diff --git a/[refs] b/[refs]
index 72c97a6d2308..310ff8e044b3 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 709772e6e06564ed94ba740de70185ac3d792773
+refs/heads/master: 4db0ee176e256444695ee2d7b004552e82fec987
diff --git a/trunk/drivers/atm/eni.h b/trunk/drivers/atm/eni.h
index e4c9525e60b3..d04fefb0841f 100644
--- a/trunk/drivers/atm/eni.h
+++ b/trunk/drivers/atm/eni.h
@@ -18,6 +18,7 @@
 #include "midway.h"
 
 
+#define KERNEL_OFFSET	0xC0000000	/* kernel 0x0 is at phys 0xC0000000 */
 #define DEV_LABEL	"eni"
 
 #define UBR_BUFFER	(128*1024)	/* UBR buffer size */
diff --git a/trunk/drivers/isdn/hardware/eicon/divasmain.c b/trunk/drivers/isdn/hardware/eicon/divasmain.c
index 16a874bb1561..5fcbdccd7a53 100644
--- a/trunk/drivers/isdn/hardware/eicon/divasmain.c
+++ b/trunk/drivers/isdn/hardware/eicon/divasmain.c
@@ -806,6 +806,7 @@ static int DIVA_INIT_FUNCTION divas_init(void)
 
 	if (!create_divas_proc()) {
 #ifdef MODULE
+		remove_divas_proc();
 		divas_unregister_chrdev();
 		divasfunc_exit();
 #endif
diff --git a/trunk/drivers/isdn/hardware/eicon/divasproc.c b/trunk/drivers/isdn/hardware/eicon/divasproc.c
index 040827288ec9..fae895828a17 100644
--- a/trunk/drivers/isdn/hardware/eicon/divasproc.c
+++ b/trunk/drivers/isdn/hardware/eicon/divasproc.c
@@ -125,8 +125,8 @@ static const struct file_operations divas_fops = {
 
 int create_divas_proc(void)
 {
-	divas_proc_entry = proc_create(divas_proc_name, S_IFREG | S_IRUGO,
-					proc_net_eicon, &divas_fops);
+	proc_create(divas_proc_name, S_IFREG | S_IRUGO, proc_net_eicon,
+		    &divas_fops);
 	if (!divas_proc_entry)
 		return (0);
 
diff --git a/trunk/drivers/isdn/hysdn/hysdn_procconf.c b/trunk/drivers/isdn/hysdn/hysdn_procconf.c
index 484299b031f8..15906d005b05 100644
--- a/trunk/drivers/isdn/hysdn/hysdn_procconf.c
+++ b/trunk/drivers/isdn/hysdn/hysdn_procconf.c
@@ -207,17 +207,30 @@ hysdn_conf_write(struct file *file, const char __user *buf, size_t count, loff_t
 /* read conf file -> output card info data */
 /*******************************************/
 static ssize_t
-hysdn_conf_read(struct file *file, char __user *buf, size_t count, loff_t *off)
+hysdn_conf_read(struct file *file, char __user *buf, size_t count, loff_t * off)
 {
 	char *cp;
+	int i;
 
-	if (!(file->f_mode & FMODE_READ))
-		return -EPERM;	/* no permission to read */
-
-	if (!(cp = file->private_data))
-		return -EFAULT;	/* should never happen */
-
-	return simple_read_from_buffer(buf, count, off, cp, strlen(cp));
+	if (file->f_mode & FMODE_READ) {
+		if (!(cp = file->private_data))
+			return (-EFAULT);	/* should never happen */
+		i = strlen(cp);	/* get total string length */
+		if (*off < i) {
+			/* still bytes to transfer */
+			cp += *off;	/* point to desired data offset */
+			i -= *off;	/* remaining length */
+			if (i > count)
+				i = count;	/* limit length to transfer */
+			if (copy_to_user(buf, cp, i))
+				return (-EFAULT);	/* copy error */
+			*off += i;	/* adjust offset */
+		} else
+			return (0);
+	} else
+		return (-EPERM);	/* no permission to read */
+
+	return (i);
 }				/* hysdn_conf_read */
 
 /******************/
diff --git a/trunk/drivers/net/forcedeth.c b/trunk/drivers/net/forcedeth.c
index 9eca97fb0a54..2cb244763292 100644
--- a/trunk/drivers/net/forcedeth.c
+++ b/trunk/drivers/net/forcedeth.c
@@ -3273,6 +3273,20 @@ static void nv_link_irq(struct net_device *dev)
 	dprintk(KERN_DEBUG "%s: link change notification done.\n", dev->name);
 }
 
+static void nv_msi_workaround(struct fe_priv *np)
+{
+
+	/* Need to toggle the msi irq mask within the ethernet device,
+	 * otherwise, future interrupts will not be detected.
+	 */
+	if (np->msi_flags & NV_MSI_ENABLED) {
+		u8 __iomem *base = np->base;
+
+		writel(0, base + NvRegMSIIrqMask);
+		writel(NVREG_MSI_VECTOR_0_ENABLED, base + NvRegMSIIrqMask);
+	}
+}
+
 static irqreturn_t nv_nic_irq(int foo, void *data)
 {
 	struct net_device *dev = (struct net_device *) data;
@@ -3295,6 +3309,8 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
 		if (!(events & np->irqmask))
 			break;
 
+		nv_msi_workaround(np);
+
 		spin_lock(&np->lock);
 		nv_tx_done(dev);
 		spin_unlock(&np->lock);
@@ -3410,6 +3426,8 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
 		if (!(events & np->irqmask))
 			break;
 
+		nv_msi_workaround(np);
+
 		spin_lock(&np->lock);
 		nv_tx_done_optimized(dev, TX_WORK_PER_LOOP);
 		spin_unlock(&np->lock);
@@ -3750,6 +3768,8 @@ static irqreturn_t nv_nic_irq_test(int foo, void *data)
 	if (!(events & NVREG_IRQ_TIMER))
 		return IRQ_RETVAL(0);
 
+	nv_msi_workaround(np);
+
 	spin_lock(&np->lock);
 	np->intr_test = 1;
 	spin_unlock(&np->lock);
diff --git a/trunk/drivers/net/pppoe.c b/trunk/drivers/net/pppoe.c
index bafb69b6f7cb..58a26a47af29 100644
--- a/trunk/drivers/net/pppoe.c
+++ b/trunk/drivers/net/pppoe.c
@@ -341,6 +341,12 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
 	struct pppox_sock *relay_po;
 
 	if (sk->sk_state & PPPOX_BOUND) {
+		struct pppoe_hdr *ph = pppoe_hdr(skb);
+		int len = ntohs(ph->length);
+		skb_pull_rcsum(skb, sizeof(struct pppoe_hdr));
+		if (pskb_trim_rcsum(skb, len))
+			goto abort_kfree;
+
 		ppp_input(&po->chan, skb);
 	} else if (sk->sk_state & PPPOX_RELAY) {
 		relay_po = get_item_by_addr(&po->pppoe_relay);
@@ -351,6 +357,7 @@ static int pppoe_rcv_core(struct sock *sk, struct sk_buff *skb)
 		if ((sk_pppox(relay_po)->sk_state & PPPOX_CONNECTED) == 0)
 			goto abort_put;
 
+		skb_pull(skb, sizeof(struct pppoe_hdr));
 		if (!__pppoe_xmit(sk_pppox(relay_po), skb))
 			goto abort_put;
 	} else {
@@ -381,7 +388,6 @@ static int pppoe_rcv(struct sk_buff *skb,
 {
 	struct pppoe_hdr *ph;
 	struct pppox_sock *po;
-	int len;
 
 	if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
 		goto out;
@@ -393,21 +399,10 @@ static int pppoe_rcv(struct sk_buff *skb,
 		goto drop;
 
 	ph = pppoe_hdr(skb);
-	len = ntohs(ph->length);
-
-	skb_pull_rcsum(skb, sizeof(*ph));
-	if (skb->len < len)
-		goto drop;
 
 	po = get_item(ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
-	if (!po)
-		goto drop;
-
-	if (pskb_trim_rcsum(skb, len))
-		goto drop;
-
-	return sk_receive_skb(sk_pppox(po), skb, 0);
-
+	if (po != NULL)
+		return sk_receive_skb(sk_pppox(po), skb, 0);
 drop:
 	kfree_skb(skb);
 out:
@@ -432,12 +427,12 @@ static int pppoe_disc_rcv(struct sk_buff *skb,
 	if (dev_net(dev) != &init_net)
 		goto abort;
 
-	if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
-		goto out;
-
 	if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
 		goto abort;
 
+	if (!(skb = skb_share_check(skb, GFP_ATOMIC)))
+		goto out;
+
 	ph = pppoe_hdr(skb);
 	if (ph->code != PADT_CODE)
 		goto abort;
@@ -942,10 +937,12 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock,
 	m->msg_namelen = 0;
 
 	if (skb) {
-		total_len = min(total_len, skb->len);
-		error = skb_copy_datagram_iovec(skb, 0, m->msg_iov, total_len);
+		struct pppoe_hdr *ph = pppoe_hdr(skb);
+		const int len = ntohs(ph->length);
+
+		error = memcpy_toiovec(m->msg_iov, (unsigned char *) &ph->tag[0], len);
 		if (error == 0)
-			error = total_len;
+			error = len;
 	}
 
 	kfree_skb(skb);
diff --git a/trunk/drivers/net/pppol2tp.c b/trunk/drivers/net/pppol2tp.c
index f9298827a76c..70cfdb46aa27 100644
--- a/trunk/drivers/net/pppol2tp.c
+++ b/trunk/drivers/net/pppol2tp.c
@@ -783,18 +783,14 @@ static int pppol2tp_recvmsg(struct kiocb *iocb, struct socket *sock,
 	err = 0;
 	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
 				flags & MSG_DONTWAIT, &err);
-	if (!skb)
-		goto end;
-
-	if (len > skb->len)
-		len = skb->len;
-	else if (len < skb->len)
-		msg->msg_flags |= MSG_TRUNC;
-
-	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, len);
-	if (likely(err == 0))
-		err = len;
-
+	if (skb) {
+		err = memcpy_toiovec(msg->msg_iov, (unsigned char *) skb->data,
+				     skb->len);
+		if (err < 0)
+			goto do_skb_free;
+		err = skb->len;
+	}
+do_skb_free:
 	kfree_skb(skb);
 end:
 	return err;
diff --git a/trunk/include/linux/ipv6.h b/trunk/include/linux/ipv6.h
index cde056e08181..10b666b61add 100644
--- a/trunk/include/linux/ipv6.h
+++ b/trunk/include/linux/ipv6.h
@@ -396,10 +396,8 @@ static inline struct request_sock *inet6_reqsk_alloc(struct request_sock_ops *op
 {
 	struct request_sock *req = reqsk_alloc(ops);
 
-	if (req != NULL) {
+	if (req != NULL)
 		inet_rsk(req)->inet6_rsk_offset = inet6_rsk_offset(req);
-		inet6_rsk(req)->pktopts = NULL;
-	}
 
 	return req;
 }
diff --git a/trunk/include/linux/rtnetlink.h b/trunk/include/linux/rtnetlink.h
index b358c704d102..a2aec2c0cfb5 100644
--- a/trunk/include/linux/rtnetlink.h
+++ b/trunk/include/linux/rtnetlink.h
@@ -246,7 +246,6 @@ enum rt_class_t
 {
 	RT_TABLE_UNSPEC=0,
 /* User defined values */
-	RT_TABLE_COMPAT=252,
 	RT_TABLE_DEFAULT=253,
 	RT_TABLE_MAIN=254,
 	RT_TABLE_LOCAL=255,
diff --git a/trunk/include/net/inet_sock.h b/trunk/include/net/inet_sock.h
index 9fabe5b38912..a42cd63d241a 100644
--- a/trunk/include/net/inet_sock.h
+++ b/trunk/include/net/inet_sock.h
@@ -197,14 +197,4 @@ static inline int inet_iif(const struct sk_buff *skb)
 	return skb->rtable->rt_iif;
 }
 
-static inline struct request_sock *inet_reqsk_alloc(struct request_sock_ops *ops)
-{
-	struct request_sock *req = reqsk_alloc(ops);
-
-	if (req != NULL)
-		inet_rsk(req)->opt = NULL;
-
-	return req;
-}
-
 #endif	/* _INET_SOCK_H */
diff --git a/trunk/include/net/tcp.h b/trunk/include/net/tcp.h
index d448310c82c1..633147cb6bbc 100644
--- a/trunk/include/net/tcp.h
+++ b/trunk/include/net/tcp.h
@@ -433,6 +433,7 @@ extern struct sk_buff *		tcp_make_synack(struct sock *sk,
 
 extern int			tcp_disconnect(struct sock *sk, int flags);
 
+extern void			tcp_unhash(struct sock *sk);
 
 /* From syncookies.c */
 extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];
diff --git a/trunk/net/dccp/ipv4.c b/trunk/net/dccp/ipv4.c
index 37d27bcb361f..c22a3780c14e 100644
--- a/trunk/net/dccp/ipv4.c
+++ b/trunk/net/dccp/ipv4.c
@@ -589,7 +589,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 	if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
 		goto drop;
 
-	req = inet_reqsk_alloc(&dccp_request_sock_ops);
+	req = reqsk_alloc(&dccp_request_sock_ops);
 	if (req == NULL)
 		goto drop;
 
@@ -605,6 +605,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 	ireq = inet_rsk(req);
 	ireq->loc_addr = ip_hdr(skb)->daddr;
 	ireq->rmt_addr = ip_hdr(skb)->saddr;
+	ireq->opt	= NULL;
 
 	/*
 	 * Step 3: Process LISTEN state
diff --git a/trunk/net/dccp/ipv6.c b/trunk/net/dccp/ipv6.c
index f7fe2a572d7b..9b1129bb7ece 100644
--- a/trunk/net/dccp/ipv6.c
+++ b/trunk/net/dccp/ipv6.c
@@ -421,6 +421,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 	ireq6 = inet6_rsk(req);
 	ipv6_addr_copy(&ireq6->rmt_addr, &ipv6_hdr(skb)->saddr);
 	ipv6_addr_copy(&ireq6->loc_addr, &ipv6_hdr(skb)->daddr);
+	ireq6->pktopts	= NULL;
 
 	if (ipv6_opt_accepted(sk, skb) ||
 	    np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
diff --git a/trunk/net/ipv4/fib_semantics.c b/trunk/net/ipv4/fib_semantics.c
index 0d4d72827e4b..3b83c34019fc 100644
--- a/trunk/net/ipv4/fib_semantics.c
+++ b/trunk/net/ipv4/fib_semantics.c
@@ -960,10 +960,7 @@ int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
 	rtm->rtm_dst_len = dst_len;
 	rtm->rtm_src_len = 0;
 	rtm->rtm_tos = tos;
-	if (tb_id < 256)
-		rtm->rtm_table = tb_id;
-	else
-		rtm->rtm_table = RT_TABLE_COMPAT;
+	rtm->rtm_table = tb_id;
 	NLA_PUT_U32(skb, RTA_TABLE, tb_id);
 	rtm->rtm_type = type;
 	rtm->rtm_flags = fi->fib_flags;
diff --git a/trunk/net/ipv4/syncookies.c b/trunk/net/ipv4/syncookies.c
index d182a2a26291..73ba98921d64 100644
--- a/trunk/net/ipv4/syncookies.c
+++ b/trunk/net/ipv4/syncookies.c
@@ -285,7 +285,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 		cookie_check_timestamp(&tcp_opt);
 
 	ret = NULL;
-	req = inet_reqsk_alloc(&tcp_request_sock_ops); /* for safety */
+	req = reqsk_alloc(&tcp_request_sock_ops); /* for safety */
 	if (!req)
 		goto out;
 
@@ -301,6 +301,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 	ireq->rmt_port		= th->source;
 	ireq->loc_addr		= ip_hdr(skb)->daddr;
 	ireq->rmt_addr		= ip_hdr(skb)->saddr;
+	ireq->opt		= NULL;
 	ireq->snd_wscale	= tcp_opt.snd_wscale;
 	ireq->rcv_wscale	= tcp_opt.rcv_wscale;
 	ireq->sack_ok		= tcp_opt.sack_ok;
diff --git a/trunk/net/ipv4/tcp_ipv4.c b/trunk/net/ipv4/tcp_ipv4.c
index 4f8485c67d1a..cd601a866c2f 100644
--- a/trunk/net/ipv4/tcp_ipv4.c
+++ b/trunk/net/ipv4/tcp_ipv4.c
@@ -1285,7 +1285,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 	if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
 		goto drop;
 
-	req = inet_reqsk_alloc(&tcp_request_sock_ops);
+	req = reqsk_alloc(&tcp_request_sock_ops);
 	if (!req)
 		goto drop;
 
diff --git a/trunk/net/ipv6/syncookies.c b/trunk/net/ipv6/syncookies.c
index 3ecc1157994e..938ce4ecde55 100644
--- a/trunk/net/ipv6/syncookies.c
+++ b/trunk/net/ipv6/syncookies.c
@@ -198,6 +198,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 	ireq = inet_rsk(req);
 	ireq6 = inet6_rsk(req);
 	treq = tcp_rsk(req);
+	ireq6->pktopts = NULL;
 
 	if (security_inet_conn_request(sk, skb, req)) {
 		reqsk_free(req);
diff --git a/trunk/net/ipv6/tcp_ipv6.c b/trunk/net/ipv6/tcp_ipv6.c
index cb46749d4c32..715965f0fac0 100644
--- a/trunk/net/ipv6/tcp_ipv6.c
+++ b/trunk/net/ipv6/tcp_ipv6.c
@@ -1299,6 +1299,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 	treq = inet6_rsk(req);
 	ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
 	ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
+	treq->pktopts = NULL;
 	if (!want_cookie)
 		TCP_ECN_create_request(req, tcp_hdr(skb));
 
diff --git a/trunk/net/key/af_key.c b/trunk/net/key/af_key.c
index 7470e367272b..9bba7ac5fee0 100644
--- a/trunk/net/key/af_key.c
+++ b/trunk/net/key/af_key.c
@@ -3030,9 +3030,6 @@ static int key_notify_sa_expire(struct xfrm_state *x, struct km_event *c)
 
 static int pfkey_send_notify(struct xfrm_state *x, struct km_event *c)
 {
-	if (atomic_read(&pfkey_socks_nr) == 0)
-		return 0;
-
 	switch (c->event) {
 	case XFRM_MSG_EXPIRE:
 		return key_notify_sa_expire(x, c);