI_CAP_ID_EXP);
+        if (pcie_cap != 0) {
                 tp->tg3_flags2 |= TG3_FLG2_PCI_EXPRESS;
+                if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
+                        u16 lnkctl;
+
+                        pci_read_config_word(tp->pdev,
+                                             pcie_cap + PCI_EXP_LNKCTL,
+                                             &lnkctl);
+                        if (lnkctl & PCI_EXP_LNKCTL_CLKREQ_EN)
+                                tp->tg3_flags2 &= ~TG3_FLG2_HW_TSO_2;
+                }
+        }
 
         /* If we have an AMD 762 or VIA K8T800 chipset, write
          * reordering to the mailbox registers done by the host
@@ -11808,6 +11820,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
         else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5700 ||
             GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701 ||
             tp->pci_chip_rev_id == CHIPREV_ID_5705_A0 ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906 ||
             (tp->tg3_flags & TG3_FLAG_ENABLE_ASF) != 0) {
                 tp->tg3_flags2 &= ~TG3_FLG2_TSO_CAPABLE;
         } else {
diff --git a/include/linux/in6.h b/include/linux/in6.h
index 9be6a4756f0b..f28621f638e0 100644
--- a/include/linux/in6.h
+++ b/include/linux/in6.h
@@ -225,7 +225,7 @@ struct in6_flowlabel_req
 #endif
 
 /*
- * Netfilter
+ * Netfilter (1)
  *
  * Following socket options are used in ip6_tables;
  * see include/linux/netfilter_ipv6/ip6_tables.h.
@@ -240,4 +240,14 @@ struct in6_flowlabel_req
 #define IPV6_RECVTCLASS         66
 #define IPV6_TCLASS             67
 
+/*
+ * Netfilter (2)
+ *
+ * Following socket options are used in ip6_tables;
+ * see include/linux/netfilter_ipv6/ip6_tables.h.
+ *
+ * IP6T_SO_GET_REVISION_MATCH   68
+ * IP6T_SO_GET_REVISION_TARGET  69
+ */
+
 #endif
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 04319a76103a..022edfa97ed9 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -96,22 +96,6 @@ struct _xt_align
 /* Error verdict. */
 #define XT_ERROR_TARGET "ERROR"
 
-/*
- * New IP firewall options for [gs]etsockopt at the RAW IP level.
- * Unlike BSD Linux inherits IP options so you don't have to use a raw
- * socket for this. Instead we check rights in the calls. */
-#define XT_BASE_CTL             64      /* base for firewall socket options */
-
-#define XT_SO_SET_REPLACE       (XT_BASE_CTL)
-#define XT_SO_SET_ADD_COUNTERS  (XT_BASE_CTL + 1)
-#define XT_SO_SET_MAX           XT_SO_SET_ADD_COUNTERS
-
-#define XT_SO_GET_INFO                  (XT_BASE_CTL)
-#define XT_SO_GET_ENTRIES               (XT_BASE_CTL + 1)
-#define XT_SO_GET_REVISION_MATCH        (XT_BASE_CTL + 2)
-#define XT_SO_GET_REVISION_TARGET       (XT_BASE_CTL + 3)
-#define XT_SO_GET_MAX                   XT_SO_GET_REVISION_TARGET
-
 #define SET_COUNTER(c,b,p) do { (c).bcnt = (b); (c).pcnt = (p); } while(0)
 #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
 
diff --git a/include/linux/netfilter_arp/arp_tables.h b/include/linux/netfilter_arp/arp_tables.h
index 44e39b61d9e7..0be235418a2f 100644
--- a/include/linux/netfilter_arp/arp_tables.h
+++ b/include/linux/netfilter_arp/arp_tables.h
@@ -112,19 +112,20 @@ struct arpt_entry
  * New IP firewall options for [gs]etsockopt at the RAW IP level.
  * Unlike BSD Linux inherits IP options so you don't have to use a raw
  * socket for this. Instead we check rights in the calls.
+ *
+ * ATTENTION: check linux/in.h before adding new number here.
  */
-#define ARPT_CTL_OFFSET         32
-#define ARPT_BASE_CTL           (XT_BASE_CTL+ARPT_CTL_OFFSET)
-
-#define ARPT_SO_SET_REPLACE             (XT_SO_SET_REPLACE+ARPT_CTL_OFFSET)
-#define ARPT_SO_SET_ADD_COUNTERS        (XT_SO_SET_ADD_COUNTERS+ARPT_CTL_OFFSET)
-#define ARPT_SO_SET_MAX                 (XT_SO_SET_MAX+ARPT_CTL_OFFSET)
-
-#define ARPT_SO_GET_INFO                (XT_SO_GET_INFO+ARPT_CTL_OFFSET)
-#define ARPT_SO_GET_ENTRIES             (XT_SO_GET_ENTRIES+ARPT_CTL_OFFSET)
-/* #define ARPT_SO_GET_REVISION_MATCH   XT_SO_GET_REVISION_MATCH  */
-#define ARPT_SO_GET_REVISION_TARGET     (XT_SO_GET_REVISION_TARGET+ARPT_CTL_OFFSET)
-#define ARPT_SO_GET_MAX                 (XT_SO_GET_REVISION_TARGET+ARPT_CTL_OFFSET)
+#define ARPT_BASE_CTL           96
+
+#define ARPT_SO_SET_REPLACE             (ARPT_BASE_CTL)
+#define ARPT_SO_SET_ADD_COUNTERS        (ARPT_BASE_CTL + 1)
+#define ARPT_SO_SET_MAX                 ARPT_SO_SET_ADD_COUNTERS
+
+#define ARPT_SO_GET_INFO                (ARPT_BASE_CTL)
+#define ARPT_SO_GET_ENTRIES             (ARPT_BASE_CTL + 1)
+/* #define ARPT_SO_GET_REVISION_MATCH   (APRT_BASE_CTL + 2) */
+#define ARPT_SO_GET_REVISION_TARGET     (ARPT_BASE_CTL + 3)
+#define ARPT_SO_GET_MAX                 (ARPT_SO_GET_REVISION_TARGET)
 
 /* CONTINUE verdict for targets */
 #define ARPT_CONTINUE XT_CONTINUE
diff --git a/include/linux/netfilter_ipv4/ip_tables.h b/include/linux/netfilter_ipv4/ip_tables.h
index a536bbdef145..4f06dad0bde9 100644
--- a/include/linux/netfilter_ipv4/ip_tables.h
+++ b/include/linux/netfilter_ipv4/ip_tables.h
@@ -101,18 +101,21 @@ struct ipt_entry
 /*
  * New IP firewall options for [gs]etsockopt at the RAW IP level.
  * Unlike BSD Linux inherits IP options so you don't have to use a raw
- * socket for this. Instead we check rights in the calls. */
-#define IPT_BASE_CTL            XT_BASE_CTL
-
-#define IPT_SO_SET_REPLACE      XT_SO_SET_REPLACE
-#define IPT_SO_SET_ADD_COUNTERS XT_SO_SET_ADD_COUNTERS
-#define IPT_SO_SET_MAX          XT_SO_SET_MAX
-
-#define IPT_SO_GET_INFO                 XT_SO_GET_INFO
-#define IPT_SO_GET_ENTRIES              XT_SO_GET_ENTRIES
-#define IPT_SO_GET_REVISION_MATCH       XT_SO_GET_REVISION_MATCH
-#define IPT_SO_GET_REVISION_TARGET      XT_SO_GET_REVISION_TARGET
-#define IPT_SO_GET_MAX                  XT_SO_GET_REVISION_TARGET
+ * socket for this. Instead we check rights in the calls.
+ *
+ * ATTENTION: check linux/in.h before adding new number here.
+ */
+#define IPT_BASE_CTL            64
+
+#define IPT_SO_SET_REPLACE      (IPT_BASE_CTL)
+#define IPT_SO_SET_ADD_COUNTERS (IPT_BASE_CTL + 1)
+#define IPT_SO_SET_MAX          IPT_SO_SET_ADD_COUNTERS
+
+#define IPT_SO_GET_INFO                 (IPT_BASE_CTL)
+#define IPT_SO_GET_ENTRIES              (IPT_BASE_CTL + 1)
+#define IPT_SO_GET_REVISION_MATCH       (IPT_BASE_CTL + 2)
+#define IPT_SO_GET_REVISION_TARGET      (IPT_BASE_CTL + 3)
+#define IPT_SO_GET_MAX                  IPT_SO_GET_REVISION_TARGET
 
 #define IPT_CONTINUE XT_CONTINUE
 #define IPT_RETURN XT_RETURN
diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index d7a8e9c0dad0..4aed340401db 100644
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -107,18 +107,21 @@ struct ip6t_entry
 /*
  * New IP firewall options for [gs]etsockopt at the RAW IP level.
  * Unlike BSD Linux inherits IP options so you don't have to use
- * a raw socket for this. Instead we check rights in the calls. */
-#define IP6T_BASE_CTL                   XT_BASE_CTL
-
-#define IP6T_SO_SET_REPLACE             XT_SO_SET_REPLACE
-#define IP6T_SO_SET_ADD_COUNTERS        XT_SO_SET_ADD_COUNTERS
-#define IP6T_SO_SET_MAX                 XT_SO_SET_MAX
-
-#define IP6T_SO_GET_INFO                XT_SO_GET_INFO
-#define IP6T_SO_GET_ENTRIES             XT_SO_GET_ENTRIES
-#define IP6T_SO_GET_REVISION_MATCH      XT_SO_GET_REVISION_MATCH
-#define IP6T_SO_GET_REVISION_TARGET     XT_SO_GET_REVISION_TARGET
-#define IP6T_SO_GET_MAX                 XT_SO_GET_REVISION_TARGET
+ * a raw socket for this. Instead we check rights in the calls.
+ *
+ * ATTENTION: check linux/in6.h before adding new number here.
+ */
+#define IP6T_BASE_CTL                   64
+
+#define IP6T_SO_SET_REPLACE             (IP6T_BASE_CTL)
+#define IP6T_SO_SET_ADD_COUNTERS        (IP6T_BASE_CTL + 1)
+#define IP6T_SO_SET_MAX                 IP6T_SO_SET_ADD_COUNTERS
+
+#define IP6T_SO_GET_INFO                (IP6T_BASE_CTL)
+#define IP6T_SO_GET_ENTRIES             (IP6T_BASE_CTL + 1)
+#define IP6T_SO_GET_REVISION_MATCH      (IP6T_BASE_CTL + 4)
+#define IP6T_SO_GET_REVISION_TARGET     (IP6T_BASE_CTL + 5)
+#define IP6T_SO_GET_MAX                 IP6T_SO_GET_REVISION_TARGET
 
 /* CONTINUE verdict for targets */
 #define IP6T_CONTINUE XT_CONTINUE
diff --git a/include/linux/pci_regs.h b/include/linux/pci_regs.h
index c312a12ad2d6..c321316f1bc7 100644
--- a/include/linux/pci_regs.h
+++ b/include/linux/pci_regs.h
@@ -371,6 +371,7 @@
 #define  PCI_EXP_DEVSTA_TRPND   0x20    /* Transactions Pending */
 #define PCI_EXP_LNKCAP          12      /* Link Capabilities */
 #define PCI_EXP_LNKCTL          16      /* Link Control */
+#define  PCI_EXP_LNKCTL_CLKREQ_EN 0x100 /* Enable clkreq */
 #define PCI_EXP_LNKSTA          18      /* Link Status */
 #define PCI_EXP_SLTCAP          20      /* Slot Capabilities */
 #define PCI_EXP_SLTCTL          24      /* Slot Control */
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 7edad790478a..97556cc2e4e0 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -351,9 +351,10 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
         if (v->data_len < sizeof(*user_iph))
                 return 0;
         diff = v->data_len - e->skb->len;
-        if (diff < 0)
-                skb_trim(e->skb, v->data_len);
-        else if (diff > 0) {
+        if (diff < 0) {
+                if (pskb_trim(e->skb, v->data_len))
+                        return -ENOMEM;
+        } else if (diff > 0) {
                 if (v->data_len > 0xFFFF)
                         return -EINVAL;
                 if (diff > skb_tailroom(e->skb)) {
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 4322318ab332..c05e8edaf544 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2316,9 +2316,10 @@ void __init tcp_init(void)
                 sysctl_max_syn_backlog = 128;
         }
 
-        sysctl_tcp_mem[0] =  768 << order;
-        sysctl_tcp_mem[1] = 1024 << order;
-        sysctl_tcp_mem[2] = 1536 << order;
+        /* Allow no more than 3/4 kernel memory (usually less) allocated to TCP */
+        sysctl_tcp_mem[0] = (1536 / sizeof (struct inet_bind_hashbucket)) << order;
+        sysctl_tcp_mem[1] = sysctl_tcp_mem[0] * 4 / 3;
+        sysctl_tcp_mem[2] = sysctl_tcp_mem[0] * 2;
 
         limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7);
         max_share = min(4UL*1024*1024, limit);
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 9510c24ca8d2..9fec832ee08b 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -349,9 +349,10 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
         if (v->data_len < sizeof(*user_iph))
                 return 0;
         diff = v->data_len - e->skb->len;
-        if (diff < 0)
-                skb_trim(e->skb, v->data_len);
-        else if (diff > 0) {
+        if (diff < 0) {
+                if (pskb_trim(e->skb, v->data_len))
+                        return -ENOMEM;
+        } else if (diff > 0) {
                 if (v->data_len > 0xFFFF)
                         return -EINVAL;
                 if (diff > skb_tailroom(e->skb)) {
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 167c2ea88f6b..204e02162d49 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1494,7 +1494,7 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                         if (_frag_off) {
                                 if (target < 0 &&
                                     ((!ipv6_ext_hdr(hp->nexthdr)) ||
-                                     nexthdr == NEXTHDR_NONE)) {
+                                     hp->nexthdr == NEXTHDR_NONE)) {
                                         if (fragoff)
                                                 *fragoff = _frag_off;
                                         return hp->nexthdr;
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index b2bf8f2e01da..1e5207b80fe5 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -544,7 +544,7 @@ __build_packet_message(struct nfulnl_instance *inst,
         }
         /* global sequence number */
         if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) {
-                tmp_uint = atomic_inc_return(&global_seq);
+                tmp_uint = htonl(atomic_inc_return(&global_seq));
                 NFA_PUT(inst->skb, NFULA_SEQ_GLOBAL, sizeof(tmp_uint), &tmp_uint);
         }
 
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 6e4ada3c1844..e815a9aa6e95 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -622,9 +622,10 @@ nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
         int diff;
 
         diff = data_len - e->skb->len;
-        if (diff < 0)
-                skb_trim(e->skb, data_len);
-        else if (diff > 0) {
+        if (diff < 0) {
+                if (pskb_trim(e->skb, data_len))
+                        return -ENOMEM;
+        } else if (diff > 0) {
                 if (data_len > 0xFFFF)
                         return -EINVAL;
                 if (diff > skb_tailroom(e->skb)) {