## Automatically generated incremental diff
## From:   linux-2.4.27-rc3
## To:     linux-2.4.27-rc4
## Robot:  $Id: make-incremental-diff,v 1.12 2004/01/06 07:19:36 hpa Exp $

diff -urN linux-2.4.27-rc3/CREDITS linux-2.4.27-rc4/CREDITS
--- linux-2.4.27-rc3/CREDITS	2004-04-14 06:05:21.000000000 -0700
+++ linux-2.4.27-rc4/CREDITS	2004-07-31 07:28:24.063174654 -0700
@@ -1232,8 +1232,8 @@
 D: National Language Support
 D: Linux Internationalization Project
 D: German Localization for Linux and GNU software
-S: Helenenstrasse 18
-S: 65183 Wiesbaden
+S: Kriemhildring 12a
+S: 65795 Hattersheim am Main
 S: Germany
 
 N: Christoph Hellwig
diff -urN linux-2.4.27-rc3/Documentation/Configure.help linux-2.4.27-rc4/Documentation/Configure.help
--- linux-2.4.27-rc3/Documentation/Configure.help	2004-07-31 07:28:20.697038808 -0700
+++ linux-2.4.27-rc4/Documentation/Configure.help	2004-07-31 07:28:24.180179376 -0700
@@ -6172,8 +6172,7 @@
   can be useful if you want to make your (or some other) machine
   appear on a different network than it physically is, or to use
   mobile-IP facilities (allowing laptops to seamlessly move between
-  networks without changing their IP addresses; check out
-  <http://anchor.cs.binghamton.edu/~mobileip/LJ/index.html>).
+  networks without changing their IP addresses).
 
   Saying Y to this option will produce two modules ( = code which can
   be inserted in and removed from the running kernel whenever you
@@ -28924,6 +28923,17 @@
   The CAST6 encryption algorithm (synonymous with CAST-256) is
   described in RFC2612.
 
+CONFIG_CRYPTO_TEA
+  TEA cipher algorithm.
+
+  Tiny Encryption Algorithm is a simple cipher that uses
+  many rounds for security.  It is very fast and uses
+  little memory.
+
+  Xtendend Tiny Encryption Algorithm is a modifcation to
+  the TEA algorithm to address a potential key weakness
+  in the TEA algorithm.
+
 CONFIG_CRYPTO_ARC4
   ARC4 cipher algorithm.
   
diff -urN linux-2.4.27-rc3/MAINTAINERS linux-2.4.27-rc4/MAINTAINERS
--- linux-2.4.27-rc3/MAINTAINERS	2004-07-31 07:28:20.768041673 -0700
+++ linux-2.4.27-rc4/MAINTAINERS	2004-07-31 07:28:24.473191201 -0700
@@ -1153,11 +1153,14 @@
 L:	linux-scsi@vger.kernel.org
 S:	Maintained
 
-M68K
-P:	Jes Sorensen
-M:	jes@trained-monkey.org
-W:	http://www.clark.net/pub/lawrencc/linux/index.html
+M68K ARCHITECTURE
+P:	Geert Uytterhoeven
+M:	geert@linux-m68k.org
+P:	Roman Zippel
+M:	zippel@linux-m68k.org
 L:	linux-m68k@lists.linux-m68k.org
+W:	http://www.linux-m68k.org/
+W:	http://linux-m68k-cvs.ubb.ca/
 S:	Maintained
 
 M68K ON APPLE MACINTOSH
@@ -1318,6 +1321,8 @@
 M:	jmorris@intercode.com.au
 P:	Hideaki YOSHIFUJI
 M:	yoshfuji@linux-ipv6.org
+P:	Patrick McHardy
+M:	kaber@coreworks.de
 L:	netdev@oss.sgi.com
 S:	Maintained
 
diff -urN linux-2.4.27-rc3/Makefile linux-2.4.27-rc4/Makefile
--- linux-2.4.27-rc3/Makefile	2004-07-31 07:28:20.769041713 -0700
+++ linux-2.4.27-rc4/Makefile	2004-07-31 07:28:24.474191242 -0700
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 4
 SUBLEVEL = 27
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 
 KERNELRELEASE=$(VERSION).$(PATCHLEVEL).$(SUBLEVEL)$(EXTRAVERSION)
 
diff -urN linux-2.4.27-rc3/arch/ia64/kernel/palinfo.c linux-2.4.27-rc4/arch/ia64/kernel/palinfo.c
--- linux-2.4.27-rc3/arch/ia64/kernel/palinfo.c	2003-11-28 10:26:19.000000000 -0800
+++ linux-2.4.27-rc4/arch/ia64/kernel/palinfo.c	2004-07-31 07:28:24.538193825 -0700
@@ -509,10 +509,10 @@
 	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
 	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
 	NULL, NULL, NULL, NULL,
-	"Enable Cache Line Repl. Exclusive",
 	"Enable Cache Line Repl. Shared",
+	"Enable Cache Line Repl. Exclusive",
 	"Disable Transaction Queuing",
-	"Disable Reponse Error Checking",
+	"Disable Response Error Checking",
 	"Disable Bus Error Checking",
 	"Disable Bus Requester Internal Error Signalling",
 	"Disable Bus Requester Error Signalling",
diff -urN linux-2.4.27-rc3/arch/ia64/kernel/perfmon.c linux-2.4.27-rc4/arch/ia64/kernel/perfmon.c
--- linux-2.4.27-rc3/arch/ia64/kernel/perfmon.c	2004-07-31 07:28:20.831044216 -0700
+++ linux-2.4.27-rc4/arch/ia64/kernel/perfmon.c	2004-07-31 07:28:24.541193946 -0700
@@ -888,6 +888,8 @@
 		DBprintk(("Cannot allocate vma\n"));
 		goto error_kmem;
 	}
+	memset(vma, 0, sizeof(*vma));
+
 	/*
 	 * partially initialize the vma for the sampling buffer
 	 *
diff -urN linux-2.4.27-rc3/arch/m68k/ifpsp060/iskeleton.S linux-2.4.27-rc4/arch/m68k/ifpsp060/iskeleton.S
--- linux-2.4.27-rc3/arch/m68k/ifpsp060/iskeleton.S	2003-06-13 07:51:31.000000000 -0700
+++ linux-2.4.27-rc4/arch/m68k/ifpsp060/iskeleton.S	2004-07-31 07:28:24.544194067 -0700
@@ -196,14 +196,58 @@
 | Expected outputs:
 |	d0 = 0 -> success; non-zero -> failure
 |
-| Linux/68k: As long as ints are disabled, no swapping out should
-| occur (hopefully...)
+| Linux/m68k: Make sure the page is properly paged in, so we use
+| plpaw and handle any exception here. The kernel must not be
+| preempted until _060_unlock_page(), so that the page stays mapped.
 |
 	.global		_060_real_lock_page
 _060_real_lock_page:
-	clr.l		%d0
+	move.l	%d2,-(%sp)
+	| load sfc/dfc
+	tst.b	%d0
+	jne	1f
+	moveq	#1,%d0
+	jra	2f
+1:	moveq	#5,%d0
+2:	movec.l	%dfc,%d2
+	movec.l	%d0,%dfc
+	movec.l	%d0,%sfc
+
+	clr.l	%d0
+	| prefetch address
+	.chip	68060
+	move.l	%a0,%a1
+1:	plpaw	(%a1)
+	addq.w	#1,%a0
+	tst.b	%d1
+	jeq	2f
+	addq.w	#2,%a0
+2:	plpaw	(%a0)
+3:	.chip	68k
+
+	| restore sfc/dfc
+	movec.l	%d2,%dfc
+	movec.l	%d2,%sfc
+	move.l	(%sp)+,%d2
 	rts
 
+.section __ex_table,"a"
+	.align	4
+	.long	1b,11f
+	.long	2b,21f
+.previous
+.section .fixup,"ax"
+	.even
+11:	move.l	#0x020003c0,%d0
+	or.l	%d2,%d0
+	swap	%d0
+	jra	3b
+21:	move.l	#0x02000bc0,%d0
+	or.l	%d2,%d0
+	swap	%d0
+	jra	3b
+.previous
+
 |
 | _060_unlock_page():
 |
@@ -216,8 +260,7 @@
 |	d0 = `xxxxxxff -> supervisor; `xxxxxx00 -> user
 |	d1 = `xxxxxxff -> longword; `xxxxxx00 -> word
 |
-| Linux/68k: As we do no special locking operation, also no unlocking
-| is needed...
+| Linux/m68k: perhaps reenable preemption here...
 
 	.global		_060_real_unlock_page
 _060_real_unlock_page:
diff -urN linux-2.4.27-rc3/arch/m68k/kernel/setup.c linux-2.4.27-rc4/arch/m68k/kernel/setup.c
--- linux-2.4.27-rc3/arch/m68k/kernel/setup.c	2003-06-13 07:51:31.000000000 -0700
+++ linux-2.4.27-rc4/arch/m68k/kernel/setup.c	2004-07-31 07:28:24.573195237 -0700
@@ -244,6 +244,18 @@
 	else if (CPU_IS_060)
 		m68k_is040or060 = 6;
 
+	if (CPU_IS_060) {
+		u32 pcr;
+
+		asm (".chip 68060; movec %%pcr,%0; .chip 68k"
+		     : "=d" (pcr));
+		if (((pcr >> 8) & 0xff) <= 5) {
+			printk("Enabling workaround for errata I14\n");
+			asm (".chip 68060; movec %0,%%pcr; .chip 68k"
+			     : : "d" (pcr | 0x20));
+		}
+	}
+
 	/* FIXME: m68k_fputype is passed in by Penguin booter, which can
 	 * be confused by software FPU emulation. BEWARE.
 	 * We should really do our own FPU check at startup.
diff -urN linux-2.4.27-rc3/crypto/Config.in linux-2.4.27-rc4/crypto/Config.in
--- linux-2.4.27-rc3/crypto/Config.in	2004-07-31 07:28:20.879046153 -0700
+++ linux-2.4.27-rc4/crypto/Config.in	2004-07-31 07:28:24.732201654 -0700
@@ -72,6 +72,7 @@
   tristate       '  AES cipher algorithms' CONFIG_CRYPTO_AES
   tristate       '  CAST5 (CAST-128) cipher algorithm' CONFIG_CRYPTO_CAST5
   tristate       '  CAST6 (CAST-256) cipher algorithm' CONFIG_CRYPTO_CAST6
+  tristate       '  TEA and XTEA cipher algorithms' CONFIG_CRYPTO_TEA
   tristate       '  ARC4 cipher algorithm' CONFIG_CRYPTO_ARC4
   if [ "$CONFIG_INET_IPCOMP" = "y" -o \
        "$CONFIG_INET_IPCOMP" = "m" -o \
diff -urN linux-2.4.27-rc3/crypto/Makefile linux-2.4.27-rc4/crypto/Makefile
--- linux-2.4.27-rc3/crypto/Makefile	2004-07-31 07:28:20.880046193 -0700
+++ linux-2.4.27-rc4/crypto/Makefile	2004-07-31 07:28:24.732201654 -0700
@@ -27,6 +27,7 @@
 obj-$(CONFIG_CRYPTO_CAST5) += cast5.o
 obj-$(CONFIG_CRYPTO_CAST6) += cast6.o
 obj-$(CONFIG_CRYPTO_ARC4) += arc4.o
+obj-$(CONFIG_CRYPTO_TEA) += tea.o
 obj-$(CONFIG_CRYPTO_DEFLATE) += deflate.o
 obj-$(CONFIG_CRYPTO_MICHAEL_MIC) += michael_mic.o
 
diff -urN linux-2.4.27-rc3/crypto/cipher.c linux-2.4.27-rc4/crypto/cipher.c
--- linux-2.4.27-rc3/crypto/cipher.c	2004-07-31 07:28:20.880046193 -0700
+++ linux-2.4.27-rc4/crypto/cipher.c	2004-07-31 07:28:24.733201695 -0700
@@ -52,8 +52,8 @@
 {
 	struct scatter_walk walk_in, walk_out;
 	const unsigned int bsize = crypto_tfm_alg_blocksize(tfm);
-	u8 tmp_src[nbytes > src->length ? bsize : 0];
-	u8 tmp_dst[nbytes > dst->length ? bsize : 0];
+	u8 tmp_src[bsize];
+	u8 tmp_dst[bsize];
 
 	if (!nbytes)
 		return 0;
diff -urN linux-2.4.27-rc3/crypto/tcrypt.c linux-2.4.27-rc4/crypto/tcrypt.c
--- linux-2.4.27-rc3/crypto/tcrypt.c	2004-07-31 07:28:20.883046314 -0700
+++ linux-2.4.27-rc4/crypto/tcrypt.c	2004-07-31 07:28:24.735201775 -0700
@@ -63,7 +63,7 @@
 static char *check[] = {
 	"des", "md5", "des3_ede", "rot13", "sha1", "sha256", "blowfish",
 	"twofish", "serpent", "sha384", "sha512", "md4", "aes", "cast6", 
-	"arc4", "michael_mic", "deflate", NULL
+	"arc4", "michael_mic", "deflate", "tea", "xtea", NULL
 };
 
 static void
@@ -566,6 +566,15 @@
 		test_cipher ("arc4", MODE_ECB, ENCRYPT, arc4_enc_tv_template, ARC4_ENC_TEST_VECTORS);
 		test_cipher ("arc4", MODE_ECB, DECRYPT, arc4_dec_tv_template, ARC4_DEC_TEST_VECTORS);
 
+		//TEA
+		test_cipher ("tea", MODE_ECB, ENCRYPT, tea_enc_tv_template, TEA_ENC_TEST_VECTORS);
+		test_cipher ("tea", MODE_ECB, DECRYPT, tea_dec_tv_template, TEA_DEC_TEST_VECTORS);
+
+
+		//XTEA
+		test_cipher ("xtea", MODE_ECB, ENCRYPT, xtea_enc_tv_template, XTEA_ENC_TEST_VECTORS);
+		test_cipher ("xtea", MODE_ECB, DECRYPT, xtea_dec_tv_template, XTEA_DEC_TEST_VECTORS);
+
 		test_hash("sha384", sha384_tv_template, SHA384_TEST_VECTORS);
 		test_hash("sha512", sha512_tv_template, SHA512_TEST_VECTORS);
 		test_deflate();		
@@ -659,6 +668,16 @@
 		test_hash("michael_mic", michael_mic_tv_template, MICHAEL_MIC_TEST_VECTORS);
 		break;
 
+	case 19:
+		test_cipher ("tea", MODE_ECB, ENCRYPT, tea_enc_tv_template, TEA_ENC_TEST_VECTORS);
+		test_cipher ("tea", MODE_ECB, DECRYPT, tea_dec_tv_template, TEA_DEC_TEST_VECTORS);
+		break;
+
+	case 20:
+		test_cipher ("xtea", MODE_ECB, ENCRYPT, xtea_enc_tv_template, XTEA_ENC_TEST_VECTORS);
+		test_cipher ("xtea", MODE_ECB, DECRYPT, xtea_dec_tv_template, XTEA_DEC_TEST_VECTORS);
+		break;
+
 #ifdef CONFIG_CRYPTO_HMAC
 	case 100:
 		test_hmac("md5", hmac_md5_tv_template, HMAC_MD5_TEST_VECTORS);
diff -urN linux-2.4.27-rc3/crypto/tcrypt.h linux-2.4.27-rc4/crypto/tcrypt.h
--- linux-2.4.27-rc3/crypto/tcrypt.h	2004-07-31 07:28:20.884046355 -0700
+++ linux-2.4.27-rc4/crypto/tcrypt.h	2004-07-31 07:28:24.737201856 -0700
@@ -1630,6 +1630,195 @@
 	},
 };
 
+/* 
+ * TEA test vectors
+ */
+#define TEA_ENC_TEST_VECTORS	4
+#define TEA_DEC_TEST_VECTORS	4
+
+struct cipher_testvec tea_enc_tv_template[] =
+{
+	{
+		.key    = { [0 ... 15] = 0x00 },
+		.klen	= 16,
+		.input  = { [0 ... 8] = 0x00 },
+		.ilen	= 8,
+		.result	= { 0x0a, 0x3a, 0xea, 0x41, 0x40, 0xa9, 0xba, 0x94 },
+		.rlen	= 8,
+	}, {
+		.key	= { 0x2b, 0x02, 0x05, 0x68, 0x06, 0x14, 0x49, 0x76,
+			    0x77, 0x5d, 0x0e, 0x26, 0x6c, 0x28, 0x78, 0x43 },
+		.klen	= 16,
+		.input	= { 0x74, 0x65, 0x73, 0x74, 0x20, 0x6d, 0x65, 0x2e },
+		.ilen	= 8,
+		.result	= { 0x77, 0x5d, 0x2a, 0x6a, 0xf6, 0xce, 0x92, 0x09 },
+		.rlen	= 8,
+	}, {
+		.key	= { 0x09, 0x65, 0x43, 0x11, 0x66, 0x44, 0x39, 0x25,
+			    0x51, 0x3a, 0x16, 0x10, 0x0a, 0x08, 0x12, 0x6e },
+		.klen	= 16,
+		.input	= { 0x6c, 0x6f, 0x6e, 0x67, 0x65, 0x72, 0x5f, 0x74, 
+			    0x65, 0x73, 0x74, 0x5f, 0x76, 0x65, 0x63, 0x74 },
+		.ilen	= 16,
+		.result	= { 0xbe, 0x7a, 0xbb, 0x81, 0x95, 0x2d, 0x1f, 0x1e, 
+			    0xdd, 0x89, 0xa1, 0x25, 0x04, 0x21, 0xdf, 0x95 },
+		.rlen	= 16,
+	}, {
+		.key	= { 0x4d, 0x76, 0x32, 0x17, 0x05, 0x3f, 0x75, 0x2c,
+			    0x5d, 0x04, 0x16, 0x36, 0x15, 0x72, 0x63, 0x2f },
+		.klen	= 16,
+		.input	= { 0x54, 0x65, 0x61, 0x20, 0x69, 0x73, 0x20, 0x67, 
+			    0x6f, 0x6f, 0x64, 0x20, 0x66, 0x6f, 0x72, 0x20, 
+			    0x79, 0x6f, 0x75, 0x21, 0x21, 0x21, 0x20, 0x72, 
+			    0x65, 0x61, 0x6c, 0x6c, 0x79, 0x21, 0x21, 0x21 },
+		.ilen	= 32,
+		.result	= { 0xe0, 0x4d, 0x5d, 0x3c, 0xb7, 0x8c, 0x36, 0x47, 
+			    0x94, 0x18, 0x95, 0x91, 0xa9, 0xfc, 0x49, 0xf8, 
+			    0x44, 0xd1, 0x2d, 0xc2, 0x99, 0xb8, 0x08, 0x2a, 
+			    0x07, 0x89, 0x73, 0xc2, 0x45, 0x92, 0xc6, 0x90 },
+		.rlen	= 32,
+	}
+};
+
+struct cipher_testvec tea_dec_tv_template[] =
+{
+	{
+		.key    = { [0 ... 15] = 0x00 },
+		.klen	= 16,
+		.input	= { 0x0a, 0x3a, 0xea, 0x41, 0x40, 0xa9, 0xba, 0x94 },
+		.ilen	= 8,
+		.result = { [0 ... 8] = 0x00 },
+		.rlen	= 8,
+	}, {
+		.key	= { 0x2b, 0x02, 0x05, 0x68, 0x06, 0x14, 0x49, 0x76,
+			    0x77, 0x5d, 0x0e, 0x26, 0x6c, 0x28, 0x78, 0x43 },
+		.klen	= 16,
+		.input	= { 0x77, 0x5d, 0x2a, 0x6a, 0xf6, 0xce, 0x92, 0x09 },
+		.ilen	= 8,
+		.result	= { 0x74, 0x65, 0x73, 0x74, 0x20, 0x6d, 0x65, 0x2e },
+		.rlen	= 8,
+	}, {
+		.key	= { 0x09, 0x65, 0x43, 0x11, 0x66, 0x44, 0x39, 0x25,
+			    0x51, 0x3a, 0x16, 0x10, 0x0a, 0x08, 0x12, 0x6e },
+		.klen	= 16,
+		.input	= { 0xbe, 0x7a, 0xbb, 0x81, 0x95, 0x2d, 0x1f, 0x1e,
+                            0xdd, 0x89, 0xa1, 0x25, 0x04, 0x21, 0xdf, 0x95 },
+                .ilen   = 16,
+		.result	= { 0x6c, 0x6f, 0x6e, 0x67, 0x65, 0x72, 0x5f, 0x74, 
+			    0x65, 0x73, 0x74, 0x5f, 0x76, 0x65, 0x63, 0x74 },
+		.rlen	= 16,
+	}, {
+		.key	= { 0x4d, 0x76, 0x32, 0x17, 0x05, 0x3f, 0x75, 0x2c,
+			    0x5d, 0x04, 0x16, 0x36, 0x15, 0x72, 0x63, 0x2f },
+		.klen	= 16,
+		.input	= { 0xe0, 0x4d, 0x5d, 0x3c, 0xb7, 0x8c, 0x36, 0x47,
+                            0x94, 0x18, 0x95, 0x91, 0xa9, 0xfc, 0x49, 0xf8,
+                            0x44, 0xd1, 0x2d, 0xc2, 0x99, 0xb8, 0x08, 0x2a,
+                            0x07, 0x89, 0x73, 0xc2, 0x45, 0x92, 0xc6, 0x90 },
+		.ilen	= 32,
+		.result	= { 0x54, 0x65, 0x61, 0x20, 0x69, 0x73, 0x20, 0x67, 
+			    0x6f, 0x6f, 0x64, 0x20, 0x66, 0x6f, 0x72, 0x20, 
+			    0x79, 0x6f, 0x75, 0x21, 0x21, 0x21, 0x20, 0x72, 
+			    0x65, 0x61, 0x6c, 0x6c, 0x79, 0x21, 0x21, 0x21 },
+		.rlen	= 32,
+	}
+};
+
+/* 
+ * XTEA test vectors 
+ */
+#define XTEA_ENC_TEST_VECTORS	4
+#define XTEA_DEC_TEST_VECTORS	4
+
+struct cipher_testvec xtea_enc_tv_template[] =
+{
+	{
+		.key    = { [0 ... 15] = 0x00 },
+		.klen	= 16,
+		.input  = { [0 ... 8] = 0x00 },
+		.ilen	= 8,
+		.result	= { 0xaa, 0x22, 0x96, 0xe5, 0x6c, 0x61, 0xf3, 0x45 },
+		.rlen	= 8,
+	}, {
+		.key	= { 0x2b, 0x02, 0x05, 0x68, 0x06, 0x14, 0x49, 0x76,
+			    0x77, 0x5d, 0x0e, 0x26, 0x6c, 0x28, 0x78, 0x43 },
+		.klen	= 16,
+		.input	= { 0x74, 0x65, 0x73, 0x74, 0x20, 0x6d, 0x65, 0x2e },
+		.ilen	= 8,
+		.result	= { 0x82, 0x3e, 0xeb, 0x35, 0xdc, 0xdd, 0xd9, 0xc3 },
+		.rlen	= 8,
+	}, {
+		.key	= { 0x09, 0x65, 0x43, 0x11, 0x66, 0x44, 0x39, 0x25,
+			    0x51, 0x3a, 0x16, 0x10, 0x0a, 0x08, 0x12, 0x6e },
+		.klen	= 16,
+		.input	= { 0x6c, 0x6f, 0x6e, 0x67, 0x65, 0x72, 0x5f, 0x74, 
+			    0x65, 0x73, 0x74, 0x5f, 0x76, 0x65, 0x63, 0x74 },
+		.ilen	= 16,
+		.result	= { 0xe2, 0x04, 0xdb, 0xf2, 0x89, 0x85, 0x9e, 0xea, 
+			    0x61, 0x35, 0xaa, 0xed, 0xb5, 0xcb, 0x71, 0x2c },
+		.rlen	= 16,
+	}, {
+		.key	= { 0x4d, 0x76, 0x32, 0x17, 0x05, 0x3f, 0x75, 0x2c,
+			    0x5d, 0x04, 0x16, 0x36, 0x15, 0x72, 0x63, 0x2f },
+		.klen	= 16,
+		.input	= { 0x54, 0x65, 0x61, 0x20, 0x69, 0x73, 0x20, 0x67, 
+			    0x6f, 0x6f, 0x64, 0x20, 0x66, 0x6f, 0x72, 0x20, 
+			    0x79, 0x6f, 0x75, 0x21, 0x21, 0x21, 0x20, 0x72, 
+			    0x65, 0x61, 0x6c, 0x6c, 0x79, 0x21, 0x21, 0x21 },
+		.ilen	= 32,
+		.result	= { 0x0b, 0x03, 0xcd, 0x8a, 0xbe, 0x95, 0xfd, 0xb1, 
+			    0xc1, 0x44, 0x91, 0x0b, 0xa5, 0xc9, 0x1b, 0xb4, 
+			    0xa9, 0xda, 0x1e, 0x9e, 0xb1, 0x3e, 0x2a, 0x8f, 
+			    0xea, 0xa5, 0x6a, 0x85, 0xd1, 0xf4, 0xa8, 0xa5 },
+		.rlen	= 32,
+	}
+};
+
+struct cipher_testvec xtea_dec_tv_template[] =
+{
+	{
+		.key    = { [0 ... 15] = 0x00 },
+		.klen	= 16,
+		.input	= { 0xaa, 0x22, 0x96, 0xe5, 0x6c, 0x61, 0xf3, 0x45 },
+		.ilen	= 8,
+		.result = { [0 ... 8] = 0x00 },
+		.rlen	= 8,
+	}, {
+		.key	= { 0x2b, 0x02, 0x05, 0x68, 0x06, 0x14, 0x49, 0x76,
+			    0x77, 0x5d, 0x0e, 0x26, 0x6c, 0x28, 0x78, 0x43 },
+		.klen	= 16,
+		.input	= { 0x82, 0x3e, 0xeb, 0x35, 0xdc, 0xdd, 0xd9, 0xc3 },
+		.ilen	= 8,
+		.result	= { 0x74, 0x65, 0x73, 0x74, 0x20, 0x6d, 0x65, 0x2e },
+		.rlen	= 8,
+	}, {
+		.key	= { 0x09, 0x65, 0x43, 0x11, 0x66, 0x44, 0x39, 0x25,
+			    0x51, 0x3a, 0x16, 0x10, 0x0a, 0x08, 0x12, 0x6e },
+		.klen	= 16,
+		.input	= { 0xe2, 0x04, 0xdb, 0xf2, 0x89, 0x85, 0x9e, 0xea, 
+			    0x61, 0x35, 0xaa, 0xed, 0xb5, 0xcb, 0x71, 0x2c },
+		.ilen	= 16,
+		.result	= { 0x6c, 0x6f, 0x6e, 0x67, 0x65, 0x72, 0x5f, 0x74, 
+			    0x65, 0x73, 0x74, 0x5f, 0x76, 0x65, 0x63, 0x74 },
+		.rlen	= 16,
+	}, {
+		.key	= { 0x4d, 0x76, 0x32, 0x17, 0x05, 0x3f, 0x75, 0x2c,
+			    0x5d, 0x04, 0x16, 0x36, 0x15, 0x72, 0x63, 0x2f },
+		.klen	= 16,
+		.input	= { 0x0b, 0x03, 0xcd, 0x8a, 0xbe, 0x95, 0xfd, 0xb1, 
+			    0xc1, 0x44, 0x91, 0x0b, 0xa5, 0xc9, 0x1b, 0xb4, 
+			    0xa9, 0xda, 0x1e, 0x9e, 0xb1, 0x3e, 0x2a, 0x8f, 
+			    0xea, 0xa5, 0x6a, 0x85, 0xd1, 0xf4, 0xa8, 0xa5 },
+		.ilen	= 32,
+		.result	= { 0x54, 0x65, 0x61, 0x20, 0x69, 0x73, 0x20, 0x67, 
+			    0x6f, 0x6f, 0x64, 0x20, 0x66, 0x6f, 0x72, 0x20, 
+			    0x79, 0x6f, 0x75, 0x21, 0x21, 0x21, 0x20, 0x72, 
+			    0x65, 0x61, 0x6c, 0x6c, 0x79, 0x21, 0x21, 0x21 },
+		.rlen	= 32,
+	}
+};
+
+
 
 /*
  * Compression stuff.
@@ -1771,4 +1960,5 @@
 		.digest = { 0x0a, 0x94, 0x2b, 0x12, 0x4e, 0xca, 0xa5, 0x46 },
 	}
 };
+
 #endif	/* _CRYPTO_TCRYPT_H */
diff -urN linux-2.4.27-rc3/crypto/tea.c linux-2.4.27-rc4/crypto/tea.c
--- linux-2.4.27-rc3/crypto/tea.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.4.27-rc4/crypto/tea.c	2004-07-31 07:28:24.738201896 -0700
@@ -0,0 +1,246 @@
+/* 
+ * Cryptographic API.
+ *
+ * TEA and Xtended TEA Algorithms
+ *
+ * The TEA and Xtended TEA algorithms were developed by David Wheeler 
+ * and Roger Needham at the Computer Laboratory of Cambridge University.
+ *
+ * Copyright (c) 2004 Aaron Grothe ajgrothe@yahoo.com
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ */
+
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/mm.h>
+#include <asm/scatterlist.h>
+#include <linux/crypto.h>
+
+#define TEA_KEY_SIZE		16
+#define TEA_BLOCK_SIZE		8
+#define TEA_ROUNDS		32
+#define TEA_DELTA		0x9e3779b9
+
+#define XTEA_KEY_SIZE		16
+#define XTEA_BLOCK_SIZE		8
+#define XTEA_ROUNDS		32
+#define XTEA_DELTA		0x9e3779b9
+
+#define u32_in(x) le32_to_cpu(*(const u32 *)(x))
+#define u32_out(to, from) (*(u32 *)(to) = cpu_to_le32(from))
+
+struct tea_ctx {
+	u32 KEY[4];
+};
+
+struct xtea_ctx {
+	u32 KEY[4];
+};
+
+static int tea_setkey(void *ctx_arg, const u8 *in_key,
+                       unsigned int key_len, u32 *flags)
+{ 
+
+	struct tea_ctx *ctx = ctx_arg;
+	
+	if (key_len != 16)
+	{
+		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
+		return -EINVAL;
+	}
+
+	ctx->KEY[0] = u32_in (in_key);
+	ctx->KEY[1] = u32_in (in_key + 4);
+	ctx->KEY[2] = u32_in (in_key + 8);
+	ctx->KEY[3] = u32_in (in_key + 12);
+
+	return 0; 
+
+}
+
+static void tea_encrypt(void *ctx_arg, u8 *dst, const u8 *src)
+{ 
+	u32 y, z, n, sum = 0;
+	u32 k0, k1, k2, k3;
+
+	struct tea_ctx *ctx = ctx_arg;
+
+	y = u32_in (src);
+	z = u32_in (src + 4);
+
+	k0 = ctx->KEY[0];
+	k1 = ctx->KEY[1];
+	k2 = ctx->KEY[2];
+	k3 = ctx->KEY[3];
+
+	n = TEA_ROUNDS;
+
+	while (n-- > 0) {
+		sum += TEA_DELTA;
+		y += ((z << 4) + k0) ^ (z + sum) ^ ((z >> 5) + k1);
+		z += ((y << 4) + k2) ^ (y + sum) ^ ((y >> 5) + k3);
+	}
+	
+	u32_out (dst, y);
+	u32_out (dst + 4, z);
+}
+
+static void tea_decrypt(void *ctx_arg, u8 *dst, const u8 *src)
+{ 
+	u32 y, z, n, sum;
+	u32 k0, k1, k2, k3;
+
+	struct tea_ctx *ctx = ctx_arg;
+
+	y = u32_in (src);
+	z = u32_in (src + 4);
+
+	k0 = ctx->KEY[0];
+	k1 = ctx->KEY[1];
+	k2 = ctx->KEY[2];
+	k3 = ctx->KEY[3];
+
+	sum = TEA_DELTA << 5;
+
+	n = TEA_ROUNDS;
+
+	while (n-- > 0) {
+		z -= ((y << 4) + k2) ^ (y + sum) ^ ((y >> 5) + k3);
+		y -= ((z << 4) + k0) ^ (z + sum) ^ ((z >> 5) + k1);
+		sum -= TEA_DELTA;
+	}
+	
+	u32_out (dst, y);
+	u32_out (dst + 4, z);
+
+}
+
+static int xtea_setkey(void *ctx_arg, const u8 *in_key,
+                       unsigned int key_len, u32 *flags)
+{ 
+
+	struct xtea_ctx *ctx = ctx_arg;
+	
+	if (key_len != 16)
+	{
+		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
+		return -EINVAL;
+	}
+
+	ctx->KEY[0] = u32_in (in_key);
+	ctx->KEY[1] = u32_in (in_key + 4);
+	ctx->KEY[2] = u32_in (in_key + 8);
+	ctx->KEY[3] = u32_in (in_key + 12);
+
+	return 0; 
+
+}
+
+static void xtea_encrypt(void *ctx_arg, u8 *dst, const u8 *src)
+{ 
+
+	u32 y, z, sum = 0;
+	u32 limit = XTEA_DELTA * XTEA_ROUNDS;
+
+	struct xtea_ctx *ctx = ctx_arg;
+
+	y = u32_in (src);
+	z = u32_in (src + 4);
+
+	while (sum != limit) {
+		y += (z << 4 ^ z >> 5) + (z ^ sum) + ctx->KEY[sum&3]; 
+		sum += TEA_DELTA;
+		z += (y << 4 ^ y >> 5) + (y ^ sum) + ctx->KEY[sum>>11 &3]; 
+	}
+	
+	u32_out (dst, y);
+	u32_out (dst + 4, z);
+
+}
+
+static void xtea_decrypt(void *ctx_arg, u8 *dst, const u8 *src)
+{ 
+
+	u32 y, z, sum;
+	struct tea_ctx *ctx = ctx_arg;
+
+	y = u32_in (src);
+	z = u32_in (src + 4);
+
+	sum = XTEA_DELTA * XTEA_ROUNDS;
+
+	while (sum) {
+		z -= (y << 4 ^ y >> 5) + (y ^ sum) + ctx->KEY[sum>>11 & 3];
+		sum -= XTEA_DELTA;
+		y -= (z << 4 ^ z >> 5) + (z ^ sum) + ctx->KEY[sum & 3];
+	}
+	
+	u32_out (dst, y);
+	u32_out (dst + 4, z);
+
+}
+
+static struct crypto_alg tea_alg = {
+	.cra_name		=	"tea",
+	.cra_flags		=	CRYPTO_ALG_TYPE_CIPHER,
+	.cra_blocksize		=	TEA_BLOCK_SIZE,
+	.cra_ctxsize		=	sizeof (struct tea_ctx),
+	.cra_module		=	THIS_MODULE,
+	.cra_list		=	LIST_HEAD_INIT(tea_alg.cra_list),
+	.cra_u			=	{ .cipher = {
+	.cia_min_keysize	=	TEA_KEY_SIZE,
+	.cia_max_keysize	=	TEA_KEY_SIZE,
+	.cia_setkey		= 	tea_setkey,
+	.cia_encrypt		=	tea_encrypt,
+	.cia_decrypt		=	tea_decrypt } }
+};
+
+static struct crypto_alg xtea_alg = {
+	.cra_name		=	"xtea",
+	.cra_flags		=	CRYPTO_ALG_TYPE_CIPHER,
+	.cra_blocksize		=	XTEA_BLOCK_SIZE,
+	.cra_ctxsize		=	sizeof (struct xtea_ctx),
+	.cra_module		=	THIS_MODULE,
+	.cra_list		=	LIST_HEAD_INIT(xtea_alg.cra_list),
+	.cra_u			=	{ .cipher = {
+	.cia_min_keysize	=	XTEA_KEY_SIZE,
+	.cia_max_keysize	=	XTEA_KEY_SIZE,
+	.cia_setkey		= 	xtea_setkey,
+	.cia_encrypt		=	xtea_encrypt,
+	.cia_decrypt		=	xtea_decrypt } }
+};
+
+static int __init init(void)
+{
+	int ret = 0;
+	
+	ret = crypto_register_alg(&tea_alg);
+	if (ret < 0)
+		goto out;
+
+	ret = crypto_register_alg(&xtea_alg);
+	if (ret < 0) {
+		crypto_unregister_alg(&tea_alg);
+		goto out;
+	}
+
+out:	
+	return ret;
+}
+
+static void __exit fini(void)
+{
+	crypto_unregister_alg(&tea_alg);
+	crypto_unregister_alg(&xtea_alg);
+}
+
+module_init(init);
+module_exit(fini);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("TEA & XTEA Cryptographic Algorithms");
diff -urN linux-2.4.27-rc3/crypto/twofish.c linux-2.4.27-rc4/crypto/twofish.c
--- linux-2.4.27-rc3/crypto/twofish.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.27-rc4/crypto/twofish.c	2004-07-31 07:28:24.739201937 -0700
@@ -663,7 +663,10 @@
 
 	/* Check key length. */
 	if (key_len != 16 && key_len != 24 && key_len != 32)
+	{
+		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
 		return -EINVAL; /* unsupported key length */
+	}
 
 	/* Compute the first two words of the S vector.  The magic numbers are
 	 * the entries of the RS matrix, preprocessed through poly_to_exp. The
diff -urN linux-2.4.27-rc3/drivers/bluetooth/hci_usb.c linux-2.4.27-rc4/drivers/bluetooth/hci_usb.c
--- linux-2.4.27-rc3/drivers/bluetooth/hci_usb.c	2004-07-31 07:28:20.922047888 -0700
+++ linux-2.4.27-rc4/drivers/bluetooth/hci_usb.c	2004-07-31 07:28:24.815205004 -0700
@@ -76,14 +76,15 @@
 	/* AVM BlueFRITZ! USB v2.0 */
 	{ USB_DEVICE(0x057c, 0x3800) },
 
-	/* Ericsson with non-standard id */
-	{ USB_DEVICE(0x0bdb, 0x1002) },
+	/* Bluetooth Ultraport Module from IBM */
+	{ USB_DEVICE(0x04bf, 0x030a) },
 
-	/* ALPS Module with non-standard id */
+	/* ALPS Modules with non-standard id */
+	{ USB_DEVICE(0x044e, 0x3001) },
 	{ USB_DEVICE(0x044e, 0x3002) },
 
-	/* Bluetooth Ultraport Module from IBM */
-	{ USB_DEVICE(0x04bf, 0x030a) },
+	/* Ericsson with non-standard id */
+	{ USB_DEVICE(0x0bdb, 0x1002) },
 
 	{ }	/* Terminating entry */
 };
diff -urN linux-2.4.27-rc3/drivers/char/sysrq.c linux-2.4.27-rc4/drivers/char/sysrq.c
--- linux-2.4.27-rc3/drivers/char/sysrq.c	2003-08-25 04:44:41.000000000 -0700
+++ linux-2.4.27-rc4/drivers/char/sysrq.c	2004-07-31 07:28:24.848206336 -0700
@@ -365,7 +365,7 @@
 /* v */	NULL,
 /* w */	NULL,
 /* x */	NULL,
-/* w */	NULL,
+/* y */	NULL,
 /* z */	NULL
 };
 
diff -urN linux-2.4.27-rc3/drivers/isdn/hisax/nj_s.c linux-2.4.27-rc4/drivers/isdn/hisax/nj_s.c
--- linux-2.4.27-rc3/drivers/isdn/hisax/nj_s.c	2002-11-28 15:53:13.000000000 -0800
+++ linux-2.4.27-rc4/drivers/isdn/hisax/nj_s.c	2004-07-31 07:28:25.031213721 -0700
@@ -130,6 +130,7 @@
 			release_io_netjet(cs);
 			return(0);
 		case CARD_INIT:
+			reset_netjet_s(cs);
 			inittiger(cs);
 			clear_pending_isac_ints(cs);
 			initisac(cs);
@@ -262,7 +263,6 @@
 	} else {
 		request_region(cs->hw.njet.base, bytecnt, "netjet-s isdn");
 	}
-	reset_netjet_s(cs);
 	cs->readisac  = &NETjet_ReadIC;
 	cs->writeisac = &NETjet_WriteIC;
 	cs->readisacfifo  = &NETjet_ReadICfifo;
diff -urN linux-2.4.27-rc3/drivers/net/tg3.c linux-2.4.27-rc4/drivers/net/tg3.c
--- linux-2.4.27-rc3/drivers/net/tg3.c	2004-07-31 07:28:21.222059996 -0700
+++ linux-2.4.27-rc4/drivers/net/tg3.c	2004-07-31 07:28:25.149218484 -0700
@@ -1,8 +1,9 @@
 /*
  * tg3.c: Broadcom Tigon3 ethernet driver.
  *
- * Copyright (C) 2001, 2002, 2003 David S. Miller (davem@redhat.com)
+ * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com)
  * Copyright (C) 2001, 2002, 2003 Jeff Garzik (jgarzik@pobox.com)
+ * Copyright (C) 2004 Sun Microsystems Inc.
  */
 
 #include <linux/config.h>
@@ -55,8 +56,8 @@
 
 #define DRV_MODULE_NAME		"tg3"
 #define PFX DRV_MODULE_NAME	": "
-#define DRV_MODULE_VERSION	"3.6"
-#define DRV_MODULE_RELDATE	"June 12, 2004"
+#define DRV_MODULE_VERSION	"3.8"
+#define DRV_MODULE_RELDATE	"July 14, 2004"
 
 #define TG3_DEF_MAC_MODE	0
 #define TG3_DEF_RX_MODE		0
@@ -1960,6 +1961,67 @@
 	return ret;
 }
 
+static int fiber_autoneg(struct tg3 *tp, u32 *flags)
+{
+	int res = 0;
+
+	if (tp->tg3_flags2 & TG3_FLG2_HW_AUTONEG) {
+		u32 dig_status;
+
+		dig_status = tr32(SG_DIG_STATUS);
+		*flags = 0;
+		if (dig_status & SG_DIG_PARTNER_ASYM_PAUSE)
+			*flags |= MR_LP_ADV_ASYM_PAUSE;
+		if (dig_status & SG_DIG_PARTNER_PAUSE_CAPABLE)
+			*flags |= MR_LP_ADV_SYM_PAUSE;
+
+		if ((dig_status & SG_DIG_AUTONEG_COMPLETE) &&
+		    !(dig_status & (SG_DIG_AUTONEG_ERROR |
+				    SG_DIG_PARTNER_FAULT_MASK)))
+			res = 1;
+	} else {
+		struct tg3_fiber_aneginfo aninfo;
+		int status = ANEG_FAILED;
+		unsigned int tick;
+		u32 tmp;
+
+		tw32_f(MAC_TX_AUTO_NEG, 0);
+
+		tmp = tp->mac_mode & ~MAC_MODE_PORT_MODE_MASK;
+		tw32_f(MAC_MODE, tmp | MAC_MODE_PORT_MODE_GMII);
+		udelay(40);
+
+		tw32_f(MAC_MODE, tp->mac_mode | MAC_MODE_SEND_CONFIGS);
+		udelay(40);
+
+		memset(&aninfo, 0, sizeof(aninfo));
+		aninfo.flags |= MR_AN_ENABLE;
+		aninfo.state = ANEG_STATE_UNKNOWN;
+		aninfo.cur_time = 0;
+		tick = 0;
+		while (++tick < 195000) {
+			status = tg3_fiber_aneg_smachine(tp, &aninfo);
+			if (status == ANEG_DONE || status == ANEG_FAILED)
+				break;
+
+			udelay(1);
+		}
+
+		tp->mac_mode &= ~MAC_MODE_SEND_CONFIGS;
+		tw32_f(MAC_MODE, tp->mac_mode);
+		udelay(40);
+
+		*flags = aninfo.flags;
+
+		if (status == ANEG_DONE &&
+		    (aninfo.flags & (MR_AN_COMPLETE | MR_LINK_OK |
+				     MR_LP_ADV_FULL_DUPLEX)))
+			res = 1;
+	}
+
+	return res;
+}
+
 static int tg3_setup_fiber_phy(struct tg3 *tp, int force_reset)
 {
 	u32 orig_pause_cfg;
@@ -1979,6 +2041,20 @@
 	tw32_f(MAC_MODE, tp->mac_mode);
 	udelay(40);
 
+	if (tp->tg3_flags2 & TG3_FLG2_HW_AUTONEG) {
+		/* Allow time for the hardware to auto-negotiate (195ms) */
+		unsigned int tick = 0;
+
+		while (++tick < 195000) { 
+			if (tr32(SG_DIG_STATUS) & SG_DIG_AUTONEG_COMPLETE)
+				break;
+			udelay(1);
+		}
+		if (tick >= 195000)
+			printk(KERN_INFO PFX "%s: HW autoneg failed !\n",
+			    tp->dev->name);
+	}
+
 	/* Reset when initting first time or we have a link. */
 	if (!(tp->tg3_flags & TG3_FLAG_INIT_COMPLETE) ||
 	    (tr32(MAC_STATUS) & MAC_STATUS_PCS_SYNCED)) {
@@ -2030,53 +2106,18 @@
 	udelay(40);
 
 	current_link_up = 0;
-	if (tr32(MAC_STATUS) & MAC_STATUS_PCS_SYNCED) {
-		if (tp->link_config.autoneg == AUTONEG_ENABLE &&
-		    !(tp->tg3_flags & TG3_FLAG_GOT_SERDES_FLOWCTL)) {
-			struct tg3_fiber_aneginfo aninfo;
-			int status = ANEG_FAILED;
-			unsigned int tick;
-			u32 tmp;
-
-			memset(&aninfo, 0, sizeof(aninfo));
-			aninfo.flags |= (MR_AN_ENABLE);
-
-			tw32(MAC_TX_AUTO_NEG, 0);
-
-			tmp = tp->mac_mode & ~MAC_MODE_PORT_MODE_MASK;
-			tw32_f(MAC_MODE, tmp | MAC_MODE_PORT_MODE_GMII);
-			udelay(40);
-
-			tw32_f(MAC_MODE, tp->mac_mode | MAC_MODE_SEND_CONFIGS);
-			udelay(40);
-
-			aninfo.state = ANEG_STATE_UNKNOWN;
-			aninfo.cur_time = 0;
-			tick = 0;
-			while (++tick < 195000) {
-				status = tg3_fiber_aneg_smachine(tp, &aninfo);
-				if (status == ANEG_DONE ||
-				    status == ANEG_FAILED)
-					break;
-
-				udelay(1);
-			}
-
-			tp->mac_mode &= ~MAC_MODE_SEND_CONFIGS;
-			tw32_f(MAC_MODE, tp->mac_mode);
-			udelay(40);
-
-			if (status == ANEG_DONE &&
-			    (aninfo.flags &
-			     (MR_AN_COMPLETE | MR_LINK_OK |
-			      MR_LP_ADV_FULL_DUPLEX))) {
+ 	if (tr32(MAC_STATUS) & MAC_STATUS_PCS_SYNCED) {
+		if (tp->link_config.autoneg == AUTONEG_ENABLE) {
+			u32 flags;
+  
+			if (fiber_autoneg(tp, &flags)) {
 				u32 local_adv, remote_adv;
 
 				local_adv = ADVERTISE_PAUSE_CAP;
 				remote_adv = 0;
-				if (aninfo.flags & MR_LP_ADV_SYM_PAUSE)
-					remote_adv |= LPA_PAUSE_CAP;
-				if (aninfo.flags & MR_LP_ADV_ASYM_PAUSE)
+				if (flags & MR_LP_ADV_SYM_PAUSE)
+  					remote_adv |= LPA_PAUSE_CAP;
+				if (flags & MR_LP_ADV_ASYM_PAUSE)
 					remote_adv |= LPA_PAUSE_ASYM;
 
 				tg3_setup_flow_control(tp, local_adv, remote_adv);
@@ -2103,8 +2144,10 @@
 		} else {
 			/* Forcing 1000FD link up. */
 			current_link_up = 1;
+			tp->tg3_flags |= TG3_FLAG_GOT_SERDES_FLOWCTL;
 		}
-	}
+	} else
+		tp->tg3_flags &= ~TG3_FLAG_GOT_SERDES_FLOWCTL;
 
 	tp->mac_mode &= ~MAC_MODE_LINK_POLARITY;
 	tw32_f(MAC_MODE, tp->mac_mode);
@@ -2411,6 +2454,11 @@
 	int received;
 
 	hw_idx = tp->hw_status->idx[0].rx_producer;
+	/*
+	 * We need to order the read of hw_idx and the read of
+	 * the opaque cookie.
+	 */
+	rmb();
 	sw_idx = rx_rcb_ptr % TG3_RX_RCB_RING_SIZE(tp);
 	work_mask = 0;
 	received = 0;
@@ -2809,11 +2857,10 @@
 	u32 base = (u32) mapping & 0xffffffff;
 
 	return ((base > 0xffffdcc0) &&
-		((u64) mapping >> 32) == 0 &&
 		(base + len + 8 < base));
 }
 
-static int tg3_start_xmit_4gbug(struct sk_buff *skb, struct net_device *dev)
+static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct tg3 *tp = netdev_priv(dev);
 	dma_addr_t mapping;
@@ -3017,165 +3064,6 @@
 	return 0;
 }
 
-static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
-{
-	struct tg3 *tp = netdev_priv(dev);
-	dma_addr_t mapping;
-	u32 len, entry, base_flags, mss;
-	unsigned long flags;
-
-	len = skb_headlen(skb);
-
-	/* No BH disabling for tx_lock here.  We are running in BH disabled
-	 * context and TX reclaim runs via tp->poll inside of a software
-	 * interrupt.  Rejoice!
-	 *
-	 * Actually, things are not so simple.  If we are to take a hw
-	 * IRQ here, we can deadlock, consider:
-	 *
-	 *       CPU1		CPU2
-	 *   tg3_start_xmit
-	 *   take tp->tx_lock
-	 *			tg3_timer
-	 *			take tp->lock
-	 *   tg3_interrupt
-	 *   spin on tp->lock
-	 *			spin on tp->tx_lock
-	 *
-	 * So we really do need to disable interrupts when taking
-	 * tx_lock here.
-	 */
-	spin_lock_irqsave(&tp->tx_lock, flags);
-
-	/* This is a hard error, log it. */
-	if (unlikely(TX_BUFFS_AVAIL(tp) <= (skb_shinfo(skb)->nr_frags + 1))) {
-		netif_stop_queue(dev);
-		spin_unlock_irqrestore(&tp->tx_lock, flags);
-		printk(KERN_ERR PFX "%s: BUG! Tx Ring full when queue awake!\n",
-		       dev->name);
-		return 1;
-	}
-
-	entry = tp->tx_prod;
-	base_flags = 0;
-	if (skb->ip_summed == CHECKSUM_HW)
-		base_flags |= TXD_FLAG_TCPUDP_CSUM;
-#if TG3_TSO_SUPPORT != 0
-	mss = 0;
-	if (skb->len > (tp->dev->mtu + ETH_HLEN) &&
-	    (mss = skb_shinfo(skb)->tso_size) != 0) {
-		int tcp_opt_len, ip_tcp_len;
-
-		tcp_opt_len = ((skb->h.th->doff - 5) * 4);
-		ip_tcp_len = (skb->nh.iph->ihl * 4) + sizeof(struct tcphdr);
-
-		base_flags |= (TXD_FLAG_CPU_PRE_DMA |
-			       TXD_FLAG_CPU_POST_DMA);
-
-		skb->nh.iph->check = 0;
-		skb->nh.iph->tot_len = ntohs(mss + ip_tcp_len + tcp_opt_len);
-		skb->h.th->check = ~csum_tcpudp_magic(skb->nh.iph->saddr,
-						      skb->nh.iph->daddr,
-						      0, IPPROTO_TCP, 0);
-
-		if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5705) {
-			if (tcp_opt_len || skb->nh.iph->ihl > 5) {
-				int tsflags;
-
-				tsflags = ((skb->nh.iph->ihl - 5) +
-					   (tcp_opt_len >> 2));
-				mss |= (tsflags << 11);
-			}
-		} else {
-			if (tcp_opt_len || skb->nh.iph->ihl > 5) {
-				int tsflags;
-
-				tsflags = ((skb->nh.iph->ihl - 5) +
-					   (tcp_opt_len >> 2));
-				base_flags |= tsflags << 12;
-			}
-		}
-	}
-#else
-	mss = 0;
-#endif
-#if TG3_VLAN_TAG_USED
-	if (tp->vlgrp != NULL && vlan_tx_tag_present(skb))
-		base_flags |= (TXD_FLAG_VLAN |
-			       (vlan_tx_tag_get(skb) << 16));
-#endif
-
-	/* Queue skb data, a.k.a. the main skb fragment. */
-	mapping = pci_map_single(tp->pdev, skb->data, len, PCI_DMA_TODEVICE);
-
-	tp->tx_buffers[entry].skb = skb;
-	pci_unmap_addr_set(&tp->tx_buffers[entry], mapping, mapping);
-
-	tg3_set_txd(tp, entry, mapping, len, base_flags,
-		    (skb_shinfo(skb)->nr_frags == 0) | (mss << 1));
-
-	entry = NEXT_TX(entry);
-
-	/* Now loop through additional data fragments, and queue them. */
-	if (skb_shinfo(skb)->nr_frags > 0) {
-		unsigned int i, last;
-
-		last = skb_shinfo(skb)->nr_frags - 1;
-		for (i = 0; i <= last; i++) {
-			skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-
-
-			len = frag->size;
-			mapping = pci_map_page(tp->pdev,
-					       frag->page,
-					       frag->page_offset,
-					       len, PCI_DMA_TODEVICE);
-
-			tp->tx_buffers[entry].skb = NULL;
-			pci_unmap_addr_set(&tp->tx_buffers[entry], mapping, mapping);
-
-			if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5750)
-				tg3_set_txd(tp, entry, mapping, len,
-					    base_flags, (i == last)|(mss << 1));
-			else
-				tg3_set_txd(tp, entry, mapping, len,
-					    base_flags, (i == last));
-
-			entry = NEXT_TX(entry);
-		}
-	}
-
-	/* Packets are ready, update Tx producer idx local and on card.
-	 * We know this is not a 5700 (by virtue of not being a chip
-	 * requiring the 4GB overflow workaround) so we can safely omit
-	 * the double-write bug tests.
-	 */
-	if (tp->tg3_flags & TG3_FLAG_HOST_TXDS) {
-		tw32_tx_mbox((MAILBOX_SNDHOST_PROD_IDX_0 +
-			      TG3_64BIT_REG_LOW), entry);
-	} else {
-		/* First, make sure tg3 sees last descriptor fully
-		 * in SRAM.
-		 */
-		if (tp->tg3_flags & TG3_FLAG_MBOX_WRITE_REORDER)
-			tr32(MAILBOX_SNDNIC_PROD_IDX_0 +
-			     TG3_64BIT_REG_LOW);
-
-		tw32_tx_mbox((MAILBOX_SNDNIC_PROD_IDX_0 +
-			      TG3_64BIT_REG_LOW), entry);
-	}
-
-	tp->tx_prod = entry;
-	if (TX_BUFFS_AVAIL(tp) <= (MAX_SKB_FRAGS + 1))
-		netif_stop_queue(dev);
-
-	spin_unlock_irqrestore(&tp->tx_lock, flags);
-
-	dev->trans_start = jiffies;
-
-	return 0;
-}
-
 static inline void tg3_set_mtu(struct net_device *dev, struct tg3 *tp,
 			       int new_mtu)
 {
@@ -3745,9 +3633,25 @@
 	/* restore 5701 hardware bug workaround flag */
 	tp->tg3_flags = flags_save;
 
+	/* Unfortunately, we have to delay before the PCI read back.
+	 * Some 575X chips even will not respond to a PCI cfg access
+	 * when the reset command is given to the chip.
+	 *
+	 * How do these hardware designers expect things to work
+	 * properly if the PCI write is posted for a long period
+	 * of time?  It is always necessary to have some method by
+	 * which a register read back can occur to push the write
+	 * out which does the reset.
+	 *
+	 * For most tg3 variants the trick below was working.
+	 * Ho hum...
+	 */
+	udelay(120);
+
 	/* Flush PCI posted writes.  The normal MMIO registers
 	 * are inaccessible at this time so this is the only
-	 * way to make this reliably.  I tried to use indirect
+	 * way to make this reliably (actually, this is no longer
+	 * the case, see above).  I tried to use indirect
 	 * register read/write but this upset some 5701 variants.
 	 */
 	pci_read_config_dword(tp->pdev, PCI_COMMAND, &val);
@@ -5361,6 +5265,26 @@
 	 */
 	tw32_f(MAC_LOW_WMARK_MAX_RX_FRAME, 2);
 
+	if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704 &&
+	    tp->phy_id == PHY_ID_SERDES) {
+		/* Enable hardware link auto-negotiation */
+		u32 digctrl, txctrl;
+
+		digctrl = SG_DIG_USING_HW_AUTONEG | SG_DIG_CRC16_CLEAR_N |
+		    SG_DIG_LOCAL_DUPLEX_STATUS | SG_DIG_LOCAL_LINK_STATUS |
+		    (2 << SG_DIG_SPEED_STATUS_SHIFT) | SG_DIG_FIBER_MODE |
+		    SG_DIG_GBIC_ENABLE;
+
+		txctrl = tr32(MAC_SERDES_CFG);
+		tw32_f(MAC_SERDES_CFG, txctrl | MAC_SERDES_CFG_EDGE_SELECT);
+		tw32_f(SG_DIG_CTRL, digctrl | SG_DIG_SOFT_RESET);
+		tr32(SG_DIG_CTRL);
+		udelay(5);
+		tw32_f(SG_DIG_CTRL, digctrl);
+
+		tp->tg3_flags2 |= TG3_FLG2_HW_AUTONEG;
+	}
+
 	err = tg3_setup_phy(tp, 1);
 	if (err)
 		return err;
@@ -6694,6 +6618,9 @@
 	case SIOCGMIIREG: {
 		u32 mii_regval;
 
+		if (tp->phy_id == PHY_ID_SERDES)
+			break;			/* We have no PHY */
+
 		spin_lock_irq(&tp->lock);
 		err = tg3_readphy(tp, data->reg_num & 0x1f, &mii_regval);
 		spin_unlock_irq(&tp->lock);
@@ -6704,6 +6631,9 @@
 	}
 
 	case SIOCSMIIREG:
+		if (tp->phy_id == PHY_ID_SERDES)
+			break;			/* We have no PHY */
+
 		if (!capable(CAP_NET_ADMIN))
 			return -EPERM;
 
@@ -7634,13 +7564,10 @@
 	else
 		tp->tg3_flags &= ~TG3_FLAG_TXD_MBOX_HWBUG;
 
-	/* 5700 chips can get confused if TX buffers straddle the
-	 * 4GB address boundary in some cases.
+	/* It seems all chips can get confused if TX buffers
+	 * straddle the 4GB address boundary in some cases.
 	 */
-	if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5700)
-		tp->dev->hard_start_xmit = tg3_start_xmit_4gbug;
-	else
-		tp->dev->hard_start_xmit = tg3_start_xmit;
+	tp->dev->hard_start_xmit = tg3_start_xmit;
 
 	tp->rx_offset = 2;
 	if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701 &&
diff -urN linux-2.4.27-rc3/drivers/net/tg3.h linux-2.4.27-rc4/drivers/net/tg3.h
--- linux-2.4.27-rc3/drivers/net/tg3.h	2004-07-31 07:28:21.225060117 -0700
+++ linux-2.4.27-rc4/drivers/net/tg3.h	2004-07-31 07:28:25.152218605 -0700
@@ -1,8 +1,9 @@
 /* $Id: tg3.h,v 1.37.2.32 2002/03/11 12:18:18 davem Exp $
  * tg3.h: Definitions for Broadcom Tigon3 ethernet driver.
  *
- * Copyright (C) 2001, 2002 David S. Miller (davem@redhat.com)
+ * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com)
  * Copyright (C) 2001 Jeff Garzik (jgarzik@pobox.com)
+ * Copyright (C) 2004 Sun Microsystems Inc.
  */
 
 #ifndef _T3_H
@@ -116,6 +117,7 @@
 #define  CHIPREV_ID_5704_A0		 0x2000
 #define  CHIPREV_ID_5704_A1		 0x2001
 #define  CHIPREV_ID_5704_A2		 0x2002
+#define  CHIPREV_ID_5704_A3		 0x2003
 #define  CHIPREV_ID_5705_A0		 0x3000
 #define  CHIPREV_ID_5705_A1		 0x3001
 #define  CHIPREV_ID_5705_A2		 0x3002
@@ -518,8 +520,50 @@
 #define MAC_EXTADDR_11_HIGH		0x00000588
 #define MAC_EXTADDR_11_LOW		0x0000058c
 #define MAC_SERDES_CFG			0x00000590
+#define  MAC_SERDES_CFG_EDGE_SELECT	 0x00001000
 #define MAC_SERDES_STAT			0x00000594
-/* 0x598 --> 0x600 unused */
+/* 0x598 --> 0x5b0 unused */
+#define SG_DIG_CTRL			0x000005b0
+#define  SG_DIG_USING_HW_AUTONEG	 0x80000000
+#define  SG_DIG_SOFT_RESET		 0x40000000
+#define  SG_DIG_DISABLE_LINKRDY		 0x20000000
+#define  SG_DIG_CRC16_CLEAR_N		 0x01000000
+#define  SG_DIG_EN10B			 0x00800000
+#define  SG_DIG_CLEAR_STATUS		 0x00400000
+#define  SG_DIG_LOCAL_DUPLEX_STATUS	 0x00200000
+#define  SG_DIG_LOCAL_LINK_STATUS	 0x00100000
+#define  SG_DIG_SPEED_STATUS_MASK	 0x000c0000
+#define  SG_DIG_SPEED_STATUS_SHIFT	 18
+#define  SG_DIG_JUMBO_PACKET_DISABLE	 0x00020000
+#define  SG_DIG_RESTART_AUTONEG		 0x00010000
+#define  SG_DIG_FIBER_MODE		 0x00008000
+#define  SG_DIG_REMOTE_FAULT_MASK	 0x00006000
+#define  SG_DIG_PAUSE_MASK		 0x00001800
+#define  SG_DIG_GBIC_ENABLE		 0x00000400
+#define  SG_DIG_CHECK_END_ENABLE	 0x00000200
+#define  SG_DIG_SGMII_AUTONEG_TIMER	 0x00000100
+#define  SG_DIG_CLOCK_PHASE_SELECT	 0x00000080
+#define  SG_DIG_GMII_INPUT_SELECT	 0x00000040
+#define  SG_DIG_MRADV_CRC16_SELECT	 0x00000020
+#define  SG_DIG_COMMA_DETECT_ENABLE	 0x00000010
+#define  SG_DIG_AUTONEG_TIMER_REDUCE	 0x00000008
+#define  SG_DIG_AUTONEG_LOW_ENABLE	 0x00000004
+#define  SG_DIG_REMOTE_LOOPBACK		 0x00000002
+#define  SG_DIG_LOOPBACK		 0x00000001
+#define SG_DIG_STATUS			0x000005b4
+#define  SG_DIG_CRC16_BUS_MASK		 0xffff0000
+#define  SG_DIG_PARTNER_FAULT_MASK	 0x00600000 /* If !MRADV_CRC16_SELECT */
+#define  SG_DIG_PARTNER_ASYM_PAUSE	 0x00100000 /* If !MRADV_CRC16_SELECT */
+#define  SG_DIG_PARTNER_PAUSE_CAPABLE	 0x00080000 /* If !MRADV_CRC16_SELECT */
+#define  SG_DIG_PARTNER_HALF_DUPLEX	 0x00040000 /* If !MRADV_CRC16_SELECT */
+#define  SG_DIG_PARTNER_FULL_DUPLEX	 0x00020000 /* If !MRADV_CRC16_SELECT */
+#define  SG_DIG_PARTNER_NEXT_PAGE	 0x00010000 /* If !MRADV_CRC16_SELECT */
+#define  SG_DIG_AUTONEG_STATE_MASK	 0x00000ff0
+#define  SG_DIG_COMMA_DETECTOR		 0x00000008
+#define  SG_DIG_MAC_ACK_STATUS		 0x00000004
+#define  SG_DIG_AUTONEG_COMPLETE	 0x00000002
+#define  SG_DIG_AUTONEG_ERROR		 0x00000001
+/* 0x5b8 --> 0x600 unused */
 #define MAC_TX_MAC_STATE_BASE		0x00000600 /* 16 bytes */
 #define MAC_RX_MAC_STATE_BASE		0x00000610 /* 20 bytes */
 /* 0x624 --> 0x800 unused */
@@ -2044,6 +2088,7 @@
 #define TG3_FLG2_PHY_BER_BUG		0x00000100
 #define TG3_FLG2_PCI_EXPRESS		0x00000200
 #define TG3_FLG2_ASF_NEW_HANDSHAKE	0x00000400
+#define TG3_FLG2_HW_AUTONEG		0x00000800
 
 	u32				split_mode_max_reqs;
 #define SPLIT_MODE_5704_MAX_REQ		3
diff -urN linux-2.4.27-rc3/drivers/sound/cmpci.c linux-2.4.27-rc4/drivers/sound/cmpci.c
--- linux-2.4.27-rc3/drivers/sound/cmpci.c	2003-11-28 10:26:20.000000000 -0800
+++ linux-2.4.27-rc4/drivers/sound/cmpci.c	2004-07-31 07:28:25.274223529 -0700
@@ -3595,7 +3595,7 @@
 MODULE_DESCRIPTION("CM8x38 Audio Driver");
 MODULE_LICENSE("GPL");
 
-static void __devinit cm_remove(struct pci_dev *dev)
+static void __devexit cm_remove(struct pci_dev *dev)
 {
 	struct cm_state *s = pci_get_drvdata(dev);
 
@@ -3643,10 +3643,10 @@
 MODULE_DEVICE_TABLE(pci, id_table);
 
 static struct pci_driver cm_driver = {
-       name: "cmpci",
-       id_table: id_table,
-       probe: cm_probe,
-       remove: cm_remove
+	.name		= "cmpci",
+	.id_table	= id_table,
+	.probe		= cm_probe,
+	.remove		= __devexit_p(cm_remove)
 };
  
 static int __init init_cmpci(void)
diff -urN linux-2.4.27-rc3/drivers/usb/audio.c linux-2.4.27-rc4/drivers/usb/audio.c
--- linux-2.4.27-rc3/drivers/usb/audio.c	2004-04-14 06:05:32.000000000 -0700
+++ linux-2.4.27-rc4/drivers/usb/audio.c	2004-07-31 07:28:25.306224820 -0700
@@ -2141,6 +2141,8 @@
   
 	if (cmd == SOUND_MIXER_INFO) {
 		mixer_info info;
+
+		memset(&info, 0, sizeof(info));
 		strncpy(info.id, "USB_AUDIO", sizeof(info.id));
 		strncpy(info.name, "USB Audio Class Driver", sizeof(info.name));
 		info.modify_counter = ms->modcnt;
@@ -2150,6 +2152,8 @@
 	}
 	if (cmd == SOUND_OLD_MIXER_INFO) {
 		_old_mixer_info info;
+
+		memset(&info, 0, sizeof(info));
 		strncpy(info.id, "USB_AUDIO", sizeof(info.id));
 		strncpy(info.name, "USB Audio Class Driver", sizeof(info.name));
 		if (copy_to_user((void *)arg, &info, sizeof(info)))
diff -urN linux-2.4.27-rc3/drivers/usb/auermain.c linux-2.4.27-rc4/drivers/usb/auermain.c
--- linux-2.4.27-rc3/drivers/usb/auermain.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.27-rc4/drivers/usb/auermain.c	2004-07-31 07:28:25.331225829 -0700
@@ -55,7 +55,7 @@
 
 /*-------------------------------------------------------------------*/
 /* Version Information */
-#define DRIVER_VERSION "1.2.6"
+#define DRIVER_VERSION "1.2.7"
 #define DRIVER_AUTHOR  "Wolfgang Mües <wolfgang@iksw-muees.de>"
 #define DRIVER_DESC    "Auerswald PBX/System Telephone usb driver"
 
@@ -110,8 +110,8 @@
 	case 0:
 	case -ETIMEDOUT:
 	case -EOVERFLOW:
+	case -EFBIG:
 	case -EAGAIN:
-	case -EPIPE:
 	case -EPROTO:
 	case -EILSEQ:
 	case -ENOSR:
diff -urN linux-2.4.27-rc3/drivers/usb/brlvger.c linux-2.4.27-rc4/drivers/usb/brlvger.c
--- linux-2.4.27-rc3/drivers/usb/brlvger.c	2003-11-28 10:26:20.000000000 -0800
+++ linux-2.4.27-rc4/drivers/usb/brlvger.c	2004-07-31 07:28:25.341226233 -0700
@@ -743,6 +743,7 @@
 	case BRLVGER_GET_INFO: {
 		struct brlvger_info vi;
 
+		memset(&vi, 0, sizeof(vi));
 		strncpy(vi.driver_version, DRIVER_VERSION,
 			sizeof(vi.driver_version));
 		vi.driver_version[sizeof(vi.driver_version)-1] = 0;
diff -urN linux-2.4.27-rc3/drivers/usb/printer.c linux-2.4.27-rc4/drivers/usb/printer.c
--- linux-2.4.27-rc3/drivers/usb/printer.c	2004-07-31 07:28:21.377066251 -0700
+++ linux-2.4.27-rc4/drivers/usb/printer.c	2004-07-31 07:28:25.450230632 -0700
@@ -1,9 +1,9 @@
 /*
- * printer.c  Version 0.11
+ * printer.c  Version 0.13
  *
  * Copyright (c) 1999 Michael Gee	<michael@linuxspecific.com>
  * Copyright (c) 1999 Pavel Machek	<pavel@suse.cz>
- * Copyright (c) 2000 Randy Dunlap	<randy.dunlap@intel.com>
+ * Copyright (c) 2000 Randy Dunlap	<rddunlap@osdl.org>
  * Copyright (c) 2000 Vojtech Pavlik	<vojtech@suse.cz>
  # Copyright (c) 2001 Pete Zaitcev	<zaitcev@redhat.com>
  # Copyright (c) 2001 David Paschal	<paschal@rcsis.com>
@@ -230,11 +230,21 @@
 
 static int usblp_ctrl_msg(struct usblp *usblp, int request, int type, int dir, int recip, int value, void *buf, int len)
 {
-	int retval = usb_control_msg(usblp->dev,
+	int retval;
+	int index = usblp->ifnum;
+
+	/* High byte has the interface index.
+	   Low byte has the alternate setting.
+	 */
+	if ((request == USBLP_REQ_GET_ID) && (type == USB_TYPE_CLASS)) {
+	  index = (usblp->ifnum<<8)|usblp->protocol[usblp->current_protocol].alt_setting;
+	}
+
+	retval = usb_control_msg(usblp->dev,
 		dir ? usb_rcvctrlpipe(usblp->dev, 0) : usb_sndctrlpipe(usblp->dev, 0),
-		request, type | dir | recip, value, usblp->ifnum, buf, len, USBLP_WRITE_TIMEOUT);
-	dbg("usblp_control_msg: rq: 0x%02x dir: %d recip: %d value: %d len: %#x result: %d",
-		request, !!dir, recip, value, len, retval);
+		request, type | dir | recip, value, index, buf, len, USBLP_WRITE_TIMEOUT);
+	dbg("usblp_control_msg: rq: 0x%02x dir: %d recip: %d value: %d idx: %d len: %#x result: %d",
+		request, !!dir, recip, value, index, len, retval);
 	return retval < 0 ? retval : 0;
 }
 
@@ -747,6 +757,7 @@
 			usblp->minor, usblp->readurb->status);
 		usblp->readurb->dev = usblp->dev;
  		usblp->readcount = 0;
+		usblp->rcomplete = 0;
 		if (usb_submit_urb(usblp->readurb) < 0)
 			dbg("error submitting urb");
 		count = -EIO;
diff -urN linux-2.4.27-rc3/drivers/usb/serial/io_edgeport.c linux-2.4.27-rc4/drivers/usb/serial/io_edgeport.c
--- linux-2.4.27-rc3/drivers/usb/serial/io_edgeport.c	2004-04-14 06:05:35.000000000 -0700
+++ linux-2.4.27-rc4/drivers/usb/serial/io_edgeport.c	2004-07-31 07:28:25.497232529 -0700
@@ -1913,6 +1913,7 @@
 
 		case TIOCGICOUNT:
 			cnow = edge_port->icount;
+			memset(&icount, 0, sizeof(icount));
 			icount.cts = cnow.cts;
 			icount.dsr = cnow.dsr;
 			icount.rng = cnow.rng;
diff -urN linux-2.4.27-rc3/drivers/usb/serial/ipaq.c linux-2.4.27-rc4/drivers/usb/serial/ipaq.c
--- linux-2.4.27-rc3/drivers/usb/serial/ipaq.c	2003-11-28 10:26:20.000000000 -0800
+++ linux-2.4.27-rc4/drivers/usb/serial/ipaq.c	2004-07-31 07:28:25.499232609 -0700
@@ -188,6 +188,7 @@
 	port->private = (void *)priv;
 	priv->active = 0;
 	priv->queue_len = 0;
+	priv->free_len = 0;
 	INIT_LIST_HEAD(&priv->queue);
 	INIT_LIST_HEAD(&priv->freelist);
 
diff -urN linux-2.4.27-rc3/drivers/usb/serial/pl2303.c linux-2.4.27-rc4/drivers/usb/serial/pl2303.c
--- linux-2.4.27-rc3/drivers/usb/serial/pl2303.c	2004-07-31 07:28:21.382066453 -0700
+++ linux-2.4.27-rc4/drivers/usb/serial/pl2303.c	2004-07-31 07:28:25.502232730 -0700
@@ -652,7 +652,7 @@
 		state = BREAK_OFF;
 	else
 		state = BREAK_ON;
-	dbg("%s - turning break %s", state==BREAK_OFF ? "off" : "on", __FUNCTION__);
+	dbg("%s - turning break %s", __FUNCTION__, state==BREAK_OFF ? "off" : "on");
 
 	result = usb_control_msg (serial->dev, usb_sndctrlpipe (serial->dev, 0),
 				  BREAK_REQUEST, BREAK_REQUEST_TYPE, state, 
diff -urN linux-2.4.27-rc3/drivers/usb/storage/unusual_devs.h linux-2.4.27-rc4/drivers/usb/storage/unusual_devs.h
--- linux-2.4.27-rc3/drivers/usb/storage/unusual_devs.h	2004-07-31 07:28:21.390066776 -0700
+++ linux-2.4.27-rc4/drivers/usb/storage/unusual_devs.h	2004-07-31 07:28:25.553234789 -0700
@@ -185,7 +185,7 @@
 UNUSUAL_DEV(  0x04e6, 0x0006, 0x0100, 0x0205, 
 		"Shuttle",
 		"eUSB MMC Adapter",
-		US_SC_SCSI, US_PR_CB, NULL, 
+		US_SC_SCSI, US_PR_DEVICE, NULL, 
 		US_FL_SINGLE_LUN), 
 
 UNUSUAL_DEV(  0x04e6, 0x0007, 0x0100, 0x0200, 
@@ -318,6 +318,15 @@
 		US_SC_DEVICE,  US_PR_DEVICE, NULL,
 		US_FL_SINGLE_LUN),
 
+/* Reported by Johann Cardon <johann.cardon@free.fr>
+ * This entry is needed only because the device reports
+ * bInterfaceClass = 0xff (vendor-specific)
+ */
+UNUSUAL_DEV(  0x057b, 0x0022, 0x0000, 0x9999, 
+		"Y-E Data",
+		"Silicon Media R/W",
+		US_SC_DEVICE, US_PR_DEVICE, NULL, 0),
+
 /* Fabrizio Fellini <fello@libero.it> */
 UNUSUAL_DEV(  0x0595, 0x4343, 0x0000, 0x2210,
 		"Fujifilm",
diff -urN linux-2.4.27-rc3/drivers/usb/vicam.c linux-2.4.27-rc4/drivers/usb/vicam.c
--- linux-2.4.27-rc3/drivers/usb/vicam.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.27-rc4/drivers/usb/vicam.c	2004-07-31 07:28:25.566235313 -0700
@@ -481,6 +481,7 @@
 			struct video_capability b;
 
 			DBG("VIDIOCGCAP\n");
+			memset(&b, 0, sizeof(b));
 			strcpy(b.name, "ViCam-based Camera");
 			b.type = VID_TYPE_CAPTURE;
 			b.channels = 1;
diff -urN linux-2.4.27-rc3/fs/jfs/file.c linux-2.4.27-rc4/fs/jfs/file.c
--- linux-2.4.27-rc3/fs/jfs/file.c	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.27-rc4/fs/jfs/file.c	2004-07-31 07:28:25.736242174 -0700
@@ -70,11 +70,13 @@
 	if (S_ISREG(inode->i_mode) && file->f_mode & FMODE_WRITE &&
 	    (inode->i_size == 0)) {
 		struct jfs_inode_info *ji = JFS_IP(inode);
+		spin_lock_irq(&ji->ag_lock);
 		if (ji->active_ag == -1) {
 			ji->active_ag = ji->agno;
 			atomic_inc(
 			    &JFS_SBI(inode->i_sb)->bmap->db_active[ji->agno]);
 		}
+		spin_unlock_irq(&ji->ag_lock);
 	}
 
 	return 0;
@@ -83,11 +85,13 @@
 {
 	struct jfs_inode_info *ji = JFS_IP(inode);
 
+	spin_lock_irq(&ji->ag_lock);
 	if (ji->active_ag != -1) {
 		struct bmap *bmap = JFS_SBI(inode->i_sb)->bmap;
 		atomic_dec(&bmap->db_active[ji->active_ag]);
 		ji->active_ag = -1;
 	}
+	spin_unlock_irq(&ji->ag_lock);
 
 	return 0;
 }
diff -urN linux-2.4.27-rc3/fs/jfs/inode.c linux-2.4.27-rc4/fs/jfs/inode.c
--- linux-2.4.27-rc3/fs/jfs/inode.c	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.27-rc4/fs/jfs/inode.c	2004-07-31 07:28:25.736242174 -0700
@@ -49,10 +49,13 @@
 
 	jfs_info("jfs_clear_inode called ip = 0x%p", inode);
 
+	spin_lock_irq(&ji->ag_lock);
 	if (ji->active_ag != -1) {
 		struct bmap *bmap = JFS_SBI(inode->i_sb)->bmap;
 		atomic_dec(&bmap->db_active[ji->active_ag]);
+		ji->active_ag = -1;
 	}
+	spin_unlock_irq(&ji->ag_lock);
 
 	ASSERT(list_empty(&ji->anon_inode_list));
 
diff -urN linux-2.4.27-rc3/fs/jfs/jfs_dmap.c linux-2.4.27-rc4/fs/jfs/jfs_dmap.c
--- linux-2.4.27-rc3/fs/jfs/jfs_dmap.c	2004-07-31 07:28:21.488070731 -0700
+++ linux-2.4.27-rc4/fs/jfs/jfs_dmap.c	2004-07-31 07:28:25.740242336 -0700
@@ -1205,6 +1205,12 @@
 	s8 *leaf;
 	u32 mask;
 
+	if (dp->tree.leafidx != cpu_to_le32(LEAFIND)) {
+		jfs_error(bmp->db_ipbmap->i_sb,
+			  "dbAllocNext: Corrupt dmap page");
+		return -EIO;
+	}
+
 	/* pick up a pointer to the leaves of the dmap tree.
 	 */
 	leaf = dp->tree.stree + le32_to_cpu(dp->tree.leafidx);
@@ -1328,7 +1334,15 @@
 	    struct dmap * dp, s64 blkno, int nblocks, int l2nb, s64 * results)
 {
 	int word, lword, rc;
-	s8 *leaf = dp->tree.stree + le32_to_cpu(dp->tree.leafidx);
+	s8 *leaf;
+
+	if (dp->tree.leafidx != cpu_to_le32(LEAFIND)) {
+		jfs_error(bmp->db_ipbmap->i_sb,
+			  "dbAllocNear: Corrupt dmap page");
+		return -EIO;
+	}
+
+	leaf = dp->tree.stree + le32_to_cpu(dp->tree.leafidx);
 
 	/* determine the word within the dmap that holds the hint
 	 * (i.e. blkno).  also, determine the last word in the dmap
@@ -1490,6 +1504,13 @@
 	dcp = (struct dmapctl *) mp->data;
 	budmin = dcp->budmin;
 
+	if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) {
+		jfs_error(bmp->db_ipbmap->i_sb,
+			  "dbAllocAG: Corrupt dmapctl page");
+		release_metapage(mp);
+		return -EIO;
+	}
+
 	/* search the subtree(s) of the dmap control page that describes
 	 * the allocation group, looking for sufficient free space.  to begin,
 	 * determine how many allocation groups are represented in a dmap
@@ -1698,6 +1719,13 @@
 		dcp = (struct dmapctl *) mp->data;
 		budmin = dcp->budmin;
 
+		if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) {
+			jfs_error(bmp->db_ipbmap->i_sb,
+				  "dbFindCtl: Corrupt dmapctl page");
+			release_metapage(mp);
+			return -EIO;
+		}
+
 		/* search the tree within the dmap control page for
 		 * sufficent free space.  if sufficient free space is found,
 		 * dbFindLeaf() returns the index of the leaf at which
@@ -2460,6 +2488,13 @@
 		return -EIO;
 	dcp = (struct dmapctl *) mp->data;
 
+	if (dcp->leafidx != cpu_to_le32(CTLLEAFIND)) {
+		jfs_error(bmp->db_ipbmap->i_sb,
+			  "dbAdjCtl: Corrupt dmapctl page");
+		release_metapage(mp);
+		return -EIO;
+	}
+
 	/* determine the leaf number corresponding to the block and
 	 * the index within the dmap control tree.
 	 */
diff -urN linux-2.4.27-rc3/fs/jfs/jfs_extent.c linux-2.4.27-rc4/fs/jfs/jfs_extent.c
--- linux-2.4.27-rc3/fs/jfs/jfs_extent.c	2004-04-14 06:05:40.000000000 -0700
+++ linux-2.4.27-rc4/fs/jfs/jfs_extent.c	2004-07-31 07:28:25.744242497 -0700
@@ -554,6 +554,7 @@
 
 	if (S_ISREG(ip->i_mode) && (ji->fileset == FILESYSTEM_I)) {
 		ag = BLKTOAG(daddr, sbi);
+		spin_lock_irq(&ji->ag_lock);
 		if (ji->active_ag == -1) {
 			atomic_inc(&bmp->db_active[ag]);
 			ji->active_ag = ag;
@@ -562,6 +563,7 @@
 			atomic_inc(&bmp->db_active[ag]);
 			ji->active_ag = ag;
 		}
+		spin_unlock_irq(&ji->ag_lock);
 	}
 
 	return (0);
diff -urN linux-2.4.27-rc3/fs/jfs/jfs_imap.c linux-2.4.27-rc4/fs/jfs/jfs_imap.c
--- linux-2.4.27-rc3/fs/jfs/jfs_imap.c	2004-04-14 06:05:40.000000000 -0700
+++ linux-2.4.27-rc4/fs/jfs/jfs_imap.c	2004-07-31 07:28:25.746242578 -0700
@@ -1286,6 +1286,7 @@
 	 * to be freed by the transaction;  
 	 */
 	tid = txBegin(ipimap->i_sb, COMMIT_FORCE);
+	down(&JFS_IP(ipimap)->commit_sem);
 
 	/* acquire tlock of the iag page of the freed ixad 
 	 * to force the page NOHOMEOK (even though no data is
@@ -1318,6 +1319,7 @@
 	rc = txCommit(tid, 1, &iplist[0], COMMIT_FORCE);
 
 	txEnd(tid);
+	up(&JFS_IP(ipimap)->commit_sem);
 
 	/* unlock the AG inode map information */
 	AG_UNLOCK(imap, agno);
@@ -2630,10 +2632,13 @@
 		 */
 #endif				/*  _STILL_TO_PORT */
 		tid = txBegin(sb, COMMIT_FORCE);
+		down(&JFS_IP(ipimap)->commit_sem);
 
 		/* update the inode map addressing structure to point to it */
 		if ((rc =
 		     xtInsert(tid, ipimap, 0, blkno, xlen, &xaddr, 0))) {
+			txEnd(tid);
+			up(&JFS_IP(ipimap)->commit_sem);
 			/* Free the blocks allocated for the iag since it was
 			 * not successfully added to the inode map
 			 */
@@ -2658,6 +2663,7 @@
 		rc = txCommit(tid, 1, &iplist[0], COMMIT_FORCE);
 
 		txEnd(tid);
+		up(&JFS_IP(ipimap)->commit_sem);
 
 		duplicateIXtree(sb, blkno, xlen, &xaddr);
 
diff -urN linux-2.4.27-rc3/fs/jfs/jfs_incore.h linux-2.4.27-rc4/fs/jfs/jfs_incore.h
--- linux-2.4.27-rc3/fs/jfs/jfs_incore.h	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.27-rc4/fs/jfs/jfs_incore.h	2004-07-31 07:28:25.747242618 -0700
@@ -54,6 +54,7 @@
 	lid_t	blid;		/* lid of pseudo buffer?	*/
 	lid_t	atlhead;	/* anonymous tlock list head	*/
 	lid_t	atltail;	/* anonymous tlock list tail	*/
+	spinlock_t ag_lock;	/* protects active_ag		*/
 	struct list_head anon_inode_list; /* inodes having anonymous txns */
 	/*
 	 * rdwrlock serializes xtree between reads & writes and synchronizes
diff -urN linux-2.4.27-rc3/fs/jfs/jfs_xtree.c linux-2.4.27-rc4/fs/jfs/jfs_xtree.c
--- linux-2.4.27-rc3/fs/jfs/jfs_xtree.c	2004-04-14 06:05:40.000000000 -0700
+++ linux-2.4.27-rc4/fs/jfs/jfs_xtree.c	2004-07-31 07:28:25.756242982 -0700
@@ -1071,8 +1071,10 @@
 		 */
 		/* get/pin the parent page <sp> */
 		XT_GETPAGE(ip, parent->bn, smp, PSIZE, sp, rc);
-		if (rc)
-			goto errout2;
+		if (rc) {
+			XT_PUTPAGE(rcmp);
+			return rc;
+		}
 
 		/*
 		 * The new key entry goes ONE AFTER the index of parent entry,
@@ -1106,8 +1108,10 @@
 			rc = (sp->header.flag & BT_ROOT) ?
 			    xtSplitRoot(tid, ip, split, &rmp) :
 			    xtSplitPage(tid, ip, split, &rmp, &rbn);
-			if (rc)
-				goto errout1;
+			if (rc) {
+				XT_PUTPAGE(smp);
+				return rc;
+			}
 
 			XT_PUTPAGE(smp);
 			/* keep new child page <rp> pinned */
@@ -1170,19 +1174,6 @@
 	XT_PUTPAGE(rmp);
 
 	return 0;
-
-	/*
-	 * If something fails in the above loop we were already walking back
-	 * up the tree and the tree is now inconsistent.
-	 * release all pages we're holding.
-	 */
-      errout1:
-	XT_PUTPAGE(smp);
-
-      errout2:
-	XT_PUTPAGE(rcmp);
-
-	return rc;
 }
 
 
@@ -3504,7 +3495,17 @@
 	 * a page that was formerly to the right, let's make sure that the
 	 * next pointer is zero.
 	 */
-	p->header.next = 0;
+	if (p->header.next) {
+		if (log)
+			/*
+			 * Make sure this change to the header is logged.
+			 * If we really truncate this leaf, the flag
+			 * will be changed to tlckTRUNCATE
+			 */
+			tlck = txLock(tid, ip, mp, tlckXTREE|tlckGROW);
+		BT_MARK_DIRTY(mp, ip);
+		p->header.next = 0;
+	}
 
 	freed = 0;
 
diff -urN linux-2.4.27-rc3/fs/jfs/super.c linux-2.4.27-rc4/fs/jfs/super.c
--- linux-2.4.27-rc3/fs/jfs/super.c	2004-04-14 06:05:40.000000000 -0700
+++ linux-2.4.27-rc4/fs/jfs/super.c	2004-07-31 07:28:25.758243062 -0700
@@ -485,6 +485,7 @@
 		INIT_LIST_HEAD(&jfs_ip->anon_inode_list);
 		init_rwsem(&jfs_ip->rdwrlock);
 		init_MUTEX(&jfs_ip->commit_sem);
+		spin_lock_init(&jfs_ip->ag_lock);
 		jfs_ip->active_ag = -1;
 	}
 }
diff -urN linux-2.4.27-rc3/include/asm-ia64/system.h linux-2.4.27-rc4/include/asm-ia64/system.h
--- linux-2.4.27-rc3/include/asm-ia64/system.h	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.27-rc4/include/asm-ia64/system.h	2004-07-31 07:28:25.900248793 -0700
@@ -269,7 +269,7 @@
  * the latest fph state from another CPU.  In other words: eager save, lazy restore.
  */
 # define switch_to(prev,next,last) do {						\
-	if (ia64_psr(ia64_task_regs(prev))->mfh) {				\
+	if (ia64_psr(ia64_task_regs(prev))->mfh && ia64_is_local_fpu_owner(prev)) {				\
 		ia64_psr(ia64_task_regs(prev))->mfh = 0;			\
 		(prev)->thread.flags |= IA64_THREAD_FPH_VALID;			\
 		__ia64_save_fpu((prev)->thread.fph);				\
diff -urN linux-2.4.27-rc3/include/linux/atmlec.h linux-2.4.27-rc4/include/linux/atmlec.h
--- linux-2.4.27-rc3/include/linux/atmlec.h	2000-12-11 13:33:43.000000000 -0800
+++ linux-2.4.27-rc4/include/linux/atmlec.h	2004-07-31 07:28:25.913249318 -0700
@@ -2,7 +2,7 @@
  * 
  * ATM Lan Emulation Daemon vs. driver interface
  *
- * carnil@cs.tut.fi
+ * mkiiskila@yahoo.com
  *
  */
 
diff -urN linux-2.4.27-rc3/include/linux/pci.h linux-2.4.27-rc4/include/linux/pci.h
--- linux-2.4.27-rc3/include/linux/pci.h	2004-07-31 07:28:21.667077955 -0700
+++ linux-2.4.27-rc4/include/linux/pci.h	2004-07-31 07:28:25.928249923 -0700
@@ -595,6 +595,7 @@
 int pci_bus_exists(const struct list_head *list, int nr);
 struct pci_bus *pci_scan_bus(int bus, struct pci_ops *ops, void *sysdata);
 struct pci_bus *pci_alloc_primary_bus(int bus);
+struct pci_dev *pci_scan_device(struct pci_dev *temp);
 struct pci_dev *pci_scan_slot(struct pci_dev *temp);
 int pci_proc_attach_device(struct pci_dev *dev);
 int pci_proc_detach_device(struct pci_dev *dev);
diff -urN linux-2.4.27-rc3/include/linux/pkt_sched.h linux-2.4.27-rc4/include/linux/pkt_sched.h
--- linux-2.4.27-rc3/include/linux/pkt_sched.h	2004-07-31 07:28:21.670078076 -0700
+++ linux-2.4.27-rc4/include/linux/pkt_sched.h	2004-07-31 07:28:25.951250852 -0700
@@ -432,12 +432,15 @@
 
 #define TCA_ATM_MAX	TCA_ATM_STATE
 
-/* Delay section */
-struct tc_dly_qopt
+/* Network emulator */
+struct tc_netem_qopt
 {
-	__u32	latency;
-	__u32   limit;
-	__u32	loss;
+	__u32	latency;	/* added delay (us) */
+	__u32   limit;		/* fifo limit (packets) */
+	__u32	loss;		/* random packet loss (0=none ~0=100%) */
+	__u32	gap;		/* re-ordering gap (0 for delay all) */
+	__u32   duplicate;	/* random packet dup  (0=none ~0=100%) */
+	__u32	jitter;		/* random jitter in latency (us) */
 };
 
 #endif
diff -urN linux-2.4.27-rc3/include/net/bluetooth/hci.h linux-2.4.27-rc4/include/net/bluetooth/hci.h
--- linux-2.4.27-rc3/include/net/bluetooth/hci.h	2004-04-14 06:05:40.000000000 -0700
+++ linux-2.4.27-rc4/include/net/bluetooth/hci.h	2004-07-31 07:28:25.959251174 -0700
@@ -474,7 +474,7 @@
 	__u8	pscan_period_mode;
 	__u8	dev_class[3];
 	__u16	clock_offset;
-	__u8	rssi;
+	__s8	rssi;
 } __attribute__ ((packed)) inquiry_info_with_rssi;
 #define INQUIRY_INFO_WITH_RSSI_SIZE 14
 
diff -urN linux-2.4.27-rc3/include/net/bluetooth/l2cap.h linux-2.4.27-rc4/include/net/bluetooth/l2cap.h
--- linux-2.4.27-rc3/include/net/bluetooth/l2cap.h	2003-08-25 04:44:44.000000000 -0700
+++ linux-2.4.27-rc4/include/net/bluetooth/l2cap.h	2004-07-31 07:28:25.960251215 -0700
@@ -190,6 +190,14 @@
 } __attribute__ ((packed))	l2cap_info_rsp;
 #define L2CAP_INFO_RSP_SIZE	4
 
+/* info type */
+#define L2CAP_IT_CL_MTU     0x0001
+#define L2CAP_IT_FEAT_MASK  0x0002
+
+/* info result */
+#define L2CAP_IR_SUCCESS    0x0000
+#define L2CAP_IR_NOTSUPP    0x0001
+
 /* ----- L2CAP connections ----- */
 struct l2cap_chan_list {
 	struct sock	*head;
diff -urN linux-2.4.27-rc3/net/8021q/vlan_dev.c linux-2.4.27-rc4/net/8021q/vlan_dev.c
--- linux-2.4.27-rc3/net/8021q/vlan_dev.c	2004-04-14 06:05:41.000000000 -0700
+++ linux-2.4.27-rc4/net/8021q/vlan_dev.c	2004-07-31 07:28:25.977251901 -0700
@@ -782,7 +782,6 @@
 	struct dev_mc_list *dmi = dev->mc_list;
 
 	while (dmi) {
-		dev_mc_delete(dev, dmi->dmi_addr, dmi->dmi_addrlen, 0);
 		printk(KERN_DEBUG "%s: del %.2x:%.2x:%.2x:%.2x:%.2x:%.2x mcast address from vlan interface\n",
 		       dev->name,
 		       dmi->dmi_addr[0],
@@ -791,6 +790,7 @@
 		       dmi->dmi_addr[3],
 		       dmi->dmi_addr[4],
 		       dmi->dmi_addr[5]);
+		dev_mc_delete(dev, dmi->dmi_addr, dmi->dmi_addrlen, 0);
 		dmi = dev->mc_list;
 	}
 
diff -urN linux-2.4.27-rc3/net/atm/lec.c linux-2.4.27-rc4/net/atm/lec.c
--- linux-2.4.27-rc3/net/atm/lec.c	2004-04-14 06:05:41.000000000 -0700
+++ linux-2.4.27-rc4/net/atm/lec.c	2004-07-31 07:28:25.980252022 -0700
@@ -1,6 +1,6 @@
 /*
  * lec.c: Lan Emulation driver 
- * Marko Kiiskila carnil@cs.tut.fi
+ * Marko Kiiskila mkiiskila@yahoo.com
  *
  */
 
diff -urN linux-2.4.27-rc3/net/atm/lec.h linux-2.4.27-rc4/net/atm/lec.h
--- linux-2.4.27-rc3/net/atm/lec.h	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.27-rc4/net/atm/lec.h	2004-07-31 07:28:25.980252022 -0700
@@ -2,7 +2,7 @@
  *
  * Lan Emulation client header file
  *
- * Marko Kiiskila carnil@cs.tut.fi
+ * Marko Kiiskila mkiiskila@yahoo.com
  *
  */
 
diff -urN linux-2.4.27-rc3/net/atm/lec_arpc.h linux-2.4.27-rc4/net/atm/lec_arpc.h
--- linux-2.4.27-rc3/net/atm/lec_arpc.h	2000-12-11 13:33:43.000000000 -0800
+++ linux-2.4.27-rc4/net/atm/lec_arpc.h	2004-07-31 07:28:25.981252062 -0700
@@ -1,6 +1,6 @@
 /*
  * Lec arp cache
- * Marko Kiiskila carnil@cs.tut.fi
+ * Marko Kiiskila mkiiskila@yahoo.com
  *
  */
 #ifndef _LEC_ARP_H
diff -urN linux-2.4.27-rc3/net/bluetooth/l2cap.c linux-2.4.27-rc4/net/bluetooth/l2cap.c
--- linux-2.4.27-rc3/net/bluetooth/l2cap.c	2004-04-14 06:05:41.000000000 -0700
+++ linux-2.4.27-rc4/net/bluetooth/l2cap.c	2004-07-31 07:28:25.984252183 -0700
@@ -1642,6 +1642,35 @@
 	return 0;
 }
 
+static inline int l2cap_information_req(struct l2cap_conn *conn, l2cap_cmd_hdr *cmd, u8 *data)
+{
+	l2cap_info_req *req = (l2cap_info_req *) data;
+	l2cap_info_rsp rsp;
+	u16 type;
+
+	type = __le16_to_cpu(req->type);
+
+	BT_DBG("type 0x%4.4x", type);
+
+	rsp.type   = __cpu_to_le16(type);
+	rsp.result = __cpu_to_le16(L2CAP_IR_NOTSUPP);
+	l2cap_send_rsp(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp), &rsp);
+	return 0;
+}
+
+static inline int l2cap_information_rsp(struct l2cap_conn *conn, l2cap_cmd_hdr *cmd, u8 *data)
+{
+	l2cap_info_rsp *rsp = (l2cap_info_rsp *) data;
+	u16 type, result;
+
+	type   = __le16_to_cpu(rsp->type);
+	result = __le16_to_cpu(rsp->result);
+
+	BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
+
+	return 0;
+}
+
 static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
 {
 	__u8 *data = skb->data;
@@ -1666,6 +1695,10 @@
 		}
 
 		switch (cmd.code) {
+		case L2CAP_COMMAND_REJ:
+			/* FIXME: We should process this */
+			break;
+
 		case L2CAP_CONN_REQ:
 			err = l2cap_connect_req(conn, &cmd, data);
 			break;
@@ -1690,17 +1723,19 @@
 			err = l2cap_disconnect_rsp(conn, &cmd, data);
 			break;
 
-		case L2CAP_COMMAND_REJ:
-			/* FIXME: We should process this */
-			break;
-
 		case L2CAP_ECHO_REQ:
 			l2cap_send_rsp(conn, cmd.ident, L2CAP_ECHO_RSP, cmd.len, data);
 			break;
 
 		case L2CAP_ECHO_RSP:
+			break;
+
 		case L2CAP_INFO_REQ:
+			err = l2cap_information_req(conn, &cmd, data);
+			break;
+
 		case L2CAP_INFO_RSP:
+			err = l2cap_information_rsp(conn, &cmd, data);
 			break;
 
 		default:
@@ -1713,7 +1748,7 @@
 			l2cap_cmd_rej rej;
 			BT_DBG("error %d", err);
 
-			/* FIXME: Map err to a valid reason. */
+			/* FIXME: Map err to a valid reason */
 			rej.reason = __cpu_to_le16(0);
 			l2cap_send_rsp(conn, cmd.ident, L2CAP_COMMAND_REJ, L2CAP_CMD_REJ_SIZE, &rej);
 		}
diff -urN linux-2.4.27-rc3/net/bridge/br_ioctl.c linux-2.4.27-rc4/net/bridge/br_ioctl.c
--- linux-2.4.27-rc3/net/bridge/br_ioctl.c	2004-07-31 07:28:21.702079368 -0700
+++ linux-2.4.27-rc4/net/bridge/br_ioctl.c	2004-07-31 07:28:25.986252264 -0700
@@ -234,6 +234,7 @@
 int br_ioctl_deviceless_stub(unsigned long arg)
 {
 	unsigned long i[3];
+	int err;
 
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
@@ -241,8 +242,10 @@
 	if (copy_from_user(i, (void *)arg, 3*sizeof(unsigned long)))
 		return -EFAULT;
 
-	ASSERT_RTNL();
-	return  br_ioctl_deviceless(i[0], i[1], i[2]);
+	rtnl_lock();
+	err =  br_ioctl_deviceless(i[0], i[1], i[2]);
+	rtnl_unlock();
+	return err;
 }
 
 int br_ioctl(struct net_bridge *br, unsigned int cmd, unsigned long arg0, unsigned long arg1, unsigned long arg2)
diff -urN linux-2.4.27-rc3/net/ipv4/devinet.c linux-2.4.27-rc4/net/ipv4/devinet.c
--- linux-2.4.27-rc3/net/ipv4/devinet.c	2004-04-14 06:05:41.000000000 -0700
+++ linux-2.4.27-rc4/net/ipv4/devinet.c	2004-07-31 07:28:25.993252547 -0700
@@ -662,7 +662,23 @@
 			if (ifa->ifa_mask != sin->sin_addr.s_addr) {
 				inet_del_ifa(in_dev, ifap, 0);
 				ifa->ifa_mask = sin->sin_addr.s_addr;
-				ifa->ifa_prefixlen = inet_mask_len(ifa->ifa_mask);
+				ifa->ifa_prefixlen =
+					inet_mask_len(ifa->ifa_mask);
+
+				/* See if current broadcast address matches
+				 * with current netmask, then recalculate
+				 * the broadcast address. Otherwise it's a
+				 * funny address, so don't touch it since
+				 * the user seems to know what (s)he's doing...
+				 */
+				if ((dev->flags & IFF_BROADCAST) &&
+				    (ifa->ifa_prefixlen < 31) &&
+				    (ifa->ifa_broadcast ==
+				     (ifa->ifa_local|~ifa->ifa_mask))) {
+					ifa->ifa_broadcast =
+						(ifa->ifa_local |
+						 ~sin->sin_addr.s_addr);
+				}
 				inet_insert_ifa(ifa);
 			}
 			break;
diff -urN linux-2.4.27-rc3/net/ipv4/raw.c linux-2.4.27-rc4/net/ipv4/raw.c
--- linux-2.4.27-rc3/net/ipv4/raw.c	2003-08-25 04:44:44.000000000 -0700
+++ linux-2.4.27-rc4/net/ipv4/raw.c	2004-07-31 07:28:26.010253233 -0700
@@ -524,6 +524,8 @@
 	}
 	if (sk->protinfo.af_inet.cmsg_flags)
 		ip_cmsg_recv(msg, skb);
+	if (flags & MSG_TRUNC)
+		copied = skb->len;
 done:
 	skb_free_datagram(sk, skb);
 out:	return err ? : copied;
diff -urN linux-2.4.27-rc3/net/ipv4/udp.c linux-2.4.27-rc4/net/ipv4/udp.c
--- linux-2.4.27-rc3/net/ipv4/udp.c	2004-07-31 07:28:21.768082031 -0700
+++ linux-2.4.27-rc4/net/ipv4/udp.c	2004-07-31 07:28:26.019253596 -0700
@@ -698,7 +698,10 @@
   	}
 	if (sk->protinfo.af_inet.cmsg_flags)
 		ip_cmsg_recv(msg, skb);
+
 	err = copied;
+	if (flags & MSG_TRUNC)
+		err = skb->len - sizeof(struct udphdr);
   
 out_free:
   	skb_free_datagram(sk, skb);
diff -urN linux-2.4.27-rc3/net/ipv6/raw.c linux-2.4.27-rc4/net/ipv6/raw.c
--- linux-2.4.27-rc3/net/ipv6/raw.c	2004-07-31 07:28:21.775082314 -0700
+++ linux-2.4.27-rc4/net/ipv6/raw.c	2004-07-31 07:28:26.025253838 -0700
@@ -407,7 +407,10 @@
 
 	if (sk->net_pinfo.af_inet6.rxopt.all)
 		datagram_recv_ctl(sk, msg, skb);
+
 	err = copied;
+	if (flags & MSG_TRUNC)
+		err = skb->len;
 
 out_free:
 	skb_free_datagram(sk, skb);
diff -urN linux-2.4.27-rc3/net/ipv6/udp.c linux-2.4.27-rc4/net/ipv6/udp.c
--- linux-2.4.27-rc3/net/ipv6/udp.c	2004-07-31 07:28:21.778082435 -0700
+++ linux-2.4.27-rc4/net/ipv6/udp.c	2004-07-31 07:28:26.028253959 -0700
@@ -456,7 +456,10 @@
 			}
 		}
   	}
+
 	err = copied;
+	if (flags & MSG_TRUNC)
+		err = skb->len - sizeof(struct udphdr);
 
 out_free:
 	skb_free_datagram(sk, skb);
diff -urN linux-2.4.27-rc3/net/sched/Config.in linux-2.4.27-rc4/net/sched/Config.in
--- linux-2.4.27-rc3/net/sched/Config.in	2004-04-14 06:05:41.000000000 -0700
+++ linux-2.4.27-rc4/net/sched/Config.in	2004-07-31 07:28:26.029254000 -0700
@@ -15,7 +15,7 @@
 tristate '  TEQL queue' CONFIG_NET_SCH_TEQL
 tristate '  TBF queue' CONFIG_NET_SCH_TBF
 tristate '  GRED queue' CONFIG_NET_SCH_GRED
-tristate '  Network delay simulator' CONFIG_NET_SCH_DELAY
+tristate '  Network emulator' CONFIG_NET_SCH_NETEM
 tristate '  Diffserv field marker' CONFIG_NET_SCH_DSMARK
 if [ "$CONFIG_NETFILTER" = "y" ]; then
    tristate '  Ingress Qdisc' CONFIG_NET_SCH_INGRESS
diff -urN linux-2.4.27-rc3/net/sched/Makefile linux-2.4.27-rc4/net/sched/Makefile
--- linux-2.4.27-rc3/net/sched/Makefile	2004-04-14 06:05:41.000000000 -0700
+++ linux-2.4.27-rc4/net/sched/Makefile	2004-07-31 07:28:26.030254040 -0700
@@ -14,7 +14,7 @@
 obj-$(CONFIG_NET_SCH_INGRESS)	+= sch_ingress.o 
 obj-$(CONFIG_NET_SCH_CBQ)	+= sch_cbq.o
 obj-$(CONFIG_NET_SCH_CSZ)	+= sch_csz.o
-obj-$(CONFIG_NET_SCH_DELAY)	+= sch_delay.o
+obj-$(CONFIG_NET_SCH_NETEM)	+= sch_netem.o
 obj-$(CONFIG_NET_SCH_HPFQ)	+= sch_hpfq.o
 obj-$(CONFIG_NET_SCH_HFSC)	+= sch_hfsc.o
 obj-$(CONFIG_NET_SCH_HTB)	+= sch_htb.o
diff -urN linux-2.4.27-rc3/net/sched/sch_delay.c linux-2.4.27-rc4/net/sched/sch_delay.c
--- linux-2.4.27-rc3/net/sched/sch_delay.c	2004-07-31 07:28:21.781082556 -0700
+++ linux-2.4.27-rc4/net/sched/sch_delay.c	1969-12-31 16:00:00.000000000 -0800
@@ -1,289 +0,0 @@
-/*
- * net/sched/sch_delay.c	Simple constant delay
- *
- * 		This program is free software; you can redistribute it and/or
- * 		modify it under the terms of the GNU General Public License
- * 		as published by the Free Software Foundation; either version
- * 		2 of the License, or (at your option) any later version.
- *
- * Authors:	Stephen Hemminger <shemminger@osdl.org>
- */
-
-#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-
-#include <linux/string.h>
-#include <linux/mm.h>
-#include <linux/socket.h>
-#include <linux/sockios.h>
-#include <linux/in.h>
-#include <linux/errno.h>
-#include <linux/interrupt.h>
-#include <linux/if_ether.h>
-#include <linux/inet.h>
-#include <linux/netdevice.h>
-#include <linux/etherdevice.h>
-#include <linux/notifier.h>
-#include <net/ip.h>
-#include <net/route.h>
-#include <linux/skbuff.h>
-#include <net/sock.h>
-#include <net/pkt_sched.h>
-
-/*	Network delay simulator
-	This scheduler adds a fixed delay to all packets.
-	Similar to NISTnet and BSD Dummynet.
-
-	It uses byte fifo underneath similar to TBF */
-struct dly_sched_data {
-	u32	latency;
-	u32	limit;
-	u32	loss;
-	struct timer_list timer;
-	struct Qdisc *qdisc;
-};
-
-/* Time stamp put into socket buffer control block */
-struct dly_skb_cb {
-	psched_time_t	queuetime;
-};
-
-/* Enqueue packets with underlying discipline (fifo)
- * but mark them with current time first.
- */
-static int dly_enqueue(struct sk_buff *skb, struct Qdisc *sch)
-{
-	struct dly_sched_data *q = (struct dly_sched_data *)sch->data;
-	struct dly_skb_cb *cb = (struct dly_skb_cb *)skb->cb;
-	int ret;
-
-	/* Random packet drop 0 => none, ~0 => all */
-	if (q->loss >= net_random()) {
-		sch->stats.drops++;
-		return 0;	/* lie about loss so TCP doesn't know */
-	}
-
-	PSCHED_GET_TIME(cb->queuetime);
-
-	/* Queue to underlying scheduler */
-	ret = q->qdisc->enqueue(skb, q->qdisc);
-	if (ret)
-		sch->stats.drops++;
-	else {
-		sch->q.qlen++;
-		sch->stats.bytes += skb->len;
-		sch->stats.packets++;
-	}
-	return ret;
-}
-
-/* Requeue packets but don't change time stamp */
-static int dly_requeue(struct sk_buff *skb, struct Qdisc *sch)
-{
-	struct dly_sched_data *q = (struct dly_sched_data *)sch->data;
-	int ret;
-
-	ret = q->qdisc->ops->requeue(skb, q->qdisc);
-	if (ret == 0)
-		sch->q.qlen++;
-	return ret;
-}
-
-static unsigned int dly_drop(struct Qdisc *sch)
-{
-	struct dly_sched_data *q = (struct dly_sched_data *)sch->data;
-	unsigned int len;
-
-	len = q->qdisc->ops->drop(q->qdisc);
-	if (len) {
-		sch->q.qlen--;
-		sch->stats.drops++;
-	}
-	return len;
-}
-
-/* Dequeue packet.
- * If packet needs to be held up, then stop the
- * queue and set timer to wakeup later.
- */
-static struct sk_buff *dly_dequeue(struct Qdisc *sch)
-{
-	struct dly_sched_data *q = (struct dly_sched_data *)sch->data;
-	struct sk_buff *skb;
-
- retry:
-	skb = q->qdisc->dequeue(q->qdisc);
-	if (skb) {
-		struct dly_skb_cb *cb = (struct dly_skb_cb *)skb->cb;
-		psched_time_t now;
-		long diff, delay;
-
-		PSCHED_GET_TIME(now);
-		diff = q->latency - PSCHED_TDIFF(now, cb->queuetime);
-
-		if (diff <= 0) {
-			sch->q.qlen--;
-			sch->flags &= ~TCQ_F_THROTTLED;
-			return skb;
-		}
-
-		if (q->qdisc->ops->requeue(skb, q->qdisc) != NET_XMIT_SUCCESS) {
-			sch->q.qlen--;
-			sch->stats.drops++;
-			goto retry;
-		}
-
-		delay = PSCHED_US2JIFFIE(diff);
-		if (delay <= 0)
-		  delay = 1;
-		mod_timer(&q->timer, jiffies+delay);
-
-		sch->flags |= TCQ_F_THROTTLED;
-	}
-	return NULL;
-}
-
-static void dly_reset(struct Qdisc *sch)
-{
-	struct dly_sched_data *q = (struct dly_sched_data *)sch->data;
-
-	qdisc_reset(q->qdisc);
-	sch->q.qlen = 0;
-	sch->flags &= ~TCQ_F_THROTTLED;
-	del_timer(&q->timer);
-}
-
-static void dly_timer(unsigned long arg)
-{
-	struct Qdisc *sch = (struct Qdisc *)arg;
-
-	sch->flags &= ~TCQ_F_THROTTLED;
-	netif_schedule(sch->dev);
-}
-
-/* Tell Fifo the new limit. */
-static int change_limit(struct Qdisc *q, u32 limit)
-{
-	struct rtattr *rta;
-	int ret;
-
-	rta = kmalloc(RTA_LENGTH(sizeof(struct tc_fifo_qopt)), GFP_KERNEL);
-	if (!rta)
-		return -ENOMEM;
-
-	rta->rta_type = RTM_NEWQDISC;
-	rta->rta_len = RTA_LENGTH(sizeof(struct tc_fifo_qopt));
-	((struct tc_fifo_qopt *)RTA_DATA(rta))->limit = limit;
-	ret = q->ops->change(q, rta);
-	kfree(rta);
-
-	return ret;
-}
-
-/* Setup underlying FIFO discipline */
-static int dly_change(struct Qdisc *sch, struct rtattr *opt)
-{
-	struct dly_sched_data *q = (struct dly_sched_data *)sch->data;
-	struct tc_dly_qopt *qopt = RTA_DATA(opt);
-	int err;
-
-	if (q->qdisc == &noop_qdisc) {
-		struct Qdisc *child
-			= qdisc_create_dflt(sch->dev, &bfifo_qdisc_ops);
-		if (!child)
-			return -EINVAL;
-		q->qdisc = child;
-	}
-
-	err = change_limit(q->qdisc, qopt->limit);
-	if (err) {
-		qdisc_destroy(q->qdisc);
-		q->qdisc = &noop_qdisc;
-	} else {
-		q->latency = qopt->latency;
-		q->limit = qopt->limit;
-		q->loss = qopt->loss;
-	}
-	return err;
-}
-
-static int dly_init(struct Qdisc *sch, struct rtattr *opt)
-{
-	struct dly_sched_data *q = (struct dly_sched_data *)sch->data;
-	int err;
-
-	if (!opt)
-		return -EINVAL;
-
-	MOD_INC_USE_COUNT;
-
-	init_timer(&q->timer);
-	q->timer.function = dly_timer;
-	q->timer.data = (unsigned long) sch;
-	q->qdisc = &noop_qdisc;
-
-	err = dly_change(sch, opt);
-	if (err)
-		MOD_DEC_USE_COUNT;
-
-	return err;
-}
-
-static void dly_destroy(struct Qdisc *sch)
-{
-	struct dly_sched_data *q = (struct dly_sched_data *)sch->data;
-
-	del_timer(&q->timer);
-	qdisc_destroy(q->qdisc);
-	q->qdisc = &noop_qdisc;
-
-	MOD_DEC_USE_COUNT;
-}
-
-static int dly_dump(struct Qdisc *sch, struct sk_buff *skb)
-{
-	struct dly_sched_data *q = (struct dly_sched_data *)sch->data;
-	unsigned char	 *b = skb->tail;
-	struct tc_dly_qopt qopt;
-
-	qopt.latency = q->latency;
-	qopt.limit = q->limit;
-	qopt.loss = q->loss;
-
-	RTA_PUT(skb, TCA_OPTIONS, sizeof(qopt), &qopt);
-
-	return skb->len;
-
-rtattr_failure:
-	skb_trim(skb, b - skb->data);
-	return -1;
-}
-
-struct Qdisc_ops dly_qdisc_ops = {
-	.id		=	"delay",
-	.priv_size	=	sizeof(struct dly_sched_data),
-	.enqueue	=	dly_enqueue,
-	.dequeue	=	dly_dequeue,
-	.requeue	=	dly_requeue,
-	.drop		=	dly_drop,
-	.init		=	dly_init,
-	.reset		=	dly_reset,
-	.destroy	=	dly_destroy,
-	.change		=	dly_change,
-	.dump		=	dly_dump,
-};
-
-#ifdef MODULE
-int init_module(void)
-{
-	return register_qdisc(&dly_qdisc_ops);
-}
-
-void cleanup_module(void)
-{
-	unregister_qdisc(&dly_qdisc_ops);
-}
-#endif
-MODULE_LICENSE("GPL");
diff -urN linux-2.4.27-rc3/net/sched/sch_netem.c linux-2.4.27-rc4/net/sched/sch_netem.c
--- linux-2.4.27-rc3/net/sched/sch_netem.c	1969-12-31 16:00:00.000000000 -0800
+++ linux-2.4.27-rc4/net/sched/sch_netem.c	2004-07-31 07:28:26.037254322 -0700
@@ -0,0 +1,961 @@
+/*
+ * net/sched/sch_netem.c	Network emulator
+ *
+ * 		This program is free software; you can redistribute it and/or
+ * 		modify it under the terms of the GNU General Public License
+ * 		as published by the Free Software Foundation; either version
+ * 		2 of the License, or (at your option) any later version.
+ *
+ * Authors:	Stephen Hemminger <shemminger@osdl.org>
+ *		Catalin(ux aka Dino) BOIE <catab at umbrella dot ro>
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <asm/bitops.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/netdevice.h>
+#include <linux/skbuff.h>
+#include <linux/rtnetlink.h>
+
+#include <net/pkt_sched.h>
+
+/*	Network emulator
+ *
+ *	This scheduler can alters spacing and order
+ *	Similar to NISTnet and BSD Dummynet.
+ */
+
+struct netem_sched_data {
+	struct Qdisc	*qdisc;
+	struct sk_buff_head delayed;
+	struct timer_list timer;
+
+	u32 latency;
+	u32 loss;
+	u32 limit;
+	u32 counter;
+	u32 gap;
+	u32 jitter;
+};
+
+/* Time stamp put into socket buffer control block */
+struct netem_skb_cb {
+	psched_time_t	time_to_send;
+};
+
+/* This is the distribution table for the normal distribution produced
+ * with NISTnet tools.
+ * The entries represent a scaled inverse of the cumulative distribution
+ * function.
+ */
+#define TABLESIZE	2048
+#define TABLEFACTOR	8192
+
+static const short disttable[TABLESIZE] = {
+	-31473,		-26739,		-25226,		-24269,
+	-23560,		-22993,		-22518,		-22109,
+	-21749,		-21426,		-21133,		-20865,
+	-20618,		-20389,		-20174,		-19972,
+	-19782,		-19601,		-19430,		-19267,
+	-19112,		-18962,		-18819,		-18681,
+	-18549,		-18421,		-18298,		-18178,
+	-18062,		-17950,		-17841,		-17735,
+	-17632,		-17532,		-17434,		-17339,
+	-17245,		-17155,		-17066,		-16979,
+	-16894,		-16811,		-16729,		-16649,
+	-16571,		-16494,		-16419,		-16345,
+	-16272,		-16201,		-16130,		-16061,
+	-15993,		-15926,		-15861,		-15796,
+	-15732,		-15669,		-15607,		-15546,
+	-15486,		-15426,		-15368,		-15310,
+	-15253,		-15196,		-15140,		-15086,
+	-15031,		-14977,		-14925,		-14872,
+	-14821,		-14769,		-14719,		-14669,
+	-14619,		-14570,		-14522,		-14473,
+	-14426,		-14379,		-14332,		-14286,
+	-14241,		-14196,		-14150,		-14106,
+	-14062,		-14019,		-13976,		-13933,
+	-13890,		-13848,		-13807,		-13765,
+	-13724,		-13684,		-13643,		-13604,
+	-13564,		-13525,		-13486,		-13447,
+	-13408,		-13370,		-13332,		-13295,
+	-13258,		-13221,		-13184,		-13147,
+	-13111,		-13075,		-13040,		-13004,
+	-12969,		-12934,		-12899,		-12865,
+	-12830,		-12796,		-12762,		-12729,
+	-12695,		-12662,		-12629,		-12596,
+	-12564,		-12531,		-12499,		-12467,
+	-12435,		-12404,		-12372,		-12341,
+	-12310,		-12279,		-12248,		-12218,
+	-12187,		-12157,		-12127,		-12097,
+	-12067,		-12038,		-12008,		-11979,
+	-11950,		-11921,		-11892,		-11863,
+	-11835,		-11806,		-11778,		-11750,
+	-11722,		-11694,		-11666,		-11639,
+	-11611,		-11584,		-11557,		-11530,
+	-11503,		-11476,		-11450,		-11423,
+	-11396,		-11370,		-11344,		-11318,
+	-11292,		-11266,		-11240,		-11214,
+	-11189,		-11164,		-11138,		-11113,
+	-11088,		-11063,		-11038,		-11013,
+	-10988,		-10964,		-10939,		-10915,
+	-10891,		-10866,		-10843,		-10818,
+	-10794,		-10770,		-10747,		-10723,
+	-10700,		-10676,		-10652,		-10630,
+	-10606,		-10583,		-10560,		-10537,
+	-10514,		-10491,		-10469,		-10446,
+	-10424,		-10401,		-10378,		-10356,
+	-10334,		-10312,		-10290,		-10267,
+	-10246,		-10224,		-10202,		-10180,
+	-10158,		-10137,		-10115,		-10094,
+	-10072,		-10051,		-10030,		-10009,
+	-9988,		-9967,		-9945,		-9925,
+	-9904,		-9883,		-9862,		-9842,
+	-9821,		-9800,		-9780,		-9760,
+	-9739,		-9719,		-9699,		-9678,
+	-9658,		-9638,		-9618,		-9599,
+	-9578,		-9559,		-9539,		-9519,
+	-9499,		-9480,		-9461,		-9441,
+	-9422,		-9402,		-9383,		-9363,
+	-9344,		-9325,		-9306,		-9287,
+	-9268,		-9249,		-9230,		-9211,
+	-9192,		-9173,		-9155,		-9136,
+	-9117,		-9098,		-9080,		-9062,
+	-9043,		-9025,		-9006,		-8988,
+	-8970,		-8951,		-8933,		-8915,
+	-8897,		-8879,		-8861,		-8843,
+	-8825,		-8807,		-8789,		-8772,
+	-8754,		-8736,		-8718,		-8701,
+	-8683,		-8665,		-8648,		-8630,
+	-8613,		-8595,		-8578,		-8561,
+	-8543,		-8526,		-8509,		-8492,
+	-8475,		-8458,		-8441,		-8423,
+	-8407,		-8390,		-8373,		-8356,
+	-8339,		-8322,		-8305,		-8289,
+	-8272,		-8255,		-8239,		-8222,
+	-8206,		-8189,		-8172,		-8156,
+	-8140,		-8123,		-8107,		-8090,
+	-8074,		-8058,		-8042,		-8025,
+	-8009,		-7993,		-7977,		-7961,
+	-7945,		-7929,		-7913,		-7897,
+	-7881,		-7865,		-7849,		-7833,
+	-7817,		-7802,		-7786,		-7770,
+	-7754,		-7739,		-7723,		-7707,
+	-7692,		-7676,		-7661,		-7645,
+	-7630,		-7614,		-7599,		-7583,
+	-7568,		-7553,		-7537,		-7522,
+	-7507,		-7492,		-7476,		-7461,
+	-7446,		-7431,		-7416,		-7401,
+	-7385,		-7370,		-7356,		-7340,
+	-7325,		-7311,		-7296,		-7281,
+	-7266,		-7251,		-7236,		-7221,
+	-7207,		-7192,		-7177,		-7162,
+	-7148,		-7133,		-7118,		-7104,
+	-7089,		-7075,		-7060,		-7046,
+	-7031,		-7016,		-7002,		-6988,
+	-6973,		-6959,		-6944,		-6930,
+	-6916,		-6901,		-6887,		-6873,
+	-6859,		-6844,		-6830,		-6816,
+	-6802,		-6788,		-6774,		-6760,
+	-6746,		-6731,		-6717,		-6704,
+	-6690,		-6675,		-6661,		-6647,
+	-6633,		-6620,		-6606,		-6592,
+	-6578,		-6564,		-6550,		-6537,
+	-6523,		-6509,		-6495,		-6482,
+	-6468,		-6454,		-6441,		-6427,
+	-6413,		-6400,		-6386,		-6373,
+	-6359,		-6346,		-6332,		-6318,
+	-6305,		-6291,		-6278,		-6264,
+	-6251,		-6238,		-6224,		-6211,
+	-6198,		-6184,		-6171,		-6158,
+	-6144,		-6131,		-6118,		-6105,
+	-6091,		-6078,		-6065,		-6052,
+	-6039,		-6025,		-6012,		-5999,
+	-5986,		-5973,		-5960,		-5947,
+	-5934,		-5921,		-5908,		-5895,
+	-5882,		-5869,		-5856,		-5843,
+	-5830,		-5817,		-5804,		-5791,
+	-5779,		-5766,		-5753,		-5740,
+	-5727,		-5714,		-5702,		-5689,
+	-5676,		-5663,		-5650,		-5638,
+	-5625,		-5612,		-5600,		-5587,
+	-5575,		-5562,		-5549,		-5537,
+	-5524,		-5512,		-5499,		-5486,
+	-5474,		-5461,		-5449,		-5436,
+	-5424,		-5411,		-5399,		-5386,
+	-5374,		-5362,		-5349,		-5337,
+	-5324,		-5312,		-5299,		-5287,
+	-5275,		-5263,		-5250,		-5238,
+	-5226,		-5213,		-5201,		-5189,
+	-5177,		-5164,		-5152,		-5140,
+	-5128,		-5115,		-5103,		-5091,
+	-5079,		-5067,		-5055,		-5043,
+	-5030,		-5018,		-5006,		-4994,
+	-4982,		-4970,		-4958,		-4946,
+	-4934,		-4922,		-4910,		-4898,
+	-4886,		-4874,		-4862,		-4850,
+	-4838,		-4826,		-4814,		-4803,
+	-4791,		-4778,		-4767,		-4755,
+	-4743,		-4731,		-4719,		-4708,
+	-4696,		-4684,		-4672,		-4660,
+	-4649,		-4637,		-4625,		-4613,
+	-4601,		-4590,		-4578,		-4566,
+	-4554,		-4543,		-4531,		-4520,
+	-4508,		-4496,		-4484,		-4473,
+	-4461,		-4449,		-4438,		-4427,
+	-4415,		-4403,		-4392,		-4380,
+	-4368,		-4357,		-4345,		-4334,
+	-4322,		-4311,		-4299,		-4288,
+	-4276,		-4265,		-4253,		-4242,
+	-4230,		-4219,		-4207,		-4196,
+	-4184,		-4173,		-4162,		-4150,
+	-4139,		-4128,		-4116,		-4105,
+	-4094,		-4082,		-4071,		-4060,
+	-4048,		-4037,		-4026,		-4014,
+	-4003,		-3992,		-3980,		-3969,
+	-3958,		-3946,		-3935,		-3924,
+	-3913,		-3901,		-3890,		-3879,
+	-3868,		-3857,		-3845,		-3834,
+	-3823,		-3812,		-3801,		-3790,
+	-3779,		-3767,		-3756,		-3745,
+	-3734,		-3723,		-3712,		-3700,
+	-3689,		-3678,		-3667,		-3656,
+	-3645,		-3634,		-3623,		-3612,
+	-3601,		-3590,		-3579,		-3568,
+	-3557,		-3545,		-3535,		-3524,
+	-3513,		-3502,		-3491,		-3480,
+	-3469,		-3458,		-3447,		-3436,
+	-3425,		-3414,		-3403,		-3392,
+	-3381,		-3370,		-3360,		-3348,
+	-3337,		-3327,		-3316,		-3305,
+	-3294,		-3283,		-3272,		-3262,
+	-3251,		-3240,		-3229,		-3218,
+	-3207,		-3197,		-3185,		-3175,
+	-3164,		-3153,		-3142,		-3132,
+	-3121,		-3110,		-3099,		-3088,
+	-3078,		-3067,		-3056,		-3045,
+	-3035,		-3024,		-3013,		-3003,
+	-2992,		-2981,		-2970,		-2960,
+	-2949,		-2938,		-2928,		-2917,
+	-2906,		-2895,		-2885,		-2874,
+	-2864,		-2853,		-2842,		-2832,
+	-2821,		-2810,		-2800,		-2789,
+	-2778,		-2768,		-2757,		-2747,
+	-2736,		-2725,		-2715,		-2704,
+	-2694,		-2683,		-2673,		-2662,
+	-2651,		-2641,		-2630,		-2620,
+	-2609,		-2599,		-2588,		-2578,
+	-2567,		-2556,		-2546,		-2535,
+	-2525,		-2515,		-2504,		-2493,
+	-2483,		-2472,		-2462,		-2451,
+	-2441,		-2431,		-2420,		-2410,
+	-2399,		-2389,		-2378,		-2367,
+	-2357,		-2347,		-2336,		-2326,
+	-2315,		-2305,		-2295,		-2284,
+	-2274,		-2263,		-2253,		-2243,
+	-2232,		-2222,		-2211,		-2201,
+	-2191,		-2180,		-2170,		-2159,
+	-2149,		-2139,		-2128,		-2118,
+	-2107,		-2097,		-2087,		-2076,
+	-2066,		-2056,		-2046,		-2035,
+	-2025,		-2014,		-2004,		-1994,
+	-1983,		-1973,		-1963,		-1953,
+	-1942,		-1932,		-1921,		-1911,
+	-1901,		-1891,		-1880,		-1870,
+	-1860,		-1849,		-1839,		-1829,
+	-1819,		-1808,		-1798,		-1788,
+	-1778,		-1767,		-1757,		-1747,
+	-1736,		-1726,		-1716,		-1706,
+	-1695,		-1685,		-1675,		-1665,
+	-1654,		-1644,		-1634,		-1624,
+	-1613,		-1603,		-1593,		-1583,
+	-1573,		-1563,		-1552,		-1542,
+	-1532,		-1522,		-1511,		-1501,
+	-1491,		-1481,		-1471,		-1461,
+	-1450,		-1440,		-1430,		-1420,
+	-1409,		-1400,		-1389,		-1379,
+	-1369,		-1359,		-1348,		-1339,
+	-1328,		-1318,		-1308,		-1298,
+	-1288,		-1278,		-1267,		-1257,
+	-1247,		-1237,		-1227,		-1217,
+	-1207,		-1196,		-1186,		-1176,
+	-1166,		-1156,		-1146,		-1135,
+	-1126,		-1115,		-1105,		-1095,
+	-1085,		-1075,		-1065,		-1055,
+	-1044,		-1034,		-1024,		-1014,
+	-1004,		-994,		-984,		-974,
+	-964,		-954,		-944,		-933,
+	-923,		-913,		-903,		-893,
+	-883,		-873,		-863,		-853,
+	-843,		-833,		-822,		-812,
+	-802,		-792,		-782,		-772,
+	-762,		-752,		-742,		-732,
+	-722,		-712,		-702,		-691,
+	-682,		-671,		-662,		-651,
+	-641,		-631,		-621,		-611,
+	-601,		-591,		-581,		-571,
+	-561,		-551,		-541,		-531,
+	-521,		-511,		-501,		-491,
+	-480,		-471,		-460,		-451,
+	-440,		-430,		-420,		-410,
+	-400,		-390,		-380,		-370,
+	-360,		-350,		-340,		-330,
+	-320,		-310,		-300,		-290,
+	-280,		-270,		-260,		-250,
+	-240,		-230,		-220,		-210,
+	-199,		-190,		-179,		-170,
+	-159,		-150,		-139,		-129,
+	-119,		-109,		-99,		-89,
+	-79,		-69,		-59,		-49,
+	-39,		-29,		-19,		-9,
+	1,		11,		21,		31,
+	41,		51,		61,		71,
+	81,		91,		101,		111,
+	121,		131,		141,		152,
+	161,		172,		181,		192,
+	202,		212,		222,		232,
+	242,		252,		262,		272,
+	282,		292,		302,		312,
+	322,		332,		342,		352,
+	362,		372,		382,		392,
+	402,		412,		422,		433,
+	442,		453,		462,		473,
+	483,		493,		503,		513,
+	523,		533,		543,		553,
+	563,		573,		583,		593,
+	603,		613,		623,		633,
+	643,		653,		664,		673,
+	684,		694,		704,		714,
+	724,		734,		744,		754,
+	764,		774,		784,		794,
+	804,		815,		825,		835,
+	845,		855,		865,		875,
+	885,		895,		905,		915,
+	925,		936,		946,		956,
+	966,		976,		986,		996,
+	1006,		1016,		1026,		1037,
+	1047,		1057,		1067,		1077,
+	1087,		1097,		1107,		1117,
+	1128,		1138,		1148,		1158,
+	1168,		1178,		1188,		1198,
+	1209,		1219,		1229,		1239,
+	1249,		1259,		1269,		1280,
+	1290,		1300,		1310,		1320,
+	1330,		1341,		1351,		1361,
+	1371,		1381,		1391,		1402,
+	1412,		1422,		1432,		1442,
+	1452,		1463,		1473,		1483,
+	1493,		1503,		1513,		1524,
+	1534,		1544,		1554,		1565,
+	1575,		1585,		1595,		1606,
+	1616,		1626,		1636,		1647,
+	1656,		1667,		1677,		1687,
+	1697,		1708,		1718,		1729,
+	1739,		1749,		1759,		1769,
+	1780,		1790,		1800,		1810,
+	1821,		1831,		1841,		1851,
+	1862,		1872,		1883,		1893,
+	1903,		1913,		1923,		1934,
+	1944,		1955,		1965,		1975,
+	1985,		1996,		2006,		2016,
+	2027,		2037,		2048,		2058,
+	2068,		2079,		2089,		2099,
+	2110,		2120,		2130,		2141,
+	2151,		2161,		2172,		2182,
+	2193,		2203,		2213,		2224,
+	2234,		2245,		2255,		2265,
+	2276,		2286,		2297,		2307,
+	2318,		2328,		2338,		2349,
+	2359,		2370,		2380,		2391,
+	2401,		2412,		2422,		2433,
+	2443,		2454,		2464,		2475,
+	2485,		2496,		2506,		2517,
+	2527,		2537,		2548,		2559,
+	2569,		2580,		2590,		2601,
+	2612,		2622,		2632,		2643,
+	2654,		2664,		2675,		2685,
+	2696,		2707,		2717,		2728,
+	2738,		2749,		2759,		2770,
+	2781,		2791,		2802,		2813,
+	2823,		2834,		2845,		2855,
+	2866,		2877,		2887,		2898,
+	2909,		2919,		2930,		2941,
+	2951,		2962,		2973,		2984,
+	2994,		3005,		3015,		3027,
+	3037,		3048,		3058,		3069,
+	3080,		3091,		3101,		3113,
+	3123,		3134,		3145,		3156,
+	3166,		3177,		3188,		3199,
+	3210,		3220,		3231,		3242,
+	3253,		3264,		3275,		3285,
+	3296,		3307,		3318,		3329,
+	3340,		3351,		3362,		3373,
+	3384,		3394,		3405,		3416,
+	3427,		3438,		3449,		3460,
+	3471,		3482,		3493,		3504,
+	3515,		3526,		3537,		3548,
+	3559,		3570,		3581,		3592,
+	3603,		3614,		3625,		3636,
+	3647,		3659,		3670,		3681,
+	3692,		3703,		3714,		3725,
+	3736,		3747,		3758,		3770,
+	3781,		3792,		3803,		3814,
+	3825,		3837,		3848,		3859,
+	3870,		3881,		3893,		3904,
+	3915,		3926,		3937,		3949,
+	3960,		3971,		3983,		3994,
+	4005,		4017,		4028,		4039,
+	4051,		4062,		4073,		4085,
+	4096,		4107,		4119,		4130,
+	4141,		4153,		4164,		4175,
+	4187,		4198,		4210,		4221,
+	4233,		4244,		4256,		4267,
+	4279,		4290,		4302,		4313,
+	4325,		4336,		4348,		4359,
+	4371,		4382,		4394,		4406,
+	4417,		4429,		4440,		4452,
+	4464,		4475,		4487,		4499,
+	4510,		4522,		4533,		4545,
+	4557,		4569,		4581,		4592,
+	4604,		4616,		4627,		4639,
+	4651,		4663,		4674,		4686,
+	4698,		4710,		4722,		4734,
+	4746,		4758,		4769,		4781,
+	4793,		4805,		4817,		4829,
+	4841,		4853,		4865,		4877,
+	4889,		4900,		4913,		4925,
+	4936,		4949,		4961,		4973,
+	4985,		4997,		5009,		5021,
+	5033,		5045,		5057,		5070,
+	5081,		5094,		5106,		5118,
+	5130,		5143,		5155,		5167,
+	5179,		5191,		5204,		5216,
+	5228,		5240,		5253,		5265,
+	5278,		5290,		5302,		5315,
+	5327,		5340,		5352,		5364,
+	5377,		5389,		5401,		5414,
+	5426,		5439,		5451,		5464,
+	5476,		5489,		5502,		5514,
+	5527,		5539,		5552,		5564,
+	5577,		5590,		5603,		5615,
+	5628,		5641,		5653,		5666,
+	5679,		5691,		5704,		5717,
+	5730,		5743,		5756,		5768,
+	5781,		5794,		5807,		5820,
+	5833,		5846,		5859,		5872,
+	5885,		5897,		5911,		5924,
+	5937,		5950,		5963,		5976,
+	5989,		6002,		6015,		6028,
+	6042,		6055,		6068,		6081,
+	6094,		6108,		6121,		6134,
+	6147,		6160,		6174,		6187,
+	6201,		6214,		6227,		6241,
+	6254,		6267,		6281,		6294,
+	6308,		6321,		6335,		6348,
+	6362,		6375,		6389,		6403,
+	6416,		6430,		6443,		6457,
+	6471,		6485,		6498,		6512,
+	6526,		6540,		6554,		6567,
+	6581,		6595,		6609,		6623,
+	6637,		6651,		6665,		6679,
+	6692,		6706,		6721,		6735,
+	6749,		6763,		6777,		6791,
+	6805,		6819,		6833,		6848,
+	6862,		6876,		6890,		6905,
+	6919,		6933,		6948,		6962,
+	6976,		6991,		7005,		7020,
+	7034,		7049,		7064,		7078,
+	7093,		7107,		7122,		7136,
+	7151,		7166,		7180,		7195,
+	7210,		7225,		7240,		7254,
+	7269,		7284,		7299,		7314,
+	7329,		7344,		7359,		7374,
+	7389,		7404,		7419,		7434,
+	7449,		7465,		7480,		7495,
+	7510,		7526,		7541,		7556,
+	7571,		7587,		7602,		7618,
+	7633,		7648,		7664,		7680,
+	7695,		7711,		7726,		7742,
+	7758,		7773,		7789,		7805,
+	7821,		7836,		7852,		7868,
+	7884,		7900,		7916,		7932,
+	7948,		7964,		7981,		7997,
+	8013,		8029,		8045,		8061,
+	8078,		8094,		8110,		8127,
+	8143,		8160,		8176,		8193,
+	8209,		8226,		8242,		8259,
+	8276,		8292,		8309,		8326,
+	8343,		8360,		8377,		8394,
+	8410,		8428,		8444,		8462,
+	8479,		8496,		8513,		8530,
+	8548,		8565,		8582,		8600,
+	8617,		8634,		8652,		8670,
+	8687,		8704,		8722,		8740,
+	8758,		8775,		8793,		8811,
+	8829,		8847,		8865,		8883,
+	8901,		8919,		8937,		8955,
+	8974,		8992,		9010,		9029,
+	9047,		9066,		9084,		9103,
+	9121,		9140,		9159,		9177,
+	9196,		9215,		9234,		9253,
+	9272,		9291,		9310,		9329,
+	9349,		9368,		9387,		9406,
+	9426,		9445,		9465,		9484,
+	9504,		9524,		9544,		9563,
+	9583,		9603,		9623,		9643,
+	9663,		9683,		9703,		9723,
+	9744,		9764,		9785,		9805,
+	9826,		9846,		9867,		9888,
+	9909,		9930,		9950,		9971,
+	9993,		10013,		10035,		10056,
+	10077,		10099,		10120,		10142,
+	10163,		10185,		10207,		10229,
+	10251,		10273,		10294,		10317,
+	10339,		10361,		10384,		10406,
+	10428,		10451,		10474,		10496,
+	10519,		10542,		10565,		10588,
+	10612,		10635,		10658,		10682,
+	10705,		10729,		10752,		10776,
+	10800,		10824,		10848,		10872,
+	10896,		10921,		10945,		10969,
+	10994,		11019,		11044,		11069,
+	11094,		11119,		11144,		11169,
+	11195,		11221,		11246,		11272,
+	11298,		11324,		11350,		11376,
+	11402,		11429,		11456,		11482,
+	11509,		11536,		11563,		11590,
+	11618,		11645,		11673,		11701,
+	11728,		11756,		11785,		11813,
+	11842,		11870,		11899,		11928,
+	11957,		11986,		12015,		12045,
+	12074,		12104,		12134,		12164,
+	12194,		12225,		12255,		12286,
+	12317,		12348,		12380,		12411,
+	12443,		12475,		12507,		12539,
+	12571,		12604,		12637,		12670,
+	12703,		12737,		12771,		12804,
+	12839,		12873,		12907,		12942,
+	12977,		13013,		13048,		13084,
+	13120,		13156,		13192,		13229,
+	13267,		13304,		13341,		13379,
+	13418,		13456,		13495,		13534,
+	13573,		13613,		13653,		13693,
+	13734,		13775,		13817,		13858,
+	13901,		13943,		13986,		14029,
+	14073,		14117,		14162,		14206,
+	14252,		14297,		14343,		14390,
+	14437,		14485,		14533,		14582,
+	14631,		14680,		14731,		14782,
+	14833,		14885,		14937,		14991,
+	15044,		15099,		15154,		15210,
+	15266,		15324,		15382,		15441,
+	15500,		15561,		15622,		15684,
+	15747,		15811,		15877,		15943,
+	16010,		16078,		16148,		16218,
+	16290,		16363,		16437,		16513,
+	16590,		16669,		16749,		16831,
+	16915,		17000,		17088,		17177,
+	17268,		17362,		17458,		17556,
+	17657,		17761,		17868,		17977,
+	18090,		18207,		18328,		18452,
+	18581,		18715,		18854,		18998,
+	19149,		19307,		19472,		19645,
+	19828,		20021,		20226,		20444,
+	20678,		20930,		21204,		21503,
+	21835,		22206,		22630,		23124,
+	23721,		24478,		25529,		27316,
+};
+
+/* tabledist - return a pseudo-randomly distributed value with mean mu and
+ * std deviation sigma.  Uses table lookup to approximate the desired
+ * distribution, and a uniformly-distributed pseudo-random source.
+ */
+static inline int tabledist(int mu, int sigma)
+{
+	int x;
+	int index;
+	int sigmamod, sigmadiv;
+
+	if (sigma == 0)
+		return mu;
+
+	index = (net_random() & (TABLESIZE-1));
+	sigmamod = sigma%TABLEFACTOR;
+	sigmadiv = sigma/TABLEFACTOR;
+	x = sigmamod*disttable[index];
+
+	if (x >= 0)
+		x += TABLEFACTOR/2;
+	else
+		x -= TABLEFACTOR/2;
+
+	x /= TABLEFACTOR;
+	x += sigmadiv*disttable[index];
+	x += mu;
+	return x;
+}
+
+/* Enqueue packets with underlying discipline (fifo)
+ * but mark them with current time first.
+ */
+static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+{
+	struct netem_sched_data *q = (struct netem_sched_data *)sch->data;
+	struct netem_skb_cb *cb = (struct netem_skb_cb *)skb->cb;
+	psched_time_t now;
+	long delay;
+
+	pr_debug("netem_enqueue skb=%p @%lu\n", skb, jiffies);
+
+	/* Random packet drop 0 => none, ~0 => all */
+	if (q->loss && q->loss >= net_random()) {
+		sch->stats.drops++;
+		return 0;	/* lie about loss so TCP doesn't know */
+	}
+
+
+	/* If doing simple delay then gap == 0 so all packets
+	 * go into the delayed holding queue
+	 * otherwise if doing out of order only "1 out of gap"
+	 * packets will be delayed.
+	 */
+	if (q->counter < q->gap) {
+		int ret;
+
+		++q->counter;
+		ret = q->qdisc->enqueue(skb, q->qdisc);
+		if (ret)
+			sch->stats.drops++;
+		return ret;
+	}
+	
+	q->counter = 0;
+	
+	PSCHED_GET_TIME(now);
+	if (q->jitter) 
+		delay = tabledist(q->latency, q->jitter);
+	else
+		delay = q->latency;
+
+	PSCHED_TADD2(now, delay, cb->time_to_send);
+	
+	/* Always queue at tail to keep packets in order */
+	if (likely(q->delayed.qlen < q->limit)) {
+		__skb_queue_tail(&q->delayed, skb);
+		sch->q.qlen++;
+		sch->stats.bytes += skb->len;
+		sch->stats.packets++;
+		return 0;
+	}
+
+	sch->stats.drops++;
+	kfree_skb(skb);
+	return NET_XMIT_DROP;
+}
+
+/* Requeue packets but don't change time stamp */
+static int netem_requeue(struct sk_buff *skb, struct Qdisc *sch)
+{
+	struct netem_sched_data *q = (struct netem_sched_data *)sch->data;
+	int ret;
+
+	if ((ret = q->qdisc->ops->requeue(skb, q->qdisc)) == 0)
+		sch->q.qlen++;
+
+	return ret;
+}
+
+static unsigned int netem_drop(struct Qdisc* sch)
+{
+	struct netem_sched_data *q = (struct netem_sched_data *)sch->data;
+	unsigned int len;
+
+	if ((len = q->qdisc->ops->drop(q->qdisc)) != 0) {
+		sch->q.qlen--;
+		sch->stats.drops++;
+	}
+	return len;
+}
+
+/* Dequeue packet.
+ *  Move all packets that are ready to send from the delay holding
+ *  list to the underlying qdisc, then just call dequeue
+ */
+static struct sk_buff *netem_dequeue(struct Qdisc *sch)
+{
+	struct netem_sched_data *q = (struct netem_sched_data *)sch->data;
+	struct sk_buff *skb;
+	psched_time_t now;
+
+	PSCHED_GET_TIME(now);
+	while ((skb = skb_peek(&q->delayed)) != NULL) {
+		const struct netem_skb_cb *cb
+			= (const struct netem_skb_cb *)skb->cb;
+		long delay 
+			= PSCHED_US2JIFFIE(PSCHED_TDIFF(cb->time_to_send, now));
+		pr_debug("netem_dequeue: delay queue %p@%lu %ld\n",
+			 skb, jiffies, delay);
+
+		/* if more time remaining? */
+		if (delay > 0) {
+			mod_timer(&q->timer, jiffies + delay);
+			break;
+		}
+		__skb_unlink(skb, &q->delayed);
+
+		if (q->qdisc->enqueue(skb, q->qdisc))
+			sch->stats.drops++;
+	}
+
+	skb = q->qdisc->dequeue(q->qdisc);
+	if (skb) 
+		sch->q.qlen--;
+	return skb;
+}
+
+static void netem_watchdog(unsigned long arg)
+{
+	struct Qdisc *sch = (struct Qdisc *)arg;
+
+	pr_debug("netem_watchdog: fired @%lu\n", jiffies);
+	netif_schedule(sch->dev);
+}
+
+static void netem_reset(struct Qdisc *sch)
+{
+	struct netem_sched_data *q = (struct netem_sched_data *)sch->data;
+
+	qdisc_reset(q->qdisc);
+	skb_queue_purge(&q->delayed);
+
+	sch->q.qlen = 0;
+	del_timer_sync(&q->timer);
+}
+
+static int set_fifo_limit(struct Qdisc *q, int limit)
+{
+        struct rtattr *rta;
+	int ret = -ENOMEM;
+
+	rta = kmalloc(RTA_LENGTH(sizeof(struct tc_fifo_qopt)), GFP_KERNEL);
+	if (rta) {
+		rta->rta_type = RTM_NEWQDISC;
+		rta->rta_len = RTA_LENGTH(sizeof(struct tc_fifo_qopt)); 
+		((struct tc_fifo_qopt *)RTA_DATA(rta))->limit = limit;
+		
+		ret = q->ops->change(q, rta);
+		kfree(rta);
+	}
+	return ret;
+}
+
+static int netem_change(struct Qdisc *sch, struct rtattr *opt)
+{
+	struct netem_sched_data *q = (struct netem_sched_data *)sch->data;
+	struct tc_netem_qopt *qopt = RTA_DATA(opt);
+	struct Qdisc *child;
+	int ret;
+
+	if (opt->rta_len < RTA_LENGTH(sizeof(*qopt)))
+		return -EINVAL;
+
+	child = qdisc_create_dflt(sch->dev, &pfifo_qdisc_ops);
+	if (!child)
+		return -EINVAL;
+
+	ret = set_fifo_limit(child, qopt->limit);
+	if (ret) {
+		qdisc_destroy(child);
+		return ret;
+	}
+
+	sch_tree_lock(sch);
+	if (child) {
+		child = xchg(&q->qdisc, child);
+		if (child != &noop_qdisc)
+			qdisc_destroy(child);
+	
+		q->latency = qopt->latency;
+		q->jitter = qopt->jitter;
+		q->limit = qopt->limit;
+		q->gap = qopt->gap;
+		q->loss = qopt->loss;
+	}
+	sch_tree_unlock(sch);
+
+	return 0;
+}
+
+static int netem_init(struct Qdisc *sch, struct rtattr *opt)
+{
+	struct netem_sched_data *q = (struct netem_sched_data *)sch->data;
+	int err;
+
+	if (!opt)
+		return -EINVAL;
+
+	MOD_INC_USE_COUNT;
+	skb_queue_head_init(&q->delayed);
+	q->qdisc = &noop_qdisc;
+
+	init_timer(&q->timer);
+	q->timer.function = netem_watchdog;
+	q->timer.data = (unsigned long) sch;
+	q->counter = 0;
+
+	err = netem_change(sch, opt);
+	if (err != 0)
+		MOD_DEC_USE_COUNT;
+	return err;
+}
+
+static void netem_destroy(struct Qdisc *sch)
+{
+	struct netem_sched_data *q = (struct netem_sched_data *)sch->data;
+
+	del_timer(&q->timer);
+
+	qdisc_destroy(q->qdisc);
+	q->qdisc = &noop_qdisc;
+
+	MOD_DEC_USE_COUNT;
+}
+
+static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
+{
+	struct netem_sched_data *q = (struct netem_sched_data *)sch->data;
+	unsigned char	 *b = skb->tail;
+	struct tc_netem_qopt qopt;
+
+	qopt.latency = q->latency;
+	qopt.jitter = q->jitter;
+	qopt.limit = sch->dev->tx_queue_len;
+	qopt.loss = q->loss;
+	qopt.gap = q->gap;
+
+	RTA_PUT(skb, TCA_OPTIONS, sizeof(qopt), &qopt);
+
+	return skb->len;
+
+rtattr_failure:
+	skb_trim(skb, b - skb->data);
+	return -1;
+}
+
+static int netem_dump_class(struct Qdisc *sch, unsigned long cl,
+			  struct sk_buff *skb, struct tcmsg *tcm)
+{
+	struct netem_sched_data *q = (struct netem_sched_data*)sch->data;
+
+	if (cl != 1) 	/* only one class */
+		return -ENOENT;
+
+	tcm->tcm_handle |= TC_H_MIN(1);
+	tcm->tcm_info = q->qdisc->handle;
+
+	return 0;
+}
+
+static int netem_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
+		     struct Qdisc **old)
+{
+	struct netem_sched_data *q = (struct netem_sched_data *)sch->data;
+
+	if (new == NULL)
+		new = &noop_qdisc;
+
+	sch_tree_lock(sch);
+	*old = xchg(&q->qdisc, new);
+	qdisc_reset(*old);
+	sch->q.qlen = 0;
+	sch_tree_unlock(sch);
+
+	return 0;
+}
+
+static struct Qdisc *netem_leaf(struct Qdisc *sch, unsigned long arg)
+{
+	struct netem_sched_data *q = (struct netem_sched_data *)sch->data;
+	return q->qdisc;
+}
+
+static unsigned long netem_get(struct Qdisc *sch, u32 classid)
+{
+	return 1;
+}
+
+static void netem_put(struct Qdisc *sch, unsigned long arg)
+{
+}
+
+static int netem_change_class(struct Qdisc *sch, u32 classid, u32 parentid, 
+			    struct rtattr **tca, unsigned long *arg)
+{
+	return -ENOSYS;
+}
+
+static int netem_delete(struct Qdisc *sch, unsigned long arg)
+{
+	return -ENOSYS;
+}
+
+static void netem_walk(struct Qdisc *sch, struct qdisc_walker *walker)
+{
+	if (!walker->stop) {
+		if (walker->count >= walker->skip)
+			if (walker->fn(sch, 1, walker) < 0) {
+				walker->stop = 1;
+				return;
+			}
+		walker->count++;
+	}
+}
+
+static struct tcf_proto **netem_find_tcf(struct Qdisc *sch, unsigned long cl)
+{
+	return NULL;
+}
+
+static struct Qdisc_class_ops netem_class_ops = {
+	.graft		=	netem_graft,
+	.leaf		=	netem_leaf,
+	.get		=	netem_get,
+	.put		=	netem_put,
+	.change		=	netem_change_class,
+	.delete		=	netem_delete,
+	.walk		=	netem_walk,
+	.tcf_chain	=	netem_find_tcf,
+	.dump		=	netem_dump_class,
+};
+
+static struct Qdisc_ops netem_qdisc_ops = {
+	.id		=	"netem",
+	.cl_ops		=	&netem_class_ops,
+	.priv_size	=	sizeof(struct netem_sched_data),
+	.enqueue	=	netem_enqueue,
+	.dequeue	=	netem_dequeue,
+	.requeue	=	netem_requeue,
+	.drop		=	netem_drop,
+	.init		=	netem_init,
+	.reset		=	netem_reset,
+	.destroy	=	netem_destroy,
+	.change		=	netem_change,
+	.dump		=	netem_dump,
+};
+
+
+static int __init netem_module_init(void)
+{
+	return register_qdisc(&netem_qdisc_ops);
+}
+static void __exit netem_module_exit(void)
+{
+	unregister_qdisc(&netem_qdisc_ops);
+}
+module_init(netem_module_init)
+module_exit(netem_module_exit)
+MODULE_LICENSE("GPL");
